joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006133
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.100576a0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10006178
push ebx
call fcn.1005686d
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x10105243
mov ebx, dword [ebp + 8]
push dword [ebx]
call fcn.10001add
add esp, 8
cmp eax, 0
jne 0x100061f3
call fcn.10001a1c
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [0x10106b93]
test ebx, ebx
je 0x100061b6
push ebx
call fcn.1005686d
add esp, 4
pop eax
mov dword [0x10106b93], eax
mov eax, dword [0x10106b93]
test eax, eax
je 0x100061da
push eax
mov ebx, eax
call fcn.10001b7a
inc eax
push eax
call fcn.10056873
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
test ebx, ebx
je 0x100061ed
push ebx
call fcn.1005686d
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0
mov ebx, dword [ebp + 0x10]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
nop
nop
cmp dword [ebp - 8], esp
je 0x1000622e
push 0x202
push 0x4035a00
push 6
call fcn.10056879
add esp, 0xc
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10006241
mov eax, 0x10105243
push eax
push 1
mov ebx, 0x170
call fcn.100576e0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x1000625f
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10006270
push ebx
call fcn.1005686d
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x10006277
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.100576a0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100062bc
push ebx
call fcn.1005686d
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0xff
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
nop
nop
cmp dword [ebp - 8], esp
je 0x100062f1
push 0x36
push 0x4035a01
push 6
call fcn.10056879
add esp, 0xc
mov eax, dword [ebp - 4]
test eax, eax
je 0x1000630d
push eax
mov ebx, eax
call fcn.10001b7a
inc eax
push eax
call fcn.10056873
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x10006312
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10006323
push ebx
call fcn.1005686d
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x1000668b
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.100066ed
test eax, eax
je 0x100066ce
xor eax, eax
xchg dword [ebp + 8], eax
cmp eax, 0xffff
jle 0x100066ce
cmp word [eax], 0x5a4d
jne 0x100066ce
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x100066ce
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.100067bf
mov eax, dword [ebp + 8]
jmp 0x100066e7
mov esp, ebp
pop ebp
ret 4

Function at 0x100066ed
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x100067a0
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]

Function at 0x100069af
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jge 0x100069d1
mov eax, 0xfffffffd
jmp 0x10006ab1
mov ebx, dword [0x10106b8f]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x10006a7f
mov ebx, dword [0x10106b8f]
add ebx, 4
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 6
jne 0x10006a20
mov ebx, dword [0x10106b8f]
add ebx, 8
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
cmp dword [ebx], 2
jne 0x10006a20
mov eax, 1
jmp 0x10006a25
mov eax, 0
test eax, eax
je 0x10006a51
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x10006a3a
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
mov ebx, dword [0x10106b8f]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x10006aa7
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x10006ab1
mov esp, ebp
pop ebp
ret 4

Function at 0x1000a7ba
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ebx, dword [0x10106bbb]
push ebx
call fcn.1005686d
add esp, 4
mov eax, 0x101052bf
mov dword [0x10106bbb], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
call fcn.1005686d
add esp, 4
mov eax, 0x101052bf
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov dword [ebp - 4], esp
push 0
push 0x1000a915
xor eax, eax
call dword [sym.imp.USER32.dll_EnumWindows]
nop
nop
cmp dword [ebp - 4], esp
je 0x1000a827
push 0x34
push 0x4035a21
push 6
call fcn.10056879
add esp, 0xc
mov eax, dword [0x10106bbb]
push eax
push eax
mov ebx, eax
call fcn.10001079
pop eax
sub ebx, eax
shl ecx, 2
add ecx, ebx
push ecx
call fcn.10056873
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
call fcn.1005686d
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov ebx, dword [0x10106bbb]
call fcn.10002831
jmp 0x1000a86e
mov esp, ebp
pop ebp
ret 8
Function at 0x1000aa31
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
lea eax, [ebp + 8]
push eax
push 0x1000ab47
xor eax, eax
call dword [sym.imp.USER32.dll_EnumWindows]
nop
nop
cmp dword [ebp - 4], esp
je 0x1000aa6c
push 0
push 0x4035a23
push 6
call fcn.10056879
add esp, 0xc
mov eax, dword [ebp + 8]
jmp 0x1000aa74
mov esp, ebp
pop ebp
ret 4
Function at 0x10015def
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jge 0x10015e11
mov eax, 0xfffffffd
jmp 0x10015ef1
mov ebx, dword [0x10106beb]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x10015ebf
mov ebx, dword [0x10106beb]
add ebx, 4
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 6
jne 0x10015e60
mov ebx, dword [0x10106beb]
add ebx, 8
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
cmp dword [ebx], 2
jne 0x10015e60
mov eax, 1
jmp 0x10015e65
mov eax, 0
test eax, eax
je 0x10015e91
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x10015e7a
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
mov ebx, dword [0x10106beb]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x10015ee7
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x10015ef1
mov esp, ebp
pop ebp
ret 4

Function at 0x1001606e
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x10016121
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]

Function at 0x1001618c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x1001623f
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]
Function at 0x100167aa
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.100576a0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100167ef
push ebx
call fcn.1005686d
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x10105243
mov ebx, dword [ebp + 8]
push dword [ebx]
call fcn.10001add
add esp, 8
cmp eax, 0
jne 0x1001686a
call fcn.100168ee
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [0x10106bf3]
test ebx, ebx
je 0x1001682d
push ebx
call fcn.1005686d
add esp, 4
pop eax
mov dword [0x10106bf3], eax
mov eax, dword [0x10106bf3]
test eax, eax
je 0x10016851
push eax
mov ebx, eax
call fcn.10001b7a
inc eax
push eax
call fcn.10056873
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
test ebx, ebx
je 0x10016864
push ebx
call fcn.1005686d
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0
mov ebx, dword [ebp + 0x10]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
nop
nop
cmp dword [ebp - 8], esp
je 0x100168a5
push 0x202
push 0x4035ea2
push 6
call fcn.10056879
add esp, 0xc
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x100168b8
mov eax, 0x10105243
push eax
push 1
mov ebx, 0x170
call fcn.100576e0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x100168d6
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100168e7
push ebx
call fcn.1005686d
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x100168ee
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.100576a0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10016933
push ebx
call fcn.1005686d
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0xff
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
nop
nop
cmp dword [ebp - 8], esp
je 0x10016968
push 0x36
push 0x4035eb8
push 6
call fcn.10056879
add esp, 0xc
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x1001697b
mov eax, 0x10105243
push eax
push 1
mov ebx, 0x170
call fcn.100576e0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x10016999
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100169aa
push ebx
call fcn.1005686d
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x100169af
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.100576a0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100169f4
push ebx
call fcn.1005686d
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0xff
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
nop
nop
cmp dword [ebp - 8], esp
je 0x10016a29
push 0x36
push 0x4035ea3
push 6
call fcn.10056879
add esp, 0xc
mov eax, dword [ebp - 4]
test eax, eax
je 0x10016a45
push eax
mov ebx, eax
call fcn.10001b7a
inc eax
push eax
call fcn.10056873
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x10016a4a
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10016a5b
push ebx
call fcn.1005686d
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x10016dc3
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.1001618c
test eax, eax
je 0x10016e06
xor eax, eax
xchg dword [ebp + 8], eax
cmp eax, 0xffff
jle 0x10016e06
cmp word [eax], 0x5a4d
jne 0x10016e06
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x10016e06
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.1001625e
mov eax, dword [ebp + 8]
jmp 0x10016e1f
mov esp, ebp
pop ebp
ret 4

Function at 0x1001e4fd
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
nop
nop
cmp dword [ebp - 4], esp
je 0x1001e532
push 0x25
push 0x4035e63
push 6
call fcn.10056879
add esp, 0xc
jmp 0x1001e537
mov esp, ebp
pop ebp
ret 4
Function at 0x1001e6c2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
push 0x18
call fcn.10056873
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov edi, eax
xor eax, eax
mov ecx, 6
rep stosd dword es:[edi], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
push 1
mov eax, 0x10105244
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
call fcn.10015598
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x1001e723
push ebx
call fcn.1005686d
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
cmp dword [0x10106c63], 0
jne 0x1001e747
cmp dword [ebp - 4], 0
je 0x1001e747
mov eax, 1
jmp 0x1001e74c
mov eax, 0
test eax, eax
je 0x1001e7c2
mov eax, 0x1010595a
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
call fcn.1001c041
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x1001e778
push ebx
call fcn.1005686d
add esp, 4
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 4]
call fcn.1001e8aa
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x1001e797
push ebx
call fcn.1005686d
add esp, 4
mov eax, dword [ebp - 0x1c]
mov dword [0x10106c63], eax
push reloc.oleaut32.dll_SysStringLen
push 0
push 0x1002176d
push 1
mov ebx, 0x9dc
call fcn.10057ef0
add esp, 0x10
mov dword [0x10106c67], eax
push 1
lea eax, [ebp - 8]
push eax
push 1
push 0
push 1
push 0
push dword [0x10106c67]
push dword [0x10106c63]
call fcn.1001fc90
mov dword [ebp - 0x14], esp
lea eax, [ebp - 0x10]
push eax
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push 0
push 0
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
nop
nop
cmp dword [ebp - 0x14], esp
je 0x1001e82c
push 0x22e
push 0x4035e66
push 6
call fcn.10056879
add esp, 0xc
mov dword [ebp - 0xc], eax
push 1
lea eax, [ebp - 8]
push eax
call fcn.10021524
cmp dword [ebp - 0xc], 0
je 0x1001e885
push 2
push dword [ebp - 0xc]
call fcn.1001b897
cmp dword [ebp + 0x1c], 0
mov eax, 0
sete al
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x1001e87c
push 1
push 0xffffffff
push dword [ebp + 0x18]
push dword [ebp - 0xc]
call fcn.100215b1
lea eax, [ebp - 0xc]
push eax
call fcn.1001ce2f
cmp dword [ebp - 0x10], 0
mov eax, 0
setne al
jmp 0x1001e896
push eax
mov ebx, dword [ebp - 8]
push ebx
call fcn.1005686d
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x18
Function at 0x100213ca
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x10106bdb], 1
jne 0x10021431
cmp dword [0x10106bdf], 1
jne 0x100213ed
mov dword [ebp - 4], esp
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
nop
nop
cmp dword [ebp - 4], esp
je 0x10021419
push 0xbc
push 0x4035e43
push 6
call fcn.10056879
add esp, 0xc
mov ebx, dword [ebp + 0xc]
mov dword [ebx], eax
mov ebx, dword [ebp + 0xc]
cmp dword [ebx], 0
mov eax, 0
setne al
jmp 0x100214a5
cmp dword [0x10106c73], 0
jne 0x10021486
mov eax, 0x10105998
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
call fcn.100119b8
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10021462
push ebx
call fcn.1005686d
add esp, 4
lea eax, [ebp - 8]
push eax
call fcn.10011caf
mov dword [ebp - 0xc], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x1002147e
push ebx
call fcn.1005686d
add esp, 4
mov eax, dword [ebp - 0xc]
mov dword [0x10106c73], eax
push dword [0x10106c73]
call fcn.10015def
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
mov eax, 0
sete al
jmp 0x100214a5
mov esp, ebp
pop ebp
ret 8
Function at 0x100538ac
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x100538e4
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x100538d2
mov al, 1
jmp 0x10053943
cmp dword [ebx + 0x54], ecx
jne 0x100538db
mov al, 2
jmp 0x10053943
cmp dword [ebx + 0x7c], ecx
jne 0x10053943
mov al, 3
jmp 0x10053943
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x100538f9
mov al, 4
jmp 0x10053943
cmp ecx, 5
jne 0x10053919
cmp ebx, 0
jne 0x10053907
mov al, 5
jmp 0x10053943
cmp ebx, 1
jne 0x10053910
mov al, 6
jmp 0x10053943
cmp ebx, 2
jne 0x10053919
mov al, 7
jmp 0x10053943
cmp ecx, 6
jne 0x10053941
cmp ebx, 0
jne 0x10053927
mov al, 8
jmp 0x10053943
cmp ebx, 1
jne 0x1005392e
mov al, 9
cmp ebx, 2
jne 0x10053935
mov al, 0xa
cmp ebx, 3
jne 0x1005393c
mov al, 0xb
cmp ebx, 4
jne 0x10053943
mov al, 0xc
pop ebx
leave
ret

Function at 0x10053b89
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ebx, dword [0x10106c7f]
push ebx
call fcn.1005686d
add esp, 4
mov eax, 0x101052bf
mov dword [0x10106c7f], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
call fcn.1005686d
add esp, 4
mov eax, 0x101052bf
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov dword [ebp - 4], esp
push 0
push 0x10053ce4
xor eax, eax
call dword [sym.imp.USER32.dll_EnumWindows]
nop
nop
cmp dword [ebp - 4], esp
je 0x10053bf6
push 0x34
push 0x4035ec3
push 6
call fcn.10056879
add esp, 0xc
mov eax, dword [0x10106c7f]
push eax
push eax
mov ebx, eax
call fcn.10001079
pop eax
sub ebx, eax
shl ecx, 2
add ecx, ebx
push ecx
call fcn.10056873
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
call fcn.1005686d
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov ebx, dword [0x10106c7f]
call fcn.10002831
jmp 0x10053c3d
mov esp, ebp
pop ebp
ret 8

Function at 0x10053e00
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
lea eax, [ebp + 8]
push eax
push 0x10053f16
xor eax, eax
call dword [sym.imp.USER32.dll_EnumWindows]
nop
nop
cmp dword [ebp - 4], esp
je 0x10053e3b
push 0
push 0x4035ec5
push 6
call fcn.10056879
add esp, 0xc
mov eax, dword [ebp + 8]
jmp 0x10053e43
mov esp, ebp
pop ebp
ret 4
Function at 0x100548d7
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.10056873
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.10056873
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0x10
call fcn.10056873
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0
mov ebx, 0x8d4
call fcn.100587d0
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
je 0x10054990
mov eax, 0
jmp 0x10054afc
cmp dword [ebp + 0xc], 0
jne 0x100549c6
mov dword [ebp - 0x18], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x100549c3
push 0xa0
push 0x4035107
push 6
call fcn.10056879
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp + 0x14], 0
jne 0x100549ee
mov eax, 0x10106694
push eax
mov ebx, dword [ebp + 0x10]
mov ebx, dword [ebx]
test ebx, ebx
je 0x100549e8
push ebx
call fcn.1005686d
add esp, 4
pop eax
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
mov dword [ebp - 0x18], esp
lea eax, [ebp - 8]
push eax
push 0x28
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x10054a23
push 0x104
push 0x4035107
push 6
call fcn.10056879
add esp, 0xc
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
push 0x10105243
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x10054a59
push 0x12e
push 0x4035107
push 6
call fcn.10056879
add esp, 0xc
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov dword [ebp - 0x18], esp
mov eax, 0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
push 0x1c
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x10054af7
push 0x225
push 0x4035107
push 6
call fcn.10056879
add esp, 0xc
jmp 0x10054afc
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.1005686d
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.1005686d
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.1005686d
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10054d5b
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ebx, dword [0x10106cab]
push ebx
call fcn.1005686d
add esp, 4
mov eax, 0x101052bf
mov dword [0x10106cab], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
call fcn.1005686d
add esp, 4
mov eax, 0x101052bf
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov dword [ebp - 4], esp
push 0
push 0x10054eb6
xor eax, eax
call dword [sym.imp.USER32.dll_EnumWindows]
nop
nop
cmp dword [ebp - 4], esp
je 0x10054dc8
push 0x34
push 0x4035165
push 6
call fcn.10056879
add esp, 0xc
mov eax, dword [0x10106cab]
push eax
push eax
mov ebx, eax
call fcn.10001079
pop eax
sub ebx, eax
shl ecx, 2
add ecx, ebx
push ecx
call fcn.10056873
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
call fcn.1005686d
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov ebx, dword [0x10106cab]
call fcn.10002831
jmp 0x10054e0f
mov esp, ebp
pop ebp
ret 8

Function at 0x10054fd2
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
lea eax, [ebp + 8]
push eax
push 0x100550e8
xor eax, eax
call dword [sym.imp.USER32.dll_EnumWindows]
nop
nop
cmp dword [ebp - 4], esp
je 0x1005500d
push 0
push 0x4035713
push 6
call fcn.10056879
add esp, 0xc
mov eax, dword [ebp + 8]
jmp 0x10055015
mov esp, ebp
pop ebp
ret 4

Function at 0x1005521a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.100576a0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1005525f
push ebx
call fcn.1005686d
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0xff
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
nop
nop
cmp dword [ebp - 8], esp
je 0x10055294
push 0x36
push 0x4035160
push 6
call fcn.10056879
add esp, 0xc
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x100552a7
mov eax, 0x10105243
push eax
push 1
mov ebx, 0x170
call fcn.100576e0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x100552c5
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100552d6
push ebx
call fcn.1005686d
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret