joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1004dc90
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff5c
push ebx
push esi
xor edx, edx
mov dword [ebp - 0xa4], edx
mov dword [ebp - 0xa0], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x1004dec2
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.10004524
mov dword [ebp - 0x9c], 0x9c
lea eax, [ebp - 0x9c]
push eax
call sub.kernel32.dll_GetVersionExA
test eax, eax
je 0x1004de6f
cmp dword [ebp - 0x8c], 2
jne 0x1004de6f
mov eax, dword [ebp - 0x98]
cmp eax, 3
je 0x1004dcfb
cmp eax, 4
jne 0x1004dd0c
mov eax, ebx
mov edx, 0x1004ded8
call fcn.10004578
jmp 0x1004de6f
cmp eax, 5
jne 0x1004dd59
mov eax, dword [ebp - 0x94]
sub eax, 1
jb 0x1004dd26
je 0x1004dd37
dec eax
je 0x1004dd48
jmp 0x1004de6f
mov eax, ebx
mov edx, 0x1004deec
call fcn.10004578
jmp 0x1004de6f
mov eax, ebx
mov edx, 0x1004df04
call fcn.10004578
jmp 0x1004de6f
mov eax, ebx
mov edx, 0x1004df18
call fcn.10004578
jmp 0x1004de6f
cmp eax, 6
jne 0x1004de6f
mov esi, dword [ebp - 0x94]
mov eax, esi
sub eax, 1
jb 0x1004dd7c
je 0x1004dda4
dec eax
je 0x1004ddcc
dec eax
je 0x1004ddf1
jmp 0x1004de13
cmp byte [ebp - 2], 1
jne 0x1004dd93
mov eax, ebx
mov edx, 0x1004df34
call fcn.10004578
jmp 0x1004de6f
mov eax, ebx
mov edx, 0x1004df4c
call fcn.10004578
jmp 0x1004de6f
cmp byte [ebp - 2], 1
jne 0x1004ddbb
mov eax, ebx
mov edx, 0x1004df68
call fcn.10004578
jmp 0x1004de6f
mov eax, ebx
mov edx, 0x1004df7c
call fcn.10004578
jmp 0x1004de6f
cmp byte [ebp - 2], 1
jne 0x1004dde3
mov eax, ebx
mov edx, 0x1004df9c
call fcn.10004578
jmp 0x1004de6f
mov eax, ebx
mov edx, 0x1004dfb0
call fcn.10004578
jmp 0x1004de6f
cmp byte [ebp - 2], 1
jne 0x1004de05
mov eax, ebx
mov edx, 0x1004dfcc
call fcn.10004578
jmp 0x1004de6f
mov eax, ebx
mov edx, 0x1004dfe0
call fcn.10004578
jmp 0x1004de6f
cmp byte [ebp - 2], 1
jne 0x1004de40
mov eax, esi
xor edx, edx
push edx
push eax
lea edx, [ebp - 0xa0]
xor eax, eax
call fcn.1004b514
mov ecx, dword [ebp - 0xa0]
mov eax, ebx
mov edx, 0x1004e000
call fcn.1000484c
jmp 0x1004de6f
push 0x1004e000
mov eax, esi
xor edx, edx
push edx
push eax
lea edx, [ebp - 0xa4]
xor eax, eax
call fcn.1004b514
push dword [ebp - 0xa4]
push 0x1004e014
mov eax, ebx
mov edx, 3
call fcn.100048c0
cmp dword [ebx], 0
jne 0x1004de80
mov eax, ebx
mov edx, 0x1004e028
call fcn.10004578
mov eax, dword [0x1005c3b8]
cmp byte [eax], 0
je 0x1004de98
mov eax, ebx
mov edx, 0x1004e038
call fcn.10004808
jmp 0x1004dea4
mov eax, ebx
mov edx, 0x1004e048
call fcn.10004808
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1004dec9
lea eax, [ebp - 0xa4]
mov edx, 2
call fcn.10004548
ret

Function at 0x1004e050
Capabilities:
Get memory capacity

Disassembly:
add esp, 0xffffffe0
push esp
call sub.kernel32.dll_GlobalMemoryStatus
mov eax, dword [esp + 8]
shr eax, 0x14
add esp, 0x20
ret
Function at 0x1004e224
Capabilities:
Execute anti-debugging instructions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_GetPriorityClass
mov ebx, eax
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_GetThreadPriority
mov esi, eax
push pe_nt_image_headers32
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_SetPriorityClass
push 0xf
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
rdtsc
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push 0x1f4
call sub.kernel32.dll_Sleep_1
rdtsc
sub eax, dword [ebp - 4]
sbb edx, dword [ebp - 8]
mov dword [ebp - 4], eax
mov dword [ebp - 8], edx
push esi
call sub.kernel32.dll_GetCurrentThread
push eax
call sub.kernel32.dll_SetThreadPriority
push ebx
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.kernel32.dll_SetPriorityClass
mov eax, dword [ebp - 4]
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0xc], eax
fild qword [ebp - 0x10]
fdiv dword [0x1004e2bc]
call fcn.10002f10
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1004e33c
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ebx
push ecx
mov ebx, eax
push 0
lea eax, [esp + 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
mov eax, dword [esp]
and eax, 1
cmp eax, 1
jne 0x1004e366
mov eax, ebx
mov edx, 0x1004e3b0
call fcn.10004578
pop edx
pop ebx
ret
mov eax, dword [esp]
and eax, 2
cmp eax, 2
jne 0x1004e37f
mov eax, ebx
mov edx, 0x1004e3c0
call fcn.10004578
jmp 0x1004e3a4
mov eax, dword [esp]
and eax, 4
cmp eax, 4
jne 0x1004e398
mov eax, ebx
mov edx, 0x1004e3d0
call fcn.10004578
jmp 0x1004e3a4
mov eax, ebx
mov edx, 0x1004e3e0
call fcn.10004578
pop edx
pop ebx
ret

Function at 0x1004e67c
Capabilities:
Find taskbar

Disassembly:
push 0
push 0x1004e68c
call sub.user32.dll_FindWindowA
ret
Function at 0x1004e834
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffedc
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x118], ebx
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x120], ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 8], ebx
mov byte [ebp - 1], cl
mov edi, edx
mov esi, eax
xor eax, eax
push ebp
push 0x1004ea15
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x10063638
call sub.kernel32.dll_EnterCriticalSection_1
xor eax, eax
push ebp
push 0x1004e9db
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 2], 0
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
lea eax, [ebp - 0x10]
call fcn.1004e798
mov eax, dword [ebp - 0x10]
call fcn.10004a00
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1004e8cd
call fcn.10003f70
jmp 0x1004e9e2
lea eax, [ebp - 0x114]
mov edx, esi
call fcn.10003164
lea edx, [ebp - 0x114]
lea eax, [ebp - 0x14]
call fcn.10004788
push dword [ebp - 0x14]
push 0x1004ea30
lea eax, [ebp - 0x118]
mov edx, edi
call fcn.1000471c
push dword [ebp - 0x118]
push 0x1004ea30
cmp byte [ebp - 1], 1
cmc
sbb eax, eax
call fcn.1004b584
mov edx, eax
lea eax, [ebp - 0x11c]
call fcn.1000470c
push dword [ebp - 0x11c]
push 0x1004ea30
cmp byte [ebp + 8], 1
cmc
sbb eax, eax
call fcn.1004b584
mov edx, eax
lea eax, [ebp - 0x120]
call fcn.1000470c
push dword [ebp - 0x120]
lea eax, [ebp - 8]
mov edx, 7
call fcn.100048c0
lea edx, [ebp - 0x124]
mov eax, dword [ebp - 8]
call fcn.1004b67c
mov edx, dword [ebp - 0x124]
lea eax, [ebp - 8]
mov ecx, 0x1004ea3c
call fcn.1000484c
mov eax, dword [ebp - 8]
call fcn.10004a00
push eax
call sub.kernel32.dll_lstrlenA_1
mov esi, eax
push 2
push 0
push 0
push ebx
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0xc]
push eax
push esi
mov eax, dword [ebp - 8]
call fcn.10004a00
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x1004e9b4
cmp esi, dword [ebp - 0xc]
je 0x1004e9b8
xor eax, eax
jmp 0x1004e9ba
mov al, 1
mov byte [ebp - 2], al
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1004e9e2
push 0x10063638
call sub.kernel32.dll_LeaveCriticalSection_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1004ea1c
lea eax, [ebp - 0x124]
mov edx, 4
call fcn.10004548
lea eax, [ebp - 0x14]
mov edx, 2
call fcn.10004548
lea eax, [ebp - 8]
call fcn.10004524
ret
Function at 0x1004ea40
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 5
push 0
push 0
dec ecx
jne 0x1004ea48
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x1004ec01
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x10063638
call sub.kernel32.dll_EnterCriticalSection_1
xor eax, eax
push ebp
push 0x1004ebd2
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 5], 0
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea eax, [ebp - 0x1c]
call fcn.1004e798
mov eax, dword [ebp - 0x1c]
call fcn.10004a00
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x1004eab9
call fcn.10003f70
jmp 0x1004ebd9
push 0
push ebx
call sub.kernel32.dll_GetFileSize
mov esi, eax
test esi, esi
je 0x1004ebb4
mov edx, esi
shr edx, 0
lea eax, [ebp - 0xc]
call fcn.10004b30
push 0
lea eax, [ebp - 0x18]
push eax
push esi
mov eax, dword [ebp - 0xc]
call fcn.10004a00
push eax
push ebx
call sub.kernel32.dll_ReadFile
test eax, eax
je 0x1004eaf7
cmp esi, dword [ebp - 0x18]
je 0x1004eafb
xor eax, eax
jmp 0x1004eafd
mov al, 1
mov byte [ebp - 5], al
cmp byte [ebp - 5], 0
je 0x1004ebb4
mov edi, 1
lea eax, [ebp - 0xc]
call fcn.10004a58
lea edx, [eax + edi - 1]
lea eax, [ebp - 0x20]
call fcn.1000471c
mov edx, dword [ebp - 0x20]
mov eax, 0x1004ec1c
call fcn.10004ae8
mov esi, eax
test esi, esi
jne 0x1004eb3c
mov byte [ebp - 5], 0
jmp 0x1004ebb4
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0xc]
call fcn.10004a58
lea edx, [eax + edi - 1]
lea eax, [ebp - 0x28]
call fcn.1000471c
mov eax, dword [ebp - 0x28]
mov ecx, esi
dec ecx
mov edx, 1
call fcn.10004a60
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x10]
call fcn.1004b67c
lea eax, [ebp - 0x14]
push eax
mov edx, dword [ebp - 0x10]
mov eax, 0x1004ec28
call fcn.10004ae8
mov ecx, eax
dec ecx
mov edx, 1
mov eax, dword [ebp - 0x10]
call fcn.10004a60
lea eax, [ebp - 0x2c]
mov edx, dword [ebp - 4]
call fcn.1000471c
mov edx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x14]
call fcn.1004b600
test eax, eax
jne 0x1004ebb4
add esi, 2
add edi, esi
jmp 0x1004eb0f
push ebx
call sub.kernel32.dll_CloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1004ebd9
push 0x10063638
call sub.kernel32.dll_LeaveCriticalSection_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1004ec08
lea eax, [ebp - 0x2c]
mov edx, 5
call fcn.10004548
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.10004548
ret

Function at 0x1004ee0c
Capabilities:
Create thread

Disassembly:
add esp, 0xffffffec
mov dword [esp + 8], eax
mov dword [esp + 0xc], edx
mov byte [esp + 0x10], cl
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [esp + 4], eax
push esp
push 0
lea eax, [esp + 0xc]
push eax
push 0x1004ecc8
push 0
push 0
call sub.kernel32.dll_CreateThread_1
push 0x7d0
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_WaitForSingleObject
mov eax, dword [esp + 4]
push eax
call sub.kernel32.dll_CloseHandle
add esp, 0x14
ret
Function at 0x1004f118
Capabilities:
Create thread

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebp, ecx
mov edi, edx
mov esi, eax
mov eax, 0xc
call fcn.10002a8c
mov ebx, eax
mov eax, esi
call fcn.10004a00
mov dword [ebx], eax
mov eax, edi
call fcn.10004a00
mov dword [ebx + 4], eax
mov dword [ebx + 8], ebp
mov eax, dword [0x1005c390]
push eax
push 0
push ebx
push 0x1004f0fc
push 0
push 0
call sub.kernel32.dll_CreateThread_1
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x1004f364
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
xor eax, eax
push ebp
push 0x1004f442
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, 0x1004f450
call fcn.1004f160
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.1004f264
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
call fcn.100045bc
push 0
push 0x80
push 1
push 0
push 2
push 0x40000000
mov eax, dword [ebp - 8]
call fcn.10004a00
push eax
call sub.kernel32.dll_CreateFileA
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1004f41f
mov eax, dword [ebp - 4]
call fcn.10004a00
push eax
call sub.kernel32.dll_lstrlenA_1
mov esi, eax
push 0
lea eax, [ebp - 0xc]
push eax
push esi
mov eax, dword [ebp - 4]
call fcn.10004a00
push eax
push ebx
call sub.kernel32.dll_WriteFile_1
test eax, eax
je 0x1004f41f
cmp esi, dword [ebp - 0xc]
jne 0x1004f41f
push ebx
call sub.kernel32.dll_CloseHandle
push 0
push 0
push 0
mov eax, dword [ebp - 8]
call fcn.10004a00
push eax
push 0
push 0
mov eax, dword [0x1005c6bc]
mov eax, dword [eax]
call eax
push 0
call sub.kernel32.dll_ExitProcess_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1004f449
lea eax, [ebp - 0x10]
call fcn.10004524
lea eax, [ebp - 8]
mov edx, 2
call fcn.10004548
ret
Function at 0x1004f458
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe94
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x164], edx
mov dword [ebp - 0x168], edx
mov dword [ebp - 0x16c], edx
mov dword [ebp - 0x15c], edx
mov dword [ebp - 0x160], edx
mov dword [ebp - 0x154], edx
mov dword [ebp - 0x158], edx
mov dword [ebp - 0x150], edx
mov dword [ebp - 0x14c], edx
mov esi, eax
xor eax, eax
push ebp
push 0x1004f6c3
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.10004524
mov edx, dword [0x1005c578]
mov edx, dword [edx]
lea eax, [ebp - 0x14c]
mov ecx, 0x1004f6d8
call fcn.1000484c
mov eax, dword [ebp - 0x14c]
call fcn.10004a00
mov dword [ebp - 8], eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x150]
mov edx, dword [ebp - 8]
call fcn.1000471c
lea eax, [ebp - 0x150]
mov edx, 0x1004f6ec
call fcn.10004808
mov eax, dword [ebp - 0x150]
call fcn.10004a00
push eax
call sub.kernel32.dll_FindFirstFileA_1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
je 0x1004f6a5
xor eax, eax
push ebp
push 0x1004f69e
push dword fs:[eax]
mov dword fs:[eax], esp
test byte [ebp - 0x148], 0x10
jne 0x1004f66f
lea eax, [ebp - 0x154]
mov edx, dword [ebp - 8]
call fcn.1000471c
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x158]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.10004794
mov edx, dword [ebp - 0x158]
pop eax
call fcn.10004808
mov eax, dword [ebp - 0x154]
call fcn.10004a00
push eax
call sub.kernel32.dll_GetModuleHandleA_2
mov ebx, eax
test ebx, ebx
jne 0x1004f5ce
lea eax, [ebp - 0x15c]
mov edx, dword [ebp - 8]
call fcn.1000471c
lea eax, [ebp - 0x15c]
push eax
lea eax, [ebp - 0x160]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.10004794
mov edx, dword [ebp - 0x160]
pop eax
call fcn.10004808
mov eax, dword [ebp - 0x15c]
call fcn.10004a00
push eax
call sub.kernel32.dll_LoadLibraryA
mov ebx, eax
test ebx, ebx
je 0x1004f66f
push 0x1004f6f0
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x1006362c], eax
push 0x1004f6fc
push ebx
call sub.kernel32.dll_GetProcAddress_1
mov dword [0x10063630], eax
cmp dword [0x1006362c], 0
je 0x1004f66f
push dword [esi]
lea eax, [ebp - 0x164]
lea edx, [ebp - 0x11c]
mov ecx, 0x104
call fcn.10004794
push dword [ebp - 0x164]
push 0x1004f714
call dword [0x10063630]
call fcn.1004b584
mov edx, eax
lea eax, [ebp - 0x168]
call fcn.1000470c
push dword [ebp - 0x168]
push 0x1004f714
call dword [0x1006362c]
mov edx, eax
lea eax, [ebp - 0x16c]
call fcn.1000471c
push dword [ebp - 0x16c]
push 0x1004f720
mov eax, esi
mov edx, 7
call fcn.100048c0
lea eax, [ebp - 0x148]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FindNextFileA
test eax, eax
jne 0x1004f529
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1004f6a5
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_FindClose_1
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1004f6ca
lea eax, [ebp - 0x16c]
mov edx, 9
call fcn.10004548
ret
Function at 0x1004f7cc
Capabilities:
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x1004f8b7
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
mov eax, dword [0x1005c69c]
mov byte [eax], 0
mov eax, dword [0x1005c368]
cmp dword [eax], 0
jne 0x1004f8a1
mov eax, dword [0x1005c68c]
push eax
call sub.kernel32.dll_InitializeCriticalSection_1
push 0
push 0x80
push 4
push 0
push 3
push 0xc0000000
lea eax, [ebp - 8]
call fcn.1004f724
mov eax, dword [ebp - 8]
call fcn.10004a00
push eax
call sub.kernel32.dll_CreateFileA
mov edx, dword [0x1005c408]
mov dword [edx], eax
push 0
mov eax, dword [0x1005c408]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetFileSize
test eax, eax
jne 0x1004f867
push 0
lea eax, [ebp - 4]
push eax
push 2
mov eax, dword [0x1005c378]
push eax
mov eax, dword [0x1005c408]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_WriteFile_1
push 0
push 0
mov eax, dword [0x1005c390]
push eax
mov ecx, 0x1004fc70
xor edx, edx
xor eax, eax
call fcn.100044e0
mov edx, dword [0x1005c368]
mov dword [edx], eax
mov eax, dword [0x1005c408]
cmp dword [eax], 0xffffffff
je 0x1004f89b
mov eax, dword [0x1005c368]
cmp dword [eax], 0
jne 0x1004f89f
xor ebx, ebx
jmp 0x1004f8a1
mov bl, 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1004f8be
lea eax, [ebp - 8]
call fcn.10004524
ret

Function at 0x1004f8c8
Capabilities:
Terminate thread

Disassembly:
mov eax, dword [0x1005c69c]
mov byte [eax], 1
mov eax, dword [0x1005c368]
cmp dword [eax], 0
je 0x1004f930
push 0x7d0
mov eax, dword [0x1005c368]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_WaitForSingleObject
cmp eax, 0x102
jne 0x1004f902
push 0
mov eax, dword [0x1005c368]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_TerminateThread
mov eax, dword [0x1005c368]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x1005c408]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, dword [0x1005c68c]
push eax
call sub.kernel32.dll_DeleteCriticalSection_1
mov eax, dword [0x1005c368]
xor edx, edx
mov dword [eax], edx
ret
Function at 0x1004f934
Capabilities:
Get graphical window text
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x230], edx
mov dword [ebp - 0x234], edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x1004fbe9
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetForegroundWindow
mov edx, dword [ebp + 8]
mov dword [edx - 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [0x1005c604]
cmp eax, dword [edx]
je 0x1004fb17
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_GetSystemTimeAsFileTime
lea edx, [ebp - 0x228]
lea eax, [ebp - 0xc]
call fcn.1004b838
mov edx, dword [ebp - 0x228]
lea eax, [ebp - 0x10]
call fcn.10004d44
push 0x200
lea eax, [ebp - 0x224]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.user32.dll_GetWindowTextW
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.user32.dll_GetWindowThreadProcessId
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
call fcn.1004db4c
test al, al
jne 0x1004f9ff
lea eax, [ebp - 0x24]
call fcn.10004524
push 0x1004fbfc
push dword [ebp - 0x10]
push 0x1004fc18
lea eax, [ebp - 0x22c]
lea edx, [ebp - 0x224]
mov ecx, pe_nt_image_headers32
call fcn.10004d28
push dword [ebp - 0x22c]
push 0x1004fc30
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x234]
xor eax, eax
call fcn.1004b514
mov edx, dword [ebp - 0x234]
lea eax, [ebp - 0x230]
call fcn.10004d44
push dword [ebp - 0x230]
push 0x1004fc50
lea eax, [ebp - 0x238]
mov edx, dword [ebp - 0x24]
call fcn.10004d44
push dword [ebp - 0x238]
push 0x1004fc5c
lea eax, [ebp - 0x20]
mov edx, 9
call fcn.10004e38
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [0x1005c604]
mov dword [edx], eax
mov eax, dword [0x1005c68c]
push eax
call sub.kernel32.dll_EnterCriticalSection_1
xor eax, eax
push ebp
push 0x1004fb10
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x20]
call fcn.10004d54
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_lstrlenW
mov ebx, eax
add ebx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.10012410
mov eax, dword [0x1005c68c]
push eax
call sub.kernel32.dll_EnterCriticalSection_1
xor eax, eax
push ebp
push 0x1004fb8b
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
push 0
push 0
mov eax, dword [0x1005c408]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x18]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
mov eax, dword [0x1005c408]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_WriteFile_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1004fb92
mov eax, dword [0x1005c68c]
push eax
call sub.kernel32.dll_LeaveCriticalSection_1
ret
Function at 0x1004fb17
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdc8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x22c], edx
mov dword [ebp - 0x230], edx
mov dword [ebp - 0x234], edx
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x1004fbe9
push dword fs:[eax]
mov dword fs:[eax], esp
call sub.user32.dll_GetForegroundWindow
mov edx, dword [ebp + 8]
mov dword [edx - 4], eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [0x1005c604]
cmp eax, dword [edx]
je 0x1004fb17
lea eax, [ebp - 0xc]
push eax
call sub.kernel32.dll_GetSystemTimeAsFileTime
lea edx, [ebp - 0x228]
lea eax, [ebp - 0xc]
call fcn.1004b838
mov edx, dword [ebp - 0x228]
lea eax, [ebp - 0x10]
call fcn.10004d44
push 0x200
lea eax, [ebp - 0x224]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.user32.dll_GetWindowTextW
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
push eax
call sub.user32.dll_GetWindowThreadProcessId
lea ecx, [ebp - 0x24]
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
call fcn.1004db4c
test al, al
jne 0x1004f9ff
lea eax, [ebp - 0x24]
call fcn.10004524
push 0x1004fbfc
push dword [ebp - 0x10]
push 0x1004fc18
lea eax, [ebp - 0x22c]
lea edx, [ebp - 0x224]
mov ecx, pe_nt_image_headers32
call fcn.10004d28
push dword [ebp - 0x22c]
push 0x1004fc30
mov eax, dword [ebp - 0x14]
xor edx, edx
push edx
push eax
lea edx, [ebp - 0x234]
xor eax, eax
call fcn.1004b514
mov edx, dword [ebp - 0x234]
lea eax, [ebp - 0x230]
call fcn.10004d44
push dword [ebp - 0x230]
push 0x1004fc50
lea eax, [ebp - 0x238]
mov edx, dword [ebp - 0x24]
call fcn.10004d44
push dword [ebp - 0x238]
push 0x1004fc5c
lea eax, [ebp - 0x20]
mov edx, 9
call fcn.10004e38
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
mov edx, dword [0x1005c604]
mov dword [edx], eax
mov eax, dword [0x1005c68c]
push eax
call sub.kernel32.dll_EnterCriticalSection_1
xor eax, eax
push ebp
push 0x1004fb10
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x20]
call fcn.10004d54
mov eax, dword [ebp - 4]
push eax
call sub.kernel32.dll_lstrlenW
mov ebx, eax
add ebx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.10012410
mov eax, dword [0x1005c68c]
push eax
call sub.kernel32.dll_EnterCriticalSection_1
xor eax, eax
push ebp
push 0x1004fb8b
push dword fs:[eax]
mov dword fs:[eax], esp
push 2
push 0
push 0
mov eax, dword [0x1005c408]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_SetFilePointer
push 0
lea eax, [ebp - 0x18]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
mov eax, dword [0x1005c408]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_WriteFile_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1004fb92
mov eax, dword [0x1005c68c]
push eax
call sub.kernel32.dll_LeaveCriticalSection_1
ret