joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001aea
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 8
call fcn.1005090d
add esp, 4
mov dword [ebp - 0xc], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
push 0x10
call fcn.1005090d
add esp, 4
mov dword [ebp - 0x10], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0x10
call fcn.1005090d
add esp, 4
mov dword [ebp - 0x14], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
mov dword [ebx + 0xc], 0
push 0
mov ebx, 0x8d4
call fcn.10051210
add esp, 4
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
je 0x10001ba3
mov eax, 0
jmp 0x10001d0f
cmp dword [ebp + 0xc], 0
jne 0x10001bd9
mov dword [ebp - 0x18], esp
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x10001bd6
push 0xa0
push 0x4035083
push 6
call fcn.1005092b
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp + 0x14], 0
jne 0x10001c01
mov eax, 0x100ff240
push eax
mov ebx, dword [ebp + 0x10]
mov ebx, dword [ebx]
test ebx, ebx
je 0x10001bfb
push ebx
call fcn.10050907
add esp, 4
pop eax
mov ebx, dword [ebp + 0x10]
mov dword [ebx], eax
mov dword [ebp - 0x18], esp
lea eax, [ebp - 8]
push eax
push 0x28
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x10001c36
push 0x104
push 0x4035083
push 6
call fcn.1005092b
add esp, 0xc
mov dword [ebp - 0x18], esp
push dword [ebp - 0xc]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
push 0x100ff251
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x10001c6c
push 0x12e
push 0x4035083
push 6
call fcn.1005092b
add esp, 0xc
mov ebx, dword [ebp - 0x10]
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 1
mov ebx, dword [ebp - 0x10]
add ebx, 4
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 8
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0xc]
add ebx, 4
mov dword [ebp - 0x1c], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, dword [ebx]
mov ebx, dword [ebp - 0x18]
mov dword [ebx], eax
mov ebx, dword [ebp - 0x10]
add ebx, 0xc
mov dword [ebp - 0x18], ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebx], 2
mov dword [ebp - 0x18], esp
mov eax, 0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x14]
push 0x1c
push dword [ebp - 0x10]
push 0
push dword [ebp - 8]
xor eax, eax
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
nop
nop
cmp dword [ebp - 0x18], esp
je 0x10001d0a
push 0x225
push 0x4035083
push 6
call fcn.1005092b
add esp, 0xc
jmp 0x10001d0f
push eax
mov ebx, dword [ebp - 0xc]
push ebx
call fcn.10050907
add esp, 4
mov ebx, dword [ebp - 0x10]
push ebx
call fcn.10050907
add esp, 4
mov ebx, dword [ebp - 0x14]
push ebx
call fcn.10050907
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10001fbb
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ebx, dword [0x10100ae1]
push ebx
call fcn.10050907
add esp, 4
mov eax, 0x100ff252
mov dword [0x10100ae1], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
call fcn.10050907
add esp, 4
mov eax, 0x100ff252
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov dword [ebp - 4], esp
push 0
push 0x10002116
xor eax, eax
call dword [sym.imp.USER32.dll_EnumWindows]
nop
nop
cmp dword [ebp - 4], esp
je 0x10002028
push 0x34
push 0x40350e1
push 6
call fcn.1005092b
add esp, 0xc
mov eax, dword [0x10100ae1]
push eax
push eax
mov ebx, eax
call fcn.10001371
pop eax
sub ebx, eax
shl ecx, 2
add ecx, ebx
push ecx
call fcn.1005090d
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
call fcn.10050907
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov ebx, dword [0x10100ae1]
call fcn.10001d8c
jmp 0x1000206f
mov esp, ebp
pop ebp
ret 8

Function at 0x10002232
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
lea eax, [ebp + 8]
push eax
push 0x10002348
xor eax, eax
call dword [sym.imp.USER32.dll_EnumWindows]
nop
nop
cmp dword [ebp - 4], esp
je 0x1000226d
push 0
push 0x403568f
push 6
call fcn.1005092b
add esp, 0xc
mov eax, dword [ebp + 8]
jmp 0x10002275
mov esp, ebp
pop ebp
ret 4

Function at 0x1000247a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.10051290
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100024bf
push ebx
call fcn.10050907
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0xff
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
nop
nop
cmp dword [ebp - 8], esp
je 0x100024f4
push 0x36
push 0x40350dc
push 6
call fcn.1005092b
add esp, 0xc
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10002507
mov eax, 0x100ff251
push eax
push 1
mov ebx, 0x170
call fcn.100512d0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x10002525
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10002536
push ebx
call fcn.10050907
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x10006ef9
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jge 0x10006f1b
mov eax, 0xfffffffd
jmp 0x10006ffb
mov ebx, dword [0x10100b01]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x10006fc9
mov ebx, dword [0x10100b01]
add ebx, 4
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 6
jne 0x10006f6a
mov ebx, dword [0x10100b01]
add ebx, 8
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
cmp dword [ebx], 2
jne 0x10006f6a
mov eax, 1
jmp 0x10006f6f
mov eax, 0
test eax, eax
je 0x10006f9b
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x10006f84
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
mov ebx, dword [0x10100b01]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x10006ff1
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x10006ffb
mov esp, ebp
pop ebp
ret 4

Function at 0x1000726a
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x1000731d
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]

Function at 0x10007388
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x1000743b
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]
Function at 0x100079a6
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.10051290
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100079eb
push ebx
call fcn.10050907
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x100ff251
mov ebx, dword [ebp + 8]
push dword [ebx]
call fcn.1000660e
add esp, 8
cmp eax, 0
jne 0x10007a66
call fcn.10007aea
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [0x10100b11]
test ebx, ebx
je 0x10007a29
push ebx
call fcn.10050907
add esp, 4
pop eax
mov dword [0x10100b11], eax
mov eax, dword [0x10100b11]
test eax, eax
je 0x10007a4d
push eax
mov ebx, eax
call fcn.10002fe8
inc eax
push eax
call fcn.1005090d
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
test ebx, ebx
je 0x10007a60
push ebx
call fcn.10050907
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0
mov ebx, dword [ebp + 0x10]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
nop
nop
cmp dword [ebp - 8], esp
je 0x10007aa1
push 0x202
push 0x4035e1e
push 6
call fcn.1005092b
add esp, 0xc
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10007ab4
mov eax, 0x100ff251
push eax
push 1
mov ebx, 0x170
call fcn.100512d0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x10007ad2
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10007ae3
push ebx
call fcn.10050907
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x10007aea
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.10051290
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10007b2f
push ebx
call fcn.10050907
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0xff
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
nop
nop
cmp dword [ebp - 8], esp
je 0x10007b64
push 0x36
push 0x4035e34
push 6
call fcn.1005092b
add esp, 0xc
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10007b77
mov eax, 0x100ff251
push eax
push 1
mov ebx, 0x170
call fcn.100512d0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x10007b95
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10007ba6
push ebx
call fcn.10050907
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x10007bab
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.10051290
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10007bf0
push ebx
call fcn.10050907
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0xff
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
nop
nop
cmp dword [ebp - 8], esp
je 0x10007c25
push 0x36
push 0x4035e1f
push 6
call fcn.1005092b
add esp, 0xc
mov eax, dword [ebp - 4]
test eax, eax
je 0x10007c41
push eax
mov ebx, eax
call fcn.10002fe8
inc eax
push eax
call fcn.1005090d
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x10007c46
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10007c57
push ebx
call fcn.10050907
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x10007fbf
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.10007388
test eax, eax
je 0x10008002
xor eax, eax
xchg dword [ebp + 8], eax
cmp eax, 0xffff
jle 0x10008002
cmp word [eax], 0x5a4d
jne 0x10008002
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x10008002
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.1000745a
mov eax, dword [ebp + 8]
jmp 0x1000801b
mov esp, ebp
pop ebp
ret 4
Function at 0x1000bd47
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x1000bd7f
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x1000bd6d
mov al, 1
jmp 0x1000bdde
cmp dword [ebx + 0x54], ecx
jne 0x1000bd76
mov al, 2
jmp 0x1000bdde
cmp dword [ebx + 0x7c], ecx
jne 0x1000bdde
mov al, 3
jmp 0x1000bdde
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x1000bd94
mov al, 4
jmp 0x1000bdde
cmp ecx, 5
jne 0x1000bdb4
cmp ebx, 0
jne 0x1000bda2
mov al, 5
jmp 0x1000bdde
cmp ebx, 1
jne 0x1000bdab
mov al, 6
jmp 0x1000bdde
cmp ebx, 2
jne 0x1000bdb4
mov al, 7
jmp 0x1000bdde
cmp ecx, 6
jne 0x1000bddc
cmp ebx, 0
jne 0x1000bdc2
mov al, 8
jmp 0x1000bdde
cmp ebx, 1
jne 0x1000bdc9
mov al, 9
cmp ebx, 2
jne 0x1000bdd0
mov al, 0xa
cmp ebx, 3
jne 0x1000bdd7
mov al, 0xb
cmp ebx, 4
jne 0x1000bdde
mov al, 0xc
pop ebx
leave
ret

Function at 0x1000be0b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.10051290
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1000be50
push ebx
call fcn.10050907
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0xff
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
nop
nop
cmp dword [ebp - 8], esp
je 0x1000be85
push 0x36
push 0x4035992
push 6
call fcn.1005092b
add esp, 0xc
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x1000be98
mov eax, 0x100ff251
push eax
push 1
mov ebx, 0x170
call fcn.100512d0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x1000beb6
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1000bec7
push ebx
call fcn.10050907
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x1001037e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.10051290
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100103c3
push ebx
call fcn.10050907
add esp, 4
pop eax
mov dword [ebp - 4], eax
push 0x100ff251
mov ebx, dword [ebp + 8]
push dword [ebx]
call fcn.1000660e
add esp, 8
cmp eax, 0
jne 0x1001043e
call fcn.1000be0b
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [0x10100b29]
test ebx, ebx
je 0x10010401
push ebx
call fcn.10050907
add esp, 4
pop eax
mov dword [0x10100b29], eax
mov eax, dword [0x10100b29]
test eax, eax
je 0x10010425
push eax
mov ebx, eax
call fcn.10002fe8
inc eax
push eax
call fcn.1005090d
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
test ebx, ebx
je 0x10010438
push ebx
call fcn.10050907
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0
mov ebx, dword [ebp + 0x10]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
nop
nop
cmp dword [ebp - 8], esp
je 0x10010479
push 0x202
push 0x403597c
push 6
call fcn.1005092b
add esp, 0xc
push VariantClear
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x1001048c
mov eax, 0x100ff251
push eax
push 1
mov ebx, 0x170
call fcn.100512d0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
jmp 0x100104aa
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x100104bb
push ebx
call fcn.10050907
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 0x10

Function at 0x100104c2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0x100
push 1
mov ebx, 0x184
call fcn.10051290
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10010507
push ebx
call fcn.10050907
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push 0xff
push dword [ebp - 4]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
nop
nop
cmp dword [ebp - 8], esp
je 0x1001053c
push 0x36
push 0x403597d
push 6
call fcn.1005092b
add esp, 0xc
mov eax, dword [ebp - 4]
test eax, eax
je 0x10010558
push eax
mov ebx, eax
call fcn.10002fe8
inc eax
push eax
call fcn.1005090d
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x1001055d
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x1001056e
push ebx
call fcn.10050907
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x100108d6
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.10010938
test eax, eax
je 0x10010919
xor eax, eax
xchg dword [ebp + 8], eax
cmp eax, 0xffff
jle 0x10010919
cmp word [eax], 0x5a4d
jne 0x10010919
add eax, dword [eax + 0x3c]
cmp dword [eax], 0x4550
jne 0x10010919
mov dword [ebp + 8], eax
mov dword [ebp - 4], 0
push 0
push dword [ebp - 4]
call fcn.10010a0a
mov eax, dword [ebp + 8]
jmp 0x10010932
mov esp, ebp
pop ebp
ret 4

Function at 0x10010938
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov dword [ebp + 8], 0x100109eb
mov eax, dword [ebp + 8]
leave
sub esp, 0x60
pushfd
pushal
push dword [esp + 0x84]
push 0
push eax
fnsave dword [esp + 0x30]
wait
push dword fs:[0]
mov dword fs:[0], esp
mov eax, 1
jmp dword [esp + 0xc]

Function at 0x10010bfa
Capabilities:
Execute syscall

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 8], 0
jge 0x10010c1c
mov eax, 0xfffffffd
jmp 0x10010cfc
mov ebx, dword [0x10100b25]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
je 0x10010cca
mov ebx, dword [0x10100b25]
add ebx, 4
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 6
jne 0x10010c6b
mov ebx, dword [0x10100b25]
add ebx, 8
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 0xc]
cmp dword [ebx], 2
jne 0x10010c6b
mov eax, 1
jmp 0x10010c70
mov eax, 0
test eax, eax
je 0x10010c9c
mov eax, dword [ebp]
add eax, 0x80
mov ecx, 0x20
push dword [eax]
sub eax, 4
loop 0x10010c85
mov eax, dword [ebp + 8]
call dword fs:[0xc0]
nop
nop
leave
ret 4
mov eax, dword [ebp + 8]
mov ecx, eax
and eax, 0xffff
shr ecx, 0x10
and ecx, 0xffff
mov edx, dword [ebp]
lea edx, [edx + 8]
call dword fs:[0xc0]
nop
nop
nop
nop
nop
leave
ret 4
mov ebx, dword [0x10100b25]
add ebx, 0x1c
mov dword [ebp - 4], ebx
mov ebx, dword [ebp - 4]
cmp dword [ebx], 0
jne 0x10010cf2
mov eax, dword [ebp + 8]
mov edx, dword [ebp]
lea edx, [edx + 8]
int 0x2e
nop
leave
ret 4
mov eax, 0
jmp 0x10010cfc
mov esp, ebp
pop ebp
ret 4

Function at 0x100149ae
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ebx, dword [0x10100b51]
push ebx
call fcn.10050907
add esp, 4
mov eax, 0x100ff252
mov dword [0x10100b51], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
call fcn.10050907
add esp, 4
mov eax, 0x100ff252
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov dword [ebp - 4], esp
push 0
push 0x10014b09
xor eax, eax
call dword [sym.imp.USER32.dll_EnumWindows]
nop
nop
cmp dword [ebp - 4], esp
je 0x10014a1b
push 0x34
push 0x403599d
push 6
call fcn.1005092b
add esp, 0xc
mov eax, dword [0x10100b51]
push eax
push eax
mov ebx, eax
call fcn.10001371
pop eax
sub ebx, eax
shl ecx, 2
add ecx, ebx
push ecx
call fcn.1005090d
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
call fcn.10050907
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov ebx, dword [0x10100b51]
call fcn.10001d8c
jmp 0x10014a62
mov esp, ebp
pop ebp
ret 8
Function at 0x10014c25
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
lea eax, [ebp + 8]
push eax
push 0x10014d3b
xor eax, eax
call dword [sym.imp.USER32.dll_EnumWindows]
nop
nop
cmp dword [ebp - 4], esp
je 0x10014c60
push 0
push 0x403599f
push 6
call fcn.1005092b
add esp, 0xc
mov eax, dword [ebp + 8]
jmp 0x10014c68
mov esp, ebp
pop ebp
ret 4
Function at 0x10015a03
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
push ebx
xor eax, eax
mov ebx, dword fs:[0x18]
mov ecx, dword fs:[0x30]
test ecx, ecx
jns 0x10015a3b
mov ecx, 0x530000
cmp dword [ebx + 0x58], ecx
jne 0x10015a29
mov al, 1
jmp 0x10015a9a
cmp dword [ebx + 0x54], ecx
jne 0x10015a32
mov al, 2
jmp 0x10015a9a
cmp dword [ebx + 0x7c], ecx
jne 0x10015a9a
mov al, 3
jmp 0x10015a9a
mov ebx, dword [ecx + 0xa8]
mov ecx, dword [ecx + 0xa4]
cmp ecx, 4
ja 0x10015a50
mov al, 4
jmp 0x10015a9a
cmp ecx, 5
jne 0x10015a70
cmp ebx, 0
jne 0x10015a5e
mov al, 5
jmp 0x10015a9a
cmp ebx, 1
jne 0x10015a67
mov al, 6
jmp 0x10015a9a
cmp ebx, 2
jne 0x10015a70
mov al, 7
jmp 0x10015a9a
cmp ecx, 6
jne 0x10015a98
cmp ebx, 0
jne 0x10015a7e
mov al, 8
jmp 0x10015a9a
cmp ebx, 1
jne 0x10015a85
mov al, 9
cmp ebx, 2
jne 0x10015a8c
mov al, 0xa
cmp ebx, 3
jne 0x10015a93
mov al, 0xb
cmp ebx, 4
jne 0x10015a9a
mov al, 0xc
pop ebx
leave
ret

Function at 0x10017267
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov ebx, dword [0x10100b65]
push ebx
call fcn.10050907
add esp, 4
mov eax, 0x100ff252
mov dword [0x10100b65], eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
call fcn.10050907
add esp, 4
mov eax, 0x100ff252
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov dword [ebp - 4], esp
push 0
push 0x100173c2
xor eax, eax
call dword [sym.imp.USER32.dll_EnumWindows]
nop
nop
cmp dword [ebp - 4], esp
je 0x100172d4
push 0x34
push 0x4035e3f
push 6
call fcn.1005092b
add esp, 0xc
mov eax, dword [0x10100b65]
push eax
push eax
mov ebx, eax
call fcn.10001371
pop eax
sub ebx, eax
shl ecx, 2
add ecx, ebx
push ecx
call fcn.1005090d
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [ebp + 8]
mov ebx, dword [ebx]
push ebx
call fcn.10050907
add esp, 4
pop eax
mov ebx, dword [ebp + 8]
mov dword [ebx], eax
mov ebx, dword [0x10100b65]
call fcn.10001d8c
jmp 0x1001731b
mov esp, ebp
pop ebp
ret 8

Function at 0x100174de
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 4
mov dword [ebp - 4], esp
lea eax, [ebp + 8]
push eax
push 0x100175f4
xor eax, eax
call dword [sym.imp.USER32.dll_EnumWindows]
nop
nop
cmp dword [ebp - 4], esp
je 0x10017519
push 0
push 0x4035e41
push 6
call fcn.1005092b
add esp, 0xc
mov eax, dword [ebp + 8]
jmp 0x10017521
mov esp, ebp
pop ebp
ret 4

Function at 0x10022c93
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push dword [ebp + 8]
xor eax, eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
nop
nop
cmp dword [ebp - 4], esp
je 0x10022cc8
push 0x25
push 0x4035ddf
push 6
call fcn.1005092b
add esp, 0xc
jmp 0x10022ccd
mov esp, ebp
pop ebp
ret 4