joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008770
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x9c
mov eax, dword [0x100d7294]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x9c], 0
lea eax, [ebp - 0x98]
push eax
mov ecx, dword [ebp + 8]
push ecx
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x94], eax
cmp dword [ebp - 0x94], 0
jne 0x100087b7
mov eax, dword [ebp - 0x9c]
jmp 0x10008975
mov edx, dword [ebp - 0x94]
push edx
call fcn.10069b06
add esp, 4
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 0x8c]
push eax
mov ecx, dword [ebp - 0x94]
push ecx
push 0
mov edx, dword [ebp + 8]
push edx
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
je 0x10008960
lea eax, [ebp - 0x98]
push eax
lea ecx, [ebp - 0x90]
push ecx
push 0x10098584
mov edx, dword [ebp - 0x8c]
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10008960
cmp dword [ebp + 0xc], 0
je 0x100088b5
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 0x90]
mov eax, dword [edx + ecx]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
push ecx
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp - 0x90]
mov edx, dword [ecx + eax]
and edx, 0xffff
movzx eax, dx
push eax
push str.StringFileInfo_04x_04xFileDescription
push 0x80
lea ecx, [ebp - 0x84]
push ecx
call fcn.1000ac50
add esp, 0x14
lea edx, [ebp - 0x98]
push edx
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x84]
push ecx
mov edx, dword [ebp - 0x8c]
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x100088b5
mov eax, dword [ebp - 0x88]
push eax
mov ecx, dword [ebp - 0x88]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
push eax
mov edx, dword [ebp + 0xc]
push edx
call fcn.1000ad10
cmp dword [ebp + 0x10], 0
je 0x10008956
mov eax, 4
imul ecx, eax, 0
mov edx, dword [ebp - 0x90]
mov eax, dword [edx + ecx]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
push ecx
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp - 0x90]
mov edx, dword [ecx + eax]
and edx, 0xffff
movzx eax, dx
push eax
push str.StringFileInfo_04x_04xCompanyName
push 0x80
lea ecx, [ebp - 0x84]
push ecx
call fcn.1000ac50
add esp, 0x14
lea edx, [ebp - 0x98]
push edx
lea eax, [ebp - 0x88]
push eax
lea ecx, [ebp - 0x84]
push ecx
mov edx, dword [ebp - 0x8c]
push edx
call sub.VERSION.dll_VerQueryValueW
test eax, eax
je 0x10008956
mov eax, dword [ebp - 0x88]
push eax
mov ecx, dword [ebp - 0x88]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
push eax
mov edx, dword [ebp + 0x10]
push edx
call fcn.1000ad10
mov dword [ebp - 0x9c], 1
mov eax, dword [ebp - 0x8c]
push eax
call fcn.10069b01
add esp, 4
mov eax, dword [ebp - 0x9c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005fbb2
mov esp, ebp
pop ebp
ret
Function at 0x10008e70
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x100d7294]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x23c], 0xffffffff
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x234], eax
cmp dword [ebp - 0x234], 0xffffffff
je 0x10008f2c
push 0x22c
push 0
lea eax, [ebp - 0x230]
push eax
call fcn.100672b0
add esp, 0xc
mov dword [ebp - 0x230], 0x22c
lea ecx, [ebp - 0x230]
push ecx
mov edx, dword [ebp - 0x234]
push edx
call sub.KERNEL32.dll_Process32FirstW
mov dword [ebp - 0x238], eax
cmp dword [ebp - 0x238], 0
je 0x10008f1f
mov eax, dword [ebp - 0x228]
cmp eax, dword [ebp + 8]
jne 0x10008f04
mov ecx, dword [ebp - 0x218]
mov dword [ebp - 0x23c], ecx
jmp 0x10008f1f
lea edx, [ebp - 0x230]
push edx
mov eax, dword [ebp - 0x234]
push eax
call sub.KERNEL32.dll_Process32NextW
mov dword [ebp - 0x238], eax
jmp 0x10008ee2
mov ecx, dword [ebp - 0x234]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x23c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005fbb2
mov esp, ebp
pop ebp
ret
Function at 0x100093f0
Capabilities:
Get process image filename

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1010
call fcn.1005fc10
mov eax, dword [0x100d7294]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0xc], 0
je 0x10009413
cmp dword [ebp + 0x10], 0x64
jae 0x1000941a
xor eax, eax
jmp 0x10009596
mov eax, dword [ebp + 8]
push eax
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1008], eax
cmp dword [ebp - 0x1008], 0
jne 0x10009461
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0x1010
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x1008], eax
cmp dword [ebp - 0x1008], 0
jne 0x10009461
xor eax, eax
jmp 0x10009596
mov dword [ebp - 0x1010], 0x400
push 0x800
push 0
lea edx, [ebp - 0x804]
push edx
call fcn.100672b0
add esp, 0xc
push 0x800
push 0
lea eax, [ebp - 0x804]
push eax
call fcn.100672b0
add esp, 0xc
mov dword [ebp - 0x100c], 0
push 0x400
lea ecx, [ebp - 0x804]
push ecx
push 0
mov edx, dword [ebp - 0x1008]
push edx
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x1000954a
push 0x800
push 0
lea eax, [ebp - 0x1004]
push eax
call fcn.100672b0
add esp, 0xc
push 0x800
push 0
lea ecx, [ebp - 0x1004]
push ecx
call fcn.100672b0
add esp, 0xc
push 0x400
lea edx, [ebp - 0x1004]
push edx
lea eax, [ebp - 0x804]
push eax
call fcn.10007de0
add esp, 0xc
test eax, eax
je 0x10009527
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x1004]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.10069734
add esp, 0xc
jmp 0x1000953e
mov ecx, dword [ebp + 0x10]
push ecx
lea edx, [ebp - 0x804]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.10069734
add esp, 0xc
mov dword [ebp - 0x100c], 1
jmp 0x10009583
push 0x400
lea ecx, [ebp - 0x804]
push ecx
mov edx, dword [ebp - 0x1008]
push edx
call sub.PSAPI.DLL_GetProcessImageFileNameW
test eax, eax
je 0x10009583
mov eax, dword [ebp + 0x10]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
lea edx, [ebp - 0x804]
push edx
call fcn.10008110
add esp, 0xc
mov dword [ebp - 0x100c], eax
mov eax, dword [ebp - 0x1008]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x100c]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005fbb2
mov esp, ebp
pop ebp
ret
Function at 0x10009b60
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
jne 0x10009bb4
push 0
mov ecx, dword [ebp + 8]
call fcn.100054d0
mov ecx, dword [ebp - 4]
or ecx, 1
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
jmp 0x10009d25
lea edx, [ebp - 0x2c]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0xffffffff
je 0x10009bda
cmp dword [ebp - 0x2c], 0
ja 0x10009bda
cmp dword [ebp - 0x30], 0x12c00000
jbe 0x10009bf5
push 0
mov ecx, dword [ebp + 8]
call fcn.100054d0
mov ecx, dword [ebp - 4]
or ecx, 1
mov dword [ebp - 4], ecx
mov eax, dword [ebp + 8]
jmp 0x10009d25
mov edx, dword [ebp - 0x30]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.1005f646
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10009c33
mov edx, dword [ebp - 0x14]
push edx
push 0
mov eax, dword [ebp - 0xc]
push eax
call fcn.100672b0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword [ebp - 0x18], ecx
jmp 0x10009c3a
mov dword [ebp - 0x18], 0
mov edx, dword [ebp - 0x18]
push edx
lea ecx, [ebp - 0x28]
call fcn.100029e0
lea ecx, [ebp - 0x28]
call fcn.10007030
movzx eax, al
test eax, eax
jne 0x10009c78
push 0
mov ecx, dword [ebp + 8]
call fcn.100054d0
mov ecx, dword [ebp - 4]
or ecx, 1
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x28]
call fcn.100064b0
mov eax, dword [ebp + 8]
jmp 0x10009d25
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x20], 0
push 0
push 0
push 0
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
cmp eax, 0xffffffff
je 0x10009cbb
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x28]
call fcn.10006fc0
push eax
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x1c], 0
je 0x10009cfd
cmp dword [ebp + 0x10], 0
je 0x10009cd9
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp - 0x20]
mov dword [ecx], edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp + 8]
call fcn.10005470
mov ecx, dword [ebp - 4]
or ecx, 1
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x28]
call fcn.100064b0
mov eax, dword [ebp + 8]
jmp 0x10009d25
push 0
mov ecx, dword [ebp + 8]
call fcn.100054d0
mov edx, dword [ebp - 4]
or edx, 1
mov dword [ebp - 4], edx
lea ecx, [ebp - 0x28]
call fcn.100064b0
mov eax, dword [ebp + 8]
jmp 0x10009d25
mov esp, ebp
pop ebp
ret
Function at 0x1000b4e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x1000b504
xor eax, eax
jmp 0x1000b584
mov edx, dword [ebp - 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000b51b
xor eax, eax
jmp 0x1000b584
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0x14], eax
mov edx, dword [ebp - 4]
add edx, dword [ebp - 0x14]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jbe 0x1000b567
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jae 0x1000b567
mov edx, dword [ebp - 4]
movzx eax, word [edx]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 + 2]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 8]
sub eax, 1
mov dword [ebp - 8], eax
jmp 0x1000b53e
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x10]
jb 0x1000b573
xor eax, eax
jmp 0x1000b584
mov edx, dword [ebp - 4]
movzx eax, word [edx]
test eax, eax
jne 0x1000b581
xor eax, eax
jmp 0x1000b584
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x10021b10
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100933c8
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x100d7294]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp + 8]
call fcn.10006fc0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10021b52
xor eax, eax
jmp 0x10021ce1
mov ecx, dword [ebp + 8]
call fcn.10006fc0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push eax
lea ecx, [ebp - 0x14]
call fcn.10004a20
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x14]
call fcn.10008d90
cmp eax, 1
jge 0x10021b9c
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.10006090
mov eax, dword [ebp - 0x20]
jmp 0x10021ce1
push 0
lea ecx, [ebp - 0x14]
call fcn.10019160
movzx eax, ax
push eax
call fcn.1006d81a
add esp, 4
mov word [ebp - 0x10], ax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x1c]
push edx
mov ecx, dword [ebp + 0xc]
add ecx, 0xc
call fcn.1001f380
lea eax, [ebp - 0x3c]
push eax
mov ecx, dword [ebp + 0xc]
add ecx, 0xc
call fcn.1001eb30
push eax
lea ecx, [ebp - 0x1c]
call fcn.10019120
movzx ecx, al
test ecx, ecx
je 0x10021cad
lea ecx, [ebp - 0x1c]
call fcn.10019240
add eax, 4
mov dword [ebp - 0x18], eax
lea edx, [ebp + 0xc]
push edx
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x24]
push edx
lea ecx, [ebp - 0x58]
call fcn.100204e0
sub esp, 0x10
mov ecx, esp
mov edx, dword [eax]
mov dword [ecx], edx
mov edx, dword [eax + 4]
mov dword [ecx + 4], edx
mov edx, dword [eax + 8]
mov dword [ecx + 8], edx
mov eax, dword [eax + 0xc]
mov dword [ecx + 0xc], eax
lea ecx, [ebp - 0x40]
push ecx
mov ecx, dword [ebp - 0x18]
call fcn.1001eba0
mov edx, dword [eax]
push edx
lea eax, [ebp - 0x44]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.1001e440
mov ecx, dword [eax]
push ecx
lea edx, [ebp - 0x28]
push edx
call fcn.100203f0
add esp, 0x1c
lea eax, [ebp - 0x48]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.1001eba0
push eax
lea ecx, [ebp - 0x28]
call fcn.10019120
movzx ecx, al
test ecx, ecx
je 0x10021c90
mov dword [ebp - 0x2c], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.10006090
mov eax, dword [ebp - 0x2c]
jmp 0x10021ce1
mov dword [ebp - 0x30], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.10006090
mov eax, dword [ebp - 0x30]
jmp 0x10021ce1
mov dword [ebp - 0x34], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.10006090
mov eax, dword [ebp - 0x34]
jmp 0x10021ce1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x10021d00
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100933fb
mov eax, dword fs:[0]
push eax
sub esp, 0x448
mov eax, dword [0x100d7294]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x454], ecx
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x448], eax
cmp dword [ebp - 0x448], 0xffffffff
jne 0x10021d50
xor eax, eax
jmp 0x10021e46
mov dword [ebp - 0x44c], 0
push 0x22c
push 0
lea eax, [ebp - 0x444]
push eax
call fcn.100672b0
add esp, 0xc
mov dword [ebp - 0x444], 0x22c
lea ecx, [ebp - 0x444]
push ecx
mov edx, dword [ebp - 0x448]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x10021e33
push 0x208
push 0
lea eax, [ebp - 0x218]
push eax
call fcn.100672b0
add esp, 0xc
push 0x104
lea ecx, [ebp - 0x218]
push ecx
mov edx, dword [ebp - 0x43c]
push edx
call fcn.100093f0
add esp, 0xc
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x450]
call fcn.10004a20
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 8]
push ecx
lea edx, [ebp - 0x450]
push edx
mov ecx, dword [ebp - 0x454]
call fcn.10021b10
mov dword [ebp - 0x44c], eax
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x450]
call fcn.10006090
cmp dword [ebp - 0x44c], 0
je 0x10021e18
jmp 0x10021e33
lea eax, [ebp - 0x444]
push eax
mov ecx, dword [ebp - 0x448]
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10021d95
mov edx, dword [ebp - 0x448]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x44c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005fbb2
mov esp, ebp
pop ebp
ret 4
Function at 0x100242e0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x654
mov eax, dword [0x100d7294]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x654], ecx
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov dword [ebp - 0x634], eax
cmp dword [ebp - 0x634], 0
jne 0x10024315
xor eax, eax
jmp 0x1002456a
push 0x200
push 0
lea eax, [ebp - 0x204]
push eax
call fcn.100672b0
add esp, 0xc
push 0x100
lea ecx, [ebp - 0x204]
push ecx
mov edx, dword [ebp - 0x634]
push edx
call dword [sym.imp.USER32.dll_GetClassNameW]
mov dword [ebp - 0x644], 0
lea eax, [ebp - 0x644]
push eax
push str.PP_dFrameClass
lea ecx, [ebp - 0x204]
push ecx
call fcn.10027d90
add esp, 0xc
cmp eax, 1
jne 0x10024378
mov eax, 1
jmp 0x1002456a
mov dword [ebp - 0x628], 0
jmp 0x10024393
mov edx, dword [ebp - 0x628]
add edx, 1
mov dword [ebp - 0x628], edx
cmp dword [ebp - 0x628], 3
jae 0x10024454
mov eax, dword [ebp - 0x628]
mov ecx, dword [eax*4 + 0x100d606c]
mov dword [ebp - 0x630], ecx
lea edx, [ebp - 0x204]
mov dword [ebp - 0x62c], edx
mov eax, dword [ebp - 0x62c]
mov cx, word [eax]
mov word [ebp - 0x636], cx
mov edx, dword [ebp - 0x630]
cmp cx, word [edx]
jne 0x10024425
cmp word [ebp - 0x636], 0
je 0x10024419
mov eax, dword [ebp - 0x62c]
mov cx, word [eax + 2]
mov word [ebp - 0x638], cx
mov edx, dword [ebp - 0x630]
cmp cx, word [edx + 2]
jne 0x10024425
add dword [ebp - 0x62c], 4
add dword [ebp - 0x630], 4
cmp word [ebp - 0x638], 0
jne 0x100243bf
mov dword [ebp - 0x63c], 0
jmp 0x10024430
sbb eax, eax
or eax, 1
mov dword [ebp - 0x63c], eax
mov ecx, dword [ebp - 0x63c]
mov dword [ebp - 0x648], ecx
cmp dword [ebp - 0x648], 0
jne 0x1002444f
mov eax, 1
jmp 0x1002456a
jmp 0x10024384
push 0x200
push 0
lea edx, [ebp - 0x404]
push edx
call fcn.100672b0
add esp, 0xc
push 0xff
lea eax, [ebp - 0x404]
push eax
mov ecx, dword [ebp - 0x634]
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push str.Microsoft_PowerPoint
lea edx, [ebp - 0x404]
push edx
call fcn.1000ae50
add esp, 8
test eax, eax
je 0x100244a5
mov eax, 1
jmp 0x1002456a
mov dword [ebp - 0x640], 0
lea eax, [ebp - 0x640]
push eax
mov ecx, dword [ebp - 0x634]
push ecx
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0x208
push 0
lea edx, [ebp - 0x60c]
push edx
call fcn.100672b0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x60c]
push eax
mov ecx, dword [ebp - 0x640]
push ecx
call fcn.10008f40
add esp, 0xc
lea edx, [ebp - 0x60c]
push edx
lea ecx, [ebp - 0x624]
call fcn.10005180
lea ecx, [ebp - 0x624]
call fcn.100104e0
test eax, eax
jbe 0x1002454f
push str.wpp.exe
lea ecx, [ebp - 0x624]
call fcn.1000e0d0
push eax
call fcn.10069777
add esp, 8
test eax, eax
jne 0x1002454f
mov dword [ebp - 0x64c], 1
lea ecx, [ebp - 0x624]
call fcn.10006330
mov eax, dword [ebp - 0x64c]
jmp 0x1002456a
mov dword [ebp - 0x650], 0
lea ecx, [ebp - 0x624]
call fcn.10006330
mov eax, dword [ebp - 0x650]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1005fbb2
mov esp, ebp
pop ebp
ret
Function at 0x10026850
Capabilities:
Check if file exists
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10093966
mov eax, dword fs:[0]
push eax
sub esp, 0x67c
mov eax, dword [0x100d7294]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x684], ecx
mov dword [ebp - 0x680], 0
push 0x208
push 0
lea eax, [ebp - 0x420]
push eax
call fcn.100672b0
add esp, 0xc
mov dword [ebp - 0x688], 0
push 0x208
push 0
lea ecx, [ebp - 0x218]
push ecx
call fcn.100672b0
add esp, 0xc
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x218]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
lea edx, [ebp - 0x218]
push edx
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x10026a70
lea ecx, [ebp - 0x674]
call fcn.10004960
mov dword [ebp - 4], 0
push 0x100a195c
lea eax, [ebp - 0x218]
push eax
push 0x104
lea ecx, [ebp - 0x674]
call fcn.10008680
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x674]
call fcn.1001c160
lea ecx, [ebp - 0x670]
push ecx
lea ecx, [ebp - 0x674]
call fcn.10006fc0
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x67c], eax
cmp dword [ebp - 0x67c], 0xffffffff
je 0x10026a5e
mov edx, dword [ebp - 0x670]
and edx, 0x10
je 0x10026a35
mov eax, 2
imul ecx, eax, 0
movzx edx, word [ebp + ecx - 0x644]
cmp edx, 0x2e
jne 0x100269bd
mov eax, 2
shl eax, 0
movzx ecx, word [ebp + eax - 0x644]
test ecx, ecx
je 0x10026a35
mov edx, 2
shl edx, 0
movzx eax, word [ebp + edx - 0x644]
cmp eax, 0x2e
jne 0x100269bd
mov ecx, 2
shl ecx, 1
movzx edx, word [ebp + ecx - 0x644]
test edx, edx
je 0x10026a35
lea eax, [ebp - 0x644]
push eax
lea ecx, [ebp - 0x678]
call fcn.10004a20
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x678]
push ecx
lea edx, [ebp - 0x218]
push edx
push str._s_smanifest.json
lea eax, [ebp - 0x674]
push eax
call fcn.10024580
add esp, 0x10
lea ecx, [ebp - 0x674]
call fcn.10006fc0
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10026a26
mov dword [ebp - 0x680], 1
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x678]
call fcn.10006090
jmp 0x10026a51
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x678]
call fcn.10006090
lea ecx, [ebp - 0x670]
push ecx
mov edx, dword [ebp - 0x67c]
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10026959
mov eax, dword [ebp - 0x67c]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x674]
call fcn.10006090
mov eax, dword [ebp - 0x680]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005fbb2
mov esp, ebp
pop ebp
ret 8
Function at 0x100270b0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10093a0b
mov eax, dword fs:[0]
push eax
sub esp, 0x320
mov eax, dword [0x100d7294]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x294], ecx
mov byte [ebp - 0x26d], 0
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x278], eax
cmp dword [ebp - 0x278], 0xffffffff
jne 0x10027107
xor eax, eax
jmp 0x1002730f
push 0x22c
push 0
lea eax, [ebp - 0x26c]
push eax
call fcn.100672b0
add esp, 0xc
mov dword [ebp - 0x26c], 0x22c
lea ecx, [ebp - 0x26c]
push ecx
mov edx, dword [ebp - 0x278]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x100272fb
mov dword [ebp - 0x274], 0
jmp 0x1002715d
mov eax, dword [ebp - 0x274]
add eax, 1
mov dword [ebp - 0x274], eax
cmp dword [ebp - 0x274], 0x1b
jae 0x100272d3
mov ecx, dword [ebp - 0x274]
mov edx, dword [ecx*4 + section..data]
push edx
lea eax, [ebp - 0x248]
push eax
call fcn.10069777
add esp, 8
test eax, eax
jne 0x100272ce
mov byte [ebp - 0x26d], 1
call fcn.10052b20
mov dword [ebp - 0x27c], eax
push 1
mov ecx, dword [ebp - 0x27c]
mov edx, dword [ecx]
mov ecx, dword [ebp - 0x27c]
mov eax, dword [edx + 8]
call eax
mov byte [ebp - 0x284], al
cmp byte [ebp - 0x284], 1
je 0x100271ca
jmp 0x100272cc
mov dword [ebp - 0x288], 0xb0
push 0x100a1128
lea ecx, [ebp - 0x40]
call fcn.10004fd0
mov dword [ebp - 4], 0
push 0x100a1124
lea ecx, [ebp - 0x28]
call fcn.10004fd0
mov byte [ebp - 4], 1
call fcn.10052b20
mov dword [ebp - 0x280], eax
push 0x100a11e8
lea ecx, [ebp - 0x288]
push ecx
push 0x100a119c
push 0x100a11a0
push 0x100a1198
lea edx, [ebp - 0x248]
push edx
push 0x100a1194
push 0xaf
lea eax, [ebp - 0x40]
push eax
lea ecx, [ebp - 0x28]
push ecx
lea ecx, [ebp - 0x32c]
call fcn.10005660
mov dword [ebp - 0x28c], eax
mov edx, dword [ebp - 0x28c]
mov dword [ebp - 0x290], edx
mov byte [ebp - 4], 2
mov ecx, dword [ebp - 0x290]
call fcn.10002ad0
mov ecx, eax
call fcn.100117d0
mov ecx, eax
call fcn.10002ad0
mov ecx, eax
call fcn.100117d0
mov ecx, eax
call fcn.10002ad0
mov ecx, eax
call fcn.10022e30
mov ecx, eax
call fcn.10002ad0
push eax
mov eax, dword [ebp - 0x280]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x280]
mov eax, dword [edx + 0x1c]
call eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x32c]
call fcn.100065c0
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.100062e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x40]
call fcn.100062e0
jmp 0x100272d3
jmp 0x1002714e
movzx ecx, byte [ebp - 0x26d]
test ecx, ecx
je 0x100272e0
jmp 0x100272fb
lea edx, [ebp - 0x26c]
push edx
mov eax, dword [ebp - 0x278]
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x10027142
mov ecx, dword [ebp - 0x278]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [ebp - 0x26d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1005fbb2
mov esp, ebp
pop ebp
ret