joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40826e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi + 8]
test bl, 3
jne 0x40829c
mov eax, dword fs:[0x18]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 8]
cmp ebx, ecx
mov dword [ebp - 4], ecx
jb 0x4082a3
cmp ebx, dword [eax + 4]
jae 0x4082a3
xor eax, eax
jmp 0x408493
push edi
mov edi, dword [esi + 0xc]
cmp edi, 0xffffffff
jne 0x4082b4
xor eax, eax
inc eax
jmp 0x408492
xor edx, edx
mov dword [ebp + 8], edx
mov eax, ebx
mov ecx, dword [eax]
cmp ecx, 0xffffffff
je 0x4082ca
cmp ecx, edx
jae 0x40840f
cmp dword [eax + 4], 0
je 0x4082d3
inc dword [ebp + 8]
inc edx
add eax, 0xc
cmp edx, edi
jbe 0x4082bb
cmp dword [ebp + 8], 0
je 0x4082f5
mov eax, dword [esi - 8]
cmp eax, dword [ebp - 4]
jb 0x40840f
cmp eax, esi
jae 0x40840f
mov eax, dword [0x46d5a0]
mov edi, ebx
and edi, 0xfffff000
xor esi, esi
test eax, eax
jle 0x40831a
cmp dword [esi*4 + 0x46d5a8], edi
je 0x408413
inc esi
cmp esi, eax
jl 0x408308
push 0x1c
lea eax, [ebp - 0x20]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x40848f
cmp dword [ebp - 8], 0x1000000
jne 0x40848f
test byte [ebp - 0xc], 0xcc
je 0x408398
mov ecx, dword [ebp - 0x1c]
cmp word [ecx], 0x5a4d
jne 0x40848f
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x40848f
cmp word [eax + 0x18], 0x10b
jne 0x40848f
sub ebx, ecx
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
lea ecx, [ecx + eax + 0x18]
jbe 0x40848f
mov eax, dword [ecx + 0xc]
cmp ebx, eax
jb 0x408398
mov edx, dword [ecx + 8]
add edx, eax
cmp ebx, edx
jae 0x408398
test byte [ecx + 0x27], 0x80
jne 0x40840f
push 1
push str.r_b4yB
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
test eax, eax
jne 0x4082ac
mov ecx, dword [0x46d5a0]
test ecx, ecx
mov edx, ecx
jle 0x4083cc
lea eax, [ecx*4 + 0x46d5a4]
cmp dword [eax], edi
je 0x4083cc
dec edx
sub eax, 4
test edx, edx
jg 0x4083c0
test edx, edx
jne 0x4083fd
push 0xf
pop ebx
cmp ecx, ebx
jg 0x4083d9
mov ebx, ecx
xor edx, edx
test ebx, ebx
jl 0x4083f1
lea eax, [edx*4 + 0x46d5a8]
mov esi, dword [eax]
inc edx
cmp edx, ebx
mov dword [eax], edi
mov edi, esi
jle 0x4083df
cmp ecx, 0x10
jge 0x4083fd
inc ecx
mov dword [0x46d5a0], ecx
push 0
push str.r_b4yB
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
jmp 0x4082ac
xor eax, eax
jmp 0x408492
test esi, esi
jle 0x4082ac
mov ebx, dword [sym.imp.KERNEL32.dll_InterlockedExchange]
push 1
push str.r_b4yB
call ebx
test eax, eax
jne 0x4082ac
cmp dword [esi*4 + 0x46d5a8], edi
je 0x408469
mov eax, dword [0x46d5a0]
lea esi, [eax - 1]
test esi, esi
jl 0x408457
cmp dword [esi*4 + 0x46d5a8], edi
je 0x408453
dec esi
jns 0x408447
test esi, esi
jge 0x408467
cmp eax, 0x10
jge 0x408462
inc eax
mov dword [0x46d5a0], eax
lea esi, [eax - 1]
jmp 0x408469
je 0x408481
xor ecx, ecx
test esi, esi
jl 0x408481
lea eax, [ecx*4 + 0x46d5a8]
mov edx, dword [eax]
inc ecx
cmp ecx, esi
mov dword [eax], edi
mov edi, edx
jle 0x40846f
push 0
push str.r_b4yB
call ebx
jmp 0x4082ac
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10005150
Capabilities:
Delete file
Get common file path
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x314
mov eax, dword [0x10136674]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
cmp dword [ebx], 0
jne 0x10005211
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.1007bae0
add esp, 0xc
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
test eax, eax
je 0x100051fb
push edi
push 0x104
lea edi, [ebx + 4]
push 0
push edi
call fcn.1007bae0
add esp, 0xc
lea eax, [ebp - 0x108]
push edi
push 0
push 0x100fd8e0
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push str..bat
push edi
call dword [sym.imp.SHLWAPI.dll_PathRenameExtensionA]
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0
push 0x80
push 4
push 0
push 7
push 0xc01200a0
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebx], eax
pop edi
cmp dword [ebx], 0
jne 0x10005211
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10069b58
mov esp, ebp
pop ebp
ret
push 0x208
lea eax, [ebp - 0x310]
push 0
push eax
call fcn.1007bae0
add esp, 0xc
mov dword [ebp - 0x314], 0
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
lea eax, [ebp - 0x310]
push 0x207
push eax
call fcn.100052e0
mov ecx, dword [eax]
push dword [eax + 4]
or ecx, 1
push ecx
call fcn.10096ac1
or ecx, 0xffffffff
add esp, 0x1c
test eax, eax
cmovs eax, ecx
test eax, eax
js 0x10005271
cmp eax, 0x207
ja 0x10005271
jne 0x10005278
mov byte [ebp - 0x109], 0
lea ecx, [ebp - 0x310]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10005281
push 0
lea eax, [ebp - 0x314]
sub ecx, edx
push eax
push ecx
lea eax, [ebp - 0x310]
push eax
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10069b58
mov esp, ebp
pop ebp
ret
Function at 0x100079c0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push esi
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x10007a19
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x10007a19
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp + 0x10]
lea edx, [esi + eax]
and ecx, 0xf
jbe 0x10007a0a
cmp esi, edx
jae 0x10007a19
movzx eax, word [esi]
lea esi, [esi + eax*2]
add esi, 2
sub ecx, 1
jne 0x100079f8
cmp esi, edx
jae 0x10007a19
cmp word [esi], 0
je 0x10007a19
mov eax, esi
pop esi
pop ebp
ret
xor eax, eax
pop esi
pop ebp
ret
Function at 0x10008360
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2024
call fcn.10069fc0
mov eax, dword [0x10136674]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
jne 0x10008390
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10069b58
mov esp, ebp
pop ebp
ret
push 0x2000
xorps xmm0, xmm0
mov dword [ebp - 0x200c], 0
lea eax, [ebp - 0x2004]
movq qword [ebp - 0x2014], xmm0
push 0
movups xmmword [ebp - 0x2024], xmm0
push eax
mov word [ebp - 0x2008], 0
mov dword [ebp - 0x2020], 3
call fcn.1007bae0
push 0x1000
lea eax, [ebp - 0x2004]
push esi
push eax
call fcn.10097da2
lea eax, [ebp - 0x2004]
add esp, 0x18
mov dword [ebp - 0x201c], eax
mov eax, 0x614
mov word [ebp - 0x2014], ax
lea eax, [ebp - 0x2024]
push eax
call dword [sym.imp.SHELL32.dll_SHFileOperationW]
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
pop esi
call fcn.10069b58
mov esp, ebp
pop ebp
ret
Function at 0x10008420
Capabilities:
Check if file exists
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x668
mov eax, dword [0x10136674]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x10008633
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10008633
mov ecx, esi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10008453
sub ecx, edx
sar ecx, 1
cmp ecx, 3
jbe 0x10008633
push ebx
push edi
push 0x208
lea eax, [ebp - 0x20c]
mov edi, 1
push 0
push eax
call fcn.1007bae0
push 0x208
lea eax, [ebp - 0x414]
push 0
push eax
call fcn.1007bae0
mov ebx, dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x414]
add esp, 0x18
push esi
push eax
call ebx
push 0x100fdc3c
lea eax, [ebp - 0x414]
push eax
call ebx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100084d4
test al, 1
je 0x100084d4
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x664]
push eax
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov dword [ebp - 0x668], eax
cmp eax, 0xffffffff
je 0x10008619
lea ecx, [ebp - 0x664]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
je 0x1000860d
nop dword [eax]
test byte [ebp - 0x664], 0x10
je 0x10008588
cmp word [ebp - 0x638], 0x2e
jne 0x10008547
mov ax, word [ebp - 0x636]
test ax, ax
je 0x100085f2
cmp ax, 0x2e
jne 0x10008547
cmp word [ebp - 0x634], 0
je 0x100085f2
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.1007bae0
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push eax
call ebx
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
call fcn.10008420
add esp, 4
jmp 0x100085f0
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.1007bae0
add esp, 0xc
lea eax, [ebp - 0x20c]
push esi
push eax
call ebx
lea eax, [ebp - 0x638]
push eax
lea eax, [ebp - 0x20c]
push eax
call ebx
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100085df
test al, 1
je 0x100085df
and eax, 0xfffffffe
push eax
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
neg eax
sbb eax, eax
and edi, eax
lea eax, [ebp - 0x664]
push eax
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10008510
push dword [ebp - 0x668]
call dword [sym.imp.KERNEL32.dll_FindClose]
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
and eax, edi
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10069b58
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
pop esi
call fcn.10069b58
mov esp, ebp
pop ebp
ret
Function at 0x10008650
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x100086a8
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100086a8
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x10008688
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x100086a8
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100086a3
test al, 0x10
je 0x100086a3
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x100086a8
xor eax, eax
pop esi
pop ebp
ret
mov eax, 1
pop esi
pop ebp
ret
Function at 0x10008e40
Capabilities:
Check if file exists
Delete file
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
je 0x10008e6f
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push esi
push str.delete__s_failed__error_d
call fcn.1002ea70
add esp, 0xc
mov eax, 1
pop esi
pop ebp
ret
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10008e67
push 0x80
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
je 0x10008e95
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x10008e52
push 4
push 0
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
xor eax, eax
pop esi
pop ebp
ret
Function at 0x100091c0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
mov dword [ebp - 4], edi
mov eax, dword [edi]
cmp eax, 0x270
jne 0x1000921e
lea edx, [edi + 8]
mov esi, eax
nop dword [eax]
mov ecx, dword [edx - 4]
lea edx, [edx + 4]
xor ecx, dword [edx - 4]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub esi, 1
jne 0x100091e0
mov eax, dword [edi]
jmp 0x10009309
cmp eax, 0x4e0
jb 0x10009309
mov eax, dword [edi + 0x9c4]
push ebx
lea ebx, [edi + 0x9c4]
mov edi, 0xe3
nop dword [eax + eax]
mov ecx, dword [ebx + 4]
lea edx, [ebx + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx + 0x634]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x10009240
mov ebx, dword [ebp - 4]
mov edi, 0x18c
add ebx, 0xd50
mov eax, dword [ebx]
nop dword [eax]
mov ecx, eax
lea edx, [ebx + 4]
xor ecx, dword [edx]
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [ebx - 0xd4c]
xor eax, ecx
mov dword [ebx - 0x9c0], eax
lea ebx, [edx]
mov eax, dword [edx]
sub edi, 1
jne 0x10009290
mov edi, dword [ebp - 4]
pop ebx
mov ecx, dword [edi + 0x1380]
xor ecx, dword [edi + 4]
and ecx, 0x7fffffff
xor ecx, dword [edi + 0x1380]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edi + 0x634]
xor eax, ecx
mov dword [edi + 0x9c0], eax
xor eax, eax
mov dword [edi], 0
mov edx, dword [edi + eax*4 + 4]
inc eax
mov dword [edi], eax
mov ecx, edx
mov eax, dword [edi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100096e0
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], ecx
push esi
and eax, 0x8000000f
jns 0x100096fb
dec eax
or eax, 0xfffffff0
add eax, 1
jne 0x1000985a
push 0
push 0x80
push 3
push 0
push 0
push SysReAllocString
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000985a
lea eax, [ebp - 0x14]
xorps xmm0, xmm0
push eax
push esi
movq qword [ebp - 0x14], xmm0
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x10009853
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x10009853
cmp dword [ebp - 0x10], 0
jg 0x10009853
jl 0x10009764
cmp eax, 0x1000000
ja 0x10009853
push edi
push 0x1000000
call fcn.10069ba1
add esp, 4
mov dword [ebp + 0x14], 0
mov edi, eax
lea eax, [ebp + 0x14]
push 0
push eax
push dword [ebp - 0x14]
push edi
push esi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10009837
cmp dword [ebp + 0x14], 0
je 0x10009837
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp - 8]
mov dword [ebp + 8], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
mov dword [ebp - 4], 0
push eax
push edi
call fcn.10009480
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 0x10]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x10009809
push 0
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
push dword [ebp + 8]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
test eax, eax
jne 0x1000981f
call ebx
push 1
push esi
call fcn.10069b93
add esp, 8
xor al, al
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
call ebx
push 1
push esi
call fcn.10069b93
add esp, 8
mov al, 1
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
push 1
push edi
call fcn.10069b93
add esp, 8
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 0x10
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1000ae50
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x10136674]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0x800
lea eax, [ebp - 0x804]
mov ebx, ecx
push 0
push eax
call fcn.1007bae0
add esp, 0xc
lea eax, [ebp - 0x804]
push 0x400
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFindFileNameW]
push str.HaloWallPaperInstaller
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov esi, eax
mov dword [ebp - 0x808], esi
test esi, esi
je 0x1000af37
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x1000af04
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push str.HaloWallPaperSetupMainWnd
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
test eax, eax
je 0x1000aef2
push 0
push 0
push 0x1400
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10069b58
mov esp, ebp
pop ebp
ret
push edi
lea edi, [ebx + 0x10]
push edi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [ebx + 8]
lea ecx, [ebx + 4]
cmp dword [ecx + 8], eax
je 0x1000af22
mov dword [eax], esi
add dword [ecx + 4], 4
jmp 0x1000af2f
lea edx, [ebp - 0x808]
push edx
push eax
call fcn.1000a940
push edi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop edi
mov ecx, dword [ebp - 4]
mov eax, 1
pop esi
xor ecx, ebp
pop ebx
call fcn.10069b58
mov esp, ebp
pop ebp
ret
Function at 0x1000afd0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1a3c
call fcn.10069fc0
mov eax, dword [0x10136674]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push 0
push 2
mov dword [ebp - 0x1a34], eax
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov ebx, eax
cmp ebx, 0xffffffff
je 0x1000b1e9
push edi
push 0x228
lea eax, [ebp - 0x1a2c]
push 0
push eax
call fcn.1007bae0
add esp, 0xc
mov dword [ebp - 0x1a30], 0x22c
lea eax, [ebp - 0x1a30]
push eax
push ebx
call sub.KERNEL32.dll_Process32FirstW
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x1000b1e5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x1a3c], eax
cmp eax, dword [ebp - 0x1a28]
je 0x1000b1ca
push dword [ebp - 0x1a34]
lea eax, [ebp - 0x1a0c]
push eax
call fcn.10096fb8
add esp, 8
test eax, eax
jne 0x1000b1ca
push 0x800
push eax
lea eax, [ebp - 0x1804]
push eax
call fcn.1007bae0
add esp, 0xc
push dword [ebp - 0x1a28]
push 0
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x1000b186
push 0x800
lea eax, [ebp - 0x804]
push 0
push eax
call fcn.1007bae0
add esp, 0xc
lea eax, [ebp - 0x804]
push 0x400
push eax
push 0
push edi
call sub.PSAPI.DLL_GetModuleFileNameExW
test eax, eax
je 0x1000b17b
push 0x800
lea eax, [ebp - 0x1004]
push 0
push eax
call fcn.1007bae0
lea eax, [ebp - 0x804]
push 0x7e
push eax
call fcn.1007d486
add esp, 0x14
test eax, eax
je 0x1000b143
push 0x400
lea eax, [ebp - 0x1004]
push eax
lea eax, [ebp - 0x804]
push eax
call dword [sym.imp.KERNEL32.dll_GetLongPathNameW]
dec eax
cmp eax, 0x3fe
ja 0x1000b143
lea ecx, [ebp - 0x1004]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000b130
lea eax, [ebp - 0x1004]
jmp 0x1000b161
lea ecx, [ebp - 0x804]
lea edx, [ecx + 2]
nop dword [eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x1000b150
lea eax, [ebp - 0x804]
sub ecx, edx
sar ecx, 1
push ecx
push eax
lea eax, [ebp - 0x1804]
push 0x400
push eax
call fcn.100974f8
add esp, 0x10
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call edi
jmp 0x1000b18c
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x1804]
push eax
call fcn.10052bd0
add esp, 4
test eax, eax
je 0x1000b1ca
mov eax, dword [esi + 4]
mov ecx, dword [ebp - 0x1a28]
mov dword [ebp - 0x1a38], ecx
cmp dword [esi + 8], eax
je 0x1000b1bb
mov dword [eax], ecx
add dword [esi + 4], 4
jmp 0x1000b1ca
lea ecx, [ebp - 0x1a38]
push ecx
push eax
mov ecx, esi
call fcn.1000a7e0
lea eax, [ebp - 0x1a30]
push eax
push ebx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
mov eax, dword [ebp - 0x1a3c]
jne 0x1000b051
push ebx
call edi
pop edi
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.10069b58
mov esp, ebp
pop ebp
ret 8
Function at 0x10011a90
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
push esi
mov esi, ecx
je 0x10011aba
mov eax, dword [esi + 0x48]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x10011ae6
push 1
mov ecx, esi
call fcn.100115a0
pop esi
pop ebp
ret 8
cmp dword [esi + 0x2c], 0
push edi
je 0x10011ac6
mov edi, dword [esi + 0x34]
jmp 0x10011ac9
mov edi, dword [esi + 0x30]
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10011ae5
test edi, edi
je 0x10011ae5
push 0
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
pop esi
pop ebp
ret 8

Function at 0x10011af0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
mov esi, dword [ebp + 8]
je 0x10011b21
mov eax, dword [esi + 0x24]
push dword [eax + 4]
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x10011b4d
push 1
lea ecx, [esi - 0x24]
call fcn.100115a0
mov eax, 1
pop esi
pop ebp
ret 0xc
cmp dword [esi + 8], 0
push edi
je 0x10011b2d
mov edi, dword [esi + 0x10]
jmp 0x10011b30
mov edi, dword [esi + 0xc]
push dword [esi - 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10011b4c
test edi, edi
je 0x10011b4c
push 0
push dword [esi - 0x20]
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
mov eax, 1
pop esi
pop ebp
ret 0xc
Function at 0x100128b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 0x10]
mov dword [ebp - 4], esi
push edi
test ebx, ebx
jne 0x100128cd
xor edi, edi
jmp 0x10012a24
cmp dword [ebp + 0x14], 0
je 0x100129fd
push 0x1440
call fcn.10035660
mov edi, eax
add esp, 4
test edi, edi
je 0x10012993
mov ecx, dword [ebp + 0x40]
xor edx, edx
mov dword [ebp - 0x28], edx
test ecx, ecx
je 0x10012907
mov eax, dword [ecx]
lea edx, [ebp - 0x4c]
push edx
call dword [eax]
mov edx, eax
mov dword [ebp - 0x28], edx
mov ecx, dword [ebp + 8]
lea esi, [edi + 0x1418]
mov dword [edi], ecx
mov dword [edi + 0x1414], 1
mov dword [esi + 0x24], 0
test edx, edx
je 0x10012931
mov eax, dword [edx]
mov ecx, edx
push esi
call dword [eax]
mov dword [esi + 0x24], eax
push 0x1000
lea esi, [edi + 4]
push 0
push esi
call fcn.1007bae0
push 0x800
push ebx
push esi
call fcn.10097da2
push 0x410
lea esi, [edi + 0x1004]
push 0
push esi
call fcn.1007bae0
mov eax, dword [ebp - 4]
add esp, 0x24
test eax, eax
je 0x10012979
push 0x208
push eax
push esi
call fcn.10097da2
add esp, 0xc
mov ecx, dword [ebp - 0x28]
test ecx, ecx
je 0x10012995
mov edx, dword [ecx]
lea eax, [ebp - 0x4c]
cmp ecx, eax
setne al
movzx eax, al
push eax
call dword [edx + 0x10]
jmp 0x10012995
xor edi, edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x24], vtable.CSimpleThread.0
push eax
push 0
push edi
push 0x10012a50
push 0
push 0
mov dword [ebp - 0xc], 0x10012a50
mov dword [ebp - 8], edi
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call fcn.1009a63c
add esp, 0x18
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], vtable.CSimpleThread.0
test eax, eax
je 0x100129f6
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 1
jmp 0x10012a24
sub esp, 0x28
mov edi, esp
mov dword [edi + 0x24], 0
mov ecx, dword [ebp + 0x40]
test ecx, ecx
je 0x10012a18
mov eax, dword [ecx]
push edi
call dword [eax]
mov dword [edi + 0x24], eax
mov ecx, dword [ebp + 8]
push esi
push ebx
call fcn.10012cd0
mov edi, eax
mov ecx, dword [ebp + 0x40]
test ecx, ecx
je 0x10012a3c
mov esi, dword [ecx]
lea eax, [ebp + 0x1c]
cmp ecx, eax
setne dl
movzx edx, dl
push edx
call dword [esi + 0x10]
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x3c