joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1322d4e8
Capabilities:
Reference http user-agent string

Disassembly:
push ebx
push esi
test dl, dl
je 0x1322d4f6
add esp, 0xfffffff0
call fcn.1314406c
mov ebx, edx
mov esi, eax
xor edx, edx
mov eax, esi
call fcn.132280d4
lea eax, [esi + 0x38]
mov edx, 0x1322d55c
call fcn.13144c7c
lea eax, [esi + 0x60]
mov edx, 0x1322d568
call fcn.13144c7c
mov byte [esi + 0x7c], 1
mov dword [esi + 0x80], 0x1400
mov eax, dword [esi + 0x1c]
mov dword [eax + 0xc], esi
mov dword [eax + 8], 0x1322d950
mov eax, esi
test bl, bl
je 0x1322d54d
call fcn.131440c4
pop dword fs:[0]
add esp, 0xc
mov eax, esi
pop esi
pop ebx
ret
Function at 0x1322eee0
Capabilities:
Access peb ldr_data
Check for peb beingdebugged flag

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
mov byte [ebp - 2], cl
mov byte [ebp - 1], dl
mov ebx, eax
mov eax, 0x40
call fcn.13142f14
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
xor ecx, ecx
mov edx, 0x40
call fcn.13143618
xor eax, eax
push ebp
push 0x1322ef6b
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebp - 8]
mov byte [esi + 0x30], bl
movzx eax, byte [ebp + 8]
mov byte [esi + 2], al
movzx eax, byte [ebp - 1]
mov byte [esi + 0xa], al
mov byte [esi + 0xb], 0
movzx eax, byte [ebp - 2]
mov byte [esi + 0xc], al
mov byte [esi + 0xd], 0
mov byte [esi], 0x32
mov eax, dword [ebp - 8]
push eax
call sub.netapi32.dll_Netbios
movzx eax, byte [esi + 0x31]
mov byte [ebp - 3], al
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1322ef72
mov edx, 0x40
mov eax, dword [ebp - 8]
call fcn.13142f30
ret
Function at 0x132307a4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee8
push ebx
push esi
xor edx, edx
mov dword [ebp - 0x110], edx
mov dword [ebp - 0x114], edx
mov dword [ebp - 0x118], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x13230872
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push pe_nt_image_headers32
lea eax, [ebp - 0x10c]
push eax
push ebx
call sub.kernel32.dll_GetVolumeInformationA
test eax, eax
je 0x13230854
lea ecx, [ebp - 0x114]
mov eax, dword [ebp - 4]
shr eax, 0x10
movzx eax, ax
mov edx, 4
call fcn.13149c18
push dword [ebp - 0x114]
push 0x1323088c
lea ecx, [ebp - 0x118]
movzx eax, word [ebp - 4]
mov edx, 4
call fcn.13149c18
push dword [ebp - 0x118]
lea eax, [ebp - 0x110]
mov edx, 3
call fcn.13144fcc
mov eax, dword [ebp - 0x110]
call fcn.131450c8
mov esi, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13230879
lea eax, [ebp - 0x118]
mov edx, 3
call fcn.13144c4c
ret

Function at 0x132315f4
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
xor eax, eax
push ebp
push 0x1323167a
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
mov edx, ebx
call fcn.13144e30
mov eax, dword [ebp - 8]
test eax, eax
je 0x13231628
sub eax, 4
mov eax, dword [eax]
push 0x40
push 0x3000
inc eax
push eax
push 0
push esi
call sub.kernel32.dll_VirtualAllocEx
mov edi, eax
lea eax, [ebp - 0xc]
mov edx, ebx
call fcn.13144e30
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x13231651
sub eax, 4
mov eax, dword [eax]
lea edx, [ebp - 4]
push edx
inc eax
push eax
push ebx
push edi
push esi
call sub.kernel32.dll_WriteProcessMemory
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13231681
lea eax, [ebp - 0xc]
mov edx, 2
call fcn.13144c4c
ret

Function at 0x1323168c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
push edi
push ebp
push ecx
mov esi, ecx
mov ebp, edx
mov ebx, eax
push 0x40
push 0x3000
push esi
push 0
push ebx
call sub.kernel32.dll_VirtualAllocEx
mov edi, eax
push esp
push esi
push ebp
push edi
push ebx
call sub.kernel32.dll_WriteProcessMemory
mov eax, edi
pop edx
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x132316bc
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
mov edi, edx
mov ebx, eax
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.1323168c
mov esi, eax
mov eax, edi
call fcn.132315d0
mov ecx, eax
mov edx, edi
mov eax, ebx
call fcn.1323168c
lea edx, [ebp - 0xc]
push edx
push 0
push esi
push eax
push 0
push 0
push ebx
call sub.kernel32.dll_CreateRemoteThread
mov edi, eax
cmp byte [ebp + 8], 0
je 0x13231722
push 0xffffffffffffffff
push edi
call sub.kernel32.dll_WaitForSingleObject
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp + 0xc]
push eax
mov eax, dword [ebp - 4]
push eax
push esi
push ebx
call sub.kernel32.dll_ReadProcessMemory
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x13231864
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
push ebx
push esi
push edi
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
mov edx, dword [0x132312e8]
call fcn.131457c4
xor eax, eax
push ebp
push 0x13231975
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 0x1d], 0
mov eax, dword [ebp - 0x1c]
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0x3c]
cdq
add eax, dword [esp]
adc edx, dword [esp + 4]
add esp, 8
mov edi, eax
mov esi, 0x10000000
add esi, 0x10000
push 0x40
push 0x3000
mov eax, dword [edi + 0x50]
push eax
mov eax, dword [edi + 0x34]
add eax, esi
push eax
call sub.kernel32.dll_VirtualAlloc_1
mov ebx, eax
test ebx, ebx
je 0x132318fd
push 0x8000
push 0
push ebx
call sub.kernel32.dll_VirtualFree_1
push 0x40
push 0x3000
mov eax, dword [edi + 0x50]
push eax
mov eax, dword [edi + 0x34]
add eax, esi
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_VirtualAllocEx
mov ebx, eax
test ebx, ebx
jne 0x13231909
cmp esi, 0x30000000
jbe 0x132318b2
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x1c]
mov edx, ebx
mov eax, dword [ebp - 0x18]
call fcn.13231e64
mov eax, dword [ebp - 0x14]
test eax, eax
je 0x13231959
mov dword [ebp - 0x28], eax
mov edx, dword [ebp - 8]
mov dword [ebp - 0x24], edx
lea edx, [ebp - 0x2c]
push edx
mov edx, dword [ebp - 0x10]
push edx
push eax
push ebx
mov eax, dword [ebp - 0x18]
push eax
call sub.kernel32.dll_WriteProcessMemory
push 8
push 0
lea ecx, [ebp - 0x28]
mov edx, 0x1323183c
mov eax, dword [ebp - 0x18]
call fcn.132316bc
test eax, eax
je 0x13231959
mov byte [ebp - 0x1d], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x1323197c
lea eax, [ebp - 0x14]
mov edx, dword [0x132312e8]
call fcn.13145894
ret

Function at 0x13231c0c
Capabilities:
Inspect section memory permissions

Disassembly:
xor edx, edx
test eax, 0x4000000
je 0x13231c1b
or edx, 0x200
test eax, 0x20000000
je 0x13231c4f
test eax, 0x40000000
je 0x13231c3a
test eax, 0x80000000
je 0x13231c35
or edx, 0x40
jmp 0x13231c76
or edx, 0x20
jmp 0x13231c76
test eax, 0x80000000
je 0x13231c49
or edx, 0x80
jmp 0x13231c76
or edx, 0x10
mov eax, edx
ret
test eax, 0x40000000
je 0x13231c67
test eax, 0x80000000
je 0x13231c62
or edx, 4
jmp 0x13231c76
or edx, 2
jmp 0x13231c76
test eax, 0x80000000
je 0x13231c73
or edx, 8
jmp 0x13231c76
or edx, 1
mov eax, edx
ret
Function at 0x1323414c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
xor eax, eax
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x132341bd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
push eax
mov eax, dword [0x132ab978]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
cmp dword [ebp - 4], 0
je 0x132341a7
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 8]
call fcn.1323413c
mov eax, dword [ebp - 8]
push eax
xor ecx, ecx
mov dl, 1
mov eax, dword [0x132328c0]
call fcn.1323504c
mov dword [0x132ab9e0], eax
mov eax, dword [ebp - 4]
call fcn.13233fc8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x132341c4
lea eax, [ebp - 8]
call fcn.13146a9c
ret

Function at 0x1323425c
Capabilities:
Get file system object information

Disassembly:
push esi
add esp, 0xfffffea0
mov esi, 0x4008
test cl, cl
je 0x1323426f
or esi, 2
test dl, dl
je 0x13234278
or esi, 0
jmp 0x1323427b
or esi, 1
push esi
push 0x160
lea edx, [esp + 8]
push edx
push 0
push eax
call sub.shell32.dll_SHGetFileInfoA
mov eax, dword [esp + 4]
add esp, 0x160
pop esi
ret
Function at 0x13234eb4
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 8], ebx
mov ebx, ecx
mov dword [ebp - 4], edx
mov edi, eax
mov eax, dword [ebp - 4]
call fcn.131450b8
xor eax, eax
push ebp
push 0x1323502f
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, 1
mov edx, dword [ebx]
mov eax, dword [0x132326a8]
call fcn.13157180
test eax, eax
jl 0x13234f1e
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebx]
call fcn.13234240
and eax, 0x7f
mov eax, dword [eax*4 + 0x132ab978]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
mov esi, eax
jmp 0x13234fa1
mov edx, dword [ebx]
mov eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x13234f31
sub eax, 4
mov eax, dword [eax]
test eax, eax
jle 0x13234fa1
mov eax, edx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x13234f46
sub eax, 4
mov eax, dword [eax]
mov edx, dword [ebx]
cmp byte [edx + eax - 1], 0x3a
jne 0x13234f5b
mov eax, ebx
mov edx, 0x13235048
call fcn.13144f04
mov eax, dword [ebx]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x13234f6c
sub eax, 4
mov eax, dword [eax]
mov dword [ebp - 0x10], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [ebx]
call fcn.13145d68
mov esi, eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
push esi
push 0
push 0
lea eax, [ebp - 0x1c]
call fcn.1323413c
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
mov esi, eax
test esi, esi
je 0x13234fec
lea eax, [ebp - 8]
push eax
lea edx, [ebp - 0x20]
mov eax, dword [0x132ac6ac]
call fcn.13146fe8
mov eax, dword [ebp - 0x20]
push eax
mov eax, dword [ebx]
mov dword [ebp - 0x28], eax
mov byte [ebp - 0x24], 0xb
lea edx, [ebp - 0x28]
xor ecx, ecx
pop eax
call fcn.1314aea4
mov eax, ebx
mov edx, dword [ebp - 4]
call fcn.13144c7c
mov ecx, dword [ebp - 8]
mov dl, 1
mov eax, dword [0x131488a0]
call fcn.1314d9d0
call fcn.131445bc
mov eax, dword [ebp - 0xc]
call fcn.13234e2c
mov ebx, eax
test edi, edi
je 0x13235001
mov eax, edi
call fcn.13143d08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13235036
lea eax, [ebp - 0x20]
call fcn.13144c28
lea eax, [ebp - 0x1c]
call fcn.13146a9c
lea eax, [ebp - 8]
call fcn.13144c28
lea eax, [ebp - 4]
call fcn.13144c28
ret

Function at 0x13235c2c
Capabilities:
Create process on windows

Disassembly:
push ebx
add esp, 0xffffffc4
mov ebx, eax
mov eax, esp
xor ecx, ecx
mov edx, 0x3c
call fcn.13143618
mov dword [esp], 0x3c
mov eax, dword [0x132acab4]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
mov dword [esp + 8], eax
mov dword [esp + 4], 0xc
mov eax, dword [ebx + 8]
mov dword [esp + 0x24], eax
mov dword [esp + 0x1c], 5
push esp
call sub.shell32.dll_ShellExecuteExA
add esp, 0x3c
pop ebx
ret
Function at 0x132360e0
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe9c
push ebx
push esi
test dl, dl
je 0x132360f7
add esp, 0xfffffff0
call fcn.1314406c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.131cd050
xor eax, eax
mov dword [ebx + 0x388], eax
xor edx, edx
mov eax, ebx
call fcn.131cdca8
movzx eax, byte [0x132361d4]
mov byte [ebx + 0x38c], al
mov byte [ebx + 0x28c], 1
mov byte [ebx + 0x395], 1
mov byte [ebx + 0x396], 0
xor eax, eax
mov dword [ebx + 0x398], eax
xor eax, eax
mov dword [ebx + 0x39c], eax
mov byte [ebx + 0x3a1], 0
mov byte [ebx + 0x3a2], 1
push 0x4001
push 0x160
lea eax, [ebp - 0x164]
push eax
push 0
push 0x132361d8
call sub.shell32.dll_SHGetFileInfoA
mov dword [ebx + 0x390], eax
mov ecx, ebx
mov dl, 1
mov eax, dword [0x13232b80]
call fcn.13235d08
mov esi, eax
mov dword [ebx + 0x3a4], esi
movzx eax, byte [esi + 0x24]
or al, byte [0x132361dc]
mov byte [esi + 0x24], al
lea eax, [ebx + 0x380]
mov edx, 0x132361e8
call fcn.13144c7c
mov byte [ebx + 0x394], 0
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x132361ca
call fcn.131440c4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1323675c
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], eax
xor eax, eax
push ebp
push 0x132368c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [0x132acd2c]
mov eax, dword [eax]
movzx eax, word [eax + 0x44]
mov word [ebp - 0x16], ax
mov eax, dword [0x132acd2c]
mov eax, dword [eax]
mov dx, 0xfff5
call fcn.131afca8
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x2b4]
call fcn.131ccb3c
xor edx, edx
push ebp
push 0x132368ac
push dword fs:[edx]
mov dword fs:[edx], esp
xor edx, edx
push ebp
push 0x1323681a
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 4]
call fcn.13146a9c
push eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax + 0x38c]
call fcn.13234874
push eax
mov eax, dword [0x132acab4]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x10]
push eax
mov eax, dword [eax]
call dword [eax + 0x10]
test eax, eax
je 0x13236810
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
call fcn.13144668
jmp 0x132368b3
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x13236858
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x2b4]
xor ecx, ecx
mov edx, dword [ebp - 0xc]
call fcn.131cc704
mov ebx, eax
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, ebx
mov eax, dword [ebp - 8]
call fcn.132365ec
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
push 1
mov eax, dword [ebp - 4]
push eax
mov eax, dword [eax]
call dword [eax + 0xc]
test eax, eax
je 0x13236832
push 0
mov edx, 0x13236584
xor ecx, ecx
mov eax, dword [ebp - 0xc]
call fcn.131cc0d4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x132368b3
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x2b4]
call fcn.131ccb88
mov eax, dword [0x132acd2c]
mov eax, dword [eax]
movzx edx, word [ebp - 0x16]
call fcn.131afca8
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x132368d0
lea eax, [ebp - 4]
call fcn.13146a9c
ret
Function at 0x13241a9c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x13241c49
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x13158d08]
call fcn.13143cd8
mov dword [ebp - 8], eax
mov dl, 1
mov eax, dword [0x13158d08]
call fcn.13143cd8
mov dword [ebp - 0xc], eax
mov esi, 0x41
lea eax, [ebp - 0x10]
mov edx, esi
call fcn.13144e10
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 4]
mov ecx, 0x13241c60
call fcn.13144f50
mov eax, dword [ebp - 4]
call fcn.131450c8
push eax
call sub.kernel32.dll_GetDriveTypeA
test eax, eax
je 0x13241b38
cmp eax, 1
je 0x13241b38
cmp eax, 3
jne 0x13241b38
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp byte [eax + 0xd], 0
jne 0x13241b3e
mov eax, dword [0x132acd48]
cmp byte [eax], 0
jne 0x13241b3e
mov eax, dword [ebp + 8]
push eax
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.1324154c
pop ecx
inc esi
cmp esi, 0x5b
jne 0x13241adc
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x13241b87
inc ebx
xor esi, esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp byte [eax + 0xd], 0
jne 0x13241b87
mov eax, dword [0x132acd48]
cmp byte [eax], 0
jne 0x13241b87
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x14]
mov edx, esi
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0xc]
call fcn.1324154c
pop ecx
inc esi
dec ebx
jne 0x13241b50
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x13241bd0
inc ebx
xor esi, esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp byte [eax + 0xd], 0
jne 0x13241bd0
mov eax, dword [0x132acd48]
cmp byte [eax], 0
jne 0x13241bd0
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x18]
mov edx, esi
mov eax, dword [ebp - 0xc]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp - 8]
call fcn.1324154c
pop ecx
inc esi
dec ebx
jne 0x13241b99
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
mov ebx, eax
dec ebx
test ebx, ebx
jl 0x13241c16
inc ebx
xor esi, esi
mov eax, dword [ebp + 8]
mov eax, dword [eax - 4]
cmp byte [eax + 0xd], 0
jne 0x13241c16
mov eax, dword [0x132acd48]
cmp byte [eax], 0
jne 0x13241c16
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x1c]
mov edx, esi
mov eax, dword [ebp - 8]
mov edi, dword [eax]
call dword [edi + 0xc]
mov eax, dword [ebp - 0x1c]
call fcn.13241858
pop ecx
inc esi
dec ebx
jne 0x13241be2
mov eax, dword [ebp - 8]
call fcn.13143d08
mov eax, dword [ebp - 0xc]
call fcn.13143d08
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13241c50
lea eax, [ebp - 0x1c]
mov edx, 4
call fcn.13144c4c
lea eax, [ebp - 4]
call fcn.13144c28
ret
Function at 0x1324395c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x104], edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], edx
mov esi, eax
xor eax, eax
push ebp
push 0x13243a30
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
mov eax, dword [0x132acab4]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_GetWindow
mov edi, eax
test edi, edi
je 0x13243a12
push 0xff
lea eax, [ebp - 0xff]
push eax
push edi
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x13243a04
lea eax, [ebp - 0x108]
lea edx, [ebp - 0xff]
call fcn.13144e30
mov eax, dword [ebp - 0x108]
lea edx, [ebp - 0x104]
call fcn.131495f8
mov eax, dword [ebp - 0x104]
push eax
lea edx, [ebp - 0x10c]
mov eax, esi
call fcn.131495f8
mov edx, dword [ebp - 0x10c]
pop eax
call fcn.13145060
jne 0x13243a04
mov bl, 1
jmp 0x13243a12
push 2
push edi
call sub.user32.dll_GetWindow
mov edi, eax
test edi, edi
jne 0x132439a6
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13243a37
lea eax, [ebp - 0x10c]
mov edx, 3
call fcn.13144c4c
ret

Function at 0x13243d00
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x104], edx
mov dword [ebp - 0x10c], edx
mov dword [ebp - 0x108], edx
mov esi, eax
xor eax, eax
push ebp
push 0x13243dd4
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
push 0
mov eax, dword [0x132acab4]
mov eax, dword [eax]
mov eax, dword [eax + 0x30]
push eax
call sub.user32.dll_GetWindow
mov edi, eax
test edi, edi
je 0x13243db6
push 0xff
lea eax, [ebp - 0xff]
push eax
push edi
call sub.user32.dll_GetWindowTextA
test eax, eax
jle 0x13243da8
lea eax, [ebp - 0x108]
lea edx, [ebp - 0xff]
call fcn.13144e30
mov eax, dword [ebp - 0x108]
lea edx, [ebp - 0x104]
call fcn.131495f8
mov eax, dword [ebp - 0x104]
push eax
lea edx, [ebp - 0x10c]
mov eax, esi
call fcn.131495f8
mov edx, dword [ebp - 0x10c]
pop eax
call fcn.13145060
jne 0x13243da8
mov bl, 1
jmp 0x13243db6
push 2
push edi
call sub.user32.dll_GetWindow
mov edi, eax
test edi, edi
jne 0x13243d4a
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13243ddb
lea eax, [ebp - 0x10c]
mov edx, 3
call fcn.13144c4c
ret
Function at 0x13244ad0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffed0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x130], ecx
mov dword [ebp - 0x12c], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.131450b8
mov eax, dword [ebp - 8]
call fcn.131450b8
xor eax, eax
push ebp
push 0x13244c69
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x13244c14
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x10]
mov eax, dword [0x132ac960]
call fcn.131d8488
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0x10]
mov ecx, 0x13244c78
call fcn.13146ae0
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0x10]
mov ecx, 0x13244c88
call fcn.13146ae0
mov eax, dword [ebp - 4]
call fcn.131450c8
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x50]
lea edx, [ebp - 0x12c]
mov eax, dword [ebp - 4]
call fcn.1314a488
mov eax, dword [ebp - 0x12c]
call fcn.131450c8
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [eax]
call dword [eax + 0x24]
lea eax, [ebp - 0x20]
push eax
push 0x10
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
lea eax, [ebp - 0x125]
push eax
mov eax, dword [ebp - 0x20]
push eax
call sub.shell32.dll_SHGetPathFromIDListA
push 0x13244ca0
push dword [ebp - 8]
push 0x13244cac
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.13144fcc
lea eax, [ebp - 0x130]
lea edx, [ebp - 0x125]
mov ecx, 0x105
call fcn.13144ea8
lea eax, [ebp - 0x130]
mov edx, dword [ebp - 0xc]
call fcn.13144f04
mov edx, dword [ebp - 0x130]
lea eax, [ebp - 0x1c]
call fcn.131455ac
push 0
mov eax, dword [ebp - 0x1c]
call fcn.131455bc
push eax
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [eax]
call dword [eax + 0x18]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x13244c1e
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x13244c70
lea eax, [ebp - 0x130]
mov edx, 2
call fcn.13144c4c
lea eax, [ebp - 0x1c]
call fcn.131453ec
lea eax, [ebp - 0x18]
call fcn.13146a9c
lea eax, [ebp - 0x14]
call fcn.13146a9c
lea eax, [ebp - 0x10]
call fcn.13146a9c
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.13144c4c
ret
Function at 0x1324c2c4
Capabilities:
Acquire debug privileges

Disassembly:
push ebx
push ecx
push esp
push 0x20
call sub.kernel32.dll_GetCurrentProcess
push eax
call sub.advapi32.dll_OpenProcessToken
push 1
push 0x1324c300
mov eax, dword [esp + 8]
push eax
call fcn.1324c230
mov ebx, eax
mov eax, dword [esp]
push eax
call sub.kernel32.dll_CloseHandle
mov eax, ebx
pop edx
pop ebx
ret

Function at 0x1324c578
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
xor esi, esi
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
mov ebx, eax
test ebx, ebx
je 0x1324c5a1
push 1
push ebx
call sub.kernel32.dll_TerminateProcess
test eax, eax
je 0x1324c59b
or esi, 0xffffffff
push ebx
call sub.kernel32.dll_CloseHandle
mov eax, esi
pop esi
pop ebx
ret