joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40530f
Capabilities:
Create process on windows

Disassembly:
push eax
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x40532a
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
leave
ret 4

Function at 0x4053d0
Capabilities:
Delete directory
Delete file
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call fcn.00405686
test byte [ebp + 0xc], 8
mov dword [ebp - 8], eax
je 0x405404
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
neg eax
sbb eax, eax
inc eax
add dword [0x423ee8], eax
jmp 0x40559d
push ebx
mov ebx, dword [ebp + 0xc]
and ebx, 1
mov dword [ebp - 4], ebx
je 0x405422
test eax, eax
je 0x405548
test byte [ebp + 0xc], 2
je 0x405548
mov esi, 0x421468
push edi
push esi
call fcn.00405aba
test ebx, ebx
je 0x40543f
push str..
push esi
call fcn.00405add
jmp 0x405445
push edi
call fcn.004055ea
cmp byte [edi], 0
jne 0x405453
cmp byte [0x421468], 0x5c
jne 0x40545e
push 0x409010
push edi
call fcn.00405add
push edi
call fcn.00405ad0
mov ebx, eax
lea eax, [ebp - 0x148]
push eax
push esi
add ebx, edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [ebp + 8], eax
je 0x40553e

Function at 0x405686
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
push edi
push dword [esp + 0xc]
mov esi, 0x421868
push esi
call fcn.00405aba
push esi
call fcn.00405637
mov edi, eax
test edi, edi
jne 0x4056a7
xor eax, eax
jmp 0x4056f9
push edi
call fcn.00405d46
test byte [0x423e78], 0x80
je 0x4056c0
mov al, byte [edi]
test al, al
je 0x4056a3
cmp al, 0x5c
je 0x4056a3
sub edi, esi
push esi
call fcn.00405ad0
cmp eax, edi
push esi
jle 0x4056e3
call fcn.00405ddf
test eax, eax
je 0x4056db
test byte [eax], 0x10
je 0x4056a3
push esi
call fcn.004055ea
jmp 0x4056c2
call fcn.004055a3
push esi
invalid
invalid
js 0x40575d
inc eax

Function at 0x405770
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
je 0x40578c
and al, 0xfe
push eax
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
ret 4

Function at 0x4057be
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0x63
pop edi
mov dword [ebp + 8], 0x61736e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x1a
xor edx, edx
pop ecx
div ecx
push esi
lea eax, [ebp + 8]
push 0
push eax
push dword [ebp + 0xc]
add byte [ebp + 0xa], dl
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
test eax, eax
jne 0x405803
mov eax, edi
dec edi
test eax, eax
jne 0x4057c9
and byte [esi], al
pop edi
pop esi
pop ebp
ret 8
mov eax, esi
jmp 0x4057fd
Function at 0x405807
Capabilities:
Get file size
Read file on windows
Write file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
push 1
call fcn.00405e06
test eax, eax
mov esi, dword [esp + 0x18]
je 0x40582b
push 5
push esi
push dword [esp + 0x1c]
call eax
test eax, eax
jne 0x405964
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
mov dword [0x4225f0], 0x4c554e
test esi, esi
mov edi, 0x400
mov ebp, 0x4225f0
je 0x40586f
push 1
push 0
push esi
call fcn.0040578f
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
push ebp
push esi
call ebx
test eax, eax
je 0x40596a
cmp eax, edi
jg 0x40596a
mov esi, 0x422068
push edi
push esi
push dword [esp + 0x1c]
call ebx
test eax, eax
je 0x40596a
cmp eax, edi
jg 0x40596a
push esi
push ebp
push str._s_s_r_n
push 0x421c68
call dword [sym.imp.USER32.dll_wsprintfA]
mov ebx, eax
mov eax, dword [0x423e70]
add esp, 0x10
push dword [eax + 0x128]
push esi
call fcn.00405aee
push 4
invalid
add byte [eax], al
invalid

Function at 0x4059a0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ebx
lea eax, [ebp + 0x18]
push esi
push eax
mov eax, dword [ebp + 0x18]
xor ebx, ebx
neg eax
sbb eax, eax
mov esi, dword [ebp + 0x14]
and eax, 0x100
or eax, 0x20019
mov byte [esi], bl
push eax
push ebx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x405a11
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], 0x400
push eax
lea eax, [ebp + 0x14]
push esi
push eax
push ebx
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x405a00
cmp dword [ebp + 0x14], 1
je 0x405a02
cmp dword [ebp + 0x14], 2
je 0x405a02
mov byte [esi], bl
Function at 0x405e7c
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp dword [0x4229f4], esi
push edi
jne 0x405eb6
mov ecx, 0x4229f0

Function at 0x405e94
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push 8
mov eax, esi
pop edi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec edi
jne 0x405e92
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x422df0
jl 0x405e8d
mov ecx, dword [esp + 0x14]
mov eax, dword [esp + 0xc]
mov edx, ecx
dec ecx
test edx, edx
not eax
jbe 0x405eeb
lea edx, [ecx + 1]
mov ecx, dword [esp + 0x10]
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4229f0]
xor eax, esi
inc ecx
dec edx
jne 0x405ece
pop edi
pop esi
not eax
ret 0xc

Function at 0x4020c2
Capabilities:
Enumerate gui resources

Disassembly:
cmp dword [esp + 4], 0
je 0x4020da
push dword [esp + 4]
push 0x40205b
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x402117
push esi
mov esi, dword [0x406858]
test esi, esi
je 0x402116
push ebx
push edi
mov ebx, dword [esi]
lea edi, [esi + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [edi], eax
jne 0x40210e
push 1
push dword [esi + 0xc]
call dword [sym.imp.USER32.dll_EnableWindow]
push edi
push 0x406858
call fcn.004046a0
pop ecx
pop ecx
test ebx, ebx
mov esi, ebx
jne 0x4020e7
pop edi
pop ebx
pop esi
ret 4

Function at 0x4028d1
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
xor esi, esi
push esi
push pe_nt_image_headers32
push 3
push esi
push 1
push 0x80000000
push dword [ebp + 0xc]
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x402956
push edi
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push eax
push esi
push dword [0x406844]
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
cmp edi, esi
je 0x40294e
push esi
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push edi
push dword [ebp + 8]
call fcn.004035e6
push edi
push esi
push dword [0x406844]
mov dword [ebp - 4], eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, dword [ebp - 4]
pop esi
pop ebx
leave
ret 0xc
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219

Function at 0x431001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
mov ecx, 0x6ad03ad
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x431024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
mov ecx, 0x658e2823
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x5de3e89
nop
nop
nop
nop
test eax, eax
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x282b79b3
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x2db22831
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42cd70
nop
mov ecx, 0x76b1672e
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x10011d81
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10011ddc
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10011dbd
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10011dda
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10015a6e
mov dword [eax], 1
jmp 0x10011db2
jmp 0x10011df0
push 0xc60
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esp, ebp
pop ebp
ret

Function at 0x10015415
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007997b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x100154a7
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
push dword [eax]
mov eax, dword [ebp - 0x28]
push dword [eax]
lea eax, [ebp - 0x48]
push eax
call fcn.10013243
add esp, 0x10
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
and dword [ebp - 4], 0
push dword [ebp - 0x30]
mov ecx, dword [ebp - 0x34]
call fcn.10015c8a
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x48]
call fcn.10015cbf
jmp 0x100154c7
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x100154c7
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10017869
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
xor esi, esi
mov dword [ebp - 8], 0x647dc4b4
inc esi
lea ecx, [ebp - 0x1c]
push esi
call fcn.100159d0
xor ebx, ebx
mov dword [ebp - 0xc], 0xfffffffb
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0xc], ebx
jmp 0x100178a3
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x10], 0x2733582f
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x10017895
mov dword [ebp - 0xc], ebx
jmp 0x100178bd
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x1c]
mov dword [eax + ecx*4], 0xf5452fa8
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], esi
jl 0x100178ad
push edi
mov edi, esi
cmp dword [ebp - 8], ebx
jne 0x100178cc
mov edi, ebx
mov eax, dword [ebp - 8]
xor ecx, ecx
mov eax, dword [ebp - 8]
cmp eax, 0xfffffff6
setg cl
xor eax, eax
test ecx, ecx
sete al
imul eax, eax, 0x7af2
cmp eax, dword [ebp - 8]
je 0x100178f3
mov edx, ebx
cmp dword [ebp - 8], ebx
je 0x100178f5
mov edx, esi
mov eax, dword [ebp - 8]
xor ecx, ecx
cmp eax, edx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
sete cl
mov dword [eax], ecx
cmp ecx, 0xfffffff9
jle 0x10017911
cmp dword [ebp - 0x10], ebx
jne 0x10017913
mov esi, ebx
mov eax, dword [ebp - 8]
xor edx, edx
cmp esi, eax
mov eax, dword [ebp - 8]
setne dl
xor ecx, ecx
add edx, 0xffff
cmp edx, eax
setge cl
mov dword [ebp - 0xc], ecx
xor ecx, ecx
mov eax, dword [ebp - 0xc]
cmp edi, eax
pop edi
setne cl
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ebx
jmp 0x1001795d
mov dword [ebp - 0xc], 0xe80a7c6d
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10017957
call sub.KERNEL32.dll_GetEnvironmentStringsW
mov eax, dword [ebp - 0xc]
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x2e
jge 0x10017943
lea ecx, [ebp - 0x1c]
call fcn.10015a52
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100259be
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100259eb
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100259e9
push 0x9e8
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x10025a36
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x10025a19
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x10025a36
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x14]
call fcn.10015a6e
mov dword [eax], 0x75158018
jmp 0x10025a0e
mov esp, ebp
pop ebp
ret

Function at 0x10025a75
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10025aac
mov eax, dword [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10025aaa
push 0x9e8
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x10025af8
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
push dword [eax]
push 0
mov eax, dword [ebp - 0x20]
push dword [eax]
mov eax, dword [ebp - 0x24]
push dword [eax]
push dword [ebp - 0x28]
call fcn.10025411
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x10025dea
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10025eed
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xf5872d9e
ja 0x10025e58
mov dword [ebp - 4], 1
jmp 0x10025e5c
and dword [ebp - 4], 0
push 0
mov ecx, dword [ebp - 0x3c]
call fcn.10015a6e
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
cmp dword [ebp - 4], eax
jne 0x10025e86
mov dword [ebp - 0xc], 1
jmp 0x10025e8a
and dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0xffffffff
ja 0x10025e99
mov dword [ebp - 0x18], 1
jmp 0x10025e9d
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jle 0x10025eb2
mov dword [ebp - 0x10], 1
jmp 0x10025eb6
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x10]
add eax, 0x46b8
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
cmp dword [ebp - 0x18], eax
jne 0x10025ed6
mov dword [ebp - 0x20], 1
jmp 0x10025eda
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
mov eax, dword [ebp - 0x44]
mov dword [eax], 0x245f5b1b
jmp 0x10025f17
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x10025f17
push 0xc60
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esp, ebp
pop ebp
ret
Function at 0x1002d0f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
push 1
lea eax, [ebp + 8]
push eax
push 0x34d8
lea eax, [ebp - 0x10]
push eax
call fcn.1002b810
add esp, 0x10
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002d125
xor eax, eax
jmp 0x1002d2b3
lea eax, [ebp + 8]
push eax
push 1
lea eax, [ebp - 0x10]
push eax
push 0x72d0
lea eax, [ebp - 8]
push eax
call fcn.1002b86a
add esp, 0x14
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1002d152
xor eax, eax
jmp 0x1002d2b3
push 0xd01
push 0x55fd
push 0x15a2
lea eax, [ebp - 8]
push eax
push 1
push 0x8fe
push 0x763
push 0x2a80
lea eax, [ebp - 0xc]
push eax
push 0x722b
call fcn.1002cd02
add esp, 0x28
cmp dword [ebp - 0xc], 0
jne 0x1002d194
xor eax, eax
jmp 0x1002d2b3
push 1
push dword [ebp - 0x10]
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x2390
call fcn.1002b6cf
add esp, 0x1c
push 1
push 0x759e
lea eax, [ebp + 8]
push eax
push 0x645e
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
call fcn.1002ce86
add esp, 0x18
push 0x6655
lea eax, [ebp - 0xc]
push eax
push 0x5366
push 1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
call fcn.1002cf5f
add esp, 0x18
cmp dword [ebp - 0x14], 0
je 0x1002d210
push 1
push dword [ebp - 4]
push dword [ebp - 0x14]
push 0x7672
call fcn.100272cf
add esp, 0x10
push dword [ebp - 4]
call fcn.1002a975
pop ecx
test eax, eax
jne 0x1002d224
xor eax, eax
jmp 0x1002d2b3
lea eax, [ebp - 4]
push eax
push 0x6970
push 0x343e
push 1
call fcn.1002cff4
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002d29b
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x1002d25b
xor eax, eax
jmp 0x1002d2b3
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1002d274
xor eax, eax
jmp 0x1002d2b3
lea eax, [ebp - 4]
push eax
push 0x581e
push 0x5d62
push 0x6fbb
push 0x3db0
push 0x531e
push 1
call fcn.1002d05d
add esp, 0x1c
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1002d2ac
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x1002d2b0
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x10041f21
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10041f7c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10041f5d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10041f7a
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10015a6e
mov dword [eax], 0xfffffffb
jmp 0x10041f52
jmp 0x10041f98
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10041f98
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esp, ebp
pop ebp
ret

Function at 0x10042167
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100421c2
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100421a3
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x100421c0
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10015a6e
mov dword [eax], 0x485bf25c
jmp 0x10042198
jmp 0x100421ec
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x100421ec
push 0xc60
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov esp, ebp
pop ebp
ret