joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1019ad0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x103b444]
xor eax, ebp
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x25c], ecx
mov dword [ebp - 0xc], 1
mov ecx, 0x103bc00
call fcn.0101a0a0
mov dword [ebp - 8], eax
push 0xf0
movzx eax, word [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1019c87
mov edx, dword [ebp - 4]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1019c87
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1019c87
cmp dword [ebp - 0xc], 0
je 0x1019c87
mov edx, dword [ebp - 0x14]
movzx eax, word [edx]
test eax, eax
je 0x1019c87
mov ecx, dword [ebp - 0x14]
mov dx, word [ecx]
mov word [ebp - 0x1c], dx
mov eax, dword [ebp - 0x14]
add eax, 2
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov dx, word [ecx]
mov word [ebp - 0x20], dx
mov eax, dword [ebp - 0x14]
add eax, 2
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 0x14]
add eax, 4
mov dword [ebp - 0x14], eax
movzx ecx, word [ebp - 0x20]
cmp ecx, 0x403
jne 0x1019bfb
mov edx, dword [ebp - 0x14]
push edx
lea ecx, [ebp - 0x130]
call fcn.01019e80
lea ecx, [ebp - 0x130]
call fcn.01024680
push eax
push 0
push 0x143
movzx eax, word [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0x25c]
add ecx, 4
call fcn.0101a710
cmp eax, 0xffffffff
jne 0x1019bee
mov dword [ebp - 0xc], 0
lea ecx, [ebp - 0x130]
call fcn.01019ec0
jmp 0x1019c79
movzx ecx, word [ebp - 0x20]
cmp ecx, 0x1234
jne 0x1019c79
mov dword [ebp - 0x154], 1
mov dword [ebp - 0x150], 0xffffffff
mov edx, dword [ebp - 0x14]
push edx
lea ecx, [ebp - 0x258]
call fcn.01019e80
mov dword [ebp - 0x260], eax
mov ecx, dword [ebp - 0x260]
call fcn.01024680
mov dword [ebp - 0x14c], eax
lea ecx, [ebp - 0x258]
call fcn.01019ec0
lea eax, [ebp - 0x154]
push eax
push 0
push 0x40b
movzx ecx, word [ebp - 0x1c]
push ecx
mov ecx, dword [ebp - 0x25c]
add ecx, 4
call fcn.0101a710
cmp eax, 0xffffffff
jne 0x1019c79
mov dword [ebp - 0xc], 0
mov edx, dword [ebp - 0x14]
add edx, dword [ebp - 0x18]
mov dword [ebp - 0x14], edx
jmp 0x1019b52
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
xor ecx, ebp
call fcn.0102c711
mov esp, ebp
pop ebp
ret 4
Function at 0x101bab0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
call fcn.01009f90
call fcn.01025250
mov dword [ebp - 4], eax
push 5
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.01009f30
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x101bbde
push 0xf0
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call fcn.01009f30
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0x1c], 0
je 0x101bb28
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], 0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x101bbc5
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
je 0x101bbba
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x20]
push edx
call fcn.010099e0
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x24]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.USER32.dll_CreateDialogIndirectParamW]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 4]
push edx
call fcn.0101bbf0
movzx eax, al
test eax, eax
jne 0x101bb9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x24]
cmp ecx, dword [ebp - 0x20]
je 0x101bbb8
mov edx, dword [ebp - 0x24]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalHandle]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
jmp 0x101bbc3
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
jmp 0x101bbce
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x101bbde
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret 0x14
Function at 0x101c450
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x103b444]
xor eax, ebp
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x274], ecx
mov dword [ebp - 0x60], 0
push 0x40
push 0
lea eax, [ebp - 0x5c]
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x14], 0
xor ecx, ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], ecx
push 0
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov dword [ebp - 0x60], 0x44
movsx edx, word [0x103b014]
and edx, 0xffff
movzx eax, dx
movsx ecx, word [0x103b018]
and ecx, 0xffff
movzx edx, cx
shl edx, 0x10
or eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x274]
mov ecx, dword [eax + 0x220]
call fcn.0101cb80
push eax
mov ecx, dword [ebp - 4]
push ecx
push 0x10021f4
push 0x208
lea edx, [ebp - 0x270]
push edx
call fcn.0101ca30
add esp, 0x14
xor eax, eax
mov word [ebp - 0x6a], ax
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x60]
push edx
push 0
push 0
push 0
push 0
push 0
push 0
lea eax, [ebp - 0x270]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
cmp dword [ebp - 0x14], 0
je 0x101c53a
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x10], 0
je 0x101c551
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [ebp - 0x10], 0
xor eax, eax
mov ecx, dword [ebp - 0x64]
xor ecx, ebp
call fcn.0102c711
mov esp, ebp
pop ebp
ret 0x10
Function at 0x101d180
Capabilities:
Inspect load icon resource

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
push ecx
mov ecx, dword [0x103b510]
call fcn.01015eb0
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.0100fbb0
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
mov ecx, 0x103b5ac
call fcn.0101e530
mov eax, dword [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.0100fbd0
push 0x65
mov ecx, dword [0x103b53c]
push ecx
call dword [sym.imp.USER32.dll_LoadIconW]
mov dword [ebp - 8], eax
push 1
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.0101e500
push 0
push 0x8000000
push 0
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.0101c930
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov dword [ebp - 4], 0
call dword [sym.imp.UxTheme.dll_IsThemeActive]
test eax, eax
je 0x101d231
lea edx, [ebp - 4]
push edx
call dword [sym.imp.dwmapi.dll_DwmIsCompositionEnabled]
test eax, eax
jl 0x101d231
cmp dword [ebp - 4], 1
je 0x101d248
push 0x20
push 0x800000
push 0x40000
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.0101c8b0
mov ecx, dword [ebp - 0x10]
call fcn.0101da40
mov ecx, dword [ebp - 0x10]
call fcn.0101daf0
mov ecx, dword [ebp - 0x10]
call fcn.0101dd90
mov ecx, dword [ebp - 0x10]
call fcn.0101d8d0
mov ecx, dword [ebp - 0x10]
call fcn.0101dee0
push 0
push 0x32
push 0x42b
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.0101e4a0
push 0
push 0xfffffffffffffffc
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 4]
push ecx
push 6
call dword [sym.imp.USER32.dll_NotifyWinEvent]
cmp dword [0x103b554], 0
je 0x101d2e9
cmp dword [0x103b584], 0
je 0x101d2e2
push 0x1001810
push 0x103b560
call fcn.0101d300
movzx edx, al
test edx, edx
je 0x101d2e2
mov eax, dword [0x103b554]
push eax
push 0x1001810
mov ecx, dword [0x103b55c]
push ecx
mov edx, dword [0x103b558]
push edx
call fcn.0101d3a0
mov dword [ebp - 0x14], eax
jmp 0x101d2e9
mov dword [ebp - 0x14], 0
xor eax, eax
mov esp, ebp
pop ebp
ret 0x10
Function at 0x101e1c0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov dword [ebp - 4], 4
lea eax, [ebp - 4]
push eax
lea ecx, [ebp - 0xc]
push ecx
push 0
push 0x18
mov edx, dword [0x1002304]
push edx
mov eax, dword [0x1002300]
push eax
push 0x80000001
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetValueW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x101e23d
mov ecx, dword [ebp - 0xc]
and ecx, 1
neg ecx
sbb ecx, ecx
neg ecx
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x7c], ecx
mov eax, dword [ebp - 0xc]
and eax, 2
neg eax
sbb eax, eax
neg eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x80], eax
mov edx, dword [ebp - 0xc]
and edx, 4
neg edx
sbb edx, edx
neg edx
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x84], edx
jmp 0x101e261
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x7c], 1
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x80], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x84], 0
mov ecx, dword [ebp - 0x10]
cmp dword [ecx + 0x84], 0
je 0x101e35a
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 0
push 0
push 0x20
mov eax, dword [0x1002308]
push eax
mov ecx, dword [0x1002300]
push ecx
push 0x80000001
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetValueW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x101e34d
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ole32.dll_CoTaskMemAlloc]
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x88], eax
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x88], 0
je 0x101e33e
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx + 0x88]
push edx
push 0
push 0x20
mov eax, dword [0x1002308]
push eax
mov ecx, dword [0x1002300]
push ecx
push 0x80000001
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetValueW]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x101e33c
mov edx, dword [ebp - 0x10]
cmp dword [edx + 0x88], 0
je 0x101e322
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x88]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x88], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x88], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x84], 0
jmp 0x101e34b
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x84], 0
jmp 0x101e35a
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x84], 0
mov esp, ebp
pop ebp
ret
Function at 0x101f970
Capabilities:
Create process on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1035c58
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x103b444]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], ecx
lea ecx, [ebp - 0x14]
call fcn.0101cba0
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov byte [ebp - 4], 1
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x24]
call fcn.0101cb80
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
push ecx
push 0x10023a8
lea edx, [ebp - 0x14]
push edx
call fcn.0101c800
add esp, 0xc
jmp 0x101fa0c
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
jl 0x101fa35
push 1
push 0
lea ecx, [ebp - 0x14]
call fcn.01024680
push eax
push 0x1002390
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x20], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0101ad70
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10

Function at 0x101fd70
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x214], 0
je 0x101fd8d
mov ecx, dword [ebp - 4]
call fcn.0101fde0
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x214], 0
jne 0x101fdcb
push 0
push 0
mov edx, dword [ebp - 4]
push edx
push 0x101fe70
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x214], eax
push 2
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x214]
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov esp, ebp
pop ebp
ret

Function at 0x101feb0
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x103b444]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], 0x208
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x210]
push ecx
push 0
push 0xffff
push 0x1001960
push 0x10023d8
push 0x80000001
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegGetValueW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x101ff46
mov edx, dword [ebp - 0x21c]
cmp dword [edx + 0x24], 0
je 0x101ff46
mov eax, dword [ebp - 0x21c]
mov ecx, dword [eax + 0x218]
push ecx
push 1
push 0
lea edx, [ebp - 0x210]
push edx
mov eax, dword [ebp - 0x21c]
mov ecx, dword [eax + 0x24]
call fcn.0101aa90
push eax
call fcn.01034530
push 0
push 0
push 0x409
mov ecx, dword [ebp - 0x21c]
add ecx, 4
call fcn.0101a570
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0102c711
mov esp, ebp
pop ebp
ret
Function at 0x1022d10
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 0x14], ecx
xor eax, eax
jne 0x1022d1b
xor ecx, ecx
jne 0x1022d1b
xor edx, edx
cmp dword [ebp + 0xc], 0
setne dl
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0
jne 0x1022d3f
push 0x80004005
call fcn.01007f50
xor eax, eax
jne 0x1022d23
mov dword [ebp - 4], 0
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 8]
lea edx, [ecx + eax*2]
mov dword [ebp - 8], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2]
mov dword [ebp - 4], edx
cmp dword [ebp - 0xc], 1
jne 0x1022d50
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 0xc]
push ecx
push 7
push 0
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
push ecx
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret 8
Function at 0x1025350
Capabilities:
Access peb ldr_data
Get kernel32 base address
Get process heap flags

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1036011
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x103b444]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.01023950
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x1002564
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.01027180
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.01027240
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.01027240
mov byte [ebp - 4], 2
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 0xc]
mov dword [edx + 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x14], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.0101a8a0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x30], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x34], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x38], 4
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x3c], 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x40], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x44], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x48], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x4c], 1
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x50], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x54], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x58], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x60
mov edx, dword [0x1002554]
mov dword [ecx], edx
mov eax, dword [0x1002558]
mov dword [ecx + 4], eax
mov edx, dword [0x100255c]
mov dword [ecx + 8], edx
mov eax, dword [0x1002560]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x70], 1
push 0x103b7f4
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
cmp dword [0x103b7e4], 0
jne 0x1025499
push 0x103b7e4
call dword [sym.imp.ole32.dll_CoCreateGuid]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret 8
Function at 0x1026810
Capabilities:
Access peb ldr_data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10360cb
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x103b444]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.01023950
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.01023950
mov eax, dword [ebp - 0x10]
mov dword [eax], 0x10025ac
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 4], 0x1002598
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.01027240
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xc
call fcn.0101a8a0
mov ecx, dword [ebp - 0x10]
add ecx, 0x24
call fcn.010246e0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x30], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x34], 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x38], 1
push 0x103b7f8
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1028e10
Capabilities:
Create process on windows
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10363b8
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x103b444]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], ecx
mov eax, dword [ebp - 0x20]
mov ecx, dword [eax + 0x20]
call fcn.01016b90
test eax, eax
je 0x1028e6d
push 1
push 0
push 0x1002680
push 0x1002390
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1028f64
mov ecx, dword [ebp - 0x20]
cmp dword [ecx + 0x298], 0
je 0x1028f1a
lea ecx, [ebp - 0x14]
call fcn.0101cba0
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], 0
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x20]
mov eax, dword [edx + 0x29c]
push eax
push 0x1002650
lea ecx, [ebp - 0x14]
push ecx
call fcn.0101c800
add esp, 0xc
jmp 0x1028ee0
mov dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0
jl 0x1028f09
push 1
push 0
lea ecx, [ebp - 0x14]
call fcn.01024680
push eax
push 0x1002390
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.0101ad70
jmp 0x1028f64
mov edx, dword [ebp - 0x20]
cmp dword [edx + 0x2bc], 0
je 0x1028f64
mov eax, dword [ebp - 0x20]
cmp dword [eax + 0x2b4], 0
je 0x1028f64
push 4
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x2b4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x13
push 0
push 0
push 0
push 0
mov eax, dword [0x103b514]
push eax
mov ecx, dword [ebp - 0x20]
mov edx, dword [ecx + 0x2b4]
push edx
call dword [sym.imp.USER32.dll_SetWindowPos]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10295d0
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0x1c]
call fcn.0102a290
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x298], 0
jne 0x1029604
mov ecx, dword [ebp - 0x1c]
call fcn.01016b70
test eax, eax
jne 0x1029604
mov dword [ebp - 0x20], 1
jmp 0x102960b
mov dword [ebp - 0x20], 0
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 0x2c0]
je 0x1029748
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 4]
mov dword [ecx + 0x2c0], edx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + 0x28]
call fcn.01022f10
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x1c]
cmp dword [ecx + 0x2c0], 0
je 0x10296de
push 0xfffffffffffffff0
push 0x190
lea edx, [ebp - 0x10]
push edx
mov ecx, dword [ebp - 0x1c]
add ecx, 4
call fcn.010111e0
mov ecx, eax
call fcn.0102a8d0
or eax, 0x800
push eax
push 0xfffffffffffffff0
push 0x190
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 4
call fcn.010111e0
mov ecx, eax
call fcn.0100e0b0
push 0
mov ecx, dword [ebp - 0x1c]
add ecx, 0x198
call fcn.01024680
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
push 0x190
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 4
call fcn.010111e0
mov ecx, eax
call fcn.01024680
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 0
push 0xa
mov ecx, dword [ebp - 0x1c]
add ecx, 0x198
call fcn.0101a540
jmp 0x102973f
mov edx, dword [ebp - 8]
push edx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x194
call fcn.0102ffb0
push 0
push 0x190
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 4
call fcn.010111e0
mov ecx, eax
call fcn.01024680
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 5
mov ecx, dword [ebp - 0x1c]
add ecx, 0x198
call fcn.01024680
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push 1
push 0xa
mov ecx, dword [ebp - 0x1c]
add ecx, 0x198
call fcn.0101a540
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 8]
mov dword [ecx + 0x64], edx
mov esp, ebp
pop ebp
ret

Function at 0x102aae0
Capabilities:
Enumerate gui resources

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
xor eax, eax
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
lea eax, [ebp - 8]
push eax
push 0x102aa10
call dword [sym.imp.USER32.dll_EnumWindows]
cmp dword [ebp - 4], 0
je 0x102ab2e
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp - 4]
mov dword [ecx], edx
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 0xc]
mov esp, ebp
pop ebp
ret 8