joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100013cb
Capabilities:
Allocate or change rwx memory

Disassembly:
push ecx
push edi
xor edi, edi
cmp dword [0x10096ac4], edi
je 0x100013de
mov eax, 0x10dd
jmp 0x10001439
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0x10096ac4
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
test eax, eax
jne 0x100013d7
push esi
mov esi, dword [0x10096ab8]
mov dword [0x10096ac0], edi
mov dword [0x10096ad4], edi
mov dword [0x10096ad0], edi
mov dword [0x10096ac8], edi
mov dword [0x10096acc], edi
jmp 0x10001432
lea eax, [esp + 8]
push eax
push 0x40
push 0x10000
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, dword [esi + 4]
cmp esi, edi
jne 0x1000141c
xor eax, eax
pop esi
pop edi
pop ecx
ret

Function at 0x1000143c
Capabilities:
Resume thread

Disassembly:
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10096ac4], eax
je 0x10001452
mov eax, 0x10dd
pop ecx
ret
push ebx
push esi
mov esi, dword [0x10096ad4]
xor ebx, ebx
push edi
cmp esi, ebx
je 0x1000149d
lea eax, [esp + 0xc]
push eax
mov eax, dword [esi + 0x10]
push dword [esi + 0x14]
movzx eax, byte [eax + 0x17]
push eax
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [esi + 4], ebx
jne 0x1000148e
mov edi, dword [esi + 0x10]
cmp edi, ebx
je 0x1000148e
call fcn.10001347
mov dword [esi + 0x10], ebx
mov edi, dword [esi]
push esi
call fcn.1001970b
pop ecx
mov esi, edi
cmp edi, ebx
jne 0x10001461
mov dword [0x10096ad4], ebx
call fcn.10001142
mov esi, dword [0x10096ad0]
cmp esi, ebx
je 0x100014ca
push dword [esi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, dword [esi]
push esi
call fcn.1001970b
pop ecx
mov esi, edi
cmp edi, ebx
jne 0x100014b2
pop edi
pop esi
mov dword [0x10096ad0], ebx
mov dword [0x10096ac4], ebx
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x10001721
Capabilities:
Suspend thread

Disassembly:
mov eax, dword [0x10096ac8]
test eax, eax
jne 0x10001791
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov edi, dword [esp + 8]
cmp edi, eax
jne 0x1000173d
xor eax, eax
jmp 0x10001790
push esi
push 8
call fcn.10018f55
mov esi, eax
pop ecx
test esi, esi
jne 0x10001751
push 8
pop edi
jmp 0x1000176c
push edi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1000177d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
mov edi, eax
call fcn.1001970b
pop ecx
and dword [0x10096acc], 0
mov dword [0x10096ac8], edi
mov eax, edi
jmp 0x1000178f
mov eax, dword [0x10096ad0]
mov dword [esi], eax
mov dword [esi + 4], edi
mov dword [0x10096ad0], esi
xor eax, eax
pop esi
pop edi
ret 4
Function at 0x100019e5
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x10096ac4], eax
je 0x10001a01
mov eax, 0x10dd
jmp 0x10001ae4
mov eax, dword [0x10096ac8]
test eax, eax
jne 0x10001ae4
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x10001a1e
push 6
pop eax
jmp 0x10001ae3
cmp dword [edi], 0
jne 0x10001a36
push 6
pop eax
mov dword [0x10096ac8], eax
mov dword [0x10096acc], edi
jmp 0x10001ae3
push ebx
push esi
push 0x18
call fcn.10018f55
mov esi, eax
pop ecx
test esi, esi
jne 0x10001a4b
push 8
pop edi
jmp 0x10001ac6
mov edi, dword [edi]
push 0
push dword [ebp + 0xc]
call fcn.1000109f
mov ebx, dword [edi + 0x18]
pop ecx
pop ecx
movzx ecx, byte [edi + 0x17]
xor edx, edx
sub ebx, ecx
cmp ecx, edx
je 0x10001abb
cmp ecx, 0x17
ja 0x10001abb
cmp dword [edi + 0x1c], eax
jne 0x10001abb
lea eax, [ebp - 4]
push eax
push 0x40
push ecx
push ebx
mov dword [ebp - 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
jne 0x10001a91
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
jmp 0x10001ac6
mov eax, dword [ebp + 8]
mov dword [esi + 8], eax
mov dword [esi + 4], 1
mov dword [esi + 0x10], edi
mov dword [esi + 0xc], ebx
mov eax, dword [ebp - 4]
mov dword [esi + 0x14], eax
mov eax, dword [0x10096ad4]
mov dword [esi], eax
mov dword [0x10096ad4], esi
xor eax, eax
jmp 0x10001ae1
push 9
pop edi
cmp dword [0x10096ac0], edx
jne 0x10001acc
mov dword [0x10096ac8], edi
test esi, esi
je 0x10001ad7
push esi
call fcn.1001970b
pop ecx
mov eax, dword [ebp + 8]
mov dword [0x10096acc], eax
mov eax, edi
pop esi
pop ebx
pop edi
leave
ret 8
Function at 0x10002e60
Capabilities:
Allocate or change rwx memory
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10002f42
cmp dword [ebp - 4], 1
je 0x10002e81
jmp 0x10002fad
lea ecx, [ebp - 8]
push ecx
push 0x40
push 0x2b3ffe
push 0x401000
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp eax, 1
jne 0x10002f40
mov ecx, 0x1006f544
call fcn.100123b0
call fcn.10012b30
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x100130c0
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x10096654], eax
push 0
push 0
push 0x10013590
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x10096658], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x100137e0
push 7
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x1009665c], eax
push 0x1003c408
call fcn.10013d30
add esp, 4
test eax, eax
jle 0x10002f40
call fcn.100013cb
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10001721
push 0x10013df0
push 0x10096678
call fcn.10001af0
push 0x10013de0
push 0x1009667c
call fcn.10001af0
call fcn.10001ae8
jmp 0x10002fad
mov edx, dword [0x10096654]
push edx
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov eax, dword [0x10096658]
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov ecx, dword [0x1009665c]
push ecx
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
push str.WindowMode
call fcn.10013d30
add esp, 4
test eax, eax
jle 0x10002fad
call fcn.100013cb
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call fcn.10001721
push 0x10013df0
push 0x10096678
call fcn.100019e5
push 0x10013de0
push 0x1009667c
call fcn.100019e5
call fcn.10001ae8
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000c410
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov eax, dword [0x100510e4]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x2c], ecx
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
je 0x1000c437
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x1000c43e
mov al, 1
jmp 0x1000c512
call fcn.1000eb40
push eax
mov eax, dword [ebp - 0x2c]
mov edx, dword [eax]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edx + 0xc]
call eax
mov dword [ebp - 0x3c], eax
call fcn.1000eb40
mov dword [ebp - 0x40], eax
lea ecx, [ebp - 0x3c]
push ecx
lea edx, [ebp - 0x40]
push edx
call fcn.1000eba0
add esp, 8
movzx eax, al
test eax, eax
je 0x1000c47a
xor al, al
jmp 0x1000c512
mov dword [ebp - 0x48], 0x20
lea ecx, [ebp - 0x44]
push ecx
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x40
push ecx
mov edx, dword [ebp - 0x2c]
mov ecx, dword [edx + 0x38]
call fcn.10010ae0
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0
je 0x1000c4b6
cmp dword [ebp - 0x30], 1
je 0x1000c4bd
cmp dword [ebp - 0x30], 3
je 0x1000c50c
jmp 0x1000c510
mov eax, dword [ebp - 0x2c]
mov byte [eax + 0x3d], 0
mov ecx, dword [ebp - 0x44]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x34], ecx
je 0x1000c4ec
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x34]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.100202e5
add esp, 0x10
cmp dword [ebp - 0x34], eax
je 0x1000c4ec
xor al, al
jmp 0x1000c512
mov ecx, dword [ebp - 0x2c]
movzx edx, byte [ecx + 0x3d]
test edx, edx
jne 0x1000c500
mov dword [ebp - 0x38], 1
jmp 0x1000c507
mov dword [ebp - 0x38], 0
mov al, byte [ebp - 0x38]
jmp 0x1000c512
mov al, 1
jmp 0x1000c512
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10018f44
mov esp, ebp
pop ebp
ret
Function at 0x1000fcc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x100510e4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov dword [ebp - 0x2c], ecx
call fcn.1000eb40
mov dword [ebp - 0x44], eax
lea eax, [ebp + 8]
push eax
lea ecx, [ebp - 0x44]
push ecx
call fcn.1000eba0
add esp, 8
movzx edx, al
test edx, edx
je 0x1000fd05
lea eax, [ebp + 8]
push eax
call fcn.1000fb70
add esp, 4
jmp 0x1000fe86
mov ecx, dword [ebp - 0x2c]
call fcn.10010070
test eax, eax
je 0x1000fd47
mov ecx, dword [ebp - 0x2c]
call fcn.10010070
mov esi, eax
mov ecx, dword [ebp - 0x2c]
call fcn.1000eb80
cmp esi, eax
jae 0x1000fd47
lea ecx, [ebp + 8]
push ecx
call fcn.10010750
add esp, 4
mov bl, al
mov ecx, dword [ebp - 0x2c]
call fcn.1000d960
mov byte [eax], bl
mov eax, dword [ebp + 8]
jmp 0x1000fe86
mov edx, dword [ebp - 0x2c]
cmp dword [edx + 0x4c], 0
jne 0x1000fd5a
call fcn.1000eb40
jmp 0x1000fe86
mov ecx, dword [ebp - 0x2c]
call fcn.1000d9b0
mov eax, dword [ebp - 0x2c]
cmp dword [eax + 0x38], 0
jne 0x1000fda9
mov ecx, dword [ebp - 0x2c]
mov edx, dword [ecx + 0x4c]
push edx
lea eax, [ebp + 8]
push eax
call fcn.10010750
add esp, 4
movzx ecx, al
push ecx
call fcn.10004000
add esp, 8
movzx edx, al
test edx, edx
je 0x1000fd99
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
jmp 0x1000fda1
call fcn.1000eb40
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
jmp 0x1000fe86
mov dword [ebp - 0x50], 0x20
lea ecx, [ebp + 8]
push ecx
call fcn.10010750
add esp, 4
mov byte [ebp - 0x2e], al
lea edx, [ebp - 0x48]
push edx
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x28]
push ecx
lea edx, [ebp - 0x4c]
push edx
lea eax, [ebp - 0x2d]
push eax
lea ecx, [ebp - 0x2e]
push ecx
mov edx, dword [ebp - 0x2c]
add edx, 0x40
push edx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x38]
call fcn.1000fc80
mov dword [ebp - 0x34], eax
cmp dword [ebp - 0x34], 0
jl 0x1000fe81
cmp dword [ebp - 0x34], 1
jle 0x1000fe04
cmp dword [ebp - 0x34], 3
je 0x1000fe51
jmp 0x1000fe81
mov ecx, dword [ebp - 0x48]
lea edx, [ebp - 0x28]
sub ecx, edx
mov dword [ebp - 0x38], ecx
je 0x1000fe36
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp - 0x38]
push edx
push 1
lea eax, [ebp - 0x28]
push eax
call fcn.100202e5
add esp, 0x10
cmp dword [ebp - 0x38], eax
je 0x1000fe36
call fcn.1000eb40
jmp 0x1000fe86
mov ecx, dword [ebp - 0x2c]
mov byte [ecx + 0x3d], 1
lea edx, [ebp - 0x2e]
cmp dword [ebp - 0x4c], edx
je 0x1000fe4a
mov eax, dword [ebp + 8]
jmp 0x1000fe86
call fcn.1000eb40
jmp 0x1000fe86
mov eax, dword [ebp - 0x2c]
mov ecx, dword [eax + 0x4c]
push ecx
movzx edx, byte [ebp - 0x2e]
push edx
call fcn.10004000
add esp, 8
movzx eax, al
test eax, eax
je 0x1000fe74
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x40], ecx
jmp 0x1000fe7c
call fcn.1000eb40
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
jmp 0x1000fe86
call fcn.1000eb40
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10018f44
mov esp, ebp
pop ebp
ret 4
Function at 0x10010bf0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, 1
test eax, eax
je 0x10010d16
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x38], 0
je 0x10010c28
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.10010d30
jmp 0x10010d2a
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
call fcn.1000ceb0
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x10010cbc
jg 0x10010c50
cmp dword [ebp + 0xc], 0
jbe 0x10010cbc
cmp dword [ebp - 8], 0
jl 0x10010cbc
jg 0x10010c5e
cmp dword [ebp - 0xc], 0
jbe 0x10010cbc
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 8]
jg 0x10010c7c
jl 0x10010c70
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0xc]
jae 0x10010c7c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
push edx
mov ecx, dword [ebp - 4]
call fcn.1000f6e0
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.1000e6d0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x10]
sbb eax, dword [ebp - 8]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
call fcn.1000f320
cmp dword [ebp + 0x10], 0
jl 0x10010d06
jg 0x10010cca
cmp dword [ebp + 0xc], 0
jbe 0x10010d06
mov edx, dword [ebp - 4]
cmp dword [edx + 0x4c], 0
je 0x10010d06
mov ecx, dword [ebp - 4]
call fcn.1000d9b0
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.1001fc78
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
jmp 0x10010d2a
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.10010d30
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10010e50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], ecx
mov eax, 1
test eax, eax
je 0x10010f6e
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x38], 0
je 0x10010e88
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 4]
call fcn.10010f90
jmp 0x10010f82
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
call fcn.1000d930
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edx
cmp dword [ebp + 0x10], 0
jl 0x10010f1c
jg 0x10010eb0
cmp dword [ebp + 0xc], 0
jbe 0x10010f1c
cmp dword [ebp - 8], 0
jl 0x10010f1c
jg 0x10010ebe
cmp dword [ebp - 0xc], 0
jbe 0x10010f1c
mov ecx, dword [ebp + 0x10]
cmp ecx, dword [ebp - 8]
jg 0x10010edc
jl 0x10010ed0
mov edx, dword [ebp + 0xc]
cmp edx, dword [ebp - 0xc]
jae 0x10010edc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.10010070
push eax
call fcn.1000e6d0
add esp, 0xc
mov ecx, dword [ebp - 0xc]
add ecx, dword [ebp + 8]
mov dword [ebp + 8], ecx
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x10]
sbb eax, dword [ebp - 8]
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 4]
call fcn.10010010
cmp dword [ebp + 0x10], 0
jl 0x10010f5e
jg 0x10010f2a
cmp dword [ebp + 0xc], 0
jbe 0x10010f5e
mov edx, dword [ebp - 4]
cmp dword [edx + 0x4c], 0
je 0x10010f5e
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x4c]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.100202e5
add esp, 0x10
xor ecx, ecx
mov edx, dword [ebp + 0xc]
sub edx, eax
mov eax, dword [ebp + 0x10]
sbb eax, ecx
mov dword [ebp + 0xc], edx
mov dword [ebp + 0x10], eax
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x10]
sbb edx, dword [ebp + 0x10]
jmp 0x10010f82
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
call fcn.10010f90
mov esp, ebp
pop ebp
ret 0xc

Function at 0x10012320
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0x1003c788
call dword [sym.imp.USER32.dll_FindWindowA]
mov dword [0x10096650], eax
mov eax, 1
shl eax, 0
movzx ecx, byte [eax + 0x10096670]
test ecx, ecx
jne 0x10012365
mov edx, dword [0x10096650]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
mov eax, dword [0x10096650]
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
jmp 0x100123a7
mov ecx, dword [0x10096650]
push ecx
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov edx, dword [0x10096650]
push edx
call dword [sym.imp.USER32.dll_SetActiveWindow]
mov eax, dword [0x10096650]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
push 1
mov ecx, dword [0x10096650]
push ecx
call dword [sym.imp.USER32.dll_ShowWindow]
mov edx, dword [0x10096650]
push edx
call dword [sym.imp.USER32.dll_UpdateWindow]
pop ebp
ret
Function at 0x10012440
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
push eax
push 0
push 0
push 0x10012400
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 4]
cmp dword [edx + 4], 0
jne 0x10012471
xor al, al
jmp 0x10012480
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x10013d30
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 4
lea eax, [ebp - 8]
push eax
push str.SoftwareWebzenMUConfig
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10013d89
lea ecx, [ebp - 0xc]
push ecx
lea edx, [ebp - 4]
push edx
push 0
push 0
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 8]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10013d7f
mov eax, dword [ebp - 4]
jmp 0x10013d8b
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1002d352
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002d1c8
Function at 0x402a6c
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00404034
test esi, esi
jne 0x402aa2
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00404124
jmp 0x402ac0
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402980
mov edi, eax
test esi, esi
je 0x402ac0
cmp dword [ebx], 0
je 0x402ac0
dec esi
jmp 0x402aa9
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x403154
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x47e020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4031ec
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4031cc
xor eax, eax
push ebp
push 0x4031c5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x403208
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4031cc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x47e020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x47e020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403eb8
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x48004c], 0
je 0x403f19
cmp word [0x480220], 0xd7b2
jne 0x403ee1
cmp dword [0x480228], 0
jbe 0x403ee1
mov eax, 0x48021c
call dword [0x480238]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x47e06c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403f40
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x47e030], 0
jne 0x403f35
push 0
push 0x47e064
push 0x47e06c
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x405e5c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x405ec2
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.004042a4
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402d18
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x405eac
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x405ec9
lea eax, [ebp - 0x10]
call fcn.00404034
ret

Function at 0x40b22c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b265
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00404124
jmp 0x40b26e
mov eax, ebx
mov edx, esi
call fcn.00404088
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x40b278
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40b299
mov al, byte [esp]
jmp 0x40b29b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x40b920
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x40b798
mov eax, dword [0x47fb88]
cmp byte [eax], 0
je 0x40b99c
mov eax, dword [0x47f968]
call fcn.00402b84
call fcn.004028ac
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00408a6c
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40b9e4
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x40b9d2
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x47f910]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x480668]
call fcn.00405354
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret