joyce8/EMBER2024-capa huggingface dataset:
Function at 0x479940
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x30
mov ecx, dword [esp + 0x38]
push ebx
push ebp
mov ebp, dword [esp + 0x3c]
xor ebx, ebx
push esi
mov esi, dword [esp + 0x48]
push edi
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], 1
mov dword [esp + 0x1c], ebx
mov edi, ecx
cmp byte [0x4a56e1], bl
je 0x479ad8
mov eax, dword [0x4a56e4]
cmp eax, ebx
je 0x479ad8
mov edx, 3
mov word [eax + 0x38], dx
mov dword [eax + 0x40], ecx
mov word [eax + 0x98], dx
call dword [0x483304]
mov edx, dword [0x4a56e4]
mov dword [edx + 0xa0], eax
mov eax, 3
mov word [edx + 0xa8], ax
mov ecx, dword [ebp + 0xec]
push ecx
call 0x4397dc
mov dword [edx + 0xb0], eax
cmp esi, ebx
je 0x479a58
mov ecx, dword [esi + 4]
mov ebx, dword [0x483430]
mov eax, 8
mov word [esp + 0x20], ax
lea eax, [esp + 0x20]
push eax
add edx, 0x68
push edx
mov dword [esp + 0x30], ecx
call ebx
mov eax, dword [0x4a56e4]
mov ecx, dword [esi + 8]
lea edx, [esp + 0x20]
push edx
add eax, 0x58
push eax
mov dword [esp + 0x30], ecx
call ebx
mov eax, dword [0x4a56e4]
mov ecx, dword [esi + 0xc]
lea edx, [esp + 0x20]
push edx
add eax, 0x78
push eax
mov dword [esp + 0x30], ecx
call ebx
mov eax, dword [0x4a56e4]
mov ecx, 3
mov word [eax + 0x88], cx
mov edx, dword [esi + 0x10]
mov dword [eax + 0x90], edx
mov word [eax + 0xb8], cx
movzx ecx, word [esi]
test cx, cx
je 0x479a49
movzx esi, cx
jmp 0x479a4c
mov esi, dword [esi + 0x1c]
mov dword [eax + 0xc0], esi
test esi, esi
je 0x479a58
mov edi, esi
mov eax, dword [esp + 0x50]
test eax, eax
je 0x479a6d
mov edi, eax
lea ebx, [esp + 0x10]
call fcn.0040fb10
jmp 0x479a8c
push edi
lea edx, [esp + 0x34]
push edx
call 0x44d05e
mov edi, eax
lea esi, [esp + 0x10]
call 0x40fa60
lea ecx, [esp + 0x30]
call fcn.00402130
mov eax, dword [0x4a56e4]
add eax, 0x48
push eax
lea ecx, [esp + 0x14]
push ecx
call fcn.00478220
mov ecx, dword [0x4a56e4]
mov edx, dword [ecx]
mov eax, dword [edx + 0x20]
add esp, 8
call eax
mov edx, dword [ebp]
mov ecx, dword [esp + 0x48]
mov eax, dword [edx + 4]
push 0
push ecx
add eax, ebp
call fcn.00403c50
lea esi, [esp + 0x10]
call fcn.00404420
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x30
ret 0x14
mov eax, dword [ebp]
mov eax, dword [eax + 4]
push ebx
push ecx
add eax, ebp
call fcn.00403c50
cmp byte [esp + 0x54], bl
je 0x479ac3
lea esi, [esp + 0x10]
call fcn.00404420
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x30
ret 0x14
Function at 0x4baee0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x78000]
push edi
or ebp, 0xffffffff
jmp 0x4baf02
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4baf09
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4baef8
mov eax, 1
add ebx, ebx
jne 0x4baf1b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4baf2c
jne 0x4baf4b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4baf4b
dec eax
add ebx, ebx
jne 0x4baf38
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x4baf10
add ebx, ebx
jne 0x4baf47
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x4baf9d
xor ecx, ecx
sub eax, 3
jb 0x4baf63
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4bafd2
sar eax, 1
mov ebp, eax
jmp 0x4baf6e
add ebx, ebx
jne 0x4baf6e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4baf3c
inc ecx
add ebx, ebx
jne 0x4baf7c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4baf3c
add ebx, ebx
jne 0x4baf89
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x4baf7e
jne 0x4baf9a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4baf7e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x4bafbc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x4bafae
jmp 0x4baefe
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x4bafbc
add edi, ecx
jmp 0x4baefe
pop esi
mov edi, esi
mov ecx, 0x370c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4bafda
cmp byte [edi], 0x4a
jne 0x4bafda
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4bafdf
lea edi, [esi + 0xb6000]
mov eax, dword [edi]
or eax, eax
je 0x4bb057
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xc763c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xc7790]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4bb00c
mov ecx, edi
jns 0x4bb03b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xc7794]
or eax, eax
je 0x4bb051
mov dword [ebx], eax
add ebx, 4
jmp 0x4bb029
call dword [esi + 0xc77a4]
mov ebp, dword [esi + 0xc7798]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x4bb08b
sub esp, 0xffffff80
jmp 0x417850
Function at 0x668011d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [ebp - 4]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x40
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
mov eax, dword [ebp + 0x10]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._memcpy
lea eax, [ebp - 4]
mov dword [esp + 0xc], eax
mov eax, dword [ebp - 4]
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_VirtualProtect
sub esp, 0x10
leave
ret
Function at 0x6680160b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_DisableThreadLibraryCalls
sub esp, 4
cmp dword [ebp + 0xc], 1
jne 0x668018a8
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], str._Ipay_Hackz2013
mov dword [esp + 4], str.Credit_By_:_Rezaldy_Yusuf
mov dword [esp], 0
call sub.USER32.dll_MessageBoxA
sub esp, 0x10
mov dword [esp + 0xc], 0x40
mov dword [esp + 8], str.Ipay_Cheats
mov dword [esp + 4], str.Ipay_Cheat_n_nwww.IpayHacker.blogspot.com_n_nHotkey__Fiture_:_n___All_Fiture_:_F1
mov dword [esp], 0
call sub.USER32.dll_MessageBoxA
sub esp, 0x10
mov dword [esp + 0xc], 0x30
mov dword [esp + 8], str.Happy_Cheat
mov dword [esp + 4], str.Aktifkan_cheat_pada_saat_Loading_HackShield_muncul
mov dword [esp], 0
call sub.USER32.dll_MessageBoxA
sub esp, 0x10
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], sym._SagaHacy
mov dword [esp + 4], 0
mov dword [esp], 0
call sub.KERNEL32.dll_CreateThread
sub esp, 0x18
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x118]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.KERNEL32.dll_GetModuleFileNameA
sub esp, 0xc
lea eax, [ebp - 0x118]
mov dword [esp + 4], str.IpayHack.dll
mov dword [esp], eax
call sym._strstr
test eax, eax
jne 0x668018a8
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.Deteckor
mov dword [esp + 4], str.Ente_Leacher__
mov dword [esp], 0
call sub.USER32.dll_MessageBoxA
sub esp, 0x10
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.Deteckor
mov dword [esp + 4], str.Ente_Leacher__
mov dword [esp], 0
call sub.USER32.dll_MessageBoxA
sub esp, 0x10
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.Deteckor
mov dword [esp + 4], str.Ente_Leacher__
mov dword [esp], 0
call sub.USER32.dll_MessageBoxA
sub esp, 0x10
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.Deteckor
mov dword [esp + 4], str.Ente_Leacher__
mov dword [esp], 0
call sub.USER32.dll_MessageBoxA
sub esp, 0x10
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.Deteckor
mov dword [esp + 4], str.Ente_Leacher__
mov dword [esp], 0
call sub.USER32.dll_MessageBoxA
sub esp, 0x10
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.Deteckor
mov dword [esp + 4], str.Ente_Leacher__
mov dword [esp], 0
call sub.USER32.dll_MessageBoxA
sub esp, 0x10
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.Deteckor
mov dword [esp + 4], str.Ente_Leacher__
mov dword [esp], 0
call sub.USER32.dll_MessageBoxA
sub esp, 0x10
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.Deteckor
mov dword [esp + 4], str.Ente_Leacher__
mov dword [esp], 0
call sub.USER32.dll_MessageBoxA
sub esp, 0x10
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.Deteckor
mov dword [esp + 4], str.Udah_dikasih_kok_rename__
mov dword [esp], 0
call sub.USER32.dll_MessageBoxA
sub esp, 0x10
mov dword [esp + 0xc], 0x10
mov dword [esp + 8], str.Deteckor
mov dword [esp + 4], str.Dadah___nKompimu_aku_Restart_ya
mov dword [esp], 0
call sub.USER32.dll_MessageBoxA
sub esp, 0x10
mov dword [esp], 0
call sub.KERNEL32.dll_ExitProcess
leave
ret 0xc
Function at 0x66801eb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp sym.___do_sjlj_init

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x11167016
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x76895e3c
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
jmp 0x431219
Function at 0x10022186
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100221d3
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov eax, dword [eax + 0x14]
add eax, dword [ecx + 0x10]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push dword [eax + 0x14]
call fcn.1001d72a
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
jmp 0x100221f3
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x100221f3
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esp, ebp
pop ebp
ret
Function at 0x10022679
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
movzx eax, byte [ebp + 0x34]
test eax, eax
je 0x100227e3
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x74], eax
xor eax, eax
jne 0x10022766
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x50]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x54]
mov ecx, dword [ecx]
cmp dword [eax], ecx
je 0x10022732
mov dword [ebp - 8], 1
jmp 0x10022736
and dword [ebp - 8], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
add eax, dword [ebp - 8]
cmp eax, 5
jne 0x1002274c
mov dword [ebp - 0x58], 1
jmp 0x10022750
and dword [ebp - 0x58], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp - 0x5c]
cmp dword [eax], 1
jg 0x10022766
and dword [ebp - 0x10], 0
jmp 0x1002276d
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
cmp dword [ebp - 0x10], eax
jge 0x10022780
mov dword [ebp - 0x18], 1
jmp 0x10022784
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
imul eax, dword [ebp - 0x18]
add eax, 0x59ba
jmp 0x1002279d
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x60]
mov eax, dword [eax]
cmp dword [ebp - 0x1c], eax
jg 0x100227b4
mov dword [ebp - 0x20], 1
jmp 0x100227b8
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x64]
mov eax, dword [eax]
cmp dword [ebp - 0x20], eax
jg 0x100227cb
mov dword [ebp - 0x68], 1
jmp 0x100227cf
and dword [ebp - 0x68], 0
mov eax, dword [ebp - 0x6c]
mov eax, dword [eax]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp - 0x70]
mov ecx, dword [ebp - 0x74]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x100227eb
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esp, ebp
pop ebp
ret
Function at 0x10022cd7
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10022d32
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10022d13
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10022d30
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10028ca7
mov dword [eax], 8
jmp 0x10022d08
jmp 0x10022d4b
push 0x400
push 0x1b7f
push 0
push 0x2219
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov esp, ebp
pop ebp
ret
Function at 0x1003146d
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10031494
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1003148f
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x10031540
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [eax], 3
jmp 0x100314da
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xffffffe8
je 0x10031540
mov dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x10], eax
je 0x1003150a
mov dword [ebp - 0x14], 1
jmp 0x1003150e
and dword [ebp - 0x14], 0
xor eax, eax
inc eax
sub eax, dword [ebp - 0x14]
cmp eax, 9
jbe 0x10031522
mov dword [ebp - 0xc], 1
jmp 0x10031526
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp - 0x30]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
jmp 0x100314cf
mov esp, ebp
pop ebp
ret
Function at 0x10036356
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1003637a
xor eax, eax
jmp 0x100364e8
lea eax, [ebp + 8]
push eax
push 0x549
push 0x2f9e
push 0x3140
lea eax, [ebp - 8]
push eax
push 1
lea eax, [ebp - 0x10]
push eax
push 0x31f
push 0x6693
call fcn.10036065
add esp, 0x24
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x100363bb
xor eax, eax
jmp 0x100364e8
lea eax, [ebp - 0xc]
push eax
push 1
push dword [ebp - 8]
call fcn.10035dbc
add esp, 0xc
cmp dword [ebp - 0xc], 0
jne 0x100363d9
xor eax, eax
jmp 0x100364e8
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 4]
push eax
call fcn.1003610c
add esp, 0x18
push 0x5654
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 4]
push eax
call fcn.10036188
add esp, 0x14
push 0x7f0
lea eax, [ebp - 8]
push eax
push 0x6a18
lea eax, [ebp - 0x14]
push eax
push 0x6d59
lea eax, [ebp - 0xc]
push eax
push 0
call fcn.100364ec
add esp, 0x1c
cmp dword [ebp - 0x14], 0
je 0x10036454
lea eax, [ebp - 0x14]
push eax
push 0x1453
push 1
lea eax, [ebp - 4]
push eax
call fcn.100361f5
add esp, 0x10
push dword [ebp - 4]
call fcn.10035cac
pop ecx
test eax, eax
jne 0x10036468
xor eax, eax
jmp 0x100364e8
push 0x65a5
push 0x7346
lea eax, [ebp - 4]
push eax
push 1
call fcn.10036260
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x100364d0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x1003649f
xor eax, eax
jmp 0x100364e8
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x100364b8
xor eax, eax
jmp 0x100364e8
push 0x6f54
push 1
lea eax, [ebp - 4]
push eax
push 0x7947
call fcn.100362df
add esp, 0x10
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x100364e1
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x100364e5
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x1003c6f2
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1003c716
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1003c71e
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esp, ebp
pop ebp
ret

Function at 0x10040098
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100400c4
push 0x400
push 0x1b7f
push 0
push 0x2219
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x10040166
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x10040101
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x10040101
mov dword [ebp - 0xc], 1
jmp 0x10040105
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x10040115
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x10040126
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x10040126
mov dword [ebp - 0x20], 1
jmp 0x1004012a
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 4]
imul eax, dword [eax], 0x6c3a
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x10040151
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x10040151
mov dword [ebp - 0x10], 1
jmp 0x10040155
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0xc]
imul eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x10055bcd
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10055c28
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10055c09
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10055c26
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10028ca7
mov dword [eax], 0xe7d214c4
jmp 0x10055bfe
jmp 0x10055c48
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10055c48
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esp, ebp
pop ebp
ret