joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4eaad0
Capabilities:
Get mac address on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f9733
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x544af0]
xor eax, ebp
mov dword [ebp - 0x14], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x40], 0
lea ecx, [ebp - 0x30]
call fcn.00407bf0
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x38], 0
lea eax, [ebp - 0x38]
push eax
push 0
call sub.IPHLPAPI.DLL_GetAdaptersInfo
mov dword [ebp - 0x3c], eax
cmp dword [ebp - 0x3c], 0
je 0x4eab62
cmp dword [ebp - 0x3c], 0x6f
je 0x4eab62
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004029a0
mov edx, dword [ebp - 0x40]
or edx, 1
mov dword [ebp - 0x40], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00402bf0
mov eax, dword [ebp + 8]
jmp 0x4eac97
mov eax, dword [ebp - 0x38]
push eax
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x4eaba3
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004029a0
mov edx, dword [ebp - 0x40]
or edx, 1
mov dword [ebp - 0x40], edx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00402bf0
mov eax, dword [ebp + 8]
jmp 0x4eac97
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call sub.IPHLPAPI.DLL_GetAdaptersInfo
test eax, eax
je 0x4eabea
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp + 8]
call fcn.004029a0
mov ecx, dword [ebp - 0x40]
or ecx, 1
mov dword [ebp - 0x40], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00402bf0
mov eax, dword [ebp + 8]
jmp 0x4eac97
lea ecx, [ebp - 0x34]
call fcn.00407250
mov byte [ebp - 4], 1
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x199]
push eax
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + 0x198]
push edx
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 0x197]
push ecx
mov edx, dword [ebp - 0x10]
movzx eax, byte [edx + 0x196]
push eax
mov ecx, dword [ebp - 0x10]
movzx edx, byte [ecx + 0x195]
push edx
mov eax, dword [ebp - 0x10]
movzx ecx, byte [eax + 0x194]
push ecx
push str._02X_02X_02X_02X_02X_02X
lea edx, [ebp - 0x34]
push edx
call fcn.00407690
add esp, 0x20
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
lea ecx, [ebp - 0x34]
call fcn.00407270
push eax
lea ecx, [ebp - 0x30]
call fcn.00407bd0
lea ecx, [ebp - 0x30]
push ecx
mov ecx, dword [ebp + 8]
call fcn.004029a0
mov edx, dword [ebp - 0x40]
or edx, 1
mov dword [ebp - 0x40], edx
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x34]
call fcn.00402e70
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.00402bf0
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.004b5ba3
mov esp, ebp
pop ebp
ret
Function at 0x4eadb0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f98e2
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x544af0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], ecx
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
add eax, 0x29c
push eax
call dword [sym.imp.KERNEL32.dll_TryEnterCriticalSection]
test eax, eax
je 0x4eaec7
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea ecx, [ebp - 0x14]
call fcn.00407250
mov byte [ebp - 4], 2
mov edx, dword [ebp + 8]
push edx
movzx eax, word [ebp - 0x16]
push eax
movzx ecx, word [ebp - 0x18]
push ecx
movzx edx, word [ebp - 0x1a]
push edx
movzx eax, word [ebp - 0x1c]
push eax
movzx ecx, word [ebp - 0x1e]
push ecx
movzx edx, word [ebp - 0x22]
push edx
movzx eax, word [ebp - 0x24]
push eax
push str._r_n_d__02d__02d__02d:_02d:_02d._03d_:__s
lea ecx, [ebp - 0x14]
push ecx
call fcn.00406160
add esp, 0x28
lea ecx, [ebp - 0x14]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov edx, dword [ebp - 0x28]
cmp dword [edx + 0x290], 0xffffffff
je 0x4eae95
lea ecx, [ebp - 0x14]
call fcn.00403300
shl eax, 1
push eax
lea ecx, [ebp - 0x14]
call sym.QiyiInstaller.exe_public:_enum_eScriptType___thiscall_CScriptModule::Type_void_
push eax
mov ecx, dword [ebp - 0x28]
add ecx, 0x28c
mov eax, dword [ebp - 0x28]
mov edx, dword [eax + 0x28c]
mov eax, dword [edx + 0x38]
call eax
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x14]
call fcn.00402e70
jmp 0x4eaeb0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x28]
add ecx, 0x29c
push ecx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.00402e70
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x4eb550
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4f9f53
mov eax, dword fs:[0]
push eax
sub esp, 0x254
mov eax, dword [0x544af0]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x260], ecx
mov dword [ebp - 0x25c], 0
lea ecx, [ebp - 0x24c]
call fcn.00407250
mov dword [ebp - 4], 0
mov dword [ebp - 0x250], 0
mov dword [ebp - 0x258], 0
mov dword [ebp - 0x248], 0
mov dword [ebp - 0x254], 0
mov dword [ebp - 0x244], 0
push 0x228
push 0
lea eax, [ebp - 0x240]
push eax
call fcn.004b5cb0
add esp, 0xc
mov dword [ebp - 0x244], 0x22c
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x250], eax
push 0
push 0x40000002
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
je 0x4eb66d
lea ecx, [ebp - 0x244]
push ecx
mov edx, dword [ebp - 0x254]
push edx
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4eb66d
mov eax, dword [ebp - 0x23c]
cmp eax, dword [ebp - 0x250]
jne 0x4eb649
mov ecx, dword [ebp - 0x22c]
mov dword [ebp - 0x258], ecx
jmp 0x4eb660
lea edx, [ebp - 0x244]
push edx
mov eax, dword [ebp - 0x254]
push eax
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4eb62d
mov ecx, dword [ebp - 0x254]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [ebp - 0x258], 0
jbe 0x4eb6ee
push 0
push 0x40000002
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x254], eax
cmp dword [ebp - 0x254], 0xffffffff
je 0x4eb6ee
lea edx, [ebp - 0x244]
push edx
mov eax, dword [ebp - 0x254]
push eax
call sub.KERNEL32.dll_Process32FirstW
test eax, eax
je 0x4eb6ee
mov ecx, dword [ebp - 0x23c]
cmp ecx, dword [ebp - 0x258]
jne 0x4eb6ca
lea edx, [ebp - 0x220]
push edx
lea ecx, [ebp - 0x24c]
call fcn.004037c0
jmp 0x4eb6e1
lea eax, [ebp - 0x244]
push eax
mov ecx, dword [ebp - 0x254]
push ecx
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x4eb6a8
mov edx, dword [ebp - 0x254]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea eax, [ebp - 0x24c]
push eax
mov ecx, dword [ebp + 8]
call fcn.00402130
mov ecx, dword [ebp - 0x25c]
or ecx, 1
mov dword [ebp - 0x25c], ecx
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x24c]
call fcn.00402e70
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.004b5ba3
mov esp, ebp
pop ebp
ret 4
Function at 0x4ec140
Capabilities:
Terminate process
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 0x1c], ecx
mov eax, dword [ebp - 0x1c]
add eax, 0x29c
push eax
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ecx + 0x274]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
cmp dword [eax + 0x290], 0xffffffff
je 0x4ec1a2
mov ecx, dword [ebp - 0x1c]
add ecx, 0x28c
mov edx, dword [ebp - 0x1c]
mov eax, dword [edx + 0x28c]
mov edx, dword [eax + 0x48]
call edx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x28c
mov eax, dword [ebp - 0x1c]
mov edx, dword [eax + 0x28c]
mov eax, dword [edx + 0x4c]
call eax
lea ecx, [ebp - 8]
push ecx
mov ecx, dword [ebp - 0x1c]
add ecx, 0x124
call fcn.004085b0
jmp 0x4ec1c4
push 0
lea edx, [ebp - 0x10]
push edx
lea ecx, [ebp - 8]
call fcn.00408cb0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
add ecx, 0x124
call fcn.00416620
push eax
lea ecx, [ebp - 8]
call fcn.00496210
movzx ecx, al
test ecx, ecx
je 0x4ec215
push 0x3e8
lea ecx, [ebp - 8]
call fcn.00487580
mov edx, dword [eax]
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4ec213
push 0xffffffffffffffff
lea ecx, [ebp - 8]
call fcn.00487580
mov eax, dword [eax]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x4ec1b6
mov ecx, dword [ebp - 0x1c]
call fcn.004eb740
mov ecx, dword [ebp - 0x1c]
call fcn.004ea5b0
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0x1c]
call fcn.00497b19
mov esp, ebp
pop ebp
ret
Function at 0x4ee4e0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov eax, dword [ebp - 4]
mov dword [eax], vtable.CPoster.0
mov ecx, dword [ebp - 4]
mov dword [ecx + method.DuiLib::CContainerUI.virtual_0], vtable.CPoster.1.0
mov edx, dword [ebp - 4]
cmp dword [edx + 0x3fc], 0
je 0x4ee531
push 0x64
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x3fc]
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x4ee531
push 0
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x3fc]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp - 4]
add ecx, 0x3f8
call fcn.00402e70
mov ecx, dword [ebp - 4]
add ecx, 0x3f4
call fcn.00402e70
mov ecx, dword [ebp - 4]
add ecx, 0x3f0
call fcn.00402e70
mov ecx, dword [ebp - 4]
call sym.QiyiInstaller.exe_public_virtual:_void___thiscall_DuiLib::CContainerUI::destructor_void_
mov esp, ebp
pop ebp
ret
Function at 0x10016775
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10016794
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x100167a1
push 0x1464
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
pop ebp
ret
Function at 0x1001852e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001855b
push 0
push 0
push 0
push 0
push 0x5f5
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x1001859a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
call fcn.1001909f
mov ecx, dword [ebp - 0x1c]
mov cl, byte [ecx]
mov byte [eax], cl
mov esp, ebp
pop ebp
ret
Function at 0x1001eff4
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001f01d
push 0
push 0x1449
push 0xb8a
push 0x1045
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
jmp 0x1001f031
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001f031
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esp, ebp
pop ebp
ret

Function at 0x1001f13b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001f15d
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x1001f1a8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001f18b
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1001f1a8
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10018f3b
mov dword [eax], 0x304b25b3
jmp 0x1001f180
mov esp, ebp
pop ebp
ret
Function at 0x1001f279
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push esi
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1001f2ad
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1001f2a8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
jmp 0x1001f3f1
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
push 1
mov ecx, dword [ebp - 4]
call fcn.10018f3b
mov esi, eax
push 1
mov ecx, dword [ebp - 4]
call fcn.10018f3b
mov ecx, dword [esi]
cmp ecx, dword [eax]
jge 0x1001f302
mov dword [ebp - 0xc], 1
jmp 0x1001f306
and dword [ebp - 0xc], 0
push 1
mov ecx, dword [ebp - 4]
call fcn.10018f3b
mov ecx, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
add ecx, 0xffff
cmp dword [eax], ecx
jne 0x1001f330
mov dword [ebp - 0x10], 1
jmp 0x1001f334
and dword [ebp - 0x10], 0
push 1
mov ecx, dword [ebp - 4]
call fcn.10018f3b
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax]
jle 0x1001f34e
mov dword [ebp - 0x3c], 1
jmp 0x1001f352
and dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, 0xdb80
add eax, 0xfff7
jne 0x1001f375
mov eax, 0xd485
test eax, eax
jne 0x1001f375
and dword [ebp - 0x14], 0
jmp 0x1001f37c
mov dword [ebp - 0x14], 1
push 1
mov ecx, dword [ebp - 4]
call fcn.10018f3b
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [eax]
jg 0x1001f396
mov dword [ebp - 0x18], 1
jmp 0x1001f39a
and dword [ebp - 0x18], 0
push 1
mov ecx, dword [ebp - 4]
call fcn.10018f3b
mov ecx, dword [ebp - 0x18]
cmp ecx, dword [eax]
je 0x1001f3b4
mov dword [ebp - 0x20], 1
jmp 0x1001f3b8
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x20]
jg 0x1001f3cb
mov dword [ebp - 0x40], 1
jmp 0x1001f3cf
and dword [ebp - 0x40], 0
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
push 0
mov ecx, dword [ebp - 4]
call fcn.10018f3b
mov esi, eax
push 1
mov ecx, dword [ebp - 4]
call fcn.10018f3b
mov ecx, dword [esi]
mov dword [eax], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001f868
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001f8c0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001f8a4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1001f8be
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10018f3b
or dword [eax], 0xffffffff
jmp 0x1001f899
jmp 0x1001f8c8
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esp, ebp
pop ebp
ret

Function at 0x1001f8cc
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001f90f
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1001f90d
push 0
push 0
push 0
push 0
push 0x5f5
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x1001f95a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001f93d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x1001f95a
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x18]
call fcn.10018f3b
mov dword [eax], 1
jmp 0x1001f932
mov esp, ebp
pop ebp
ret
Function at 0x100262b1
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100262ca
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x1002641d
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 8], eax
push 0
mov ecx, dword [ebp - 0xc]
call fcn.10018f3b
push 0
mov ecx, dword [ebp - 0xc]
call fcn.10018f3b
cmp dword [eax], 0xfffffffd
jle 0x1002631c
mov dword [ebp - 0x14], 1
jmp 0x10026320
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, 0x108fa7ad
cmp eax, dword [ebp - 0x14]
je 0x10026340
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x10026340
mov dword [ebp - 0x18], 1
jmp 0x10026344
and dword [ebp - 0x18], 0
cmp dword [ebp - 0x18], 0x6e3f
jne 0x10026356
mov dword [ebp - 0x48], 1
jmp 0x1002635a
and dword [ebp - 0x48], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jle 0x10026373
mov dword [ebp - 0x1c], 1
jmp 0x10026377
and dword [ebp - 0x1c], 0
cmp dword [ebp - 0x1c], 5
jg 0x10026386
mov dword [ebp - 0x20], 1
jmp 0x1002638a
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x20]
sub ecx, dword [eax]
neg ecx
cmp ecx, 1
jne 0x100263a2
mov dword [ebp - 0x10], 1
jmp 0x100263a6
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
push 0
mov ecx, dword [ebp - 0xc]
call fcn.10018f3b
mov ecx, dword [ebp - 0x10]
cmp ecx, dword [eax]
jge 0x100263c8
mov dword [ebp - 0x24], 1
jmp 0x100263cc
and dword [ebp - 0x24], 0
cmp dword [ebp - 0x24], 1
jbe 0x100263db
mov dword [ebp - 0x28], 1
jmp 0x100263df
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
add eax, dword [ebp - 0x28]
je 0x100263fa
mov eax, dword [ebp - 0x2c]
cmp dword [eax], 0
je 0x100263fa
mov dword [ebp - 0x30], 1
jmp 0x100263fe
and dword [ebp - 0x30], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x30], eax
jne 0x10026411
mov dword [ebp - 0x34], 1
jmp 0x10026415
and dword [ebp - 0x34], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 0x34]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1003028d
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100302a5
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x100302f0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100302d3
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x100302f0
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10018f3b
mov dword [eax], 0x2e5664dc
jmp 0x100302c8
mov esp, ebp
pop ebp
ret

Function at 0x10031318
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10031373
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10031354
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x10031371
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10018f3b
mov dword [eax], 0x743d837b
jmp 0x10031349
jmp 0x1003137b
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esp, ebp
pop ebp
ret

Function at 0x10032abe
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10032ad9
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
jmp 0x10032afc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10032afc
push 0x1464
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esp, ebp
pop ebp
ret

Function at 0x10033474
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100334a1
push 0
push 0
push 0
push 0
push 0x5f5
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x100334ec
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100334cf
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x100334ec
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10018f3b
mov dword [eax], 5
jmp 0x100334c4
mov esp, ebp
pop ebp
ret