joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d77b1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov eax, ebx
push edi
mov edi, ecx
shr eax, 0x10
test ax, ax
mov dword [edi + 0x40], ebx
jne 0x4d77d3
cmp dword [edi + 0x3c], 0
jne 0x4d77d3
movzx eax, bx
mov dword [edi + 0x3c], eax
call fcn.004f0976
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
mov ecx, edi
push dword [esp + 0x18]
push eax
call fcn.004d7800
pop edi
pop esi
pop ebx
ret 8

Function at 0x4d784e
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
mov ebx, ecx
xor edi, edi
call fcn.004f0976
mov esi, dword [eax + 0xc]
push 5
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4d787f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push esi
mov ecx, ebx
push dword [esp + 0x18]
push edi
call fcn.004d7892
pop edi
pop esi
pop ebx
ret 8

Function at 0x4d8e5b
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x4d8e93
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004dc37f
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.004dc356
jmp 0x4d8e9f
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x4d8ea3
Capabilities:
Get graphical window text

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
push 0x58e978
mov ecx, edi
call fcn.004dc058
cmp dword [esi + 0x34], 0
push dword [esp + 0xc]
jne 0x4d8ef6
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetDlgItem]
mov esi, eax
test esi, esi
je 0x4d8f09
push esi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, edi
call fcn.004dc37f
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, edi
call fcn.004dc356
jmp 0x4d8f09
mov ecx, esi
call fcn.004db319
test eax, eax
je 0x4d8f09
push edi
mov ecx, eax
call fcn.004d8e5b
mov eax, dword [edi]
pop edi
pop esi
mov eax, dword [eax - 8]
ret 8

Function at 0x4daa7d
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4daabf
call fcn.004f0976
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, edi
je 0x4daabf
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4daab6
xor eax, eax
jmp 0x4daac7
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004daacd
pop edi
pop esi
pop ebx
ret 4
Function at 0x4dd366
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, dword [esp + 8]
test esi, esi
jne 0x4dd373
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x3c]
push ebx
push ebp
push edi
mov ebx, dword [eax + esi + 0x78]
xor byte [eax + 0x33], bh
inc dword [ebx]
fimul word [ebx - 0x11fcdf95]
cmp dword [ebx + 0x18], edi
jbe 0x4dd3a7
mov eax, dword [ebp + edi*4]
push dword [esp + 0x18]
add eax, esi
push eax
call fcn.004dd402
pop ecx
pop ecx
test al, al
jne 0x4dd3ae
inc edi
cmp edi, dword [ebx + 0x18]
jb 0x4dd38b
xor eax, eax
pop edi
pop ebp
pop ebx
pop esi
ret
mov eax, dword [ebx + 0x24]
lea eax, [eax + edi*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov eax, dword [eax + esi]
add eax, esi
jmp 0x4dd3a9

Function at 0x4f1598
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov dword [ebp - 8], ecx
call fcn.004f0976
mov esi, dword [eax + 0xc]
push 0xf1
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x4f15d5
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x4f15d5
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
jne 0x4f15d9
xor eax, eax
jmp 0x4f1657
movzx eax, word [esi + 6]
push ebx
push edi
shl eax, 2
push eax
call fcn.004dbbfa
and dword [ebp - 4], 0
cmp word [esi + 6], 0
pop ecx
mov ebx, eax
jbe 0x4f1611
mov ecx, ebx
lea eax, [esi + 8]
movzx edx, word [eax]
inc dword [ebp - 4]
mov dword [ecx], edx
movzx edx, word [esi + 6]
inc eax
add ecx, 4
inc eax
cmp dword [ebp - 4], edx
jl 0x4f15fb
movzx eax, word [esi + 6]
mov ecx, dword [ebp - 8]
push eax
push ebx
call fcn.004f1748
push ebx
mov edi, eax
call fcn.004dbc23
test edi, edi
pop ecx
je 0x4f1653
movzx ecx, word [esi + 4]
movzx eax, word [esi + 2]
lea esi, [ecx + 7]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [eax + 7]
push eax
push esi
push edx
call fcn.004f1511
push dword [ebp + 8]
mov ecx, dword [ebp - 8]
call fcn.004f165c
mov edi, eax
mov eax, edi
pop edi
pop ebx
pop esi
leave
ret 4

Function at 0x4f28f9
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x4f2927
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x4f2945
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.004f285f
jmp 0x4f2945
mov eax, dword [esi + 0x14]
test eax, eax
je 0x4f2945
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.004f285f
test edi, edi
mov eax, edi
jne 0x4f292f
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x4f4b24
Capabilities:
Check for time delay via gettickcount
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push ebp
push esi
mov esi, ecx
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
xor ebx, ebx
push 1
mov dword [esi + 0x30], ebx
mov dword [esi + 0x34], ebx
mov dword [esi + 0x38], ebx
call edi
test ax, ax
jge 0x4f4b4c
or dword [esi + 0x38], 1
or dword [esi + 0x34], 2
jmp 0x4f4b5d
push 2
call edi
test ax, ax
jge 0x4f4b5d
or dword [esi + 0x38], 2
or dword [esi + 0x34], 1
mov ebp, dword [sym.imp.KERNEL32.dll_GetTickCount]
call ebp
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x34]
push dword [eax + 0x1c]
call dword [sym.imp.USER32.dll_SetCapture]
push eax
call fcn.004d849b
cmp dword [esi + 0x30], ebx
jne 0x4f4c37
mov edi, dword [sym.imp.USER32.dll_PeekMessageW]
mov ebx, 0x100
call dword [sym.imp.USER32.dll_GetCapture]
push eax
call fcn.004d849b
cmp eax, dword [esp + 0x34]
jne 0x4f4c37
push 1
push 0x209
push 0x200
lea eax, [esp + 0x20]
push 0
push eax
call edi
test eax, eax
jne 0x4f4bd3
push 1
push 0x108
push ebx
push eax
lea eax, [esp + 0x24]
push eax
call edi
test eax, eax
je 0x4f4c18
mov eax, dword [esp + 0x18]
cmp eax, 0x202
je 0x4f4c37
cmp eax, 0x205
je 0x4f4c37
cmp eax, 0x201
je 0x4f4c37
cmp eax, 0x204
je 0x4f4c37
cmp eax, ebx
jne 0x4f4bfe
cmp dword [esp + 0x1c], 0x1b
je 0x4f4c37
push dword [esp + 0x2c]
lea eax, [esi + 0x20]
push dword [esp + 0x2c]
push eax
call dword [sym.imp.USER32.dll_PtInRect]
neg eax
sbb eax, eax
inc eax
mov dword [esi + 0x30], eax
call ebp
sub eax, dword [esp + 0x10]
cmp eax, dword [0x58ec90]
jbe 0x4f4c2d
mov dword [esi + 0x30], 1
cmp dword [esi + 0x30], 0
je 0x4f4b90
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [esi + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x20
ret 4
Function at 0x50a8b0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push ebp
push esi
mov esi, dword [esp + 0x10]
mov ebp, dword [esp + 0x14]
push edi
mov bl, byte [esi]
mov al, byte [esi + 1]
inc esi
sub al, 2
mov byte [esp + 0x14], al
inc esi
mov edi, dword [esp + 0x14]
and edi, 0xff
lea ecx, [edi + 1]
push ecx
mov ecx, ebp
call fcn.004dc306
test edi, edi
jle 0x50a8f7
mov dl, byte [esi]
add eax, 2
xor dl, bl
inc bl
movsx cx, dl
mov word [eax - 2], cx
inc esi
dec edi
jne 0x50a8e2
push 0xffffffffffffffff
mov ecx, ebp
mov word [eax], 0
call fcn.004dc356
mov eax, dword [ebp]
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x40b468
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x416408]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00406147
mov dword [ebp - 0x14], eax
cmp dword [0x438b54], esi
jne 0x40b55b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40b4e8
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40b63b
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40b63b
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40b63b
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x438b54], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x438b58], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x438b5c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x438b64], eax
test eax, eax
je 0x40b558
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x438b60], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40b580
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40b573
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40b595
push 4
pop eax
jmp 0x40b63d
cmp dword [ebp - 0x14], esi
je 0x40b595
push dword [0x438b54]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40b57a
mov eax, dword [0x438b60]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40b5f3
cmp dword [0x438b64], edi
je 0x40b5f3
push eax
call ebx
push dword [0x438b64]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40b5f3
test eax, eax
je 0x40b5f3
call ecx
test eax, eax
je 0x40b5e8
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40b5e8
test byte [ebp - 8], 1
jne 0x40b5f3
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40b623
mov eax, dword [0x438b58]
cmp eax, edi
je 0x40b620
push eax
call ebx
test eax, eax
je 0x40b620
call eax
mov esi, eax
test esi, esi
je 0x40b620
mov eax, dword [0x438b5c]
cmp eax, edi
je 0x40b620
push eax
call ebx
test eax, eax
je 0x40b620
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x438b54]
call ebx
test eax, eax
je 0x40b63b
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40b63d
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403ac6
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCRT.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x402c00
pop dword [ebp - 0x44]
mov eax, 0x402c00
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xb1b31631
add dword [ebp - 0x54], 0x9c9f2f1a
mov dword [ebp - 0x50], 0xe89be65
add dword [ebp - 0x50], 0x23a98de0
mov dword [ebp - 0x4c], 0xbe11ed72
sub dword [ebp - 0x4c], 0x71c5a944
mov dword [ebp - 0x48], 0xa3c3b507
add dword [ebp - 0x48], 0x5c3c4af9
lea eax, [ebp - 0x54]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0xd731e6d6
sub dword [ebp - 0x54], 0x62bf7d80
mov dword [ebp - 0x50], 0x2ba07d41
sub dword [ebp - 0x50], 0xea341bcc
mov dword [ebp - 0x4c], 0x60aa648e
sub dword [ebp - 0x4c], 0xfd3af822
mov dword [ebp - 0x48], 0xdec10ef9
sub dword [ebp - 0x48], 0xdec10ef9
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x32b6a
push 0
call eax
mov ecx, 0x3819
xor edi, edi
add edi, eax
mov ebx, 0xf3036eee
add ebx, 0xd3d9112
add ebx, dword [ebp - 0x44]
mov esi, 0xfe58c0e8
add esi, 0x57706d7d
sub dword [ebp - 0x20], 0xc6157dc7
mov edx, dword [ebx]
add dword [ebp - 8], 0xe6b42e24
xor edx, esi
xor dword [ebp - 8], 0xd8deffc7
mov dword [edi], edx
sub dword [ebp - 0x24], 0x2d8b0538
add edi, 0x5d4d0681
add edi, 0xa2b2f983
add ebx, 4
loop 0x402d0f
add eax, 0xd3b055e7
add eax, 0x2c507d50
xor ebx, ebx
add ebx, eax
add eax, 0x1ba343df
add eax, 0xe45cbc26
mov ecx, 0x7d7ac5
sub ecx, 0x3d7ac5
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x1001d323
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1001d332
pop dword [ebp - 0x28]
mov eax, 0xcdbf4f9d
add eax, 0x42428395
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x40d16
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x5a2d
xor esi, esi
add esi, eax
mov edi, 0x2850064c
sub edi, 0x1848244c
add edi, dword [ebp - 0x28]
mov edx, 0x7e04eedd
sub edx, 0xa18defdb
sub dword [ebp - 0xc], eax
mov ebx, dword [edi]
add dword [ebp - 0xc], 0x17a05d99
add ebx, edx
xor dword [ebp - 4], 0x3ac40c6
mov dword [esi], ebx
add dword [ebp - 0x18], esi
add esi, 4
add edi, 4
loop 0x1001d388
add eax, 0x15b87
mov ebx, eax
add eax, 0x4a8aa316
add eax, 0xb5755cef
mov ecx, 0x7dd8c010
add ecx, 0x92273ff0
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x10001200
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov dword [ebp - 4], 0
jmp 0x1000125a
add esp, 0x54
pop ebp
ret
mov eax, esp
mov dword [eax], 0x558
mov eax, dword [sym.imp.USER32.dll_SetProcessDefaultLayout]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
mov eax, esp
mov dword [eax], 0x628a2a
mov eax, dword [sym.imp.KERNEL32.dll_GetFileType]
call eax
sub esp, 4
mov dword [ebp - 0x14], eax
jmp 0x10001366
mov eax, esp
mov dword [eax], 0xde9
mov eax, dword [sym.imp.KERNEL32.dll_SetHandleCount]
call eax
sub esp, 4
mov dword [ebp - 0x18], eax
jmp 0x100012d9
cmp dword [ebp - 4], 0x12a
jne 0x10001274
jmp 0x1000120f
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadLocale]
call eax
mov dword [ebp - 0x1c], eax
jmp 0x10001378
mov eax, esp
mov dword [eax], 0x334
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x20], eax
mov dword [ebp - 8], 0
cmp dword [ebp - 8], 0x3cd
je 0x100012ee
mov eax, dword [ebp - 8]
mov ecx, 0x38e38e39
mov dword [ebp - 0x24], eax
mul ecx
shr edx, 2
imul eax, edx, 0x12
mov ecx, dword [ebp - 0x24]
sub ecx, eax
mov eax, ecx
sub eax, 9
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], eax
je 0x10001243
jmp 0x100012c0
mov eax, dword [ebp - 0x28]
sub eax, 1
mov dword [ebp - 0x30], eax
jne 0x100012d9
jmp 0x100012cd
mov eax, dword [sym.imp.KERNEL32.dll_SetFileApisToOEM]
call eax
jmp 0x10001243
jmp 0x100012db
mov eax, dword [ebp - 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x10001290
mov eax, dword [ebp - 4]
mov dword [ebp - 0x38], eax
mov eax, 0xcc29786d
mov ecx, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, ecx
mov edx, dword [ebp - 0x3c]
mul edx
shr edx, 8
imul eax, edx, 0x141
sub ecx, eax
mov eax, ecx
sub eax, 6
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], eax
je 0x1000132f
jmp 0x10001320
mov eax, dword [ebp - 0x40]
sub eax, 0x3e
mov dword [ebp - 0x48], eax
jne 0x10001350
jmp 0x1000132d
jmp 0x1000132f
mov eax, esp
mov dword [eax + 4], 0x375
mov dword [eax], 0xe91d0c
mov eax, dword [sym.imp.KERNEL32.dll_SetThreadPriorityBoost]
call eax
sub esp, 8
mov dword [ebp - 0x4c], eax
jmp 0x10001265
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0xa
jne 0x10001214
jmp 0x10001373
mov eax, dword [ebp - 0xc]
add eax, 1
mov dword [ebp - 0xc], eax
jmp 0x10001357
jmp 0x10001265
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
jmp 0x1000125a

Function at 0x10211c10
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1028c2f0]
jne 0x10211c1a
repz ret
jmp fcn.10213a8c
Function at 0x10215023
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10210c18
and dword [ebp - 4], 0
cmp dword [0x1028de7c], 0
mov ebx, eax
jne 0x102150d4
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10215185
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10215185
push eax
call fcn.10210ba6
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1028de7c], eax
call esi
push eax
call fcn.10210ba6
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1028de80], eax
call esi
push eax
call fcn.10210ba6
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1028de84], eax
call esi
push eax
call fcn.10210ba6
pop ecx
mov dword [0x1028de8c], eax
test eax, eax
je 0x102150d4
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10210ba6
pop ecx
mov dword [0x1028de88], eax
mov eax, dword [0x1028de88]
cmp eax, ebx
je 0x1021512c
cmp dword [0x1028de8c], ebx
je 0x1021512c
push eax
call fcn.10210c21
push dword [0x1028de8c]
mov esi, eax
call fcn.10210c21
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1021512c
test edi, edi
je 0x1021512c
call esi
test eax, eax
je 0x10215123
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10215123
test byte [ebp - 0xc], 1
jne 0x1021512c
or dword [ebp + 0x10], 0x200000
jmp 0x10215165
mov eax, dword [0x1028de80]
cmp eax, ebx
je 0x10215165
push eax
call fcn.10210c21
pop ecx
test eax, eax
je 0x10215165
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10215165
mov eax, dword [0x1028de84]
cmp eax, ebx
je 0x10215165
push eax
call fcn.10210c21
pop ecx
test eax, eax
je 0x10215165
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1028de7c]
call fcn.10210c21
pop ecx
test eax, eax
je 0x10215185
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10215187
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10216760
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
lea eax, [fcn.10216760]
mov ecx, dword [0x1028b864]
add ecx, 0x334
mov dword [0x1028b864], ecx
mov dword [ebp - 8], eax
mov eax, dword [0x1028b864]
sub eax, 0x18bb
mov dword [0x1028b864], eax
jmp 0x102167a0
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
jmp 0x1021680e
mov eax, dword [ebp - 8]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x102167cb
mov eax, dword [ebp - 8]
add eax, 0x3c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
mov edx, dword [ecx]
cmp dword [eax + edx], 0x4550
je 0x10216792
jmp 0x102167cb
mov eax, dword [ebp - 8]
sub eax, 0x1000
and eax, 0xfffff000
mov dword [ebp - 8], eax
mov eax, dword [0x1028b864]
sub eax, 0xc52
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [0x1028b864], eax
mov al, 1
test al, 1
jne 0x102167a0
jmp 0x102167f8
mov eax, dword [0x1028b868]
add eax, 0x621
mov dword [0x1028b864], eax
mov dword [ebp - 4], 0
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
add esp, 0x18
pop ebp
ret
Function at 0x10216de0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [0x1028b868], 0x23f7
mov eax, dword [ebp - 8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 0x104
jl 0x10216e71
jmp 0x10216e93
mov dword [ebp - 4], 1
jmp 0x10216f5f
jmp 0x10216f55
mov eax, dword [0x1028b864]
add eax, 0x187b
mov dword [0x1028b868], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x16]
cmp eax, 0x61
sete dl
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x11]
test al, 1
jne 0x10216ed4
jmp 0x10216e6c
mov dword [ebp - 4], 0
jmp 0x10216f5f
jmp 0x10216f5a
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2]
cmp eax, 0
jne 0x10216e84
jmp 0x10216e93
jmp 0x10216e86
mov eax, dword [ebp - 0x10]
add eax, 1
mov dword [ebp - 0x10], eax
jmp 0x10216e16
mov dword [0x1028b864], 0x1dbc
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x1a]
cmp eax, 0x6c
jne 0x10216e60
mov dword [0x1028b868], 0xad6
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x18]
cmp eax, 0x6f
je 0x10216e32
jmp 0x10216f5a
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
movzx eax, word [ecx + eax*2 - 0x14]
cmp eax, 0x64
jne 0x10216f55
mov eax, dword [0x1028b864]
sub eax, 0x1352
mov dword [0x1028b864], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0x12]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0x64
jne 0x10216e2d
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
movzx eax, word [ecx + eax*2 - 0x10]
cmp eax, 0x6c
jne 0x10216f50
mov eax, dword [0x1028b864]
sub eax, 0x1c8b
mov dword [0x1028b868], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
movzx eax, word [eax + ecx*2 - 0xe]
cmp eax, 0x6c
je 0x10216e21
jmp 0x10216f50
jmp 0x10216e2d
jmp 0x10216e6c
jmp 0x10216e60
mov eax, dword [ebp - 4]
add esp, 0x1c
pop ebp
ret
Function at 0x4039ea
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [sym.imp.GDI32.dll_AnimatePalette]
xor ebx, ebx
push ebx
mov eax, 0x9c818068
push eax
push eax
push ebx
call edi
mov esi, eax
and esi, 0x68
imul esi, dword [ebp + 0x10]
and esi, dword [ebp + 0x18]
push ebx
mov eax, 0xebabea96
push eax
push eax
push ebx
xor esi, 0xc
call edi
mov ecx, eax
lea eax, [esi + 0x51b]
and ecx, 0x442
or ecx, 0x8d65ba2c
xor edx, edx
div ecx
push ebx
lea esi, [edx + 0x4d84a0a4]
imul esi, dword [ebp + 0x1c]
xor esi, dword [ebp + 0x14]
imul esi, esi, 0x13
sub esi, dword [ebp + 0x20]
add esi, dword [ebp + 8]
xor esi, dword [ebp + 0xc]
and esi, dword [ebp + 0x24]
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
and eax, 0x66ff
pop edi
or eax, esi
pop esi
xor eax, 0x1f713420
pop ebx
pop ebp
ret