joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42bbb4
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
call fcn.0042ca83
cmp eax, 0xffffffff
je 0x42bbe1
mov edx, eax
and dl, 0x11
cmp dl, 1
jne 0x42bbe1
and eax, 0xfffffffe
mov ecx, esi
mov edx, eax
call fcn.0042bf13
test al, al
je 0x42bc1a
cmp byte [0x4591b1], 0
jne 0x42bc0f
mov edx, esi
lea ecx, [ebp - 0xc]
call fcn.004297ba
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.004131af
pop ecx
test esi, esi
je 0x42bc1a
mov al, 1
jmp 0x42bc1c
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jmp 0x42bc09
xor al, al
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x42bd66
Capabilities:
Create directory

Disassembly:
push 0x44
mov eax, 0x444415
call fcn.0041eaf8
mov edi, ecx
cmp byte [0x4591b1], 0
jne 0x42bda5
mov edx, edi
lea ecx, [ebp - 0x18]
call fcn.004297ba
xor ebx, ebx
push ebx
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0x18]
mov esi, eax
call fcn.004131af
pop ecx
test esi, esi
je 0x42bdb3
mov al, 1
jmp 0x42bdf9
xor ebx, ebx
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jmp 0x42bd9f
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x42bdc4
xor al, al
jmp 0x42bdf9
lea ecx, [ebp - 0x50]
call fcn.0042c664
lea ecx, [ebp - 0x28]
call fcn.0042a44f
push ebx
push edi
lea ecx, [ebp - 0x50]
mov dword [ebp - 4], ebx
call fcn.0042c685
test al, al
je 0x42bdee
mov ebx, dword [ebp - 0x30]
shr ebx, 4
and bl, 1
push dword [ebp - 0x28]
call fcn.004131af
pop ecx
mov al, bl
call fcn.0041ead2
ret

Function at 0x42bdff
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4591b1], 0
jne 0x42be37
mov edx, ecx
lea ecx, [ebp - 0xc]
push esi
call fcn.004297ba
push 0
push dword [eax]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.004131af
pop ecx
test esi, esi
pop esi
je 0x42be44
mov al, 1
jmp 0x42be46
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jmp 0x42be31
xor al, al
mov esp, ebp
pop ebp
ret

Function at 0x42beb3
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4591b1], 0
jne 0x42bee9
mov edx, ecx
lea ecx, [ebp - 0xc]
push esi
call fcn.004297ba
push dword [eax]
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.004131af
pop ecx
test esi, esi
pop esi
je 0x42bef4
mov al, 1
jmp 0x42bef6
push ecx
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jmp 0x42bee3
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x42bf13
Capabilities:
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4591b1], 0
push esi
mov esi, edx
jne 0x42bf4b
mov edx, ecx
lea ecx, [ebp - 0xc]
call fcn.004297ba
push esi
push dword [eax]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.004131af
pop ecx
test esi, esi
je 0x42bf57
mov al, 1
jmp 0x42bf59
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
test eax, eax
jmp 0x42bf45
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x42bfbc
Capabilities:
Get disk information

Disassembly:
push 0x30
mov eax, 0x44447b
call fcn.0041eaf8
mov ebx, ecx
mov dword [ebp - 0x10], ebx
call fcn.00401407
cmp byte [0x4591b1], 0
jne 0x42c0a8
mov ecx, ebx
call fcn.00401407
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov edi, eax
mov dword [ebp - 0x1c], edi
test edi, edi
jne 0x42c000
xor al, al
jmp 0x42c171
push edi
call fcn.004132b7
mov esi, eax
pop ecx
mov dword [ebp - 0x24], esi
push esi
push edi
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
mov edi, eax
mov dword [ebp - 0x20], edi
test edi, edi
je 0x42c168
cmp edi, dword [ebp - 0x1c]
ja 0x42c168
lea ecx, [ebp - 0x30]
call fcn.0042a358
mov byte [ebp - 4], 1
test edi, edi
je 0x42c0a1
xor eax, eax
mov dword [ebp - 0x18], edi
inc eax
mov ecx, edi
mov dword [ebp - 0x14], eax
cmp byte [esi + eax - 1], 0
jne 0x42c092
lea eax, [ebx + esi]
push eax
lea ecx, [ebp - 0x30]
call fcn.0042a566
mov ebx, dword [ebp - 0x14]
lea edx, [ebp - 0x30]
lea ecx, [ebp - 0x3c]
call fcn.0042975c
mov edi, eax
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 2
call fcn.004014b2
mov ecx, dword [ebp - 0x10]
push edi
call fcn.00401473
mov byte [ebp - 4], 1
push dword [ebp - 0x3c]
call fcn.004131af
pop ecx
mov ecx, dword [ebp - 0x18]
mov eax, ebx
inc eax
sub ecx, 1
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
jne 0x42c048
mov edi, dword [ebp - 0x20]
cmp ebx, edi
jmp 0x42c15c
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
mov dword [ebp - 0x20], edi
test edi, edi
je 0x42bff9
xor ecx, ecx
push 2
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004132b7
mov esi, eax
pop ecx
mov dword [ebp - 0x24], esi
push esi
push edi
mov dword [ebp - 4], 3
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsW]
mov edi, eax
test edi, edi
je 0x42c168
cmp edi, dword [ebp - 0x20]
ja 0x42c168
lea ecx, [ebp - 0x30]
call fcn.0042a44f
mov byte [ebp - 4], 4
mov edx, ebx
mov dword [ebp - 0x1c], edx
mov ecx, ebx
mov dword [ebp - 0x14], ecx
test edi, edi
je 0x42c15a
push 2
pop eax
mov dword [ebp - 0x18], eax
cmp word [esi + eax - 2], bx
jne 0x42c149
lea eax, [edx + esi]
push eax
lea ecx, [ebp - 0x30]
call fcn.0042a473
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x1c], eax
call fcn.004014b2
mov ecx, dword [ebp - 0x10]
lea eax, [ebp - 0x30]
push eax
call fcn.00401473
mov eax, dword [ebp - 0x18]
mov edx, eax
mov ecx, dword [ebp - 0x14]
inc ecx
add eax, 2
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], eax
cmp ecx, edi
jb 0x42c113
mov edx, dword [ebp - 0x1c]
cmp edx, edi
push dword [ebp - 0x30]
sete bl
call fcn.004131af
pop ecx
push esi
call fcn.004131af
mov al, bl
pop ecx
call fcn.0041ead2
ret
Function at 0x42ca83
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x4591b1], 0
jne 0x42cab5
mov edx, ecx
lea ecx, [ebp - 0xc]
push esi
call fcn.004297ba
push dword [eax]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push dword [ebp - 0xc]
mov esi, eax
call fcn.004131af
pop ecx
mov eax, esi
pop esi
jmp 0x42cac6
push ecx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, eax
mov eax, ecx
mov esp, ebp
pop ebp
ret

Function at 0x42cf15
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push eax
push dword [ecx]
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x42cf3f
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x42cf3f
xor al, al
jmp 0x42cf53
mov eax, dword [ebp + 8]
xor ecx, ecx
mov edx, dword [ebp - 4]
add ecx, esi
adc edx, 0
mov dword [eax], ecx
mov dword [eax + 4], edx
mov al, 1
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x43023d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edx, dword [esp + 4]
sub esp, 0x28
mov eax, ecx
push ebx
push ebp
push esi
push edi
cmp edx, 0xffffffff
je 0x43031f
mov ecx, dword [eax + 0x78]
mov eax, dword [eax + 0x7c]
and dword [esp + 0x34], 0
add eax, dword [ecx + edx*4]
mov dword [esp + 0x2c], eax
mov eax, dword [ecx + edx*4 + 4]
sub eax, dword [ecx + edx*4]
lea ecx, [esp + 0x2c]
mov dword [esp + 0x30], eax
call fcn.0043279a
mov ebx, eax
test ebx, ebx
jmp 0x430315
lea ecx, [esp + 0x2c]
call fcn.00432782
mov esi, dword [esp + 0x34]
xorps xmm0, xmm0
mov ecx, dword [esp + 0x2c]
movzx ebp, al
movlpd qword [esp + 0x20], xmm0
mov edi, dword [esp + 0x24]
mov byte [esp + 0x3c], al
lea ecx, [esi + ecx]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 0x18], 0
and ebp, 0xf
jbe 0x4302ea
mov esi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
movzx eax, byte [esi + ebx]
shld edi, ecx, 8
cdq
shl ecx, 8
or edi, edx
or eax, ecx
inc esi
mov ecx, eax
cmp esi, ebp
jb 0x4302c7
mov esi, dword [esp + 0x34]
mov ebx, dword [esp + 0x14]
mov al, byte [esp + 0x3c]
add esi, ebp
mov dword [esp + 0x34], esi
cmp ecx, 0x6f10701
jne 0x4302fc
test edi, edi
je 0x43032b
test al, 0x20
je 0x430312
lea ecx, [esp + 0x2c]
call fcn.0043279a
and dword [esp + 0x24], 0
add dword [esp + 0x34], eax
sub ebx, 1
mov dword [esp + 0x14], ebx
jne 0x430282
xor al, al
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 4
mov al, 1
jmp 0x430321
Function at 0x43487b
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
xor edi, edi
test esi, esi
je 0x43488b
mov dword [esi], edi
mov eax, dword [ebp + 0x10]
test eax, eax
je 0x4348d1
push edi
lea ecx, [ebp + 0x14]
push ecx
mov ecx, 0x8000
cmp eax, ecx
cmovae eax, ecx
push eax
push dword [ebp + 0xc]
push 0xfffffffffffffff5
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0x14]
add dword [ecx + 8], edx
adc dword [ecx + 0xc], edi
test esi, esi
je 0x4348c6
add dword [esi], edx
test eax, eax
jne 0x4348d1
call fcn.00434d93
mov edi, eax
mov eax, edi
pop edi
pop esi
pop ebp
ret 0x10
Function at 0x43e4d0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push 0x11
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
mov edx, dword [esp + 8]
shr eax, 0xf
and al, 1
movzx ecx, word [edx + 0xc]
cmp ecx, 8
je 0x43e511
cmp ecx, 0x52
je 0x43e500
cmp ecx, 0x76
jne 0x43e50d
mov ecx, esi
call fcn.0043da35
jmp 0x43e518
test al, al
je 0x43e50d
mov ecx, esi
call fcn.0043dc3b
jmp 0x43e518
xor al, al
jmp 0x43e51a
mov ecx, esi
call fcn.0043dbd0
mov al, 1
pop esi
ret 4
Function at 0x43fb57
Capabilities:
Get file system object information

Disassembly:
push 0x1c8
mov eax, 0x446340
call fcn.0041eb2c
mov ebx, ecx
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x1c8]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x1a4], eax
call fcn.0042a44f
and dword [ebp - 4], 0
cmp byte [edi], 0
je 0x43fbda
push dword [edi + 0xc]
lea ecx, [ebp - 0x1b0]
push dword [edi + 8]
call fcn.0043fad1
push eax
mov edx, 0xdb0
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x1bc]
call fcn.0043fb17
push eax
lea ecx, [ebp - 0x1c8]
mov byte [ebp - 4], 2
call fcn.0042a508
push dword [ebp - 0x1bc]
call fcn.004131af
pop ecx
mov byte [ebp - 4], 0
push dword [ebp - 0x1b0]
call fcn.004131af
pop ecx
lea eax, [edi + 0x18]
mov ecx, eax
mov dword [ebp - 0x1a0], eax
call fcn.00429a00
mov esi, eax
lea eax, [ebp - 0x1bc]
lea ecx, [esi + 1]
push ecx
push eax
lea ecx, [edi + 0x18]
call fcn.00403442
mov byte [ebp - 4], 3
lea ecx, [ebp - 0x1b0]
mov eax, dword [edi + 0x18]
add eax, 2
lea eax, [eax + esi*2]
push eax
call fcn.0042a5b6
lea eax, [ebp - 0x1bc]
mov byte [ebp - 4], 4
push eax
mov ecx, ebx
call fcn.0043fdaa
lea eax, [ebp - 0x1b0]
mov ecx, ebx
push eax
call fcn.0043fdaa
lea eax, [ebp - 0x1bc]
push eax
lea ecx, [ebp - 0x19c]
call fcn.0042a4da
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 5
call fcn.00429b68
lea eax, [ebp - 0x1b0]
push eax
lea ecx, [ebp - 0x19c]
call fcn.00429ae9
lea ecx, [ebp - 0x19c]
call fcn.00429b68
lea eax, [ebp - 0x1c8]
push eax
lea ecx, [ebp - 0x19c]
call fcn.00429ae9
lea ecx, [ebp - 0x19c]
call fcn.00429b68
cmp byte [edi + 1], 0
je 0x43fcf7
mov edx, 0x3f4
lea ecx, [ebp - 0x1d4]
call fcn.0042dc8e
push eax
lea ecx, [ebp - 0x19c]
mov byte [ebp - 4], 6
call fcn.00429ae9
mov byte [ebp - 4], 5
push dword [ebp - 0x1d4]
call fcn.004131af
lea ecx, [ebp - 0x19c]
mov dword [esp], 0x44d590
call fcn.00429a9d
push 0
lea eax, [ebp - 0x30]
push eax
lea ecx, [edi + 0x10]
call fcn.0042da3b
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x19c]
call fcn.00429a9d
push dword [ebp + 8]
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push dword [ebx + 4]
call edi
mov edx, dword [ebp - 0x19c]
mov ecx, eax
call fcn.0042e410
mov edx, dword [ebp - 0x1a0]
lea ecx, [ebp - 0x1d4]
call fcn.00401a0f
push pe_nt_image_headers32
push 0x160
lea ecx, [ebp - 0x190]
push ecx
push 0x80
push dword [eax]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push dword [ebp - 0x1d4]
mov esi, eax
call fcn.004131af
pop ecx
test esi, esi
je 0x43fd72
push dword [ebp - 0x1a4]
push dword [ebx + 4]
call edi
push 0
push dword [ebp - 0x190]
push 0x170
push eax
call dword [sym.imp.USER32.dll_SendMessageA]
push dword [ebp - 0x19c]
call fcn.004131af
pop ecx
push dword [ebp - 0x1b0]
call fcn.004131af
pop ecx
push dword [ebp - 0x1bc]
call fcn.004131af
pop ecx
push dword [ebp - 0x1c8]
call fcn.004131af
pop ecx
call fcn.0041eae7
ret 0xc
Function at 0x440324
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
sub esp, 0x28
mov eax, dword [edx]
push esi
mov esi, ecx
cmp eax, dword [esi + 0xb4]
jne 0x440357
cmp dword [edx + 8], 0xffffff65
jne 0x440357
movzx eax, word [edx + 0xc]
sub eax, 0x2d
je 0x440393
sub eax, 0x14
je 0x440360
dec eax
sub eax, 1
je 0x440393
xor al, al
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x440357
push 2
pop eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x28]
push eax
push 0xffffffffffffffff
push 0x102b
push dword [esi + 0xb4]
call dword [sym.imp.USER32.dll_SendMessageA]
mov al, 1
jmp 0x440359
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
shr eax, 0xf
test al, 1
je 0x440357
mov ecx, esi
call fcn.00440234
jmp 0x44038f
Function at 0x442577
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x168
mov eax, dword [0x457008]
xor eax, esp
mov dword [esp + 0x164], eax
test cl, cl
mov edx, 0x4011
mov eax, 0x4110
cmovne eax, edx
push eax
push 0x160
lea eax, [esp + 8]
push eax
push 0x90
push 0x44c854
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
mov ecx, dword [esp + 0x164]
xor ecx, esp
call fcn.0041319e
mov esp, ebp
pop ebp
ret

Function at 0x4425cd
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2d0
mov eax, dword [0x457008]
xor eax, esp
mov dword [esp + 0x2cc], eax
cmp byte [0x4591b1], 0
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edx
jne 0x442630
mov edx, ecx
lea ecx, [esp + 0xc]
call fcn.004297ba
push 0x4010
push 0x160
lea ecx, [esp + 0x20]
or esi, 0x80
push ecx
push esi
push dword [eax]
call dword [sym.imp.SHELL32.dll_SHGetFileInfoA]
push dword [esp + 0xc]
mov esi, eax
call fcn.004131af
pop ecx
mov eax, esi
jmp 0x442644
push ecx
push ecx
lea eax, [esp + 0x20]
or esi, 0x80
push eax
mov edx, esi
call fcn.00442559
mov ecx, dword [esp + 0x1c]
mov dword [edi], ecx
mov ecx, dword [esp + 0x2d4]
pop edi
pop esi
xor ecx, esp
call fcn.0041319e
mov esp, ebp
pop ebp
ret 4

Function at 0x442d26
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push esi
push edi
push eax
push ecx
mov esi, edx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edi, eax
cmp edi, 0xffffffff
jne 0x442d52
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
je 0x442d52
xor al, al
jmp 0x442d63
mov ecx, dword [ebp - 4]
xor eax, eax
add eax, edi
mov dword [esi], eax
mov al, 1
adc ecx, 0
mov dword [esi + 4], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x431001
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40915c
nop
mov ecx, 0x1529586c
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x35661206
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x10001008
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [section..data]
jne 0x10001012
repz ret
jmp fcn.10001294

Function at 0x10004dfa
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1000139a
and dword [ebp - 0x14], 0
cmp dword [0x10009784], 0
mov dword [ebp - 0x18], eax
jne 0x10004ead
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10004f55
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10004f55
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x10009784], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x10009788], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1000978c], eax
call edi
push eax
call esi
mov dword [0x10009794], eax
test eax, eax
je 0x10004ead
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x10009790], eax
mov eax, dword [0x10009790]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10004f06
cmp dword [0x10009794], ecx
je 0x10004f06
push eax
call esi
push dword [0x10009794]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10004f06
test ebx, ebx
je 0x10004f06
call edi
test eax, eax
je 0x10004efd
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x10004efd
test byte [ebp - 8], 1
jne 0x10004f06
or dword [ebp + 0x10], 0x200000
jmp 0x10004f39
mov eax, dword [0x10009788]
cmp eax, dword [ebp - 0x18]
je 0x10004f39
push eax
call esi
test eax, eax
je 0x10004f39
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10004f39
mov eax, dword [0x1000978c]
cmp eax, dword [ebp - 0x18]
je 0x10004f39
push eax
call esi
test eax, eax
je 0x10004f39
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10009784]
call esi
test eax, eax
je 0x10004f55
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10004f57
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001008
leave
ret
Function at 0x10001340
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x102afe94], 0
jne 0x10001366
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x3285501
call fcn.100384c0
add esp, 0xc
mov dword [0x102afe94], eax
mov eax, dword [0x102afe94]
pop ebp
ret

Function at 0x10001430
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x102afe84], 0
jne 0x10001456
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0x53b2070f
call fcn.100384c0
add esp, 0xc
mov dword [0x102afe84], eax
mov eax, dword [0x102afe84]
pop ebp
ret

Function at 0x10001550
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x102afebc], 0
jne 0x10001576
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0xafcab3c4
call fcn.100384c0
add esp, 0xc
mov dword [0x102afebc], eax
mov eax, dword [0x102afebc]
pop ebp
ret

Function at 0x100016a0
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x102afe88], 0
jne 0x100016c6
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0xf8f45725
call fcn.100384c0
add esp, 0xc
mov dword [0x102afe88], eax
mov eax, dword [0x102afe88]
pop ebp
ret

Function at 0x100016d0
Capabilities:
Resolve function by fnv-1a hash

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x102afec4], 0
jne 0x100016f6
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
push 0xfaba0065
call fcn.100384c0
add esp, 0xc
mov dword [0x102afec4], eax
mov eax, dword [0x102afec4]
pop ebp
ret

Function at 0x100021d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10066963
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0xd
mov byte [ebp - 0x24], 0x3e
mov byte [ebp - 0x23], 0x26
mov byte [ebp - 0x22], 0x3e
mov byte [ebp - 0x21], 0x50
mov byte [ebp - 0x20], 0x66
mov byte [ebp - 0x1f], 0x33
mov byte [ebp - 0x1e], 0x32
mov byte [ebp - 0x1d], 0x37
mov byte [ebp - 0x1c], 9
mov byte [ebp - 0x1b], 0x23
mov byte [ebp - 0x1a], 0x3a
mov byte [ebp - 0x19], 0x5b
mov byte [ebp - 0x18], 1
mov eax, dword [0x102afcc4]
and eax, 1
jne 0x1000226b
mov ecx, dword [0x102afcc4]
or ecx, 1
mov dword [0x102afcc4], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 0x24]
push edx
mov ecx, 0x102afcb4
call fcn.10001b00
push 0x10066d90
call fcn.1005a862
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, 0x102afcb4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10002490
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100669e3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x1c
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x13
mov byte [ebp - 0x28], 0x32
mov byte [ebp - 0x27], 0xac
mov byte [ebp - 0x26], 0xd0
mov byte [ebp - 0x25], 0x61
mov byte [ebp - 0x24], 0x6e
mov byte [ebp - 0x23], 0x72
mov byte [ebp - 0x22], 0x6e
mov byte [ebp - 0x21], 0x67
mov byte [ebp - 0x20], 0xb
mov byte [ebp - 0x1f], 0xe8
mov byte [ebp - 0x1e], 0xe4
mov byte [ebp - 0x1d], 0x5d
mov byte [ebp - 0x1c], 0x52
mov byte [ebp - 0x1b], 0x2e
mov byte [ebp - 0x1a], 0x30
mov byte [ebp - 0x19], 0x30
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x17], 0xf5
mov byte [ebp - 0x16], 0xb3
mov eax, dword [0x102afe30]
and eax, 1
jne 0x10002543
mov ecx, dword [0x102afe30]
or ecx, 1
mov dword [0x102afe30], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
push edx
mov ecx, 0x102afe1c
call fcn.10001880
push 0x10066dd0
call fcn.1005a862
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, 0x102afe1c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10003170
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10066ae3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x14], 0x21
mov byte [ebp - 0x38], 0x25
mov byte [ebp - 0x37], 0x17
mov byte [ebp - 0x36], 0x79
mov byte [ebp - 0x35], 0x69
mov byte [ebp - 0x34], 0x72
mov byte [ebp - 0x33], 0x3b
mov byte [ebp - 0x32], 0x2e
mov byte [ebp - 0x31], 0x2e
mov byte [ebp - 0x30], 0x3e
mov byte [ebp - 0x2f], 6
mov byte [ebp - 0x2e], 0x60
mov byte [ebp - 0x2d], 0x6c
mov byte [ebp - 0x2c], 0x73
mov byte [ebp - 0x2b], 0x6e
mov byte [ebp - 0x2a], 0x79
mov byte [ebp - 0x29], 0x2f
mov byte [ebp - 0x28], 0x2e
mov byte [ebp - 0x27], 0xc
mov byte [ebp - 0x26], 0x60
mov byte [ebp - 0x25], 0x36
mov byte [ebp - 0x24], 0x60
mov byte [ebp - 0x23], 0x62
mov byte [ebp - 0x22], 0x62
mov byte [ebp - 0x21], 0x6e
mov byte [ebp - 0x20], 0x38
mov byte [ebp - 0x1f], 0xd
mov byte [ebp - 0x1e], 0x79
mov byte [ebp - 0x1d], 0x37
mov byte [ebp - 0x1c], 0x60
mov byte [ebp - 0x1b], 0x72
mov byte [ebp - 0x1a], 0x71
mov byte [ebp - 0x19], 0x79
mov byte [ebp - 0x18], 0x4d
mov eax, dword [0x102afe80]
and eax, 1
jne 0x1000325b
mov ecx, dword [0x102afe80]
or ecx, 1
mov dword [0x102afe80], ecx
mov dword [ebp - 4], 0
lea edx, [ebp - 0x38]
push edx
mov ecx, 0x102afe5c
call fcn.10001900
push 0x10066e50
call fcn.1005a862
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, 0x102afe5c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret