joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10267145
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x58
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 8]
xor edx, edx
mov dword [0x1027a8d8], 0x132c
mov esi, dword [0x1027a8dc]
mov edi, esi
add edi, 0xdd7c
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x3c], edx
jmp 0x1026726c
mov eax, dword [ebp - 0x40]
mov ecx, esp
mov dword [ecx + 0xc], 0x40
mov dword [ecx + 8], 0x1000
mov dword [ecx + 4], 0x6000
mov dword [ecx], 0
call eax
sub esp, 0x10
mov dword [esp], eax
mov ecx, dword [ebp - 0x2c]
mov dword [esp + 4], ecx
mov dword [ebp - 0x44], eax
call fcn.10267039
xor eax, eax
mov ecx, dword [ebp - 0x44]
mov word [ecx], 0x5a4d
mov dword [ecx + 0x3c], 0xc0
mov dword [ecx + 0xc0], 0x4550
add ecx, 0xffc00000
mov dword [0x1027a8d8], 0x528
mov edx, dword [ebp - 0x30]
mov dword [edx + 0x2c], ecx
mov ecx, dword [0x1027a8d8]
add ecx, 0xfffff810
mov dword [0x1027a8d8], ecx
mov ecx, dword [ebp - 0x44]
mov dword [edx + 0x20], ecx
mov dword [0x1027a8dc], 0xd26
cmp ecx, 0
mov dword [ebp - 0x48], eax
je 0x102672b1
jmp 0x10267294
lea eax, [ebp - 0x28]
mov ecx, dword [ebp - 0x38]
add ecx, 0xd1ca
mov edx, dword [ebp - 0x34]
mov dword [0x1027a8dc], edx
mov dword [0x1027a8d8], ecx
mov dword [ebp - 0x4c], eax
call fcn.10266a56
mov dword [esp], eax
mov eax, dword [ebp - 0x4c]
mov dword [esp + 4], eax
call fcn.102665dc
xor ecx, ecx
mov dword [0x1027a8dc], 0x123
cmp eax, 0
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x48], ecx
je 0x102672b1
jmp 0x10267181
mov eax, dword [ebp - 0x3c]
mov cl, byte [eax + 0x102683d2]
mov dl, byte [eax + 0x102683a3]
sub dl, cl
mov byte [ebp + eax - 0x28], dl
add eax, 1
cmp eax, 0xe
mov dword [ebp - 0x3c], eax
je 0x1026721c
jmp 0x1026726c
mov eax, dword [ebp - 0x44]
add eax, 0x2113
mov dword [0x1027a8d8], 0x1421
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x48], eax
jmp 0x102672b1
mov eax, dword [ebp - 0x48]
add esp, 0x58
pop esi
pop edi
pop ebp
ret
Function at 0x1026745b
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x1027a8e4], 0
mov byte [0x1027a8e8], 0
mov dword [0x1027a8dc], 0x608
mov dword [0x1027a8e0], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x1026758a
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov edx, 0x1877
mov esi, 0x100
mov dword [0x1027a8ec], 0
mov edi, dword [0x1027a8e4]
mov ebx, dword [ebp - 0x18]
movzx ebx, byte [ebx + eax]
add ebx, edi
mov dword [ebp - 0x28], eax
xor edi, edi
mov dword [ebp - 0x2c], edx
mov edx, edi
mov edi, dword [ebp - 0x10]
div edi
mov edi, dword [ebp - 0x14]
movzx edx, byte [edi + edx]
add ebx, edx
mov dword [0x1027a8ec], ebx
mov dword [0x1027a8d8], ecx
mov eax, ebx
cdq
idiv esi
mov dword [0x1027a8e4], edx
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x28]
mov cl, byte [ecx + esi]
mov byte [0x1027a8e8], cl
mov ebx, dword [ebp - 0x18]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x1027a8e8]
mov edx, dword [0x1027a8e4]
mov byte [ebx + edx], cl
mov dword [0x1027a8d8], 0x2706
mov edx, dword [0x1027a8e0]
add edx, 1
mov dword [0x1027a8e0], edx
cmp edx, 0x100
mov ecx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
jl 0x102674a5
mov dword [0x1027a8dc], 0xe07
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov dword [0x1027a8e0], 0
mov ecx, dword [0x1027a8d8]
add ecx, 0xfffff171
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], eax
jmp 0x102674a5
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x1027a8e0]
add eax, 1
mov dword [0x1027a8e0], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x1026758a
jmp 0x10267567
Function at 0x10013453
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001348a
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10013488
push 0x251
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x100134ad
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x100134ad
push 0x25b9
push 0
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov esp, ebp
pop ebp
ret
Function at 0x100188a1
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100188dd
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100188db
push 0
push 0x14b4
push 0x1ae4
push 0
push 0xd1d
push 0x22b8
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileW]
jmp 0x10018904
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10018904
push 0x251
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov esp, ebp
pop ebp
ret
Function at 0x10022198
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1002220a
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
push dword [eax]
mov eax, dword [ebp - 0x20]
push dword [eax]
mov eax, dword [ebp - 0x24]
push dword [eax]
push dword [ebp - 0x28]
push 0x75bd
push 0
mov eax, dword [ebp - 0x2c]
push dword [eax]
call fcn.10028b54
add esp, 0x1c
jmp 0x1002221e
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002221e
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esp, ebp
pop ebp
ret
Function at 0x10025156
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100251a7
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx]
mov dword [eax + ecx*4], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
inc eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [ecx + 0xc], eax
jmp 0x100251b4
push 0
push 0x250d
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esp, ebp
pop ebp
ret

Function at 0x100263d0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10026407
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10026405
push 0x251
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x10026431
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
movzx eax, word [eax]
and eax, 0xfff
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x10029788
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x100297ac
xor eax, eax
jmp 0x100298d6
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x100297ca
xor eax, eax
jmp 0x100298d6
push 1
push 0x742c
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
call fcn.100293ef
add esp, 0x10
cmp dword [ebp - 0xc], 0
jne 0x100297ed
xor eax, eax
jmp 0x100298d6
lea eax, [ebp - 0x10]
push eax
push 0x593
lea eax, [ebp - 0x24]
push eax
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.100296b6
add esp, 0x1c
push 0
push dword [ebp - 4]
push 0x2265
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.10022dd7
add esp, 0x14
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [eax + 0x34]
mov dword [ebp - 0x14], ecx
je 0x1002984b
push dword [ebp - 0x14]
push 0x42a1
push dword [ebp - 4]
push 1
call fcn.1002398e
add esp, 0x10
push dword [ebp - 4]
call fcn.100291a4
pop ecx
test eax, eax
jne 0x1002985c
xor eax, eax
jmp 0x100298d6
push dword [ebp - 4]
push 0
push 0x1c6b
call fcn.10028367
add esp, 0xc
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x100298be
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x1002988d
xor eax, eax
jmp 0x100298d6
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x100298a6
xor eax, eax
jmp 0x100298d6
lea eax, [ebp - 4]
push eax
push 0x1c90
push 1
push 0x3e3
call fcn.1002973a
add esp, 0x10
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x100298cf
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x100298d3
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x1006b51c
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10073330]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1005dfc6
mov dword [ebp - 0x14], eax
cmp dword [0x106603d0], esi
jne 0x1006b60f
push 0x800
push esi
push 0x1000795c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x1006b59c
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x1006b6ef
push esi
push esi
push 0x1000795c
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x1006b6ef
push 0x10007974
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1006b6ef
push eax
call ebx
push 0x10007980
push edi
mov dword [0x106603d0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007990
push edi
mov dword [0x106603d4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x100079a4
push edi
mov dword [0x106603d8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x106603e0], eax
test eax, eax
je 0x1006b60c
push 0x100079c0
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x106603dc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1006b634
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x1006b627
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x1006b649
push 4
pop eax
jmp 0x1006b6f1
cmp dword [ebp - 0x14], esi
je 0x1006b649
push dword [0x106603d0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x1006b62e
mov eax, dword [0x106603dc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x1006b6a7
cmp dword [0x106603e0], edi
je 0x1006b6a7
push eax
call ebx
push dword [0x106603e0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x1006b6a7
test eax, eax
je 0x1006b6a7
call ecx
test eax, eax
je 0x1006b69c
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x1006b69c
test byte [ebp - 8], 1
jne 0x1006b6a7
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x1006b6d7
mov eax, dword [0x106603d4]
cmp eax, edi
je 0x1006b6d4
push eax
call ebx
test eax, eax
je 0x1006b6d4
call eax
mov esi, eax
test esi, esi
je 0x1006b6d4
mov eax, dword [0x106603d8]
cmp eax, edi
je 0x1006b6d4
push eax
call ebx
test eax, eax
je 0x1006b6d4
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x106603d0]
call ebx
test eax, eax
je 0x1006b6ef
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x1006b6f1
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call main
mov esp, ebp
pop ebp
ret
Function at 0x100185a4
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100185c8
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100185c6
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x100185e6
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x100185e6
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov esp, ebp
pop ebp
ret
Function at 0x1001c0b3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
push ebx
push esi
mov ebx, ecx
je 0x1001c0f3
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
cmp dword [edi], esi
jne 0x1001c0d3
mov eax, dword [ebp + 0x10]
cmp dword [eax], esi
je 0x1001c0d3
mov eax, dword [eax]
cmp dword [edx], esi
je 0x1001c0d9
mov eax, dword [edx]
mov ecx, dword [edi]
mov eax, dword [edx]
dec ecx
xor edx, edx
cmp ecx, eax
mov eax, dword [edi]
setl dl
xor ecx, ecx
cmp eax, edx
pop edi
setl cl
mov dword [ebx], ecx
jmp 0x1001c113
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x1001c113
push 0x184b
xor esi, esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop esi
pop ebx
pop ebp
ret

Function at 0x1001ea95
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001eac2
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001eac0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x1001eadb
push 0x16b3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
mov esp, ebp
pop ebp
ret
Function at 0x10030b51
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10030ca3
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 4], eax
push 0x14
push 0
push 0x9625
push 0xae58
call fcn.10026ab8
pop ecx
pop ecx
call eax
push eax
push 0x9625
push 0xb32f
call fcn.10026ab8
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
push 0x2bf2
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebp - 8]
push eax
call fcn.10030977
add esp, 0x10
push 0x183f
push 1
lea eax, [ebp - 4]
push eax
push 0x1c03
call fcn.100309cb
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
and dword [eax + 8], 0
push 0x6c3b
push 1
push 0x1144
lea eax, [ebp - 4]
push eax
call fcn.10030a18
add esp, 0x10
push 4
push 0x1000
mov eax, dword [ebp - 0xc]
push dword [eax + 0x50]
mov eax, dword [ebp - 8]
push dword [eax]
push 0x9625
push 0x914e
call fcn.10026ab8
pop ecx
pop ecx
call eax
push 4
push 0x1000
mov eax, dword [ebp - 0xc]
push dword [eax + 0x54]
mov eax, dword [ebp - 8]
push dword [eax]
push 0x9625
push 0x914e
call fcn.10026ab8
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x3c]
mov ecx, dword [ebp - 0xc]
add eax, dword [ecx + 0x54]
push eax
push dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
push dword [eax]
call fcn.10026b33
add esp, 0xc
push 1
push 0x892
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x1100
push 0x4179
lea eax, [ebp - 4]
push eax
call fcn.10030aa6
add esp, 0x1c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov dword [eax + 0x34], ecx
jmp 0x10030cca
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x10030cca
push 0
push 0x1c96
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esp, ebp
pop ebp
ret
Function at 0x10031648
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1003166c
xor eax, eax
jmp 0x100317cc
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 8]
push eax
push 0x2799
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.100315a2
add esp, 0x14
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x10031699
xor eax, eax
jmp 0x100317cc
push 1
push 0x1f0f
push 0x69bc
push 0x22b4
push 0x5a44
push dword [ebp - 8]
push 0x2224
lea eax, [ebp - 0xc]
push eax
call fcn.100307b7
add esp, 0x20
cmp dword [ebp - 0xc], 0
jne 0x100316d0
xor eax, eax
jmp 0x100317cc
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x10]
lea eax, [ebp - 0xc]
push eax
push 1
push 0x4acb
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
call fcn.10030b51
add esp, 0x1c
push dword [ebp - 8]
push dword [ebp - 4]
push dword [ebp + 8]
push 0
call fcn.10028d75
add esp, 0x10
push 0x2d5e
lea eax, [ebp - 0xc]
push eax
push 0x48aa
push 1
lea eax, [ebp - 8]
push eax
push 0x795a
lea eax, [ebp - 0x14]
push eax
call fcn.10030cce
add esp, 0x1c
cmp dword [ebp - 0x14], 0
je 0x10031741
push 1
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
call fcn.1003155a
add esp, 0xc
push dword [ebp - 4]
call fcn.10030338
pop ecx
test eax, eax
jne 0x10031752
xor eax, eax
jmp 0x100317cc
push 0x2d53
push 0x4a11
lea eax, [ebp - 4]
push eax
push 1
push 0x458
call fcn.100315a2
add esp, 0x14
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x100317b4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x1003178e
xor eax, eax
jmp 0x100317cc
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x100317a7
xor eax, eax
jmp 0x100317cc
push 1
lea eax, [ebp - 4]
push eax
call fcn.1003160c
pop ecx
pop ecx
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x100317c5
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x100317c9
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x1004840c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1004845c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1004843c
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jl 0x1004845a
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10048458
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x10048431
jmp 0x10048480
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10048480
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
mov esp, ebp
pop ebp
ret

Function at 0x10048484
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1004849b
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
jmp 0x100484b2
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x100486e3
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1004870b
push 0
push 0x111e
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x10048826
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x10048761
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
xor eax, eax
jne 0x10048761
and dword [ebp - 0x20], 0
jmp 0x10048768
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jne 0x1004877d
mov dword [ebp - 0x40], 1
jmp 0x10048781
and dword [ebp - 0x40], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
je 0x1004879a
mov dword [ebp - 0xc], 1
jmp 0x1004879e
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0xc], eax
jle 0x100487b1
mov dword [ebp - 0x10], 1
jmp 0x100487b5
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp dword [ebp - 0x10], eax
jg 0x100487c8
mov dword [ebp - 0x14], 1
jmp 0x100487cc
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0x14]
sub ecx, dword [eax]
mov eax, dword [ebp - 0x18]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jge 0x100487ee
mov dword [ebp - 0x1c], 1
jmp 0x100487f2
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x44]
mov eax, dword [eax]
cmp dword [ebp - 0x1c], eax
jl 0x10048805
mov dword [ebp - 0x24], 1
jmp 0x10048809
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x24]
jge 0x1004881a
mov dword [ebp - 0x28], 1
jmp 0x1004881e
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret