joyce8/EMBER2024-capa huggingface dataset:
Function at 0x3503bf2
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x350a846]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.03502b49
and dword [ebp - 0x14], 0
cmp dword [0x350b972], 0
mov dword [ebp - 0x18], eax
jne 0x3503ca5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x3503d4d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x3503d4d
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x350b972], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x350b976], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x350b97a], eax
call edi
push eax
call esi
mov dword [0x350b982], eax
test eax, eax
je 0x3503ca5
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x350b97e], eax
mov eax, dword [0x350b97e]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x3503cfe
cmp dword [0x350b982], ecx
je 0x3503cfe
push eax
call esi
push dword [0x350b982]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x3503cfe
test ebx, ebx
je 0x3503cfe
call edi
test eax, eax
je 0x3503cf5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x3503cf5
test byte [ebp - 8], 1
jne 0x3503cfe
or dword [ebp + 0x10], 0x200000
jmp 0x3503d31
mov eax, dword [0x350b976]
cmp eax, dword [ebp - 0x18]
je 0x3503d31
push eax
call esi
test eax, eax
je 0x3503d31
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x3503d31
mov eax, dword [0x350b97a]
cmp eax, dword [ebp - 0x18]
je 0x3503d31
push eax
call esi
test eax, eax
je 0x3503d31
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x350b972]
call esi
test eax, eax
je 0x3503d4d
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x3503d4f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.03503f5d
leave
ret

Function at 0x3503f5d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x350a846]
jne 0x3503f67
repz ret
jmp fcn.035051cd

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10015c57
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10015c96
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
push 0x1016
push dword [ebp - 0xc]
push 0x30bf
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 1
call fcn.10015cdf
add esp, 0x18
jmp 0x10015cdb
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10015cc5
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x10015cdb
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10015cdb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esp, ebp
pop ebp
ret

Function at 0x10017ddc
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10017e08
push 0x72e9
push 1
push 0x6910
push 0x2997
push 0xfb8
call fcn.10017e39
add esp, 0x14
jmp 0x10017e35
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10017e25
push 0xde0
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x10017e35
push 0x1983
push 0x2153
call dword [sym.imp.USER32.dll_ReleaseDC]
mov esp, ebp
pop ebp
ret
Function at 0x10017f4f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100615b3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10017f9b
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
push 0x2b57
push 1
push dword [ebp - 0x2c]
push 0x3742
call fcn.100180ea
add esp, 0x10
jmp 0x100180d9
lea eax, [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x100180c0
mov dword [ebp - 0x28], 0x6616
mov dword [ebp - 0x38], 0x10008470
cmp dword [ebp - 0x28], 0x66ab
jle 0x10018075
and dword [ebp - 0x24], 0
jmp 0x10017fd7
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x3e65
jge 0x10018075
and dword [ebp - 0x18], 0
jmp 0x10017ff1
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x3285
jge 0x10018070
and dword [ebp - 0x1c], 0
jmp 0x10018007
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x5e92
jge 0x1001806b
and dword [ebp - 0x20], 0
jmp 0x1001801d
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x390
jge 0x10018069
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sar eax, cl
mov ecx, dword [ebp - 0x20]
shl eax, cl
or eax, dword [ebp - 0x24]
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
lea ecx, [ebp - 0x58]
call fcn.1000d5c0
pop ecx
pop ecx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
call fcn.1000fe6e
push eax
call fcn.1004bbc6
pop ecx
lea ecx, [ebp - 0x58]
call fcn.1000fe64
jmp 0x10018016
jmp 0x10018000
jmp 0x10017fea
jmp 0x10017fd0
push 0
push 0x1eee
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x6491
jge 0x10018098
push dword [ebp - 0x38]
call fcn.1004bbc6
pop ecx
jmp 0x100180b4
or dword [ebp - 4], 0xffffffff
jmp 0x100180be
jmp 0x100180d9
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x100180d9
push 0x11ff
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10018193
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10018234
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10018214
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100181f5
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10018212
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.10010041
mov dword [eax], 0x67f5aee0
jmp 0x100181ea
jmp 0x10018232
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10018232
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x10018242
push 0x64de
push 0
call fcn.1001b7d0
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1001870c
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x100187b2
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1001878d
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001876e
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x1001878b
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.10010041
mov dword [eax], 0x532bb11a
jmp 0x10018763
jmp 0x100187ad
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x100187ad
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x1001884e
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x1001881b
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x100187fc
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x10018819
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x44]
call fcn.10010041
mov dword [eax], 0x8ff8cd3b
jmp 0x100187f1
jmp 0x1001884e
push 0x201b
push 0x17a1
push 0xccc
push 0x864
push 0x180b
push 0x2540
push 0x771
push 0x4f0
push 0x9d
call dword [sym.imp.GDI32.dll_BitBlt]
mov esp, ebp
pop ebp
ret
Function at 0x100188ba
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100615c7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10018a87
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], 0x245f
mov dword [ebp - 0x30], 0x100085b0
cmp dword [ebp - 0x28], 0x26ef
jle 0x100189e6
push 0xc20
push 0
push 0
push 0x1d22
push 0x13dd
push 0
push 0x103f
call dword [sym.imp.GDI32.dll_GetDIBits]
and dword [ebp - 0x18], 0
jmp 0x1001893c
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x5a46
jge 0x100189d9
and dword [ebp - 0x1c], 0
jmp 0x10018956
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x655e
jge 0x100189d4
and dword [ebp - 0x20], 0
jmp 0x1001896c
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x2fbf
jge 0x100189cf
and dword [ebp - 0x24], 0
jmp 0x10018982
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x1b55
jge 0x100189cd
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
add ecx, dword [ebp - 0x24]
shl eax, cl
cdq
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
push dword [ebp - 0x54]
push dword [ebp - 0x58]
lea ecx, [ebp - 0x70]
call fcn.1000d5c0
pop ecx
pop ecx
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
call fcn.1000fe6e
push eax
call fcn.1004bbc6
pop ecx
lea ecx, [ebp - 0x70]
call fcn.1000fe64
jmp 0x1001897b
jmp 0x10018965
jmp 0x1001894f
jmp 0x10018935
push 0xce7
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x2297
jge 0x10018a02
push dword [ebp - 0x30]
call fcn.1004bbc6
pop ecx
jmp 0x10018a1e
or dword [ebp - 4], 0xffffffff
jmp 0x10018a28
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x10018a3a
call dword [sym.imp.USER32.dll_WaitMessage]
jmp 0x10018a85
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x10018a68
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 1
jge 0x10018a85
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x48]
call fcn.10010041
mov dword [eax], 0x6dd2cc9
jmp 0x10018a5d
jmp 0x10018aa8
mov eax, dword [ebp + 8]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x50], eax
push 0x77f4
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push 0
call fcn.100134ed
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10024d8b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x10024ddc
lea eax, [ebp + 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10024db9
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
jmp 0x10024dda
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10024dda
push 0xde0
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x10024e18
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x14]
push 0
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 0x5364
push dword [ebp - 0x24]
call fcn.100126d0
add esp, 0x1c
mov esp, ebp
pop ebp
ret

Function at 0x10024e35
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10024e7f
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10024e66
push 0x6b4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x10024e7d
push 0
push 0x21b2
push 0x242
push 0x5ea
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
jmp 0x10024ec1
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10024eaa
push 0
push 0
push 0x1258
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x10024ec1
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x10028667
Capabilities:
Extract resource via kernel32 functions
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100618cc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100286c0
lea eax, [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x100286b0
push 0
push 0x1f82
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
jmp 0x100286bb
push 0xa5c
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x1002879c
lea eax, [ebp + 8]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 0x8c7
mov dword [ebp - 0x2c], 0x10009578
cmp dword [ebp - 0x1c], 0x9ce
jle 0x10028744
and dword [ebp - 0x14], 0
jmp 0x100286ea
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x7da5
jge 0x10028744
and dword [ebp - 0x18], 0
jmp 0x10028700
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x3c5a
jge 0x10028742
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
push dword [ebp - 0x30]
push dword [ebp - 0x34]
lea ecx, [ebp - 0x4c]
call fcn.1000d5c0
pop ecx
pop ecx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
call fcn.1000fe6e
push eax
call fcn.1004bbc6
pop ecx
lea ecx, [ebp - 0x4c]
call fcn.1000fe64
jmp 0x100286f9
jmp 0x100286e3
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10028758
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x10028760
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x619
jge 0x10028776
push dword [ebp - 0x2c]
call fcn.1004bbc6
pop ecx
jmp 0x10028792
or dword [ebp - 4], 0xffffffff
jmp 0x1002879c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10028e7e
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100618ea
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10028ff3
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 0x179d
mov dword [ebp - 0x28], 0x100096e4
cmp dword [ebp - 0x24], 0x18d7
jle 0x10028f61
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
and dword [ebp - 0x20], 0
jmp 0x10028ee8
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x7c15
jge 0x10028f61
and dword [ebp - 0x1c], 0
jmp 0x10028efe
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x4bcf
jge 0x10028f5f
and dword [ebp - 0x14], 0
jmp 0x10028f14
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x32b5
jge 0x10028f5d
and dword [ebp - 0x18], 0
jmp 0x10028f2a
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x21f8
jge 0x10028f5b
mov ecx, dword [ebp - 0x14]
imul ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
sar eax, cl
and eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
mov ecx, 0x10609898
call fcn.1000fe8e
jmp 0x10028f23
jmp 0x10028f0d
jmp 0x10028ef7
jmp 0x10028ee1
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x1415
jge 0x10028f81
mov edx, dword [ebp - 0x28]
mov ecx, 0x10609898
call fcn.10011938
jmp 0x10028f9d
or dword [ebp - 4], 0xffffffff
jmp 0x10028fa7
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10028fde
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
push dword [eax]
mov ecx, dword [ebp - 0x44]
call fcn.10010041
mov dword [eax], 0x2a19820b
jmp 0x10028ff1
push 0
push 0
push 0x1258
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x10029001
push 0
push 0x29f
call fcn.1002a06a
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002991f
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10029952
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10029945
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x10029950
push 0x1191
call dword [sym.imp.USER32.dll_GetMenu]
jmp 0x1002995a
push 1
call fcn.100134b6
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10029b13
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10029b41
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
push 0x3fe4
push 1
push 0x64e
push dword [ebp - 0xc]
call fcn.10029bc4
add esp, 0x10
jmp 0x10029bbf
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10029bb7
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [eax], 1
jmp 0x10029b8b
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jl 0x10029bb5
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 8]
call fcn.10010041
mov esi, eax
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 8]
call fcn.10010041
mov ecx, dword [esi]
mov dword [eax], ecx
jmp 0x10029b80
jmp 0x10029bbf
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1002f16b
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002f1ad
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002f1a1
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002f19f
push 0
push 0
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
jmp 0x1002f1ab
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x1002f1e5
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1002f1da
push 0
push 0x869
push 0
push 0
push 0x198b
push 0x1721
call dword [sym.imp.USER32.dll_ToAsciiEx]
jmp 0x1002f1e5
push 0x1309
call dword [sym.imp.GDI32.dll_EndPage]
mov esp, ebp
pop ebp
ret