joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001e710
Capabilities:
Create thread
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [esi + 8]
push ebx
push edi
push eax
lea ecx, [esi + 0x18]
push ecx
push esi
push str.Thread__p._s_.CreateRunningThread_Handle:_p_threadid:_d
call fcn.1001af90
mov ecx, eax
call fcn.1001b3f0
add esp, 0x10
cmp dword [esi + 8], 0
jne 0x1001e7b9
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
xor edi, edi
lea ebx, [esi + 0xc]
lea ebx, [ebx]
push ebx
push 0
push esi
push 0x1001e8c0
push 0
push 0
call fcn.10027afa
add esp, 0x18
push edi
mov dword [esi + 8], eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebx]
push eax
mov eax, dword [esi + 8]
push eax
push ecx
push esi
push str.Thread__p_.CreateRunningThread.threadid:_d__Handle:_p_Info:_08x_Retry:_d
call fcn.1001af90
mov ecx, eax
call fcn.1001b3f0
add esp, 0x18
cmp dword [esi + 8], 0
jne 0x1001e7ab
mov edx, dword [esi + 4]
push 0x64
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x1001e7ab
inc edi
cmp edi, 0xa
jb 0x1001e750
mov eax, dword [esi + 8]
test eax, eax
je 0x1001e7b9
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
cmp dword [esi + 8], eax
pop edi
setne al
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001e7d0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
push esi
mov esi, ecx
mov eax, dword [esi + 8]
push edi
push eax
lea ecx, [esi + 0x18]
push ecx
push esi
push str.Thread__p._s_.SecureStopThread_Handle:_p
mov dword [esp + 0x1c], 0
call fcn.1001af90
mov ecx, eax
call fcn.1001b3f0
mov eax, dword [esi + 8]
add esp, 0x10
test eax, eax
jne 0x1001e816
mov eax, 1
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
lea edx, [esp + 0xc]
push edx
push eax
mov edi, 1
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x1001e87c
cmp dword [esp + 0xc], 0x103
jne 0x1001e87c
mov eax, dword [esi + 4]
test eax, eax
je 0x1001e87c
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
test eax, eax
je 0x1001e87c
mov eax, dword [ebp + 8]
mov ecx, dword [esi + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x1001e861
cmp eax, 0xffffffff
jne 0x1001e87c
cmp dword [ebp + 0xc], 0
je 0x1001e87a
mov edx, dword [esp + 0xc]
mov eax, dword [esi + 8]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edi, eax
jmp 0x1001e87c
xor edi, edi
mov ecx, dword [esi + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push esi
push str.Thread__p_.SecureStopThread.1_Handle:_p
push ecx
mov dword [esi + 8], 0
call fcn.1001af90
add esp, 4
mov ecx, eax
call fcn.1001b3f0
add esp, 0xc
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x1001f3f0
Capabilities:
Get common file path

Disassembly:
xor eax, eax
cmp ax, word [0x10051640]
jne 0x1001f481
push 0x104
push 0x10051640
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1001f487
call fcn.1001f5d0
test eax, eax
mov ecx, 0x104
mov eax, 0x10051640
je 0x1001f445
cmp word [eax], 0
je 0x1001f43a
add eax, 2
sub ecx, 1
jne 0x1001f426
mov eax, 0x10051640
ret
test ecx, ecx
je 0x1001f481
push str.SysWOW64FSEBin
jmp 0x1001f462
cmp word [eax], 0
je 0x1001f459
add eax, 2
sub ecx, 1
jne 0x1001f445
mov eax, 0x10051640
ret
test ecx, ecx
je 0x1001f481
push str._system32FSEBin
mov eax, 0x104
sub eax, ecx
mov ecx, 0x104
sub ecx, eax
lea edx, [eax*2 + 0x10051640]
mov eax, 0x7fffffff
call fcn.10014100
mov eax, 0x10051640
ret
xor eax, eax
ret

Function at 0x1001f490
Capabilities:
Get common file path

Disassembly:
xor eax, eax
cmp ax, word [0x10051848]
jne 0x1001f521
push 0x104
push 0x10051848
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1001f527
call fcn.1001f5d0
test eax, eax
mov ecx, 0x104
mov eax, 0x10051848
je 0x1001f4e5
cmp word [eax], 0
je 0x1001f4da
add eax, 2
sub ecx, 1
jne 0x1001f4c6
mov eax, 0x10051848
ret
test ecx, ecx
je 0x1001f521
push str.SysWOW64FSE
jmp 0x1001f502
cmp word [eax], 0
je 0x1001f4f9
add eax, 2
sub ecx, 1
jne 0x1001f4e5
mov eax, 0x10051848
ret
test ecx, ecx
je 0x1001f521
push str._system32FSE
mov eax, 0x104
sub eax, ecx
mov ecx, 0x104
sub ecx, eax
lea edx, [eax*2 + 0x10051848]
mov eax, 0x7fffffff
call fcn.10014100
mov eax, 0x10051848
ret
xor eax, eax
ret

Function at 0x1001f530
Capabilities:
Get common file path

Disassembly:
xor eax, eax
cmp ax, word [0x10051a50]
jne 0x1001f5c1
push 0x104
push 0x10051a50
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
test eax, eax
je 0x1001f5c7
call fcn.1001f5d0
test eax, eax
mov ecx, 0x104
mov eax, 0x10051a50
je 0x1001f585
cmp word [eax], 0
je 0x1001f57a
add eax, 2
sub ecx, 1
jne 0x1001f566
mov eax, 0x10051a50
ret
test ecx, ecx
je 0x1001f5c1
push str.SysWOW64FSEBin
jmp 0x1001f5a2
cmp word [eax], 0
je 0x1001f599
add eax, 2
sub ecx, 1
jne 0x1001f585
mov eax, 0x10051a50
ret
test ecx, ecx
je 0x1001f5c1
push str._system32FSEBin
mov eax, 0x104
sub eax, ecx
mov ecx, 0x104
sub ecx, eax
lea edx, [eax*2 + 0x10051a50]
mov eax, 0x7fffffff
call fcn.10014100
mov eax, 0x10051a50
ret
xor eax, eax
ret
Function at 0x1001ff60
Capabilities:
Check if file exists
Delete directory
Delete file
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100364b0
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1004f100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x14], edi
cmp esi, ebx
je 0x100200db
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x1001ffa1
sub eax, edx
sar eax, 1
je 0x100200db
push 0x10048174
push esi
call fcn.10026f4b
add esp, 8
test eax, eax
je 0x100200db
push 0x10048178
push esi
call fcn.10026f4b
add esp, 8
test eax, eax
je 0x100200db
mov dword [ebp - 4], ebx
push esi
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], ebx
call fcn.10020100
add esp, 4
cmp eax, ebx
jne 0x10020009
push 0x10049464
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0x1c], ebx
call fcn.10028c35
push esi
cmp dword [ebp - 0x18], ebx
je 0x10020037
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x100200c7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.KERNEL32.dll_DeleteFileW]
call edi
test eax, eax
jne 0x100200c4
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10020069
test al, 1
je 0x10020069
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push esi
call edi
test eax, eax
jne 0x100200c4
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
call edi
push 4
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x10020095
call edi
mov edi, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor edi, edi
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [ebp - 0x14]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, 0x32
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10020100
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10036490
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1004f100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov eax, dword [ebp + 8]
xor edi, edi
push eax
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x10020176
push 0x10049464
lea ecx, [ebp - 0x18]
push ecx
mov dword [ebp - 0x18], 2
call fcn.10028c35
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], edx
mov eax, 0x10020165
ret
test al, 0x10
je 0x10020184
cmp esi, edi
je 0x10020184
mov dword [esi], 1
xor eax, eax
cmp dword [ebp - 0x14], eax
sete al
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100201a0
Capabilities:
Check if file exists
Get file attributes
Move file
Set file attributes

Disassembly:
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_MoveFileExW]
push edi
xor edi, edi
push edi
push ebx
push esi
call ebp
test eax, eax
jne 0x100201ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
cmp edi, 5
jne 0x100201ef
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100201db
test al, 1
je 0x100201db
and eax, 0xfffffffe
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push 0
push ebx
push esi
call ebp
test eax, eax
jne 0x100201ed
pop edi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, edi
pop edi
pop ebp
ret
Function at 0x10020200
Capabilities:
Create directory

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xffffffffffffffff
push 0x10036580
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x1004f100]
xor eax, ebp
mov dword [ebp + 0x208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov ebx, dword [ebp + 0x214]
push 0x208
lea eax, [ebp]
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x14], esi
mov edi, edx
mov dword [ebp - 4], 0
call fcn.100285e0
add esp, 0xc
push 0x104
lea ecx, [ebp]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x100202b5
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10049464
lea edx, [ebp - 0x1c]
push edx
mov dword [ebp - 0x1c], eax
call fcn.10028c35
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
mov eax, 0x1002029b
ret
mov eax, esi
jmp 0x10020363
lea ecx, [ebp]
push 0x5c
push ecx
call fcn.100276b3
add esp, 8
test eax, eax
je 0x100202d2
cmp word [eax], 0
je 0x100202d2
xor edx, edx
mov word [eax], dx
lea eax, [ebp]
push eax
mov eax, 0x7ffffffe
mov ecx, 0x104
mov edx, esi
call fcn.10014100
test edi, edi
je 0x10020310
push 0x1003f0d0
push 0x104
push esi
call fcn.10014160
push edi
push 0x104
push esi
call fcn.10014160
push 0
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test ebx, ebx
je 0x10020330
push 0x1003f0d0
push 0x104
push esi
call fcn.10014160
push ebx
push 0x104
push esi
call fcn.10014160
xor edx, edx
mov eax, esi
lea edi, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10020337
sub eax, edi
sar eax, 1
cmp edx, eax
jae 0x100202a8
cmp word [esi + edx*2], 0x2f
jne 0x1002035e
mov ecx, 0x5c
mov word [esi + edx*2], cx
inc edx
jmp 0x10020332
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.100269c5
add ebp, 0x20c
mov esp, ebp
pop ebp
ret
Function at 0x10020390
Capabilities:
Create directory

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xffffffffffffffff
push 0x10036550
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x1004f100]
xor eax, ebp
mov dword [ebp + 0x208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
xor ebx, ebx
push 0x206
lea ecx, [ebp + 2]
xor eax, eax
push ebx
mov dword [ebp - 4], ebx
push ecx
mov word [ebp], ax
call fcn.100285e0
mov edx, dword [ebp + 0x214]
add esp, 0xc
mov edi, 0x7ffffffe
mov esi, 0x104
lea eax, [ebp]
lea esp, [esp]
test esi, esi
je 0x1002041e
test edi, edi
je 0x10020421
movzx ecx, word [edx]
test cx, cx
je 0x10020421
mov word [eax], cx
add eax, 2
add edx, 2
dec esi
dec edi
inc ebx
jmp 0x10020400
sub eax, 2
xor edx, edx
mov word [eax], dx
lea eax, [ebp]
push 0x2f
push eax
call fcn.100276b3
xor edi, edi
add esp, 8
cmp eax, edi
jne 0x1002045d
lea ecx, [ebp]
push 0x5c
push ecx
call fcn.100276b3
add esp, 8
cmp eax, edi
jne 0x1002045d
push 0x10049464
lea edx, [ebp - 0x24]
push edx
mov dword [ebp - 0x24], edi
call fcn.10028c35
xor ecx, ecx
lea edx, [ebp]
mov word [eax], cx
push edx
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x14], edi
call fcn.10020100
add esp, 4
cmp eax, edi
je 0x1002048e
cmp dword [ebp - 0x14], edi
je 0x1002048e
push 0x10049464
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], edi
call fcn.10028c35
lea ecx, [ebp]
push ecx
call fcn.10020390
mov esi, eax
add esp, 4
cmp esi, edi
je 0x100204b1
push 0x10049464
lea edx, [ebp - 0x18]
push edx
mov dword [ebp - 0x18], esi
call fcn.10028c35
push edi
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x100204fc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100204cf
xor eax, eax
push 0x10049464
lea ecx, [ebp - 0x1c]
push ecx
mov dword [ebp - 0x1c], eax
call fcn.10028c35
mov edx, dword [ebp - 0x28]
mov dword [ebp - 0x14], edx
mov eax, 0x100204f9
ret
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.100269c5
add ebp, 0x20c
mov esp, ebp
pop ebp
ret

Function at 0x10020530
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10036620
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1004f100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
xor edi, edi
push esi
mov dword [ebp - 4], edi
call fcn.10020390
add esp, 4
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp eax, edi
jne 0x100205af
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x50
je 0x100205af
mov dword [ebp - 0x18], eax
push 0x10049464
lea eax, [ebp - 0x18]
push eax
call fcn.10028c35
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], ecx
mov eax, 0x100205ac
ret
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10020610
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10036600
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push esi
push edi
mov eax, dword [0x1004f100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
cmp esi, ebx
jne 0x10020660
lea eax, [ebx + 0x57]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov dword [ebp - 4], ebx
mov eax, dword [edi + 0x20]
cmp eax, 0xffffffff
je 0x10020675
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x20], ebx
cmp dword [ebp + 0x10], ebx
je 0x10020681
mov eax, 2
jmp 0x1002068c
xor eax, eax
cmp dword [ebp + 0xc], ebx
setne al
add eax, 3
push ebx
push 0x80
push eax
mov eax, dword [ebp + 0xc]
neg eax
sbb eax, eax
push ebx
and eax, 0x90000000
push 7
add eax, 0x80000000
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 0x20], eax
cmp eax, 0xffffffff
jne 0x100206ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10049464
lea ecx, [ebp - 0x18]
push ecx
mov dword [ebp - 0x18], eax
call fcn.10028c35
mov eax, dword [edi + 0x1c]
lea esi, [edi + 0x10]
mov dword [edi + 8], ebx
mov dword [edi + 0xc], ebx
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [edi + 0x18], ebx
cmp eax, ebx
je 0x100206f2
push eax
call fcn.1002716e
add esp, 4
mov dword [edi + 0x1c], ebx
mov edx, dword [ebp + 8]
push edx
call fcn.1001fe20
mov ecx, dword [edi + 0x20]
mov eax, dword [ebp + 0xc]
push esi
push ecx
mov dword [edi + 0x18], eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x10020733
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10049464
lea edx, [ebp - 0x1c]
push edx
mov dword [ebp - 0x1c], eax
call fcn.10028c35
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x14], eax
mov eax, 0x10020733
ret
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10020a40
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10036410
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x1004f100]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
mov edi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x14], ebx
cmp edi, ebx
jne 0x10020a90
lea eax, [ebx + 0x57]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi]
mov edx, dword [eax + 0x1c]
call edx
test eax, eax
jne 0x10020ab4
mov eax, 0x3ee
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov dword [ebp - 4], ebx
mov eax, dword [esi + 0x20]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
jne 0x10020ae9
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x10049464
lea ecx, [ebp - 0x18]
push ecx
mov dword [ebp - 0x18], eax
call fcn.10028c35
mov edx, dword [ebp - 0x1c]
mov dword [ebp - 0x14], edx
mov eax, 0x10020ae9
ret
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100269c5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1004f100]
jne 0x100269cf
repz ret
jmp fcn.1002a721

Function at 0x10032929
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1002c4c3
and dword [ebp - 4], 0
cmp dword [0x100511b0], 0
mov ebx, eax
jne 0x100329da
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10032a8b
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10032a8b
push eax
call fcn.1002c451
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x100511b0], eax
call esi
push eax
call fcn.1002c451
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x100511b4], eax
call esi
push eax
call fcn.1002c451
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x100511b8], eax
call esi
push eax
call fcn.1002c451
pop ecx
mov dword [0x100511c0], eax
test eax, eax
je 0x100329da
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1002c451
pop ecx
mov dword [0x100511bc], eax
mov eax, dword [0x100511bc]
cmp eax, ebx
je 0x10032a32
cmp dword [0x100511c0], ebx
je 0x10032a32
push eax
call fcn.1002c4cc
push dword [0x100511c0]
mov esi, eax
call fcn.1002c4cc
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10032a32
test edi, edi
je 0x10032a32
call esi
test eax, eax
je 0x10032a29
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10032a29
test byte [ebp - 0xc], 1
jne 0x10032a32
or dword [ebp + 0x10], 0x200000
jmp 0x10032a6b
mov eax, dword [0x100511b4]
cmp eax, ebx
je 0x10032a6b
push eax
call fcn.1002c4cc
pop ecx
test eax, eax
je 0x10032a6b
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10032a6b
mov eax, dword [0x100511b8]
cmp eax, ebx
je 0x10032a6b
push eax
call fcn.1002c4cc
pop ecx
test eax, eax
je 0x10032a6b
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100511b0]
call fcn.1002c4cc
pop ecx
test eax, eax
je 0x10032a8b
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10032a8d
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x503dc0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xa7000]
push edi
jmp 0x503dda
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x503de1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x503dd0
mov eax, 1
add ebx, ebx
jne 0x503df3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x503e04
jne 0x503e23
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x503e23
dec eax
add ebx, ebx
jne 0x503e10
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x503de8
add ebx, ebx
jne 0x503e1f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x503e75
xor ecx, ecx
sub eax, 3
jb 0x503e3b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x503eaa
sar eax, 1
mov ebp, eax
jmp 0x503e46
add ebx, ebx
jne 0x503e46
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x503e14
inc ecx
add ebx, ebx
jne 0x503e54
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x503e14
add ebx, ebx
jne 0x503e61
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x503e56
jne 0x503e72
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x503e56
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x503e94
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x503e86
jmp 0x503dd6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x503e94
add edi, ecx
jmp 0x503dd6
pop esi
mov edi, esi
mov ecx, 0x3b6c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x503eb2
cmp byte [edi], 0x17
jne 0x503eb2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x503eb7
lea edi, [esi + 0xfd000]
mov eax, dword [edi]
or eax, eax
je 0x503f26
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x124ae0]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x124b74]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x503ee4
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x124b7c]
or eax, eax
je 0x503f20
mov dword [ebx], eax
add ebx, 4
jmp 0x503f01
call dword [esi + 0x124b78]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x503f57
cmp al, 0xef
ja 0x503f4a
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x503f2c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x503f39
mov ebp, dword [esi + 0x124b80]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x503f8b
sub esp, 0xffffff80
jmp 0x435126