joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5a8b30
Capabilities:
Create directory

Disassembly:
push ebp
push edi
push esi
mov esi, eax
push ebx
sub esp, 0x22c
movzx ebx, byte [esi]
mov eax, dword [0xd3c044]
mov dword [esp + 0x21c], eax
xor eax, eax
lea ebp, [esp + 0x1b]
cmp bl, 0x40
jg 0x5a8c00
lea edi, [esp + 0x1c]
mov ecx, ebp
xor eax, eax
mov dword [esp + 0x1b], 0
mov dword [esp + 0x218], 0
sub ecx, edi
add ecx, 0x201
shr ecx, 2
rep stosd dword es:[edi], eax
test bl, bl
je 0x5a8be0
xor edi, edi
jmp 0x5a8bbc
cmp bl, 0x5c
je 0x5a8bc1
mov dword [esp], edi
add esi, 1
mov dword [esp + 4], 1
call fcn.00402690
mov byte [esp + eax + 0x1a], bl
mov edi, eax
movzx ebx, byte [esi]
cmp eax, 0x200
je 0x5a8be0
test bl, bl
je 0x5a8be0
cmp bl, 0x2f
jne 0x5a8b90
test edi, edi
je 0x5a8b95
mov dword [esp], ebp
call dword [sym.imp.msvcrt.dll__mkdir]
cmp eax, 0xffffffff
je 0x5a8d00
movzx ebx, byte [esi]
jmp 0x5a8b95
xor eax, eax
mov edx, dword [esp + 0x21c]
sub edx, dword [0xd3c044]
jne 0x5a8d2d
add esp, 0x22c
pop ebx
pop esi
pop edi
pop ebp
ret
cmp bl, 0x5a
jg 0x5a8c40
cmp byte [esi + 1], 0x3a
lea edi, [esp + 0x1c]
mov ecx, ebp
mov dword [esp + 0x1b], 0
mov dword [esp + 0x218], 0
je 0x5a8c68
sub ecx, edi
xor eax, eax
add ecx, 0x201
shr ecx, 2
rep stosd dword es:[edi], eax
jmp 0x5a8b86
lea eax, [ebx - 0x61]
cmp al, 0x19
jbe 0x5a8c05
mov dword [esp + 0x1b], 0
lea edi, [esp + 0x1c]
mov ecx, ebp
mov dword [esp + 0x218], 0
jmp 0x5a8c24
sub ecx, edi
xor eax, eax
add ecx, 0x201
shr ecx, 2
rep stosd dword es:[edi], eax
lea edi, [esi + 2]
mov byte [esp + 0x1b], bl
mov byte [esp + 0x1c], 0x3a
movzx esi, byte [esi + 2]
mov eax, esi
test al, al
je 0x5a8be0
mov ebx, 2
jmp 0x5a8cd8
cmp al, 0x5c
je 0x5a8cde
mov dword [esp], ebx
add edi, 1
mov dword [esp + 4], 1
call fcn.00402690
mov ebx, eax
mov eax, esi
movzx esi, byte [edi]
mov byte [esp + ebx + 0x1a], al
mov eax, esi
test al, al
je 0x5a8be0
cmp ebx, 0x200
je 0x5a8be0
mov eax, esi
cmp al, 0x2f
jne 0x5a8ca0
cmp ebx, 2
je 0x5a8ca4
mov dword [esp], ebp
call dword [sym.imp.msvcrt.dll__mkdir]
cmp eax, 0xffffffff
je 0x5a8d20
movzx esi, byte [edi]
jmp 0x5a8ca4
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 0x11
je 0x5a8bd7
mov eax, 0xffffffe9
jmp 0x5a8be2
call dword [sym.imp.msvcrt.dll__errno]
cmp dword [eax], 0x11
je 0x5a8cf1
jmp 0x5a8d0f
call fcn.00401690
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
Function at 0x1000b68c
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1000b6bf
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1000b6ba
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x1000b817
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xfffe
jne 0x1000b717
mov dword [ebp - 0x10], 1
jmp 0x1000b71b
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp eax, dword [ecx]
jg 0x1000b733
mov dword [ebp - 0x40], 1
jmp 0x1000b737
and dword [ebp - 0x40], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 8]
mov ecx, 0xbf7c2f5a
sub ecx, dword [eax]
neg ecx
mov eax, dword [ebp - 4]
add ecx, dword [eax]
mov eax, dword [ebp - 4]
cmp ecx, dword [eax]
jne 0x1000b76d
mov eax, dword [ebp - 4]
cmp dword [eax], 0
mov eax, dword [ebp - 4]
imul eax, dword [eax], 0xdacb
cmp eax, 0xffff
jae 0x1000b786
mov dword [ebp - 0x14], 1
jmp 0x1000b78a
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x14], eax
jg 0x1000b79d
mov dword [ebp - 0x18], 1
jmp 0x1000b7a1
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp dword [ebp - 0x18], eax
jl 0x1000b7b4
mov dword [ebp - 0x1c], 1
jmp 0x1000b7b8
and dword [ebp - 0x1c], 0
cmp dword [ebp - 0x1c], 0x74006310
jg 0x1000b7ca
mov dword [ebp - 0x20], 1
jmp 0x1000b7ce
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x20]
jg 0x1000b7e1
mov dword [ebp - 0x44], 1
jmp 0x1000b7e5
and dword [ebp - 0x44], 0
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0xffff
je 0x1000b801
mov dword [ebp - 0x4c], 1
jmp 0x1000b805
and dword [ebp - 0x4c], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1000dba5
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1000dbfd
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1000dbe1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x1000dbfb
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.100129c3
and dword [eax], 0
jmp 0x1000dbd6
jmp 0x1000dc1b
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1000dc1b
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esp, ebp
pop ebp
ret

Function at 0x1000ee07
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1000ee58
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov ecx, dword [ecx + 0xc]
mov eax, dword [eax + 8]
mov edx, dword [ebp - 0x10]
mov edx, dword [edx]
mov dword [eax + ecx*4], edx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
inc eax
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [ecx + 0xc], eax
jmp 0x1000ee70
push 0
push 0x604
push 0
push 0
push 0x1cb9
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret

Function at 0x100121f9
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001226f
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
push 4
push 0x2000
mov eax, dword [ebp - 4]
push dword [eax + 0x50]
mov eax, dword [ebp - 4]
push dword [eax + 0x34]
push 0x429c
push 0x559e
call fcn.1003be2c
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jne 0x1001226d
push 4
push 0x2000
mov eax, dword [ebp - 4]
push dword [eax + 0x50]
push 0
push 0x429c
push 0x559e
call fcn.1003be2c
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x1001229e
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1001229e
push 0x6da
push 0x341
push 0
push 0xb7b
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov esp, ebp
pop ebp
ret
Function at 0x100123c1
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100123e7
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov eax, dword [eax]
and dword [eax + 0x10], 0
jmp 0x100123ef
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esp, ebp
pop ebp
ret

Function at 0x1001272c
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x10012750
xor eax, eax
jmp 0x100128a3
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1001276e
xor eax, eax
jmp 0x100128a3
push 0x69c2
lea eax, [ebp - 8]
push eax
push 1
push 0x5aa1
lea eax, [ebp - 0xc]
push eax
call fcn.1001254c
add esp, 0x14
cmp dword [ebp - 0xc], 0
jne 0x10012797
xor eax, eax
jmp 0x100128a3
lea eax, [ebp - 4]
push eax
push 1
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push 0x238e
lea eax, [ebp - 0x10]
push eax
push 0x43ac
lea eax, [ebp - 0x24]
push eax
call fcn.100125da
add esp, 0x20
push 0x7ea4
push 0x2ddc
push 0
push 0x44af
push dword [ebp - 4]
push 0x53d7
push dword [ebp - 8]
push dword [ebp + 8]
call fcn.10009bbe
add esp, 0x20
push 0x4c08
push 1
push 0x2db4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
call fcn.10012697
add esp, 0x18
cmp dword [ebp - 0x14], 0
je 0x10012821
push dword [ebp - 4]
push 0x8bd
push 0
push dword [ebp - 0x14]
call fcn.10011145
add esp, 0x10
push dword [ebp - 4]
call fcn.100120ba
pop ecx
test eax, eax
jne 0x10012832
xor eax, eax
jmp 0x100128a3
push dword [ebp - 4]
push 0x3b94
push 0x2239
push 0
call fcn.1000bb4f
add esp, 0x10
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1001288b
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x10012868
xor eax, eax
jmp 0x100128a3
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x10012881
xor eax, eax
jmp 0x100128a3
mov eax, dword [ebp - 4]
mov dword [eax + 0x10], 1
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1001289c
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x100128a0
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x10027957
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002796f
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x100279ba
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1002799d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x100279ba
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.100129c3
mov dword [eax], 0xb5dfeb07
jmp 0x10027992
mov esp, ebp
pop ebp
ret

Function at 0x10027a44
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10027a7d
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp - 0x10]
call fcn.100129c3
mov ecx, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ecx], eax
jmp 0x10027a91
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10027a91
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esp, ebp
pop ebp
ret

Function at 0x10027c2b
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10027c78
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov eax, dword [eax + 0x14]
add eax, dword [ecx + 0x10]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
push dword [eax + 0x14]
call fcn.10024ed3
pop ecx
pop ecx
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
jmp 0x10027c82
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov esp, ebp
pop ebp
ret
Function at 0x1002819c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100281f7
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x100281d8
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x100281f5
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x14]
call fcn.100129c3
mov dword [eax], 0xfffffffd
jmp 0x100281cd
jmp 0x1002821c
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002821c
push 0x6da
push 0x341
push 0
push 0xb7b
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov esp, ebp
pop ebp
ret

Function at 0x100285ef
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10028636
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x14]
add eax, dword [ecx]
mov ecx, dword [ebp - 0x18]
mov ecx, dword [ecx]
mov byte [ecx + eax], 0
jmp 0x1002864f
push 0
push 0
push 0
push 0
push 0
push 0
push 0x126
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esp, ebp
pop ebp
ret
Function at 0x10033b7b
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10033bad
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x10]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x10033bdc
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10033bdc
push 0x6da
push 0x341
push 0
push 0xb7b
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov esp, ebp
pop ebp
ret
Function at 0x10033ce1
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10033cfc
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x10033e5b
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0xfffffffb
jmp 0x10033d36
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xfffffff8
jle 0x10033e5b
mov dword [ebp - 4], 0
mov dword [ebp - 0x40], 0xaf1e2cd8
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0xfffe
jne 0x10033d6c
mov dword [ebp - 0x10], 1
jmp 0x10033d70
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
cmp eax, dword [ecx]
jg 0x10033d86
mov dword [ebp - 0x30], 1
jmp 0x10033d8a
and dword [ebp - 0x30], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0xc]
mov ecx, 0xbf7c2f5a
sub ecx, dword [eax]
neg ecx
add ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 4]
jne 0x10033db8
cmp dword [ebp - 4], 0
imul eax, dword [ebp - 4], 0xdacb
cmp eax, 0xffff
jae 0x10033dcf
mov dword [ebp - 0x14], 1
jmp 0x10033dd3
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 4]
cmp dword [ebp - 0x14], eax
jg 0x10033de4
mov dword [ebp - 0x18], 1
jmp 0x10033de8
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
cmp dword [ebp - 0x18], eax
jl 0x10033dfb
mov dword [ebp - 0x1c], 1
jmp 0x10033dff
and dword [ebp - 0x1c], 0
cmp dword [ebp - 0x1c], 0x74006310
jg 0x10033e11
mov dword [ebp - 0x20], 1
jmp 0x10033e15
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x20]
jg 0x10033e26
mov dword [ebp - 0x34], 1
jmp 0x10033e2a
and dword [ebp - 0x34], 0
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
cmp dword [ebp - 4], 0xffff
je 0x10033e44
mov dword [ebp - 0x3c], 1
jmp 0x10033e48
and dword [ebp - 0x3c], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x40], eax
jmp 0x10033d2b
mov esp, ebp
pop ebp
ret
Function at 0x10033ed8
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10033f33
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10033f14
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10033f31
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.100129c3
mov dword [eax], 9
jmp 0x10033f09
jmp 0x10033f3d
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov esp, ebp
pop ebp
ret

Function at 0x10034078
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100340ac
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100340aa
push 0
push 0x604
push 0
push 0
push 0x1cb9
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x100340df
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x100340df
push 0
push 0x1f08
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
mov esp, ebp
pop ebp
ret

Function at 0x1003481d
Capabilities:
Extract resource via kernel32 functions
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10034836
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x10034854
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10034854
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esp, ebp
pop ebp
ret
Function at 0x1004575f
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10045788
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
push 1
mov ecx, dword [ebp - 8]
call fcn.100129c3
and dword [eax], 0
jmp 0x100457a6
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x100457a6
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esp, ebp
pop ebp
ret

Function at 0x100457aa
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0x604
push 0
push 0
push 0x1cb9
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x10045872
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1004592b
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0x85c9e53
jle 0x100458d8
mov dword [ebp - 0xc], 1
jmp 0x100458dc
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
sub eax, dword [ebp - 0xc]
jmp 0x100458f9
and dword [ebp - 8], 0
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
sub eax, 0x21a35ca4
mov ecx, dword [ebp - 0x10]
cmp eax, dword [ecx]
jne 0x1004591d
mov dword [ebp - 0x14], 1
jmp 0x10045921
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
jmp 0x10045944
push 0x6da
push 0x341
push 0
push 0xb7b
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov esp, ebp
pop ebp
ret

Function at 0x10046edc
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10046ef4
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x10046f3c
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10046f22
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x10046f3c
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.100129c3
and dword [eax], 0
jmp 0x10046f17
mov esp, ebp
pop ebp
ret
Function at 0x10047017
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10047072
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10047053
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10047070
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.100129c3
mov dword [eax], 0x405a8158
jmp 0x10047048
jmp 0x10047081
push 0
push 0x185f
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov esp, ebp
pop ebp
ret