joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100373b4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
lea ebp, [esp - 0x1004]
mov eax, 0x1004
call fcn.10039d10
push 0xffffffffffffffff
push 0x10059845
mov eax, dword fs:[0]
push eax
sub esp, 0x10
mov eax, dword [0x10080f6c]
xor eax, ebp
mov dword [ebp + 0x1000], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 0x100c]
xor edi, edi
mov dword [ebp - 0x18], edi
xor eax, eax
push 0xffe
mov word [ebp], ax
lea eax, [ebp + 2]
push edi
push eax
mov dword [ebp - 4], edi
call fcn.10039d40
mov eax, dword [ebp + 0x1010]
add esp, 0xc
cmp eax, edi
je 0x10037425
mov esi, dword [eax]
jmp 0x10037427
xor esi, esi
movzx eax, word [esi]
xor edx, edx
xor ecx, ecx
cmp ax, di
je 0x1003754c
cmp ax, 0x2e
jne 0x10037443
inc edx
cmp edx, 1
jg 0x10037456
inc ecx
movzx eax, word [esi + ecx*2]
cmp ax, di
jne 0x10037437
cmp edx, 1
jle 0x1003754c
push 0x1006d7bc
push esi
call fcn.10035fb0
pop ecx
pop ecx
test eax, eax
js 0x1003754c
push esi
call fcn.10036485
pop ecx
test al, al
je 0x1003754c
push 0x1006d7d8
lea ecx, [ebp - 0x14]
call fcn.10001309
push 0x1006d7d4
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.1001060c
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.10001524
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 1
cmp ecx, edi
je 0x100374b8
call fcn.10001441
push esi
lea ecx, [ebp - 0x10]
call fcn.10001309
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.10001524
mov ecx, dword [ebp - 0x10]
mov byte [ebp - 4], 1
cmp ecx, edi
je 0x100374e1
call fcn.10001441
mov esi, dword [ebp - 0x14]
cmp esi, edi
je 0x100374ec
mov eax, dword [esi]
jmp 0x100374ee
xor eax, eax
lea ecx, [ebp - 0x18]
push ecx
push 0x20019
push edi
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x10037534
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp]
push eax
lea eax, [ebp - 0x1c]
push eax
push edi
push 0x1006d830
push dword [ebp - 0x18]
mov dword [ebp - 0x10], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
je 0x10037534
xor eax, eax
mov word [ebp], ax
lea eax, [ebp]
push eax
mov ecx, ebx
call fcn.10001309
cmp esi, edi
je 0x1003756c
mov ecx, esi
call fcn.10001441
jmp 0x1003756c
push str.1.3.1
push esi
call fcn.10035fb0
push esi
call fcn.10036485
add esp, 0xc
push 0x1006d10e
mov ecx, ebx
call fcn.1001060c
mov ecx, dword [ebp + 0x1010]
cmp ecx, edi
je 0x1003757b
call fcn.10001441
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x1000]
xor ecx, ebp
call fcn.10039bc2
add ebp, 0x1004
leave
ret
Function at 0x10039bc2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10080f6c]
jne 0x10039bcc
repz ret
jmp fcn.10042bbc

Function at 0x1005558b
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x10083640], 0
push esi
push edi
jne 0x10055501
call fcn.1005546d
test eax, eax
je 0x10055546
mov eax, dword [0x10083640]
cmp eax, 1
jne 0x10055522
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x10055546
jmp 0x10055588
mov edi, dword [sym.imp.kernel32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x10055588
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x1005554a
xor eax, eax
jmp 0x10055588
mov eax, dword [esi]
push dword [0x10083640]
call edi
mov edi, eax
test edi, edi
je 0x1005556c
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, edi
jmp 0x10055588
lea edi, [esi + 0xff0]
push esi
push dword [0x10083640]
call dword [sym.imp.kernel32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x10055572
mov eax, esi
pop edi
pop esi
ret
jmp 0x100554ed
Function at 0x421210
Capabilities:
Encode data using xor

Disassembly:
xor edx, edx
test edi, edi
jle 0x421223
call fcn.004211b0
xor byte [edx + esi], al
inc edx
cmp edx, edi
jl 0x421216
cmp edi, 0x2d
jne 0x42123c
mov dword [0x2bd46d8], 0xa62e7790
mov dword [0x2bd46dc], 0xffffffff
ret

Function at 0x421240
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x42c004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x42cdd0]
push esi
mov esi, dword [0x2bd224c]
push edi
mov edi, dword [0x2bd46cc]
call fcn.004211e0
cmp dword [0x2bd46cc], 0x2f
jne 0x4212ad
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.00421210
mov ecx, dword [esp + 0x24]
pop edi
pop esi
xor ecx, esp
call fcn.004010d6
add esp, 0x24
ret
Function at 0x421520
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 4], 0
jmp 0x421538
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1519a5
jge 0x421579
mov dword [0x2bd4334], 0x8e46a6f0
cmp dword [0x2bd46cc], 0x3dc
jne 0x421577
xor ecx, ecx
mov word [ebp - 8], cx
xor edx, edx
mov word [ebp - 6], dx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterA]
jmp 0x42152f
mov dword [ebp - 0x10], 0
jmp 0x42158b
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x12cad2a
jge 0x421626
cmp dword [0x2bd46cc], 0xa5f
jne 0x4215ac
push 0
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
cmp dword [ebp - 0x10], 0x84620b
jne 0x4215d1
mov eax, dword [0x42dbf0]
mov dword [0x2bd46cc], eax
mov ecx, dword [0x2bd46cc]
add ecx, 0xa231
mov dword [0x2bd46cc], ecx
cmp dword [0x2bd46cc], 0x141
jne 0x421621
xor edx, edx
mov word [ebp - 0x24], dx
xor eax, eax
mov word [ebp - 0x22], ax
xor ecx, ecx
mov word [ebp - 0x20], cx
xor edx, edx
mov word [ebp - 0x1e], dx
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x20]
push ecx
mov edx, dword [ebp - 0x24]
push edx
lea eax, [ebp - 0x1c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_ReadConsoleOutputA]
mov dword [0x42f1b8], 0xec58acac
mov dword [0x42f1bc], 0xffffffff
jmp 0x421582
call fcn.004212d0
jmp dword [0x2bd224c]

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4219a3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x4219b2
pop dword [ebp - 0x28]
mov eax, 0xa1f23d50
sub eax, 0xa1b0239e
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x3efa5
push 0
mov eax, 0x78b6158f
add eax, 0x878c3c89
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x4358a9fc
sub ecx, 0x43585e25
mov edx, eax
mov edi, 0xc4e40032
add edi, 0x3b5f53ce
add edi, dword [ebp - 0x28]
mov esi, 0x15bded11
add esi, 0xfcf992de
sub dword [ebp - 0x18], 0x1b921fd0
mov ebx, dword [edi]
sub dword [ebp - 0x18], 0x7cd800a8
xor ebx, esi
add dword [ebp - 0x14], 0xe6dda607
mov dword [edx], ebx
sub dword [ebp - 0x20], ecx
add edx, 0xfa1bd318
add edx, 0x5e42cec
add edi, 0x89ed0a5c
sub edi, 0x89ed0a58
loop 0x421a11
add eax, 0x1222f
mov ebx, eax
add eax, 0xbf2996f7
sub eax, 0xbf2996f2
mov ecx, 0xbbbfa7c8
add ecx, 0x44805838
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x4028f0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
push edi
add esp, 0xfffffef8
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403a58
test esi, esi
jne 0x402926
push 0x105
lea eax, [esp + 4]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
mov edx, esp
mov eax, ebx
call fcn.00403b48
jmp 0x402944
call sub.kernel32.dll_GetCommandLineA
mov edi, eax
mov edx, ebx
mov eax, edi
call fcn.00402804
mov edi, eax
test esi, esi
je 0x402944
cmp dword [ebx], 0
je 0x402944
dec esi
jmp 0x40292d
add esp, 0x108
pop edi
pop esi
pop ebx
ret

Function at 0x402e44
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x413020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402edc
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402ebc
xor eax, eax
push ebp
push 0x402eb5
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402ef8
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402ebc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x413020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x413020], ax
mov esp, ebp
pop ebp
ret

Function at 0x4038dc
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x414044], 0
je 0x40393d
cmp word [0x414218], 0xd7b2
jne 0x403905
cmp dword [0x414220], 0
jbe 0x403905
mov eax, 0x414214
call dword [0x414230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x413068
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403964
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x41302c], 0
jne 0x403959
push 0
push 0x413060
push 0x413068
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret
Function at 0x404b98
Capabilities:
Get geographical location
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffee0
push ebx
push esi
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x11d]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov byte [ebp - 0x12], 0
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404dc8
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404c1b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404dc8
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
je 0x404c1b
lea eax, [ebp - 8]
push eax
push 0xf0019
push 0
push 0x404de4
push 0x80000001
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x404ca4
xor eax, eax
push ebp
push 0x404c9d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0x18], 5
lea eax, [ebp - 0x11d]
mov edx, 0x105
call fcn.004049e0
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
lea eax, [ebp - 0x11d]
push eax
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404c82
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x12]
push eax
push 0
push 0
push 0x404e04
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegQueryValueExA
test eax, eax
je 0x404c82
mov byte [ebp - 0x12], 0
mov byte [ebp - 0xe], 0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404ca4
mov eax, dword [ebp - 8]
push eax
call sub.advapi32.dll_RegCloseKey
ret
push 0x105
mov eax, dword [ebp - 4]
push eax
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrcpynA
push 5
lea eax, [ebp - 0xd]
push eax
push 3
call sub.kernel32.dll_GetThreadLocale
push eax
call sub.kernel32.dll_GetLocaleInfoA
xor esi, esi
cmp byte [ebp - 0x11d], 0
je 0x404dbe
cmp byte [ebp - 0xd], 0
jne 0x404ceb
cmp byte [ebp - 0x12], 0
je 0x404dbe
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_lstrlenA
mov ebx, eax
lea eax, [ebp - 0x11d]
add ebx, eax
jmp 0x404d04
dec ebx
cmp byte [ebx], 0x2e
je 0x404d13
lea eax, [ebp - 0x11d]
cmp ebx, eax
jne 0x404d03
lea eax, [ebp - 0x11d]
cmp ebx, eax
je 0x404dbe
inc ebx
cmp byte [ebp - 0x12], 0
je 0x404d50
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0x12]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404dbe
cmp byte [ebp - 0xd], 0
je 0x404dbe
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
test esi, esi
jne 0x404dbe
mov byte [ebp - 0xb], 0
lea eax, [ebp - 0x11d]
mov edx, ebx
sub edx, eax
mov eax, 0x105
sub eax, edx
push eax
lea eax, [ebp - 0xd]
push eax
push ebx
call sub.kernel32.dll_lstrcpynA
push 2
push 0
lea eax, [ebp - 0x11d]
push eax
call sub.kernel32.dll_LoadLibraryExA
mov esi, eax
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x405454
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x4054ba
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.00403cc8
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402a38
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x4054a4
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4054c1
lea eax, [ebp - 0x10]
call fcn.00403a58
ret

Function at 0x4095f4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x40962d
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403b48
jmp 0x409636
mov eax, ebx
mov edx, esi
call fcn.00403aac
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x409640
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA_1
test eax, eax
jle 0x409661
mov al, byte [esp]
jmp 0x409663
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x409ce8
Capabilities:
Write file on windows

Disassembly:
add esp, 0xfffffbbc
push 0x400
lea ecx, [esp + 0x48]
call 0x409b60
mov eax, dword [0x4134fc]
cmp byte [eax], 0
je 0x409d64
mov eax, dword [0x41341c]
call fcn.004029b4
call fcn.00402730
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x48]
push eax
call sub.user32.dll_CharToOemA
push 0
lea eax, [esp + 4]
push eax
lea eax, [esp + 0x4c]
call fcn.00406fa8
push eax
lea eax, [esp + 0x50]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x409dac
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x409d9a
push 0x40
lea eax, [esp + 8]
push eax
mov eax, dword [0x4133f8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x414660]
call fcn.004049a4
push eax
call sub.user32.dll_LoadStringA_1
push 0x2010
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x4c]
push eax
push 0
call sub.user32.dll_MessageBoxA_1
add esp, 0x444
ret
Function at 0x40aa48
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40aaac
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00403cc8
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00406b44
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40aab3
lea eax, [ebp - 0xc]
call fcn.00403a58
ret

Function at 0x412360
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffec
push ebx
push esi
xor eax, eax
mov dword [ebp - 0x14], eax
mov eax, dword [0x4134fc]
mov byte [eax], 1
mov eax, 0x4122e8
call fcn.004056b4
xor eax, eax
push ebp
push 0x412470
push dword fs:[eax]
mov dword fs:[eax], esp
mov edx, 0x414878
mov eax, 1
call fcn.004028f0
mov eax, 0x41487c
mov ecx, 0x412488
mov edx, dword [0x414878]
call fcn.00403d40
push 0x412498
lea edx, [ebp - 0x14]
mov eax, 2
call fcn.004028f0
push dword [ebp - 0x14]
push 0x4124c0
mov eax, 0x414880
mov edx, 3
call fcn.00403db4
cmp dword [0x414878], 0
je 0x41245a
cmp dword [0x414880], 0
je 0x41245a
mov edx, dword [0x41487c]
mov eax, dword [0x414878]
call fcn.0041206c
mov dl, 1
mov eax, dword [0x40f1d0]
call fcn.00402f74
mov ebx, eax
mov edx, dword [0x41487c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x68]
mov ecx, dword [0x414880]
xor edx, edx
mov eax, ebx
mov esi, dword [eax]
call dword [esi + 0x60]
mov edx, dword [0x41487c]
mov eax, ebx
mov ecx, dword [eax]
call dword [ecx + 0x74]
mov eax, ebx
call fcn.00402fa4
mov eax, dword [0x414878]
call fcn.00403ef4
push eax
call sub.kernel32.dll_DeleteFileA
mov edx, dword [0x414878]
mov eax, dword [0x41487c]
call fcn.00406e4c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x412477
lea eax, [ebp - 0x14]
call fcn.00403a58
ret
Function at 0x1019a49c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x101a4cd8]
jne 0x1019a4a6
repz ret
jmp fcn.1019bf0b

Function at 0x1019d05f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1019a51d
and dword [ebp - 4], 0
cmp dword [0x101a6828], 0
mov ebx, eax
jne 0x1019d110
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1019d1c1
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1019d1c1
push eax
call fcn.1019a4ab
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x101a6828], eax
call esi
push eax
call fcn.1019a4ab
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x101a682c], eax
call esi
push eax
call fcn.1019a4ab
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x101a6830], eax
call esi
push eax
call fcn.1019a4ab
pop ecx
mov dword [0x101a6838], eax
test eax, eax
je 0x1019d110
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1019a4ab
pop ecx
mov dword [0x101a6834], eax
mov eax, dword [0x101a6834]
cmp eax, ebx
je 0x1019d168
cmp dword [0x101a6838], ebx
je 0x1019d168
push eax
call fcn.1019a526
push dword [0x101a6838]
mov esi, eax
call fcn.1019a526
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1019d168
test edi, edi
je 0x1019d168
call esi
test eax, eax
je 0x1019d15f
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1019d15f
test byte [ebp - 0xc], 1
jne 0x1019d168
or dword [ebp + 0x10], 0x200000
jmp 0x1019d1a1
mov eax, dword [0x101a682c]
cmp eax, ebx
je 0x1019d1a1
push eax
call fcn.1019a526
pop ecx
test eax, eax
je 0x1019d1a1
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1019d1a1
mov eax, dword [0x101a6830]
cmp eax, ebx
je 0x1019d1a1
push eax
call fcn.1019a526
pop ecx
test eax, eax
je 0x1019d1a1
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x101a6828]
call fcn.1019a526
pop ecx
test eax, eax
je 0x1019d1c1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1019d1c3
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1019ebda
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x44
mov eax, dword [ebp + 8]
mov dword [0x101a4758], 0x1dce
mov dword [ebp - 0x10], eax
call fcn.1019fb00
xor ecx, ecx
mov edx, eax
mov esi, dword [eax + 0x3c]
mov edi, edx
add edi, esi
mov esi, dword [eax + esi]
cmp esi, 0x4550
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
je 0x1019ec20
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax + 0x78]
mov dword [0x101a4754], 0x18ed
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
add ecx, dword [edx + eax + 0x20]
mov esi, dword [edx + eax + 0x18]
cmp esi, 0
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], edi
je 0x1019eca7
jmp 0x1019ecb2
mov eax, dword [ebp - 0x34]
add eax, 1
mov cl, byte [ebp - 0x35]
cmp cl, 0
setne dl
mov ch, byte [ebp - 0x36]
and ch, dl
cmp eax, 0x20
setb dl
and ch, dl
test ch, 1
mov dword [ebp - 0x3c], eax
jne 0x1019ecc6
jmp 0x1019ecf3
mov eax, dword [ebp - 0x40]
mov ecx, dword [ebp - 0x44]
xor edx, edx
mov esi, dword [ebp - 0x28]
mov edi, dword [esi + eax*4]
mov dword [0x101a4758], 0x1dce
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x50], edi
mov dword [ebp - 0x3c], edx
jmp 0x1019ecc6
mov eax, dword [ebp - 0x30]
add esp, 0x44
pop esi
pop edi
pop ebx
pop ebp
ret
xor eax, eax
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x24]
add ecx, dword [ecx + edx + 0x24]
mov dword [ebp - 0x44], ecx
mov dword [ebp - 0x40], eax
jmp 0x1019ec81
mov eax, dword [ebp - 0x3c]
mov ecx, eax
mov edx, dword [ebp - 0x50]
add ecx, edx
mov esi, dword [ebp - 0x1c]
mov bl, byte [esi + ecx]
mov ecx, dword [ebp - 0x10]
mov bh, byte [ecx + eax]
cmp bl, bh
sete cl
cmp bl, 0
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x35], bh
mov byte [ebp - 0x36], cl
jne 0x1019ec57
mov al, byte [ebp - 0x36]
test al, 1
jne 0x1019ed26
jmp 0x1019ecfc
xor eax, eax
mov ecx, dword [ebp - 0x48]
add ecx, 1
mov edx, dword [ebp - 0x4c]
add edx, 2
mov esi, dword [ebp - 0x2c]
cmp ecx, esi
mov dword [ebp - 0x40], ecx
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x30], eax
jb 0x1019ec81
jmp 0x1019eca7
mov eax, dword [ebp - 0x4c]
movzx ecx, word [eax]
mov dword [0x101a4754], 0x1941
mov edx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
add edx, dword [edx + esi + 0x1c]
mov edi, dword [ebp - 0x1c]
add edi, dword [edx + ecx*4]
mov dword [0x101a4758], 0x92b
mov dword [ebp - 0x30], edi
jmp 0x1019eca7
Function at 0x1019f076
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push esi
sub esp, 0x24
mov dword [ebp - 8], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 8], eax
xor ecx, ecx
mov edx, dword [ebp - 8]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
jmp 0x1019f0e2
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov dword [0x101a4754], ecx
add esp, 0x24
pop esi
pop ebp
ret
mov eax, dword [ebp - 0x20]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x24], eax
jl 0x1019f0e2
jmp 0x1019f0f8
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x12], 0x64
je 0x1019f15b
jmp 0x1019f18d
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], edx
jne 0x1019f0b5
mov eax, dword [ebp - 0x24]
mov dword [0x101a4758], 0x258e
mov ecx, dword [ebp - 0x10]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x28], eax
jne 0x1019f18d
mov dword [0x101a4754], 0x636
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x1019f18d
mov dword [0x101a4754], 0x3d46
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x1019f18d
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x1019f0ce
jmp 0x1019f18d
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x28]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x1019f18d
mov eax, 0x18d0
mov ecx, 1
mov edx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x28]
cmp word [edx + esi*2 - 0xe], 0x6c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
je 0x1019f0a3
mov eax, 0x1088
xor ecx, ecx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], ecx
jmp 0x1019f0a3