joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000aba0
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [0x1001f318], 0x214c
mov dword [ebp - 4], 0
mov dword [0x1001f318], 0x1a44
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], eax
mov dword [0x1001f318], 0x15d3
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], 0
jmp 0x1000ac09
mov dword [0x1001f318], 0x178b
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
movzx eax, word [eax + ecx*2]
cmp eax, 0
je 0x1000ac46
jmp 0x1000ac3a
cmp dword [ebp - 8], 0x104
jl 0x1000abec
jmp 0x1000ac55
mov dword [0x1001f314], 0x1b7
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
movzx eax, word [eax + ecx*2 - 0x18]
cmp eax, 0x6f
je 0x1000ac76
jmp 0x1000ad20
jmp 0x1000ad20
mov dword [0x1001f314], 0x2527
jmp 0x1000ac48
jmp 0x1000ac55
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
jmp 0x1000ac09
mov dword [0x1001f318], 0x2695
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
movzx eax, word [eax + ecx*2 - 0x1a]
cmp eax, 0x6c
je 0x1000ac14
jmp 0x1000ad22
mov dword [0x1001f314], 0x17a7
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
movzx eax, word [eax + ecx*2 - 0x16]
cmp eax, 0x61
jne 0x1000ac35
mov eax, dword [0x1001f314]
sub eax, 0xc08
mov dword [0x1001f314], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
movzx eax, word [eax + ecx*2 - 0x14]
cmp eax, 0x64
jne 0x1000ad1b
mov dword [0x1001f314], 0xa9c
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
movzx eax, word [eax + ecx*2 - 0x12]
cmp eax, 0x64
jne 0x1000ad19
mov dword [0x1001f314], 0x553
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
movzx eax, word [eax + ecx*2 - 0x10]
cmp eax, 0x6c
jne 0x1000ad17
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 8]
movzx eax, word [eax + ecx*2 - 0xe]
cmp eax, 0x6c
jne 0x1000ad15
mov eax, dword [0x1001f318]
sub eax, 0x136c
mov dword [0x1001f318], eax
mov dword [ebp - 0xc], 1
jmp 0x1000ad33
jmp 0x1000ad17
jmp 0x1000ad19
jmp 0x1000ad1b
jmp 0x1000ac35
jmp 0x1000ad22
mov dword [0x1001f314], 0x21c9
mov dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
add esp, 0x10
pop ebp
ret

Function at 0x1000bbf0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [fcn.1000bbf0]
mov dword [ebp - 4], eax
jmp 0x1000bc25
mov eax, dword [ebp - 4]
sub eax, 0x1000
and eax, 0xfffff000
mov dword [ebp - 4], eax
mov dword [0x1001f318], 0xe24
jmp 0x1000bc46
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
jmp 0x1000bc64
mov eax, dword [ebp - 4]
movzx eax, word [eax]
cmp eax, 0x5a4d
jne 0x1000bc01
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov eax, dword [eax + 0x3c]
cmp dword [ecx + eax], 0x4550
je 0x1000bc1d
jmp 0x1000bc01
mov al, 1
test al, 1
jne 0x1000bc25
jmp 0x1000bc4e
mov eax, dword [0x1001f314]
add eax, 0x218a
mov dword [0x1001f318], eax
mov dword [ebp - 8], 0
mov eax, dword [ebp - 8]
add esp, 8
pop ebp
ret
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..reloc
nop
nop
mov ebx, 0x407ef8
mov ecx, 0x535f5f44
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..rsrc
nop
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x4fc4f59
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219

Function at 0x433006
Capabilities:
Encode data using xor

Disassembly:
call 0x43300c
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x433030
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401a00
Capabilities:
Write file on windows

Disassembly:
push ebx
sub esp, 0x18
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x1b
mov dword [esp + 4], 1
lea ebx, [esp + 0x24]
mov dword [esp], str.Mingw_w64_runtime_failure:_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov eax, dword [sym.imp.msvcrt.dll__iob]
add eax, 0x40
mov dword [esp], eax
call sym._vfprintf
call sym._abort
jmp dbg.mark_section_writable

Function at 0x401a60
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
sub esp, 0x30
mov esi, dword [0x405054]
test esi, esi
jle 0x401b4d
mov edi, dword [0x405058]
xor ebx, ebx
lea edx, [edi + 4]
nop
mov ecx, dword [edx]
cmp ecx, eax
ja 0x401a94
mov edi, dword [edx + 4]
add ecx, dword [edi + 8]
cmp eax, ecx
jb 0x401b46
add ebx, 1
add edx, 0xc
cmp ebx, esi
jne 0x401a80
mov dword [esp], eax
mov ebx, eax
call dbg.__mingw_GetSectionForAddress
test eax, eax
mov edi, eax
je 0x401b8a
lea ebx, [esi + esi*2]
mov esi, dword [0x405058]
shl ebx, 2
add esi, ebx
mov dword [esi + 8], eax
mov dword [esi], 0
call dbg._GetPEImageBase
add eax, dword [edi + 0xc]
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], eax
mov eax, dword [0x405058]
mov eax, dword [eax + ebx + 4]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x401b6a
mov eax, dword [esp + 0x28]
lea edx, [eax - 4]
and edx, 0xfffffffb
je 0x401b3f
sub eax, 0x40
and eax, 0xffffffbf
je 0x401b3f
mov eax, dword [esp + 0x20]
add ebx, dword [0x405058]
mov dword [esp + 8], 0x40
mov dword [esp + 4], eax
mov eax, dword [esp + 0x14]
mov dword [esp + 0xc], ebx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
je 0x401b54
add dword [0x405054], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
xor esi, esi
jmp 0x401a9e
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
mov eax, dword [0x405058]
mov eax, dword [eax + ebx + 4]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
Function at 0x402050
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0x405408
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0x405400]
sub esp, 4
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
test ebx, ebx
je 0x4020a5
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x40209e
test esi, esi
je 0x40209e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x402080
mov dword [esp], 0x405408
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x4022c0
Capabilities:
Enumerate pe sections

Disassembly:
push esi
push ebx
mov edx, dword [esp + 0xc]
mov ebx, dword [esp + 0x10]
add edx, dword [edx + 0x3c]
movzx esi, word [edx + 6]
movzx eax, word [edx + 0x14]
test esi, esi
lea eax, [edx + eax + 0x18]
je 0x4022f8
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp edx, ebx
ja 0x4022ee
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x4022fa
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x4022e0
xor eax, eax
pop ebx
pop esi
ret

Function at 0x401c2e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x100
and byte [ebp - 0x100], 0
push edi
push 0x3f
xor eax, eax
pop ecx
lea edi, [ebp - 0xff]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
push 8
lea eax, [ebp - 0x100]
push 0x404008
push eax
call fcn.00401ca0
mov ecx, 0x401bdc
mov eax, 0x4017fd
sub ecx, eax
push ecx
push eax
lea eax, [ebp - 0x100]
push eax
call fcn.00401d18
push 0x100
lea eax, [ebp - 0x100]
push 0
push eax
call fcn.004020d0
add esp, 0x24
call fcn.00401846
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x4109c0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ecx + 8]
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x4109f4
cmp dword [esi + 0xa0], 0
jne 0x4109e5
mov eax, dword [esi + 0x20]
push eax
call dword [sym.imp.libssclient.dll_ss_app_session_exit]
add esp, 4
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
mov eax, dword [esi + 0x20]
push ecx
push edx
push edi
push eax
call dword [sym.imp.libssclient.dll_ss_app_session_launcher_info_send]
add esp, 0x10
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x410b00
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x44050d
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push ebx
push esi
push edi
mov eax, dword [0x4a12d8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov ebx, dword [sym.imp.mfc100u.dll_new]
xor edi, edi
push 0x210
mov dword [esi + 0x38], edi
call ebx
add esp, 4
cmp eax, edi
je 0x410be4
mov dword [esi + 0x34], eax
mov dword [eax], eax
mov eax, dword [esi + 0x34]
mov dword [eax + 4], eax
mov dword [ebp - 4], edi
push 0x218
mov dword [esi + 0x44], edi
call ebx
add esp, 4
cmp eax, edi
je 0x410bbf
mov dword [esi + 0x40], eax
mov dword [eax], eax
mov eax, dword [esi + 0x40]
mov dword [eax + 4], eax
push edi
mov eax, 1
mov dword [esi + 0x50], eax
mov dword [esi + 0x54], edi
mov dword [esi + 0x58], edi
mov dword [esi + 0x5c], edi
push edi
push edi
mov dword [esi + 0x2c], eax
mov dword [esi + 0x30], eax
mov dword [esi], edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push edi
push edi
push esi
push 0x410aa0
push edi
push edi
mov dword [0x4a3170], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], edi
call dword [sym.imp.MSVCR100.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const__]
push 0x49bdd0
lea ecx, [ebp - 0x20]
push ecx
mov dword [ebp - 0x20], vtable.std::bad_alloc.0
call sub.MSVCR100.dll__CxxThrowException
lea edx, [ebp - 0x14]
push edx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], edi
call dword [sym.imp.MSVCR100.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const__]
push 0x49bdd0
lea eax, [ebp - 0x2c]
push eax
mov dword [ebp - 0x2c], vtable.std::bad_alloc.0
call sub.MSVCR100.dll__CxxThrowException
int3
Function at 0x412e40
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4403ac
mov eax, dword fs:[0]
push eax
sub esp, 0x14
push ebx
push edi
mov eax, dword [0x4a12d8]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor ebx, ebx
mov eax, 8
push 0xc
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x18], ebx
mov dword [esi + 0x1c], ebx
mov dword [esi + 0x20], ebx
mov dword [esi + 0x24], ebx
mov dword [esi + 0x28], ebx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x38], ebx
mov word [esi + 0x3c], bx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x48], ebx
mov dword [esi + 0x50], ebx
mov dword [esi + 0x54], ebx
mov dword [esi + 0x58], ebx
mov dword [esi + 0x5c], ebx
mov dword [esi + 0x60], ebx
mov dword [esi + 0x64], ebx
mov dword [esi + 0x68], ebx
mov dword [esi + 0x6c], ebx
mov dword [esi + 0x74], ebx
mov dword [esi + 0x78], ebx
mov dword [esi + 0x7c], ebx
mov dword [esi + 0x90], ebx
mov dword [esi + 0x94], eax
mov dword [esi + 0x9c], eax
mov dword [esi + 0xa0], ebx
mov byte [esi + 0x234], 1
call dword [sym.imp.mfc100u.dll_new]
mov edi, eax
add esp, 4
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], ebx
cmp edi, ebx
je 0x412f31
push 0xc
mov dword [edi + 4], ebx
call dword [sym.imp.mfc100u.dll_new]
add esp, 4
cmp eax, ebx
je 0x412f0c
mov dword [edi], eax
mov dword [eax], eax
mov eax, dword [edi]
mov dword [eax + 4], eax
jmp 0x412f33
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x10], ebx
call dword [sym.imp.MSVCR100.dll_public:_void___thiscall_std::exception::constructor_char_const__const_const__]
push 0x49bdd0
lea ecx, [ebp - 0x20]
push ecx
mov dword [ebp - 0x20], vtable.std::bad_alloc.0
call sub.MSVCR100.dll__CxxThrowException
xor edi, edi
push ebx
push ebx
push esi
push 0x416100
push ebx
push ebx
mov dword [esi + 0x70], edi
mov dword [esi + 0xa4], ebx
mov dword [esi + 0xa8], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x415440
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x44071c
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push esi
push edi
mov eax, dword [0x4a12d8]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov ecx, dword [ebx + 0x78]
xor esi, esi
cmp ecx, esi
je 0x41548e
push esi
call dword [sym.imp.mfc100u.dll_CDialog::EndDialog]
mov ecx, dword [ebx + 0x78]
cmp ecx, esi
je 0x41548b
mov eax, dword [ecx]
mov edx, dword [eax + 4]
push 1
call edx
mov dword [ebx + 0x78], esi
mov eax, dword [ebx + 0x7c]
cmp eax, esi
je 0x4154a6
mov eax, dword [eax + 0x20]
push esi
push esi
push 0x10
push eax
call dword [sym.imp.USER32.dll_PostMessageW]
mov dword [ebx + 0x7c], esi
mov eax, dword [0x1445998]
mov edi, dword [sym.imp.USER32.dll_PostMessageA]
cmp eax, esi
je 0x4154e1
mov esi, eax
mov eax, dword [eax + 0x128]
test eax, eax
je 0x4154cd
mov eax, dword [eax + 0x20]
push 0
push 0
push 0x10
push eax
call edi
push 0
mov ecx, esi
call dword [sym.imp.mfc100u.dll_CDialog::EndDialog]
mov dword [0x1445998], 0
mov eax, dword [0x14459b8]
test eax, eax
je 0x415516
mov esi, eax
mov eax, dword [eax + 0x124]
test eax, eax
je 0x415502
mov eax, dword [eax + 0x20]
push 0
push 0
push 0x10
push eax
call edi
push 0
mov ecx, esi
call dword [sym.imp.mfc100u.dll_CDialog::EndDialog]
mov dword [0x14459b8], 0
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.libssclient.dll_ss_window_screen_size_get]
add esp, 4
push edi
call dword [sym.imp.libssclient.dll_ss_window_id_get]
add esp, 4
push edi
call dword [sym.imp.libssclient.dll_ss_window_name_get]
mov esi, eax
add esp, 4
test esi, esi
je 0x41556b
mov ecx, 0x47fe72
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x415562
test dl, dl
je 0x41555e
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x415562
add eax, 2
add ecx, 2
test dl, dl
jne 0x415542
xor eax, eax
jmp 0x415567
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x41557a
mov eax, dword [ebx + 0x28]
push eax
call dword [sym.imp.libssclient.dll_ss_app_info_name_get]
add esp, 4
mov esi, eax
push 0x1d8
call dword [sym.imp.mfc100u.dll_new]
add esp, 4
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], 0
test eax, eax
je 0x4155a9
push ebx
lea ecx, [ebx + 0x38]
push ecx
push edi
mov ecx, esi
mov edx, eax
call fcn.00416e60
jmp 0x4155ab
xor eax, eax
mov dword [esp + 0x20], 0xffffffff
mov dword [esp + 0x10], eax
test eax, eax
je 0x4155f5
mov esi, dword [ebx + 0x70]
mov edi, dword [esi]
mov eax, dword [edi + 4]
lea edx, [esp + 0x10]
push edx
push eax
push edi
call fcn.00416370
mov ecx, dword [esi + 4]
mov edx, 0x3ffffffe
sub edx, ecx
cmp edx, 1
jae 0x4155e9
push str.list_T__too_long
call dword [sym.imp.MSVCP100.dll_void___cdecl_std::_Xlength_error_char_const__]
inc ecx
mov dword [esi + 4], ecx
mov dword [edi + 4], eax
mov ecx, dword [eax + 4]
mov dword [ecx], eax
push str.In_set_activity_time
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebx + 0xa4], eax
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x416ce0
Capabilities:
Print debug messages
Register raw input devices

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x160
mov eax, dword [0x4a12d8]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0xc
mov dword [ebp - 0x124], ecx
push 1
lea ecx, [ebp - 0x130]
xor edi, edi
push ecx
mov dword [ebp - 0x120], eax
mov esi, edx
mov dword [ebp - 0x130], 0x60001
mov dword [ebp - 0x12c], edi
mov dword [ebp - 0x128], edi
call dword [sym.imp.USER32.dll_RegisterRawInputDevices]
test eax, eax
jne 0x416d5d
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea edx, [ebp - 0x10c]
push str.RegisterRawInputDevices_failed_with_error__d_n
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
push 0x30
lea ecx, [ebp - 0x160]
push edi
push ecx
call sub.MSVCR100.dll_memset
add esp, 0xc
push 0x7f00
push edi
mov dword [ebp - 0x160], 0x30
mov dword [ebp - 0x15c], 3
mov dword [ebp - 0x158], 0x4188d0
mov dword [ebp - 0x14c], esi
call dword [sym.imp.USER32.dll_LoadCursorW]
push 4
mov dword [ebp - 0x144], eax
call dword [sym.imp.GDI32.dll_GetStockObject]
lea edx, [ebp - 0x160]
push edx
mov dword [ebp - 0x140], eax
mov dword [ebp - 0x138], 0x480e34
call dword [sym.imp.USER32.dll_RegisterClassExW]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
lea ecx, [ebp - 0x11c]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
push edi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
call edi
push 1
mov ebx, eax
call edi
mov edx, dword [ebp - 0x124]
push 0
push esi
push 0
push 0
push eax
push ebx
push 0
push 0
push Ordinal_2
push edx
push 0x480e34
push 0
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, eax
mov eax, dword [ebp - 0x120]
push eax
push 0xffffffffffffffeb
push esi
call dword [sym.imp.USER32.dll_SetWindowLongW]
call dword [sym.imp.mfc100u.dll_AfxGetModuleState]
mov eax, dword [eax + 8]
push 0x80
push eax
call dword [sym.imp.USER32.dll_LoadIconW]
push eax
push 0xfffffffffffffff2
push esi
call dword [sym.imp.USER32.dll_SetClassLongW]
mov ecx, dword [ebp - 8]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.0043e590
mov esp, ebp
pop ebp
ret 4
Function at 0x420d70
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x4a12d8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea ecx, [ebp - 0xc]
push ecx
mov dword [ebp - 0x14], ebx
xor esi, esi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov word [ebp - 8], 0x500
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
test eax, eax
je 0x420dc9
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 0x14]
push edx
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x420dd1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, dword [ebp - 0x10]
cmp eax, ebx
je 0x420de2
push eax
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov dword [ebp - 0x10], ebx
cmp esi, ebx
je 0x420df7
push 0x49be04
lea ecx, [ebp - 0x18]
push ecx
mov dword [ebp - 0x18], esi
call sub.MSVCR100.dll__CxxThrowException
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x14]
pop esi
xor ecx, ebp
pop ebx
call fcn.0043e590
mov esp, ebp
pop ebp
ret

Function at 0x420e10
Capabilities:
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x248
mov eax, dword [0x4a12d8]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x104
lea eax, [ebp - 0x20c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
je 0x420ea8
push 0x38
lea ecx, [ebp - 0x244]
push 0
push ecx
mov dword [ebp - 0x248], 0x3c
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x248]
lea edx, [ebp - 0x20c]
push eax
mov dword [ebp - 0x23c], str.runas
mov dword [ebp - 0x238], edx
mov dword [ebp - 0x240], 0
mov dword [ebp - 0x22c], 1
call dword [sym.imp.SHELL32.dll_ShellExecuteExW]
test eax, eax
jne 0x420e99
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0043e590
mov esp, ebp
pop ebp
ret
Function at 0x421360
Capabilities:
Persist via default file association registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x4a12d8]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.00420d70
test eax, eax
jne 0x421381
call fcn.00420e10
push esi
lea eax, [ebp - 0x418]
push eax
push str.LudiumLab_shellopencommand
push Ordinal_2
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
mov ecx, dword [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetKeyValueW]
push 0x30
push str.URL:LudiumLab_Protocol
push 1
push 0
push 0x480e34
push Ordinal_2
call esi
push 0
push 0x47fe72
push 1
push str.URL_Protocol
push 0x480e34
push Ordinal_2
call esi
push 0x104
lea edx, [ebp - 0x414]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x414]
push eax
lea ecx, [ebp - 0x20c]
push str.__s_____1_
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x20c]
add esp, 0xc
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x421416
sub eax, edx
sar eax, 1
lea edx, [eax + eax + 4]
push edx
lea eax, [ebp - 0x20c]
push eax
push 1
push 0
push str.LudiumLab_shellopencommand
push Ordinal_2
call esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.0043e590
mov esp, ebp
pop ebp
ret

Function at 0x421450
Capabilities:
Query or enumerate registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
mov dword [ebp - 0x10], 4
cmp edi, reloc.XINPUT1_3.dll_Ordinal_2
jne 0x4214a7
push str.IsWow64Process
push str.kernel32
mov dword [ebp - 8], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x4214a7
lea eax, [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
test eax, eax
je 0x4214a7
cmp dword [ebp - 8], 0
mov esi, str.SoftwareWow6432NodeMicrosoftInternet_ExplorerMainFeatureControlFEATURE_BROWSER_EMULATION
jne 0x4214ac
mov esi, str.SoftwareMicrosoftInternet_ExplorerMainFeatureControlFEATURE_BROWSER_EMULATION
mov ebx, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
lea ecx, [ebp - 4]
push ecx
push 0x20019
push 0
push esi
push edi
call ebx
cmp eax, 2
je 0x42153e
lea edx, [ebp - 0x10]
push edx
mov edx, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
lea ecx, [ebp - 0x14]
push ecx
push 0
push edx
push eax
mov dword [ebp - 0x14], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 2
jne 0x42152a
call fcn.00420d70
test eax, eax
jne 0x4214fc
call fcn.00420e10
lea ecx, [ebp - 4]
push ecx
push 0xf003f
push 0
push esi
push edi
call ebx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
push 4
lea edx, [ebp - 0xc]
push edx
push 4
push 0
push eax
push ecx
mov dword [ebp - 0xc], 0x2af9
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegFlushKey]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4