joyce8/EMBER2024-capa huggingface dataset:
Function at 0x467190
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5bb278]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x4f0053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x2c]
mov eax, 0x5c45e0
mov dword [ebp - 0x28], 0x540046
mov dword [ebp - 0x24], 0x410057
mov edx, 0x14
mov dword [ebp - 0x20], 0x450052
sub esi, eax
mov dword [ebp - 0x1c], 0x4d005c
mov dword [ebp - 0x18], str._af_n
mov dword [ebp - 0x14], 0x6f0072
mov dword [ebp - 0x10], 0x610047
mov dword [ebp - 0xc], 0x65006d
lea ecx, [edx + 0x7fffffea]
test ecx, ecx
je 0x467213
movzx ecx, word [esi + eax]
test cx, cx
je 0x467213
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4671f5
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5c45e0
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046975d
mov esp, ebp
pop ebp
ret

Function at 0x4672b0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, dword [0x5bb278]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x38], 0x650057
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x38]
mov eax, 0x5c455c
mov dword [ebp - 0x34], 0x440069
push edi
mov dword [ebp - 0x30], 0x610075
mov edx, 0x1a
mov dword [ebp - 0x2c], 0x44006e
sub esi, eax
mov dword [ebp - 0x28], 0x610069
mov dword [ebp - 0x24], 0x6f006c
mov dword [ebp - 0x20], 0x530067
mov dword [ebp - 0x1c], 0x620075
mov dword [ebp - 0x18], 0x6e0057
mov dword [ebp - 0x14], 0x450064
mov dword [ebp - 0x10], 0x690078
mov dword [ebp - 0xc], 0x740073
nop dword [eax]
lea ecx, [edx + 0x7fffffe4]
test ecx, ecx
je 0x46734e
movzx ecx, word [esi + eax]
test cx, cx
je 0x46734e
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x467330
lea ecx, [eax - 2]
test edx, edx
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov eax, 0x5c455c
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046975d
mov esp, ebp
pop ebp
ret

Function at 0x467380
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x5bb278]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov eax, 0x5c4540
mov dword [ebp - 0x1c], 0x4f0053
lea esi, [ebp - 0x1c]
mov dword [ebp - 0x18], 0x540046
mov dword [ebp - 0x14], 0x410057
mov edx, 0xd
mov dword [ebp - 0x10], 0x450052
sub esi, eax
mov dword [ebp - 0xc], 0x25005c
mov dword [ebp - 8], 0x73
nop word [eax + eax]
lea ecx, [edx + 0x7ffffff1]
test ecx, ecx
je 0x4673ee
movzx ecx, word [esi + eax]
test cx, cx
je 0x4673ee
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x4673d0
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5c4540
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046975d
mov esp, ebp
pop ebp
ret
Function at 0x467610
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5bb278]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x4f0053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x2c]
mov eax, 0x5c45b8
mov dword [ebp - 0x28], 0x540046
mov dword [ebp - 0x24], 0x410057
mov edx, 0x14
mov dword [ebp - 0x20], 0x450052
sub esi, eax
mov dword [ebp - 0x1c], 0x4d005c
mov dword [ebp - 0x18], str._af_n
mov dword [ebp - 0x14], 0x6f0072
mov dword [ebp - 0x10], 0x610047
mov dword [ebp - 0xc], 0x65006d
lea ecx, [edx + 0x7fffffea]
test ecx, ecx
je 0x467693
movzx ecx, word [esi + eax]
test cx, cx
je 0x467693
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x467675
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5c45b8
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046975d
mov esp, ebp
pop ebp
ret

Function at 0x4676c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov eax, dword [0x5bb278]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x2c], 0x4f0053
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x2c]
mov eax, 0x5c4590
mov dword [ebp - 0x28], 0x540046
mov dword [ebp - 0x24], 0x410057
mov edx, 0x14
mov dword [ebp - 0x20], 0x450052
sub esi, eax
mov dword [ebp - 0x1c], 0x4d005c
mov dword [ebp - 0x18], str._af_n
mov dword [ebp - 0x14], 0x6f0072
mov dword [ebp - 0x10], 0x610047
mov dword [ebp - 0xc], 0x65006d
lea ecx, [edx + 0x7fffffea]
test ecx, ecx
je 0x467743
movzx ecx, word [esi + eax]
test cx, cx
je 0x467743
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x467725
lea ecx, [eax - 2]
test edx, edx
pop esi
cmovne ecx, eax
xor eax, eax
mov word [ecx], ax
mov eax, 0x5c4590
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0046975d
mov esp, ebp
pop ebp
ret
Function at 0x10007ff2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x10008001
pop dword [ebp - 0x28]
mov eax, 0x10008001
sub dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 0x130522a3
add dword [ebp - 0x38], 0x3b4d22a8
mov dword [ebp - 0x34], 0x2e007370
sub dword [ebp - 0x34], 0xfbcd272b
mov dword [ebp - 0x30], 0xd221de15
add dword [ebp - 0x30], 0x7a2a6619
mov dword [ebp - 0x2c], 0x139e94ed
sub dword [ebp - 0x2c], 0x139e94ed
lea eax, [ebp - 0x38]
push eax
mov eax, 0x33c58263
add eax, 0xdc3c6e41
add eax, dword [ebp - 0x28]
call dword [eax]
mov dword [ebp - 0x38], 0x4da1e339
sub dword [ebp - 0x38], 0xd92f79e3
mov dword [ebp - 0x34], 0x8a1dd651
add dword [ebp - 0x34], 0xb74e8b24
mov dword [ebp - 0x30], 0x71d8bbdb
add dword [ebp - 0x30], 0xf196b091
mov dword [ebp - 0x2c], 0x98e5aed0
add dword [ebp - 0x2c], 0x671a5130
lea ebx, [ebp - 0x38]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x28]
call dword [eax]
push 0x40
push 0x1000
push 0x3c0f4
push 0
call eax
mov ecx, 0xf31587f9
add ecx, 0xceac424
mov edx, eax
mov edi, 0xd6233761
add edi, 0x39df629f
add edi, dword [ebp - 0x28]
mov esi, 0xa8dc9a61
add esi, 0xc28145f
mov dword [ebp - 8], 0xa62ee09e
mov ebx, dword [edi]
xor dword [ebp - 0x18], 0xacbff1de
xor ebx, esi
xor dword [ebp - 0x1c], edx
mov dword [edx], ebx
sub dword [ebp - 4], 0x95493f59
add edx, 0x10262b2
add edx, 0xfefd9d52
add edi, 0xa5a9c932
sub edi, 0xa5a9c92e
loop 0x10008119
add eax, 0x12347
mov ebx, eax
add eax, 5
mov ecx, 0xfc766161
add ecx, 0x13899e9f
add ecx, dword [ebp - 0x28]
call ebx
leave
ret

Function at 0x1001cc37
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
jne 0x1001ccba
push ebx
mov ebx, dword [ebp + 0x10]
push edi
push 0
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [esi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x1001cc84
mov byte [esi + 0x2d], 0xff
test edi, edi
je 0x1001cc84
cmp edi, ebx
jge 0x1001cc84
mov eax, dword [ebp + 0xc]
mov ecx, ebx
sub ecx, edi
push ecx
add eax, edi
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 0
je 0x1001ccb4
add dword [esi + 0x1c], ebx
cmp dword [esi + 0x1c], 0xffff
jle 0x1001ccb4
xor eax, eax
mov word [esi + 0x1e], ax
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x18]
mov edx, dword [ecx]
push 1
push dword [esi + 0x20]
push eax
push ecx
call dword [edx + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, edi
pop edi
pop ebx
jmp 0x1001cccc
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
pop esi
pop ebp
ret 0xc
Function at 0x1001cf62
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
cmp byte [0x100269c0], al
je 0x1001cf99
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001cffd
push 0x103
push eax
mov byte [ebp - 0x108], al
lea eax, [ebp - 0x107]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.10007ff2
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.10007ff2
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
push ebx
lea eax, [ebp - 0x108]
push eax
call fcn.10007ff2
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001ddeb
leave
ret 0x10

Function at 0x1001d00e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100269c0], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001d03a
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001d06b
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001d069
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.10007ff2
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001d06b
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1001ddeb
leave
ret 8

Function at 0x1001d106
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100269c0], 0
mov eax, dword [ebp + 8]
je 0x1001d12e
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001d148
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.10007ff2
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.1001ddeb
leave
ret 4

Function at 0x1001ddeb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100268b0]
jne 0x1001ddf5
repz ret
jmp fcn.1001e62c
Function at 0x40eaf0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xb000]
push edi
or ebp, 0xffffffff
jmp 0x40eb12
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40eb19
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40eb08
mov eax, 1
add ebx, ebx
jne 0x40eb2b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40eb20
jne 0x40eb3c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40eb20
xor ecx, ecx
sub eax, 3
jb 0x40eb50
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40ebc2
mov ebp, eax
add ebx, ebx
jne 0x40eb5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40eb68
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40eb8c
inc ecx
add ebx, ebx
jne 0x40eb78
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40eb6d
jne 0x40eb89
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40eb6d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40ebac
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40eb9d
jmp 0x40eb0e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40ebac
add edi, ecx
jmp 0x40eb0e
pop esi
mov edi, esi
mov ecx, 0x84
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40ebca
cmp byte [edi], 3
jne 0x40ebca
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x40ebcf
lea edi, [esi + 0xc000]
mov eax, dword [edi]
or eax, eax
je 0x40ec3e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x10504]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x10568]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40ebfc
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1056c]
or eax, eax
je 0x40ec38
mov dword [ebx], eax
add ebx, 4
jmp 0x40ec19
call dword [esi + 0x10570]
popal
jmp 0x401350

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40de38
nop
nop
mov ecx, 0x14f33305
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x6aa02eba
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x1033a83
Capabilities:
Hide graphical window

Disassembly:
mov eax, 0x126fc6e
call fcn.01160168
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
lea edi, [esi + 0x10]
push 0
mov ecx, edi
call fcn.01032626
lea ebx, [esi + 0x54]
mov eax, dword [ebx]
test eax, eax
jne 0x1033afd
push 0x2000
push ecx
mov eax, esp
mov dword [ebp - 0x10], esp
mov dword [eax], 0x19d
call fcn.01032be6
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x14]
call fcn.0103365a
push 1
push 1
push 0xa020
push dword [ebp - 0x18]
mov ecx, ebx
push dword [ebp - 0x1c]
call fcn.01032c1a
push 0
push dword [ebp - 0x10]
push dword [ebx]
call dword [sym.imp.COMCTL32.dll_ImageList_Add]
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x10], 0
je 0x1033afd
lea ecx, [ebp - 0x14]
call fcn.01032e74
lea ebx, [esi + 0x40]
cmp dword [ebx], 0
jne 0x1033b69
push 0x2000
push ecx
mov eax, esp
mov dword [ebp - 0x14], esp
mov dword [eax], 0x19f
call fcn.01032be6
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], 1
lea eax, [ebp - 0x1c]
push eax
lea ecx, [ebp - 0x10]
call fcn.0103365a
push 1
push 1
push 0xa020
push dword [ebp - 0x18]
mov ecx, ebx
push dword [ebp - 0x1c]
call fcn.01032c1a
push 0
push dword [ebp - 0x14]
push dword [ebx]
call dword [sym.imp.COMCTL32.dll_ImageList_Add]
or dword [ebp - 4], 0xffffffff
cmp dword [ebp - 0x14], 0
je 0x1033b69
lea ecx, [ebp - 0x10]
call fcn.01032e74
mov ecx, esi
call fcn.010338fc
mov ecx, esi
call fcn.010336a1
push 0x628
push dword [edi]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
mov ebx, dword [sym.imp.USER32.dll_MapWindowPoints]
je 0x1033bbd
lea eax, [esi + 0x44]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_GetClientRect]
push 2
lea eax, [esi + 0x44]
push eax
push dword [edi]
push dword [ebp - 0x10]
call ebx
push 0
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x629
push dword [edi]
call dword [sym.imp.USER32.dll_GetDlgItem]
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1033bfa
add esi, 0x58
push esi
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_GetClientRect]
push 2
push esi
push dword [edi]
push dword [ebp - 0x10]
call ebx
push 0
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_ShowWindow]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov al, 1
mov dword fs:[0], ecx
pop ebx
leave
ret
Function at 0x103d1cf
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [0x12d1f58]
mov eax, dword [eax + 8]
push 2
push dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ecx, dword [0x12d1f58]
mov ecx, dword [ecx + 8]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
xor ecx, ecx
cmp word [eax + 0xe], 0x20
sete cl
mov al, cl
pop ebp
ret 4

Function at 0x1040530
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x12708b6
call fcn.01160168
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [0x12d23c0]
push 0xf1
push ebx
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x1040628
push eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
je 0x1040628
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
je 0x1040628
movzx eax, word [edi + 6]
mov dword [ebp - 0x10], eax
movzx eax, word [edi + 4]
push eax
movzx eax, word [edi + 2]
push eax
mov ecx, esi
call fcn.0103d6da
xor eax, eax
cmp dword [esi + 0x44], eax
jne 0x10405c5
push ebx
call fcn.0103d1cf
shl al, 5
lea ecx, [esi + 0x81]
xor al, byte [ecx]
and al, 0x20
xor byte [ecx], al
movzx eax, word [edi + 6]
push eax
mov ecx, esi
call fcn.0103d694
test al, al
je 0x1040628
xor eax, eax
mov dword [ebp + 8], eax
mov dword [ebp - 4], eax
cmp byte [ebp + 0xc], 0
je 0x10405ea
push dword [ebp + 0x18]
movzx ecx, word [ebp + 0x10]
push dword [ebp + 0x14]
movsx eax, bx
push ecx
push eax
lea ecx, [ebp + 8]
call fcn.0103d666
jmp 0x104061d
test byte [esi + 0x81], 0x20
je 0x104060d
push 0x2040
push eax
push eax
push eax
push ebx
push dword [0x12d23c0]
call dword [sym.imp.USER32.dll_LoadImageW]
mov dword [ebp + 8], eax
jmp 0x104061d
push ecx
mov eax, esp
lea ecx, [ebp + 8]
mov dword [ebp + 0xc], esp
mov dword [eax], ebx
call fcn.0103d598
xor ebx, ebx
cmp dword [ebp + 8], ebx
jne 0x104062c
or dword [ebp - 4], 0xffffffff
xor eax, eax
jmp 0x104068f
push dword [esi + 0x9c]
push dword [ebp + 8]
push dword [esi + 0x44]
call dword [sym.imp.COMCTL32.dll_ImageList_AddMasked]
cmp eax, 0xffffffff
jne 0x1040647
xor esi, esi
jmp 0x1040681
cmp dword [ebp - 0x10], 0
jle 0x104066e
xor eax, eax
mov ax, word [edi + ebx*2 + 8]
test ax, ax
je 0x1040668
mov dword [ebp + 0xc], eax
lea eax, [ebp + 0xc]
push eax
lea ecx, [esi + 0x48]
call fcn.0103fa80
inc ebx
cmp ebx, dword [ebp - 0x10]
jl 0x104064d
push dword [esi + 0x44]
mov edi, dword [esi + 0x4c]
call dword [sym.imp.COMCTL32.dll_ImageList_GetImageCount]
xor esi, esi
cmp eax, edi
jne 0x1040681
inc esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.01032e74
mov eax, esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret 0x14
Function at 0x104210c
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0x14]
and dword [edi], 0
mov esi, ecx
mov eax, dword [esi + 0xa4]
cmp eax, 0x12
je 0x1042140
cmp eax, 0x79
jne 0x1042137
push 0x10
call dword [sym.imp.USER32.dll_GetKeyState]
test al, al
jns 0x1042140
cmp dword [esi + 0xa4], 0x20
jne 0x10421b2
cmp dword [ebp + 0xc], 0xf100
jne 0x10421b2
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [esi + 4]
jne 0x104216f
mov ecx, esi
call fcn.0104208f
push 0
push 0xffffffffffffffff
push 0x448
push dword [esi + 4]
call dword [sym.imp.USER32.dll_PostMessageW]
jmp 0x10421b2
mov eax, dword [esi + 0xa4]
cmp eax, 0x20
je 0x10421b2
test byte [esi + 0x80], 0x40
jne 0x10421a7
mov al, byte [esi + 0x81]
test al, 2
je 0x104219e
test al, 4
jne 0x104219e
test al, 8
je 0x104219e
push 1
mov ecx, esi
call fcn.0104195e
mov ecx, esi
call fcn.0104205f
jmp 0x10421ac
cmp eax, 0x20
je 0x10421b2
mov dword [edi], 1
and byte [esi + 0x80], 0xbf
pop edi
xor eax, eax
pop esi
pop ebp
ret 0x10
Function at 0x104473c
Capabilities:
Capture webcam image

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
mov esi, ecx
cmp eax, dword [esi + 4]
je 0x104475a
mov eax, dword [ebp + 0x10]
and dword [eax], 0
xor eax, eax
inc eax
jmp 0x1044793
call dword [sym.imp.USER32.dll_GetFocus]
cmp eax, dword [esi + 4]
je 0x104476c
mov ecx, esi
call fcn.0104205f
mov eax, dword [edi + 0xc]
push 0
push eax
push 0x419
push dword [esi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
and byte [esi + 0x80], 0xcf
push 1
push eax
mov ecx, esi
call fcn.01044514
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x1044f98
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_SetErrorMode]
push edi
push 1
mov edi, ecx
call esi
push dword [edi]
mov ebx, eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push ebx
mov edi, eax
call esi
cmp edi, 0xffffffff
pop edi
pop esi
pop ebx
jne 0x1044fc6
mov eax, 0x80004005
ret
xor eax, eax
ret
Function at 0x104650b
Capabilities:
Delete file

Disassembly:
mov eax, 0x1270db9
call fcn.01160168
sub esp, 0x68c
mov eax, dword [0x12cf8c8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push ebx
xor ebx, ebx
cmp eax, ebx
mov dword [ebp - 0x698], eax
jne 0x104653d
mov eax, 0x80004003
jmp 0x1046762
push esi
mov esi, 0x12d2398
push edi
mov ecx, esi
call fcn.0107d75d
push eax
lea ecx, [ebp - 0x684]
call fcn.01045d3e
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x684]
call fcn.01044f6f
mov eax, dword [0x12d206c]
cmp dword [eax - 8], ebx
mov edi, 0x12d206c
jne 0x104671f
mov dword [ebp - 0x68c], ebx
mov byte [ebp - 4], 1
push 0xf003f
mov ecx, esi
call fcn.0107c455
push eax
push 0x80000001
lea ecx, [ebp - 0x68c]
call fcn.010449e2
test eax, eax
jne 0x10465e5
lea eax, [ebp - 0x688]
push eax
push dword [0x12ce320]
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x68c]
mov word [ebp - 0x218], bx
mov dword [ebp - 0x688], 0x208
call fcn.01044a51
test eax, eax
jne 0x10465e5
lea eax, [ebp - 0x218]
push eax
mov ecx, edi
call fcn.01032977
mov eax, dword [0x12d206c]
cmp dword [eax - 8], ebx
jne 0x10465fc
push dword [0x12ce324]
mov ecx, edi
call fcn.01032977
mov word [ebp - 0x224], 0x5c
mov dword [ebp - 0x220], ebx
mov dword [ebp - 0x21c], ebx
mov byte [ebp - 4], 2
push dword [0x12ce32c]
lea eax, [ebp - 0x684]
push eax
lea eax, [ebp - 0x688]
push eax
call fcn.01045b22
mov byte [ebp - 4], 3
push dword [eax]
lea ecx, [ebp - 0x67c]
call fcn.01045c08
mov esi, eax
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x688]
call fcn.010328fa
cmp esi, ebx
je 0x1046702
lea eax, [ebp - 0x688]
push eax
lea ecx, [ebp - 0x67c]
call fcn.01045ba2
mov byte [ebp - 4], 4
push dword [0x12d206c]
push dword [eax]
call fcn.01044b24
test eax, eax
setne byte [ebp - 0x67d]
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x688]
call fcn.010328fa
cmp byte [ebp - 0x67d], bl
je 0x10466ef
lea eax, [ebp - 0x694]
push eax
lea ecx, [ebp - 0x67c]
call fcn.01045ba2
mov byte [ebp - 4], 5
push eax
lea eax, [ebp - 0x684]
push eax
lea eax, [ebp - 0x690]
push eax
call fcn.01045ab7
mov byte [ebp - 4], 6
push dword [eax]
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x690]
call fcn.010328fa
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x694]
call fcn.010328fa
lea ecx, [ebp - 0x67c]
call fcn.01044cd9
cmp eax, ebx
jne 0x1046658
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x67c]
call fcn.01044d05
mov byte [ebp - 4], bl
lea ecx, [ebp - 0x68c]
call fcn.010449c4
push edi
lea ecx, [ebp - 0x684]
call fcn.01044c82
push dword [ebp - 0x684]
call dword [sym.imp.OLEAUT32.dll_SysReAllocString]
mov ecx, dword [ebp - 0x698]
mov dword [ecx], eax
neg eax
sbb eax, eax
and eax, 0x7fff0001
add eax, 0x8000ffff
mov esi, eax
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x684]
call fcn.010454b8
pop edi
mov eax, esi
pop esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov ecx, dword [ebp - 0x10]
pop ebx
call fcn.0115fe73
leave
ret 4