joyce8/EMBER2024-capa huggingface dataset:
Function at 0x439000
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x24
lea eax, [esp + 0x18]
push 0x68
push 7
push 0x100080
push eax
push dword [esp + 0x48]
call fcn.0043fca0
add esp, 0x14
not eax
shr eax, 0x1f
jmp dword [eax*4 + 0x449440]

Function at 0x4392b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, esp
push 0
push 0
push 0x20219
push eax
push dword [esp + 0x38]
call fcn.00440410
add esp, 0x14
test eax, eax
js 0x43940f
lea edi, [esp + 0xc]
lea eax, [esp + 0x10]
push edi
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push dword [esp + 0x20]
call fcn.00440840
add esp, 0x24
mov ecx, eax
xor eax, eax
test ecx, ecx
js 0x43934b
mov ebx, dword [esp + 0x2c]
mov eax, dword [esp + 0xc]
mov ecx, eax
inc ecx
jns 0x439315
mov eax, 0xffffffff
jmp 0x43931c
lea eax, [eax*2 + 2]
push eax
call fcn.00408220
add esp, 4
mov esi, eax
push edi
push eax
push 0
push ebx
push dword [esp + 0x10]
call fcn.00440e70
add esp, 0x14
test eax, eax
js 0x439340
mov eax, esi
jmp 0x43934b
push esi
call fcn.00408230
add esp, 4
xor eax, eax
mov ecx, dword [esp]
mov dword [esp + 4], 0x4c4d4a4b
mov byte [esp + 8], 0
mov edx, 0x58cf0d6d
mov esi, 0xb19e1ada
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edi, byte [esp + edx - 0x58cf0d69]
mov ebp, esi
and ebp, 0x86124a
mov ebx, edx
xor ebx, 0x85537ba5
add ebx, ebp
xor ebx, edi
neg ebx
mov edi, ebx
and edi, 0x5b
add edi, edi
xor ebx, 0xa4
sub ebx, edi
add bl, 2
mov byte [esp + edx - 0x58cf0d69], bl
inc edx
add esi, 2
cmp edx, 0x58cf0d72
jne 0x439370
mov edx, dword [0x44ce50]
test edx, edx
je 0x4393fe
mov esi, dword [esp + 4]
xor edi, edi
mov ebx, dword [0x44ce54]
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x4393e0
inc edi
cmp edx, edi
jne 0x4393d0
jmp 0x4393fe
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x4393fe
push ecx
push 4
push edx
push dword [0x44ce58]
mov esi, eax
call fcn.0043d4f0
mov eax, esi
add esp, 0x10
test eax, eax
jne 0x439411
lea eax, [esp + 4]
push eax
call fcn.0043fa80
add esp, 4
xor eax, eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x43b070
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov esi, dword [esp + 0x18]
xor eax, eax
test esi, esi
setne al
jmp dword [eax*4 + 0x449738]

Function at 0x43b100
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp + 0x10], ecx
mov ebx, dword [esp + 0x28]
mov dword [esp + 0xc], 0
mov dword [esp], 0xfcfdfeff
xor eax, eax
xor byte [esp + eax], al
inc eax
cmp eax, 4
jne 0x43b120
mov eax, dword [esp]
mov esi, dword [0x44ce50]
test esi, esi
je 0x43b174
xor ecx, ecx
mov edx, dword [0x44ce54]
nop
nop
cmp dword [edx + ecx*8], 0x61813e67
je 0x43b150
inc ecx
cmp esi, ecx
jne 0x43b140
jmp 0x43b174
mov edx, dword [edx + ecx*8 + 4]
cmp edx, eax
je 0x43b174
lea ecx, [esp + 0xc]
push ecx
push 0
push 0
push 5
push 0x10
push edx
push dword [0x44ce58]
call fcn.0043d4f0
add esp, 0x1c
mov dword [esp + 8], eax
mov dword [esp], 0x94a4b70
mov word [esp + 4], 0
mov byte [esp + 6], 0
mov eax, 0x7300ac6d
mov ecx, 0x93
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx ebp, byte [esp + ecx - 0x93]
mov edx, ecx
and edx, ebp
mov esi, edx
and esi, 2
mov edi, edx
or edx, 2
imul edx, esi
xor esi, 2
and edi, 0xffffff9d
imul edi, esi
add edx, edi
lea esi, [eax + edx]
xor esi, ebp
not edx
add edx, ecx
and edx, ebp
add edx, edx
sub edx, esi
mov esi, edx
and esi, 1
xor edx, 1
lea edx, [edx + esi*2]
add dl, 0x20
mov byte [esp + ecx - 0x93], dl
dec eax
inc ecx
cmp ecx, 0x9a
jne 0x43b1a0
mov edi, dword [esp + 8]
cmp edi, dword [esp]
jne 0x43b314
push dword [esp + 0xc]
call fcn.0043afb0
add esp, 4
mov ecx, dword [esp + 0xc]
mov dword [esp], 0xfcfdfeff
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
xor byte [esp + edx], dl
inc edx
cmp edx, 4
jne 0x43b220
mov edi, dword [esp]
mov edx, dword [0x44ce50]
test edx, edx
je 0x43b275
xor ebp, ebp
mov esi, dword [0x44ce54]
nop
nop
cmp dword [esi + ebp*8], 0x61813e67
je 0x43b250
inc ebp
cmp edx, ebp
jne 0x43b240
jmp 0x43b275
mov edx, dword [esi + ebp*8 + 4]
cmp edx, edi
je 0x43b275
push 0
push ecx
push eax
push 5
push 0x10
push edx
push dword [0x44ce58]
mov esi, eax
call fcn.0043d4f0
add esp, 0x1c
mov edi, eax
mov eax, esi
test edi, edi
js 0x43b30b
mov dword [esp], 0x97564725
mov byte [esp + 4], 0
xor esi, esi
xor edx, edx
nop
nop
nop
mov edi, edx
xor edi, 0x12
mov ecx, esi
and ecx, 0xa
sub ecx, edi
xor cl, byte [esp + edx]
add cl, 0x5a
mov byte [esp + edx], cl
inc edx
add esi, 2
cmp edx, 5
jne 0x43b290
mov ecx, dword [esp]
mov dword [esp + 8], ecx
mov esi, dword [eax]
mov ecx, eax
nop
nop
nop
nop
nop
nop
nop
mov edx, dword [ecx + esi + 0x3c]
add ecx, esi
xor ebp, ebp
nop
nop
nop
nop
nop
nop
nop
nop
movzx esi, word [edx + ebp]
movzx edi, word [ebx + ebp]
test si, si
je 0x43b2e5
add ebp, 2
cmp si, di
je 0x43b2d0
cmp si, di
je 0x43b2f6
mov esi, dword [ecx]
test esi, esi
jne 0x43b2c0
mov edi, dword [esp + 8]
jmp 0x43b30b
mov edx, dword [ecx + 0x44]
mov esi, dword [esp + 0x10]
mov dword [esi + 8], edx
mov ecx, dword [ecx + 0xdc]
mov dword [esi + 0xc], ecx
xor edi, edi
push eax
call fcn.0043b070
add esp, 4
mov eax, edi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret 4
Function at 0x43b340
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 0x24
mov esi, dword [ecx + 8]
test esi, esi
je 0x43b3e0
xor eax, eax
cmp dword [ecx], 0
jne 0x43b43d
mov edx, dword [esp + 0x34]
mov dword [esp + 4], 0x18
mov dword [esp + 8], 0
mov dword [esp + 0xc], 0
mov dword [esp + 0x10], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x1c], esi
mov eax, dword [ecx + 0xc]
mov dword [esp + 0x20], eax
mov dword [esp], 0xfcfdfeff
xor eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor byte [esp + eax], al
inc eax
cmp eax, 4
jne 0x43b3b0
mov eax, dword [esp]
mov esi, dword [0x44ce50]
test esi, esi
je 0x43b43d
xor edi, edi
mov ebx, dword [0x44ce54]
nop
nop
cmp dword [ebx + edi*8], 0x32f24c0b
je 0x43b446
inc edi
cmp esi, edi
jne 0x43b3d0
jmp 0x43b43d
mov dword [esp + 4], 0x5f9e9990
mov dword [esp + 8], 0
mov eax, 0x7dfe301a
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
movzx edx, byte [esp + eax - 0x7dfe3016]
mov ecx, eax
or ecx, edx
and edx, eax
sub ecx, edx
mov edx, 0x32fee7ff
sub edx, ecx
add ecx, 0xcd011900
and edx, 0x83
and ecx, 0x7c
sub ecx, edx
inc cl
mov byte [esp + eax - 0x7dfe3016], cl
inc eax
cmp eax, 0x7dfe3022
jne 0x43b400
mov eax, dword [esp + 4]
add esp, 0x24
pop esi
pop edi
pop ebx
ret 4
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43b43d
lea eax, [esp + 0x1c]
lea edi, [esp + 4]
push eax
push edi
push edx
push ecx
push 0x10
push esi
push dword [0x44ce58]
call fcn.0043d4f0
add esp, 0x1c
jmp 0x43b43d

Function at 0x43b470
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [ecx]
test eax, eax
je 0x43b4ea
push ebx
push edi
push esi
push eax
mov dword [esp], 0xfcfdfeff
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor byte [esp + edx], dl
inc edx
cmp edx, 4
jne 0x43b490
mov edx, dword [0x44ce50]
test edx, edx
je 0x43b4de
mov esi, dword [esp]
xor edi, edi
mov ebx, dword [0x44ce54]
nop
nop
cmp dword [ebx + edi*8], 0x1b6183f2
je 0x43b4c0
inc edi
cmp edx, edi
jne 0x43b4b0
jmp 0x43b4de
mov edx, dword [ebx + edi*8 + 4]
cmp edx, esi
je 0x43b4de
push eax
push 4
push edx
push dword [0x44ce58]
mov esi, ecx
call fcn.0043d4f0
mov ecx, esi
add esp, 0x10
mov dword [ecx], 0
add esp, 4
pop esi
pop edi
pop ebx
ret
Function at 0x43b4f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x18
mov dword [esp + 8], ecx
cmp dword [ecx + 8], 0
je 0x43b568
mov eax, dword [esp + 8]
mov edx, dword [eax]
test edx, edx
je 0x43b568
mov edi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov dword [esp], 0xfcfdfeff
xor eax, eax
nop
xor byte [esp + eax], al
inc eax
cmp eax, 4
jne 0x43b520
mov eax, dword [esp]
mov esi, dword [0x44ce50]
test esi, esi
je 0x43b5ec
mov ecx, edi
xor edi, edi
mov ebx, dword [0x44ce54]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [ebx + edi*8], 0xaf0e0c2e
je 0x43b5ca
inc edi
cmp esi, edi
jne 0x43b550
mov edi, ecx
mov ebx, dword [ebp + 0xc]
jmp 0x43b5ec
mov dword [esp], 0xf3323138
mov byte [esp + 4], 0
mov eax, 0x6ec45b4
nop
nop
nop
nop
nop
nop
nop
movzx ecx, byte [esp + eax - 0x6ec45b4]
xor ecx, eax
mov edx, ecx
and edx, 0x460017b
xor ecx, 0xdd62a37b
lea esi, [ecx + edx*2]
lea edx, [ecx + edx*2]
inc edx
mov edi, esi
not edi
or edi, 1
add esi, edi
inc esi
add ecx, ecx
and ecx, 2
sub edx, ecx
lea ecx, [edx + esi*2]
mov byte [esp + eax - 0x6ec45b4], cl
inc eax
cmp eax, 0x6ec45b9
jne 0x43b580
mov eax, dword [esp]
jmp 0x43b728
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
mov edi, ecx
mov ebx, dword [ebp + 0xc]
je 0x43b5ec
push dword [ebp + 8]
push edx
push 8
push esi
push dword [0x44ce58]
call fcn.0043d4f0
add esp, 0x14
cmp ebx, 1
mov edx, edi
sbb edx, 0
jl 0x43b6af
cmp eax, 0xc000010a
jne 0x43b6af
mov esi, ebx
and esi, 0xffffd8f0
mov eax, esi
xor eax, 0xffffd8f0
mov ecx, ebx
mov ebx, edi
not ebx
mov edx, ecx
and edx, 0x270f
imul ebx, edx
mul edx
mov dword [esp + 0x10], eax
add edx, ebx
mov ebx, edx
or ecx, 0xffffd8f0
imul edi, ecx
mov eax, ecx
mul esi
add edx, edi
sub edx, esi
add eax, dword [esp + 0x10]
adc edx, ebx
mov dword [esp], eax
mov dword [esp + 4], edx
mov eax, dword [esp + 8]
mov edx, dword [eax]
mov dword [esp + 0xc], 0xfcfdfeff
xor eax, eax
nop
nop
nop
xor byte [esp + eax + 0xc], al
inc eax
cmp eax, 4
jne 0x43b660
mov eax, dword [esp + 0xc]
mov esi, dword [0x44ce50]
test esi, esi
je 0x43b6af
xor edi, edi
mov ebx, dword [0x44ce54]
cmp dword [ebx + edi*8], 0x4c697c35
je 0x43b690
inc edi
cmp esi, edi
jne 0x43b680
jmp 0x43b6af
mov esi, dword [ebx + edi*8 + 4]
cmp esi, eax
je 0x43b6af
mov eax, esp
push eax
push 0
push edx
push 0xc
push esi
push dword [0x44ce58]
call fcn.0043d4f0
add esp, 0x18
test eax, eax
js 0x43b728
mov ecx, dword [esp + 8]
mov edx, dword [ecx]
test edx, edx
je 0x43b728
mov dword [esp], 0xfcfdfeff
xor ebx, ebx
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
xor byte [esp + ebx], bl
inc ebx
cmp ebx, 4
jne 0x43b6d0
mov esi, dword [0x44ce50]
test esi, esi
je 0x43b71e
mov ecx, dword [esp]
xor ebx, ebx
mov edi, dword [0x44ce54]
nop
nop
cmp dword [edi + ebx*8], 0x1b6183f2
je 0x43b700
inc ebx
cmp esi, ebx
jne 0x43b6f0
jmp 0x43b71e
mov esi, dword [edi + ebx*8 + 4]
cmp esi, ecx
je 0x43b71e
push edx
push 4
push esi
push dword [0x44ce58]
mov edi, eax
call fcn.0043d4f0
mov eax, edi
add esp, 0x10
mov ecx, dword [esp + 8]
mov dword [ecx], 0
lea esp, [ebp - 0xc]
pop esi
pop edi
pop ebx
pop ebp
ret 0xc
Function at 0x43b740
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 8
mov ebx, dword [esp + 0x28]
mov edi, dword [esp + 0x24]
mov ecx, dword [ecx]
mov dword [esp], 0xfcfdfeff
xor eax, eax
nop
nop
nop
nop
nop
nop
xor byte [esp + eax], al
inc eax
cmp eax, 4
jne 0x43b760
test ebx, ebx
jne 0x43b771
lea ebx, [esp + 4]
mov eax, dword [esp]
mov ebp, dword [0x44ce50]
test ebp, ebp
je 0x43b7c4
xor edx, edx
mov esi, dword [0x44ce54]
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp dword [esi + edx*8], 0xe6c7f7c6
je 0x43b7a0
inc edx
cmp ebp, edx
jne 0x43b790
jmp 0x43b7c4
mov ebp, dword [esi + edx*8 + 4]
cmp ebp, eax
je 0x43b7c4
push ebx
push edi
push dword [esp + 0x28]
push dword [esp + 0x28]
push ecx
push 0x14
push ebp
push dword [0x44ce58]
call fcn.0043d4f0
add esp, 0x20
add esp, 8
pop esi
pop edi
pop ebx
pop ebp
ret 0x10
Function at 0x43f0f0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push edi
push esi
sub esp, 8
mov ecx, dword [esp + 0x18]
mov dword [esp], 0x1f1e1968
mov word [esp + 4], 0
xor eax, eax
xor edx, edx
nop
nop
nop
nop
mov esi, eax
and esi, 4
mov ebx, edx
xor ebx, 0x3a
add ebx, esi
xor bl, byte [esp + edx]
add bl, 0xde
mov byte [esp + edx], bl
inc edx
add eax, 2
cmp edx, 6
jne case.default.0x43f13b
mov eax, dword [esp]
mov eax, dword fs:[eax]
xor edx, edx
test ecx, ecx
sete dl
jmp dword [edx*4 + 0x44a5d0]
mov edx, dword [eax + 0xc]
mov esi, dword [edx + 0xc]
add edx, 0xc
xor eax, eax
mov edi, dword [0x44a5fc]
xor ebx, ebx
cmp esi, edx
setne bl
jmp dword [ebx*4 + 0x44a5d8]
xor ebx, ebx
cmp dword [esi + 0x18], ecx
sete bl
jmp dword [ebx*4 + 0x44a5e0]
mov ebx, 1
jmp dword [ebx*4 + 0x44a5e8]
mov eax, dword [esi + 0x28]
xor ebx, ebx
jmp dword [ebx*4 + 0x44a5e8]
mov eax, dword [eax + 0x10]
mov eax, dword [eax + 0x3c]
add esp, 8
pop esi
pop edi
pop ebx
ret
Function at 0xf1f21
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push ebx
xor edx, edx
xor ebx, ebx
push esi
inc ebx
push edi
mov dword [ebp - 4], edx
mov dword [ebp - 0x10], edx
cmp dword [eax + 4], edx
je 0x163a1b
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x18]
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov byte [eax], dl
mov eax, dword [ebp + 0x10]
mov byte [ecx], dl
mov ecx, dword [ebp + 0x14]
mov dword [edi], edx
mov byte [ecx], dl
mov byte [eax], dl
mov dword [ebp - 0xc], 0x2b
mov dword [ebp - 8], 0x23
mov edi, edx
push edi
mov ecx, esi
call fcn.000f2086
movzx eax, word [eax]
push 0x2b
pop ecx
push 0x5e
cmp ax, cx
pop ecx
push 0x21
pop edx
je 0x163a22
cmp ax, cx
je 0x163a22
cmp ax, dx
je 0x163a22
cmp ax, word [ebp - 8]
je 0x163a22
push edi
inc edi
mov ecx, esi
mov dword [ebp + 0x1c], edi
call fcn.000f2086
movzx eax, word [eax]
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp + 0xc]
cmp eax, 0x7b
jne 0x163a9d
push 0x40
lea ecx, [ebp - 0x20]
call fcn.000f6b0f
lea eax, [ebp + 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
mov eax, dword [ebp + 8]
push eax
push 0x7d
call fcn.000f2036
test al, al
je 0xf2032
push dword [ebp - 0x20]
push dword [esi*4 + 0x1ab5d0]
call fcn.00110fa7
pop ecx
pop ecx
test eax, eax
je 0xf2000
inc esi
cmp esi, 0x62
jl 0xf1fe5
cmp esi, 0x62
je 0x163a54
cmp byte [esi + 0x1ab568], 0
jne 0xf2032
movzx eax, byte [esi + str._f_b_b..__reepqrstuvwxyz________t___]
mov dword [edi], eax
lea ecx, [ebp - 0x20]
call fcn.000fcb37
and dword [edi], 0xff
mov al, bl
pop edi
pop esi
pop ebx
leave
ret 0x18
xor bl, bl
jmp 0xf201b
lea ecx, [ebp - 0x20]
call fcn.000fcb37
xor al, al
jmp 0xf202b
cmp ax, word [ebp - 0xc]
jne 0x163a2d
mov eax, dword [ebp + 0x10]
jmp 0x163a4c
cmp ax, cx
jne 0x163a37
mov eax, dword [ebp + 0x14]
jmp 0x163a4c
cmp ax, dx
jne 0x163a41
mov eax, dword [ebp + 0x18]
jmp 0x163a4c
push 0x23
pop ecx
cmp ax, cx
jne 0x163a4e
mov eax, dword [ebp + 0x1c]
mov byte [eax], bl
inc edi
jmp 0xf1f6d
push 0
lea ecx, [ebp - 0x20]
call fcn.000f61a6
movzx eax, word [eax]
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
cwde
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x163a13
test eax, 0x200
je 0x163a7c
mov ecx, dword [ebp + 0x14]
mov byte [ecx], bl
test eax, 0x400
je 0x163a88
mov ecx, dword [ebp + 0x18]
mov byte [ecx], bl
test eax, 0x100
je 0xf201b
mov eax, dword [ebp + 0x10]
mov byte [eax], bl
jmp 0xf201b
push eax
call dword [sym.imp.USER32.dll_VkKeyScanW]
cwde
mov dword [edi], eax
cmp eax, 0xffffffff
je 0x163a1b
test eax, 0x200
je 0x163abc
mov ecx, dword [ebp + 0x14]
mov byte [ecx], bl
test eax, 0x400
je 0x163ac8
mov ecx, dword [ebp + 0x18]
mov byte [ecx], bl
test eax, 0x100
je 0xf2023
mov eax, dword [ebp + 0x10]
mov byte [eax], bl
jmp 0xf2023
Function at 0xf27ec
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
push edi
mov edi, ecx
push 5
pop eax
xor ebx, ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov word [edi + 8], 1
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
push ebx
mov dword [edi + 0x1c], ebx
push 0x5b
mov dword [edi + 0xc], 4
call esi
push ebx
push 0x10
mov byte [edi + 0x29], al
call esi
push ebx
push 0xa0
mov byte [edi + 0x26], al
call esi
push ebx
push 0xa1
mov byte [edi + 0x27], al
call esi
push ebx
push 0x11
mov byte [edi + 0x28], al
call esi
push ebx
push 0x12
mov byte [edi + 0x24], al
call esi
mov byte [edi + 0x25], al
pop edi
pop esi
pop ebx
ret
Function at 0xf3d19
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20030
call fcn.0011f8a0
push ebx
push esi
push edi
lea ecx, [ebp - 0x2c]
call fcn.000fd7f7
lea eax, [ebp - 0x1002c]
push eax
xor ebx, ebx
push 0x7fff
mov byte [ebp - 6], bl
mov byte [ebp - 5], bl
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 7]
push eax
push dword [ebp + 8]
call fcn.000f61ca
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x161cc1
mov eax, dword [0x1b1130]
test eax, eax
je 0xf3e5d
xor edi, edi
inc edi
mov esi, 0x1b2100
cmp eax, edi
je 0x161cd9
lea eax, [ebp - 6]
push eax
push ecx
push 0x1b1130
push 0x1b1148
mov ecx, esi
call fcn.000f40e5
test al, al
je 0xf3e66
mov al, byte [0x1b2100]
mov byte [0x1b1134], al
mov al, byte [0x1b2101]
mov byte [ebp - 5], al
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x2002c]
push eax
push 0x7fff
push dword [0x1b1148]
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
push dword [ebp - 0xc]
mov ecx, 0x1b1120
call fcn.000f6a63
mov bl, byte [ebp - 6]
push dword [0x1b1130]
push 0x1b1148
call fcn.000f6430
test eax, eax
jne 0x161cf8
cmp byte [ebp - 5], 1
je 0x161d17
call fcn.000f3e6e
call fcn.000f36b8
cmp byte [0x1b1134], 0
mov ebx, 0x1b1708
jne 0xf3e1f
mov ecx, ebx
call fcn.000f4ffc
push edi
mov ecx, 0x1b1160
call fcn.000fe8d0
cmp byte [0x1b1134], 0
jne 0xf3e3a
mov ecx, ebx
call fcn.000f3847
mov ecx, esi
call fcn.000f52b5
lea eax, [ebp - 0x1002c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [ebp - 0x2c]
call fcn.000fcb37
pop edi
pop esi
pop ebx
leave
ret 4
or dword [0x1b10bc], 0xffffffff
jmp 0xf3e41
mov dword [0x1b10bc], edi
jmp 0xf3e41
push 0x10
push 0x1a28f4
push str.This_is_a_third_party_compiled_AutoIt_script.
push ebx
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0xf3e4e
push 0xffffffffffffffff
push dword [0x1b1138]
mov ecx, esi
push edi
call fcn.0010c682
mov al, byte [0x1b10c2]
mov byte [0x1b2102], al
jmp 0xf3dde
mov ecx, esi
call fcn.000f52b5
lea eax, [ebp - 0x1002c]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [0x1b10bc], edi
jmp 0xf3e4e
call fcn.001371fa
test al, al
jne 0xf3e00
cmp byte [ebp - 7], al
jne 0xf3e00
lea ecx, [ebp - 0x2c]
call fcn.000f5374
push 0x18dab4
lea ecx, [ebp - 0x1c]
call fcn.000fce19
lea ecx, [ebp - 0x1c]
test bl, bl
je 0x161d6e
mov edi, 0x1a2928
push edi
call fcn.000f518c
push 0x1b1148
lea ecx, [ebp - 0x1c]
call fcn.000f510d
push edi
lea ecx, [ebp - 0x1c]
call fcn.000f518c
push 1
jmp 0x161d77
push dword [ebp + 8]
call fcn.000f518c
push edi
lea eax, [ebp - 0x1002c]
push eax
push dword [ebp - 0x1c]
push dword [ebp - 0x2c]
push 0x1a292c
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
lea ecx, [ebp - 0x1c]
call fcn.000fcb37
jmp 0xf3e3a
Function at 0xf406b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x10]
push ebx
push 1
push 0
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
js 0xf40a3
push edi
push 0
push str.SCRIPT
push 0xa
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_FindResourceExW]
mov edi, eax
test edi, edi
jne 0x164f16
pop edi
pop esi
pop ebx
leave
ret
push edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], eax
test eax, eax
je 0xf40a2
push edi
push dword [esi + 0xc]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, eax
test edi, edi
je 0xf40a2
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0xf40a2
mov ecx, dword [ebx]
push 0
mov edx, dword [ecx]
push edi
push eax
push ecx
call dword [edx + 0x10]
mov eax, dword [ebx]
xor edx, edx
mov ecx, dword [eax]
push edx
push edx
push edx
push edx
push eax
call dword [ecx + 0x14]
mov byte [esi + 0x14], 1
jmp 0xf40a2

Function at 0xf44ed
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
and dword [ebp - 4], 0
cmp byte [ecx + 0x14], 0
jne 0x164fc0
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.0011381e
add esp, 0x10
leave
ret 0x10
mov ecx, dword [ecx + 0x10]
lea eax, [ebp - 4]
mov edx, dword [ecx]
push eax
mov eax, dword [ebp + 0xc]
imul eax, dword [ebp + 0x10]
push eax
push dword [ebp + 8]
push ecx
call dword [edx + 0xc]
mov eax, dword [ebp - 4]
jmp 0xf4513

Function at 0xf49fb
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
sub esp, 0x10
push ebx
call fcn.000fbcce
lea eax, [ebp - 8]
push eax
push 1
xor ebx, ebx
push ebx
push str.SoftwareAutoIt_v3AutoIt
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1641cc
xor al, al
pop ebx
leave
ret
lea eax, [ebp - 4]
push eax
push ebx
push ebx
push ebx
push str.Include
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x164246
mov eax, dword [ebp - 4]
push esi
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.0010f4ea
pop ecx
push eax
lea ecx, [ebp - 0x10]
call fcn.000f47b7
mov esi, dword [ebp - 0x10]
lea eax, [ebp - 4]
push eax
push esi
push ebx
push ebx
push str.Include
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x16423d
mov eax, dword [ebp - 4]
shr eax, 1
xor ecx, ecx
mov dword [ebp - 4], eax
mov word [esi + eax*2], cx
mov ecx, dword [ebp + 0xc]
push esi
call fcn.000f6a63
mov bl, 1
lea ecx, [ebp - 0x10]
call fcn.000f47e2
pop esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov al, bl
jmp 0xf4a2d
Function at 0xfc2e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, ecx
push edi
cmp dword [esi + 8], 0
je 0xfc354
mov ebx, dword [ebp + 0xc]
xor edi, edi
test ebx, ebx
je 0xfc317
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 8]
je 0xfc327
mov ecx, dword [esi + 4]
mov eax, dword [esi + 0xc]
inc edi
mov al, byte [ecx + eax]
mov ecx, dword [ebp + 8]
mov byte [edi + ecx - 1], al
inc dword [esi + 0xc]
cmp edi, ebx
jb 0xfc2f7
add dword [esi + 0x10], edi
mov eax, edi
pop edi
adc dword [esi + 0x14], 0
pop esi
pop ebx
pop ebp
ret 8
push 0
lea eax, [ebp + 0xc]
push eax
push 0x10000
push dword [esi + 4]
push dword [esi]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0xfc317
mov eax, dword [ebp + 0xc]
test eax, eax
je 0xfc317
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0
jmp 0xfc2ff
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.000f45a6
jmp 0xfc2ee