joyce8/EMBER2024-capa huggingface dataset:
Function at 0x472280
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
mov eax, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x24]
mov ecx, dword [eax + 0x7c]
push esi
cmp ebp, 0xffffffff
push edi
mov dword [esp + 0x10], ecx
jne 0x472335
mov edx, dword [esp + 0x1c]
mov ebp, dword [edx]
test ebp, ebp
je 0x47230c
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call esi
push 0x10
mov edi, eax
call esi
push 0x12
mov ebx, eax
call esi
xor ecx, ecx
test edi, 0x8000
je 0x4722cc
mov ecx, 2
test bh, 0x80
je 0x4722d4
or ecx, 1
test ah, 0x80
je 0x4722dc
or ecx, 4
mov esi, dword [esp + 0x28]
push ecx
mov ecx, esi
mov eax, dword [esp + 0x14]
shr ecx, 0x10
movsx edx, cx
mov eax, dword [eax + 8]
push edx
mov edx, dword [esp + 0x24]
movsx ecx, si
push ecx
mov ecx, dword [edx + 4]
push ecx
push eax
call ebp
test eax, eax
jne 0x472312
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
mov esi, dword [esp + 0x28]
jmp 0x472316
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
push esi
push edx
mov edx, dword [eax + 0x14]
mov eax, dword [eax + 4]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_CallWindowProcW]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x11
call esi
push 0x10
mov edi, eax
call esi
push 0x12
mov ebx, eax
call esi
xor ecx, ecx
test edi, 0x8000
je 0x47235a
mov ecx, 2
test bh, 0x80
je 0x472362
or ecx, 1
test ah, 0x80
je 0x47236a
or ecx, 4
mov esi, dword [esp + 0x28]
push ecx
mov ecx, esi
mov edi, dword [esp + 0x1c]
shr ecx, 0x10
movsx edx, cx
movsx eax, si
push edx
push eax
push 3
push ebp
push edi
call fcn.004721a0
add esp, 0x18
test eax, eax
je 0x472304
cmp ebp, 0x18
je 0x47239d
mov eax, dword [esp + 0x24]
mov ecx, dword [esp + 0x20]
mov edx, dword [edi + 0x14]
push esi
push eax
mov eax, dword [edi + 4]
push ecx
push edx
push eax
call dword [sym.imp.USER32.dll_CallWindowProcW]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x472bb0
Capabilities:
Allocate or change rwx memory

Disassembly:
mov eax, dword [0x4d6d54]
test eax, eax
je 0x472bc6
mov ecx, dword [eax + 4]
test ecx, ecx
jne 0x472c13
mov eax, dword [eax]
test eax, eax
jne 0x472bb9
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
je 0x472c13
lea ecx, [eax + 0x20]
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov edx, dword [eax + 4]
mov dword [ecx], edx
mov dword [eax + 4], ecx
add ecx, 0x20
mov edx, ecx
sub edx, eax
cmp edx, 0xfe0
jbe 0x472bef
mov ecx, dword [0x4d6d54]
mov dword [eax], ecx
mov dword [0x4d6d54], eax
ret

Function at 0x473050
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
mov cl, byte [esi]
test cl, cl
je 0x473069
cmp cl, 0x90
je 0x473069
cmp cl, 0xcc
je 0x473069
pop esi
xor eax, eax
ret
mov edx, dword [esp + 0xc]
mov eax, 1
cmp edx, eax
jbe 0x473080
cmp byte [eax + esi], cl
jne 0x473065
inc eax
cmp eax, edx
jb 0x473076
pop esi
mov eax, 1
ret
Function at 0x488017
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x48804f
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.004860a4
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.0048607c
jmp 0x48805b
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x48970c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x48974e
call fcn.0048f1c6
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x48974e
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x489745
xor eax, eax
jmp 0x489756
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.0048975c
pop edi
pop esi
pop ebx
ret 4

Function at 0x48f6f6
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x48f724
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x48f742
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0048f65c
jmp 0x48f742
mov eax, dword [esi + 0x14]
test eax, eax
je 0x48f742
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0048f65c
test edi, edi
mov eax, edi
jne 0x48f72c
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rdata
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
je 0x433072
nop
nop
nop
nop
mov ebx, 0x40de38
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x72534964
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x4330d2
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x4b382533
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
loop 0x4330c0
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401100
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x405042], eax
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0
push 0
push 0
push 0x80000000
push 0x80000000
push 0x80000000
push 0xcf0000
push 0x405228
push 0x405290
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x40114b
xor eax, eax
jmp 0x401166
push 0
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.USER32.dll_UpdateWindow]
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x423630
Capabilities:
Packed with generic packer

Disassembly:
push ebp
push esp
pop ebp
push edi
push esi
push ebx
mov ecx, dword [ebp + 0x10]
or ecx, ecx
je 0x42372a
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
lea eax, [0x43450c]
cmp dword [eax + 8], 0
jne 0x4236a1
mov bh, 0x41
mov bl, 0x5a
mov dh, 0x20
lea ecx, [ecx]
mov ah, byte [esi]
or ah, ah
mov al, byte [edi]
je 0x423685
or al, al
je 0x423685
inc esi
inc edi
cmp ah, bh
jb 0x423674
cmp ah, bl
ja 0x423674
add ah, dh
cmp al, bh
jb 0x42367e
cmp al, bl
ja 0x42367e
add al, dh
cmp ah, al
jne 0x42368f
dec ecx
jne 0x42365c
sub ecx, ecx
cmp ah, al
je 0x42372a
mov ecx, 0xffffffff
jb 0x42372a
neg ecx
jmp 0x42372a
lock inc dword [0x435ca8]
cmp dword [0x435ca4], 0
jg 0x4236b5
push 0
jmp 0x4236ce
lock dec dword [0x435ca8]
mov ebx, ecx
push 0x13
call fcn.0041f155
mov dword [esp], 1
mov ecx, ebx
xor eax, eax
xor ebx, ebx
pushal
popal
mov al, byte [esi]
or eax, eax
mov bl, byte [edi]
je 0x4236ff
or ebx, ebx
je 0x4236ff
inc esi
inc edi
push ecx
push eax
push ebx
call fcn.0041bd8e
mov ebx, eax
add esp, 4
call fcn.0041bd8e
add esp, 4
pop ecx
cmp eax, ebx
jne 0x423705
dec ecx
jne 0x4236d4
sub ecx, ecx
cmp eax, ebx
je 0x42370e
mov ecx, 0xffffffff
jb 0x42370e
neg ecx
pop eax
or eax, eax
jne 0x42371c
lock dec dword [0x435ca8]
jmp 0x42372a
push ecx
pop ebx
push 0x13
call fcn.0041f1b6
add esp, 4
mov ecx, ebx
mov eax, ecx
pop ebx
pop esi
pop edi
leave
ret
Function at 0x4239d9
Capabilities:
Set environment variable

Disassembly:
push ebp
push esp
pop ebp
push ecx
push ecx
push ebx
push esi
push edi
sub edi, edi
cmp dword [ebp + 8], edi
je 0x423a3d
push 0x3d
push dword [ebp + 8]
call fcn.0041c080
push eax
pop esi
pop ecx
cmp esi, edi
pop ecx
mov dword [ebp - 8], esi
je 0x423a3d
cmp dword [ebp + 8], esi
je 0x423a3d
mov eax, dword [0x434390]
xor ebx, ebx
cmp byte [esi + 1], bl
sete bl
cmp eax, dword [0x434394]
jne 0x423a23
push eax
call fcn.00423bb8
pop ecx
mov dword [0x434390], eax
cmp eax, edi
jne 0x423a7b
cmp dword [ebp + 0xc], edi
je 0x423a45
cmp dword [0x434398], edi
je 0x423a45
call fcn.004235c2
test eax, eax
je 0x423a7b
or eax, 0xffffffff
pop edi
pop esi
pop ebx
leave
ret
cmp ebx, edi
jne 0x423b59
push 4
call fcn.0041d367
cmp eax, edi
pop ecx
mov dword [0x434390], eax
je 0x423a3d
mov dword [eax], edi
cmp dword [0x434398], edi
jne 0x423a7b
push 4
call fcn.0041d367
cmp eax, edi
pop ecx
mov dword [0x434398], eax
je 0x423a3d
mov dword [eax], edi
sub esi, dword [ebp + 8]
mov edi, dword [0x434390]
mov dword [ebp - 4], edi
push esi
push dword [ebp + 8]
call fcn.00423b60
mov esi, eax
pop ecx
or esi, esi
pop ecx
jl 0x423adb
cmp dword [edi], 0
je 0x423adb
or ebx, ebx
je 0x423ad3
push dword [edi + esi*4]
lea edi, [edi + esi*4]
call fcn.0041d2aa
pop ecx
cmp dword [edi], 0
je 0x423abd
mov eax, dword [edi + 4]
inc esi
mov dword [edi], eax
add edi, 4
jmp 0x423aad
push esi
pop eax
shl eax, 2
push eax
push dword [ebp - 4]
call fcn.0041e8e3
pop ecx
or eax, eax
pop ecx
je 0x423b0d
jmp 0x423b08
mov eax, dword [ebp + 8]
mov dword [edi + esi*4], eax
jmp 0x423b0d
or ebx, ebx
jne 0x423b59
or esi, esi
jge 0x423ae5
neg esi
lea eax, [esi*4 + 8]
push eax
push edi
call fcn.0041e8e3
pop ecx
or eax, eax
pop ecx
je 0x423a3d
mov ecx, dword [ebp + 8]
mov dword [eax + esi*4], ecx
and dword [eax + esi*4 + 4], 0
mov dword [0x434390], eax
cmp dword [ebp + 0xc], 0
je 0x423b59
push dword [ebp + 8]
call fcn.00420d10
inc eax
inc eax
push eax
call fcn.0041d367
push eax
pop esi
pop ecx
test esi, esi
pop ecx
je 0x423b59
push dword [ebp + 8]
push esi
call fcn.00422cf0
mov eax, esi
pop ecx
sub eax, dword [ebp + 8]
pop ecx
add eax, dword [ebp - 8]
and byte [eax], 0
inc eax
neg ebx
sbb ebx, ebx
not ebx
and ebx, eax
push ebx
push esi
call dword [sym.imp.KERNEL32.DLL_SetEnvironmentVariableA]
push esi
call fcn.0041d2aa
pop ecx
xor eax, eax
jmp 0x423a40
Function at 0x424040
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
sub esp, 0x350
push ebx
push ebp
push esi
mov esi, dword [esp + 0x360]
push edi
xor edi, edi
mov dword [esp + 0x14], ecx
push esi
mov dword [esp + 0x14], edi
call fcn.0040c9d0
add esp, 4
or eax, eax
je 0x42420e
mov ebx, dword [esp + 0x368]
or ebx, ebx
je 0x42420e
mov edi, dword [sym.imp.KERNEL32.DLL_lstrcpyA]
lea eax, [esp + 0x18]
push esi
push eax
call edi
lea ecx, [esp + 0x18]
push 0x104
push ecx
call fcn.0040ce70
mov ebp, dword [sym.imp.KERNEL32.DLL_lstrcatA]
add esp, 8
lea edx, [esp + 0x18]
push ebx
push edx
call ebp
lea eax, [esp + 0x220]
lea ecx, [esp + 0x18]
push eax
push ecx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x424137
call fcn.004246e0
lea edx, [esp + 0x11c]
push esi
push edx
call edi
lea eax, [esp + 0x11c]
push 0x104
push eax
call fcn.0040ce70
add esp, 8
lea ecx, [esp + 0x24c]
lea edx, [esp + 0x11c]
push ecx
push edx
call ebp
test byte [esp + 0x220], 0x10
jne 0x42411d
mov ecx, dword [esp + 0x14]
lea edx, [esp + 0x11c]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
or eax, eax
jl 0x42411d
inc dword [esp + 0x10]
lea eax, [esp + 0x220]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x4240c3
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
lea ecx, [esp + 0x18]
push esi
push ecx
call edi
lea edx, [esp + 0x18]
push 0x104
push edx
call fcn.0040ce70
add esp, 8
lea eax, [esp + 0x18]
push 0x42b1bc
push eax
call ebp
lea ecx, [esp + 0x220]
lea edx, [esp + 0x18]
push ecx
push edx
call dword [sym.imp.KERNEL32.DLL_FindFirstFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x4241fd
call fcn.004246e0
test byte [esp + 0x220], 0x10
je 0x4241e3
cmp byte [esp + 0x24c], 0x2e
je 0x4241e3
lea eax, [esp + 0x11c]
push esi
push eax
call edi
lea ecx, [esp + 0x11c]
push 0x104
push ecx
call fcn.0040ce70
add esp, 8
lea edx, [esp + 0x24c]
lea eax, [esp + 0x11c]
push edx
push eax
call ebp
mov ecx, dword [esp + 0x368]
lea edx, [esp + 0x11c]
push ecx
mov ecx, dword [esp + 0x18]
push edx
call fcn.00424040
add dword [esp + 0x10], eax
lea eax, [esp + 0x220]
push eax
push ebx
call dword [sym.imp.KERNEL32.DLL_FindNextFileA]
test eax, eax
jne 0x42417b
push ebx
call dword [sym.imp.KERNEL32.DLL_FindClose]
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret 8
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x350
ret 8

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
mov ecx, 0x126b7065
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x73902efc
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x409070
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x40907f
pop dword [ebp - 0x20]
mov eax, 0x40907f
sub dword [ebp - 0x20], eax
push 0x40
push 0x1000
push 0x3acaa
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x20]
call dword [eax]
mov ecx, 0x9fefc78e
sub ecx, 0x9fef7934
mov esi, eax
mov edx, 0x413bc4
add edx, dword [ebp - 0x20]
mov edi, 0xd3ac2d52
add edi, 0xf52c9b0e
sub dword [ebp - 4], ebx
mov ebx, dword [edx]
sub dword [ebp - 0x18], eax
add ebx, edi
xor dword [ebp - 0x10], 0xb151949d
mov dword [esi], ebx
add dword [ebp - 0x1c], ecx
add esi, 0xec699110
sub esi, 0xec69910c
add edx, 4
loop 0x4090ce
add eax, 0xb8a8644c
sub eax, 0xb8a73811
xor ebx, ebx
add ebx, eax
add eax, 0x93b2ac30
add eax, 0x6c4d53d5
mov ecx, 0x584cc723
add ecx, 0xa7f338dd
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x402d89
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
lea ebx, [ecx + 4]
push edi
mov edi, edx
test ebx, ebx
je 0x402dbf
lea esi, [edi + 4]
test esi, esi
je 0x402dbf
call fcn.00402ceb
test al, al
je 0x402dbf
mov ecx, edi
call fcn.00402ceb
test al, al
je 0x402dbf
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
jmp 0x402dc1
xor al, al
pop edi
pop esi
pop ebx
ret

Function at 0x4052f2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x405301
pop dword [ebp - 0x40]
mov eax, 0xfdddf728
sub eax, 0xfd9da427
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x3ca65
push 0
mov eax, 0x57042b13
sub eax, 0x56c258ff
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0xbf15e72b
sub ecx, 0xbf15a213
xor ebx, ebx
add ebx, eax
mov edi, 0x34b8b3d8
add edi, 0xcb8aac28
add edi, dword [ebp - 0x40]
mov edx, 0x249c104
add edx, 0x3084f1e4
xor dword [ebp - 0x34], 0x5212ccb6
mov esi, dword [edi]
xor dword [ebp - 8], esi
xor esi, edx
sub dword [ebp - 8], ecx
mov dword [ebx], esi
add dword [ebp - 0x34], ebx
add ebx, 0xca1edb13
add ebx, 0x35e124f1
add edi, 4
loop 0x405362
add eax, 0x2d5af12b
add eax, 0xd2a61608
xor ebx, ebx
add ebx, eax
add eax, 0xfb30097e
sub eax, 0xfb300979
mov ecx, 0x400000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x40612f
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
jne 0x4061b0
mov byte [esi + 8], 1
call main
cmp dword [esi + 0x10], 0
je 0x4061b0
test al, al
je 0x40614f
mov byte [esi + 0xa], 1
mov ecx, esi
call fcn.00406749
test al, al
jne 0x406176
push dword [esi + 0xc]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
call fcn.00406e12
add esp, 0xc
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
pop esi
ret
mov ecx, esi
call main
cmp dword [esi + 0x18], 0
jne 0x40619d
push dword [esi + 0x14]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_create_logging_file__s_n
call fcn.00406e12
add esp, 0xc
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp dword [esi + 0x10], 0
mov byte [esi + 9], 1
je 0x4061b0
push dword [esi + 0x10]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
pop esi
ret

Function at 0x406749
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x406756
xor al, al
pop esi
ret
push 0x1f4
push dword [esi + 0x10]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
test eax, eax
je 0x40678f
cmp eax, 0x80
je 0x40678f
push dword [esi + 0xc]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
call fcn.00406e12
add esp, 0xc
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov byte [esi + 9], 0
jmp 0x406752
mov al, 1
pop esi
ret
Function at 0x407427
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push edi
mov edi, ecx
push edi
call dword [sym.imp.kernel32.dll_lstrlenW]
push 0
mov ebx, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x407496
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ebx, [ebx*2 + 2]
push ebx
push 0x2002
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.kernel32.dll_GlobalLock]
test eax, eax
je 0x407472
push ebx
push edi
push eax
call fcn.0040b3a0
add esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x40748d
push esi
call dword [sym.imp.kernel32.dll_GlobalFree]
pop esi
pop edi
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
ret

Function at 0x40229a
Capabilities:
Terminate process

Disassembly:
mov edx, eax
push edi
push dword [0x403716]
call dword [sym.imp.pdh.dll_PdhCloseLog]
mov eax, 5
add eax, 5
inc eax
xor edi, edi
xor esi, esi
test eax, 0xb
jne 0x4022c9
push 0
call dword [sym.imp.kernel32.dll_ExitProcess]
mov edx, eax
mov dword [0x40164f], eax
ret
Function at 0x4075c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
pushal
call 0x4075cf
pop dword [ebp - 0x38]
mov eax, 0x8bdcca68
sub eax, 0x8b9c5499
sub dword [ebp - 0x38], eax
mov dword [ebp - 0x48], 0x49d338d1
sub dword [ebp - 0x48], 0xfb80f386
mov dword [ebp - 0x44], 0xdef7a7a8
sub dword [ebp - 0x44], 0xacc45b63
mov dword [ebp - 0x40], 0x824306da
add dword [ebp - 0x40], 0xca093d54
mov dword [ebp - 0x3c], 0x41a9c553
add dword [ebp - 0x3c], 0xbe563aad
lea eax, [ebp - 0x48]
push eax
mov eax, 0x9b31e33
sub eax, 0x971bd9b
add eax, dword [ebp - 0x38]
call dword [eax]
mov dword [ebp - 0x48], 0x39f3a484
add dword [ebp - 0x48], 0x3a7ec4d2
mov dword [ebp - 0x44], 0xde3bc101
sub dword [ebp - 0x44], 0x9ccf5f8c
mov dword [ebp - 0x40], 0xed010ffa
add dword [ebp - 0x40], 0x766e5c72
mov dword [ebp - 0x3c], 0x1ecd911c
add dword [ebp - 0x3c], 0xe1326ee4
lea ebx, [ebp - 0x48]
push ebx
push eax
mov eax, 0x478f79ff
sub eax, 0x474e198b
add eax, dword [ebp - 0x38]
call dword [eax]
push 0x40
push 0x1000
push 0x3c4ba
push 0
call eax
mov ecx, 0x6dc633ac
add ecx, 0x923a195f
mov esi, eax
mov edx, 0x9ef60451
sub edx, 0x9eb35e51
add edx, dword [ebp - 0x38]
mov ebx, 0x22516198
mov dword [ebp - 8], 0xdc54ec8
mov edi, dword [edx]
sub dword [ebp - 0x14], ebx
add edi, ebx
xor dword [ebp - 0x14], 0x535b168b
mov dword [esi], edi
mov dword [ebp - 0x30], 0xb0bced36
add esi, 0x14f223a7
sub esi, 0x14f223a3
add edx, 0x98f3dc3a
add edx, 0x670c23ca
loop 0x4076eb
add eax, 0x47a1bcd9
sub eax, 0x47a095da
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x8f11b5c3
sub ecx, 0x8ed1b5c3
add ecx, dword [ebp - 0x38]
call ebx
leave
ret
Function at 0x40ee60
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, ecx
cmp dword [ebx + 0x38], 0
je 0x40ee85
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
push esi
mov esi, dword [ebp + 0xc]
push edi
mov eax, dword [eax]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0xc], eax
test eax, eax
je 0x40eea6
mov eax, dword [ebx + 0x30]
mov eax, dword [eax]
jmp 0x40eea8
xor eax, eax
cdq
mov dword [ebp - 4], eax
mov ecx, edx
mov dword [ebp - 8], ecx
test edi, edi
jl 0x40ef26
jg 0x40eebb
test esi, esi
je 0x40ef26
test ecx, ecx
jl 0x40eeff
jg 0x40eec5
test eax, eax
je 0x40eeff
cmp edi, ecx
jg 0x40eed7
jl 0x40eecf
cmp esi, eax
jae 0x40eed7
mov eax, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], edi
push eax
push dword [ebp + 8]
push dword [ebp - 0xc]
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [ebp - 4]
add esp, 0xc
mov edx, dword [ebp + 8]
mov eax, dword [ebx + 0x30]
add edx, ecx
sub esi, ecx
sbb edi, dword [ebp - 8]
sub dword [eax], ecx
mov eax, dword [ebx + 0x20]
add dword [eax], ecx
jmp 0x40ef02
mov edx, dword [ebp + 8]
test edi, edi
jl 0x40ef26
jg 0x40ef0c
test esi, esi
je 0x40ef26
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x40ef26
push eax
push esi
push 1
push edx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x401031
Capabilities:
Create process on windows

Disassembly:
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x403220], eax
call sub.kernel32.dll_GetCommandLineA
mov dword [0x403224], eax
push 0xa
push dword [0x403224]
push 0
push dword [0x403220]
call 0x401031
push eax
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xffffffb0
mov eax, dword [ebp + 0x10]
inc eax
mov dl, byte [eax]
cmp dl, 0x20
jne 0x401044
jmp 0x401046
jmp 0x40103a
inc eax
push eax
push 0x403123
call fcn.00401110
push 0xfa
push 0x403029
push 0xffffffffffffffff
push 0x403123
push 0
push 0
call sub.kernel32.dll_MultiByteToWideChar
mov dword [0x403228], 0x44
mov dword [0x403254], 1
mov word [0x403258], 0
push 0x40326c
push 0x403228
push 0
push 0
push 0
push 0x403029
push 0
push 0
push 0x403025
push 0
push str.mima1
call sub.advapi32.dll_CreateProcessWithLogonW
push 0xffffffffffffffff
push dword [0x40326c]
call sub.kernel32.dll_WaitForSingleObject
push dword [0x40326c]
call sub.kernel32.dll_CloseHandle
push dword [0x403270]
call sub.kernel32.dll_CloseHandle
push 0
call sub.kernel32.dll_ExitProcess
mov eax, dword [ebp - 0x44]
leave
ret 0x10