joyce8/EMBER2024-capa huggingface dataset:
Function at 0x403d59
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
mov edi, dword [ebp + 8]
mov edi, dword [edi]
push edi
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
pop edi
mov esi, ecx
not esi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0xc]
lea eax, [eax + 0x10]
push dword [eax]
xor eax, eax
push edx
mov ecx, dword [edx + 0x30]
movzx ebx, byte [eax + edi]
movzx edx, byte [ecx + eax*2]
sub ebx, edx
cmp ebx, 0
je 0x403da0
cmp ebx, 0x20
je 0x403da0
cmp ebx, 0xffffffe0
je 0x403da0
jne 0x403da9
add eax, 1
cmp esi, eax
je 0x403db6
jne 0x403d85
pop edx
mov edx, dword [edx]
xor eax, eax
pop ebx
cmp ebx, edx
push ebx
je 0x403dba
jne 0x403d81
pop edx
mov eax, dword [edx + 0x18]
leave
ret 4

Function at 0x403dce
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push ebx
sub esp, 0x10
mov edx, dword [esp + 0x28]
mov eax, dword [esp + 0x24]
mov ecx, dword [edx]
test eax, eax
je 0x403e8f
test ecx, ecx
je 0x403e8f
mov ebx, dword [eax + 0x3c]
mov edx, dword [ebx + eax + 0x78]
mov ebx, dword [ebx + eax + 0x7c]
test edx, edx
je 0x403e8f
test ebx, ebx
je 0x403e8f
mov ebx, eax
add ebx, edx
je 0x403e8f
mov esi, dword [edx + eax + 0x18]
test esi, esi
je 0x403e8f
cmp dword [edx + eax + 0x14], 0
je 0x403e8f
mov edi, dword [edx + eax + 0x20]
mov ebx, dword [edx + eax + 0x24]
add edi, eax
mov edx, dword [edx + eax + 0x1c]
add ebx, eax
add edx, eax
test esi, esi
jbe 0x403e8f
mov dword [esp], edx
xor ebp, ebp
mov dword [esp + 0xc], edi
mov dword [esp + 4], esi
mov dword [esp + 8], ecx
mov eax, dword [esp + 0xc]
mov edi, dword [esp + 8]
movzx ecx, word [ebx + ebp*2]
mov esi, dword [eax + ebp*4]
add esi, dword [esp + 0x24]
mov dl, byte [edi]
cmp dl, byte [esi]
jne 0x403e7f
test dl, dl
je 0x403e7b
mov dl, byte [edi + 1]
cmp dl, byte [esi + 1]
jne 0x403e7f
add edi, 2
add esi, 2
test dl, dl
jne 0x403e5f
xor eax, eax
jmp 0x403e84
sbb eax, eax
or eax, 1
test eax, eax
je 0x403e9b
inc ebp
cmp ebp, dword [esp + 4]
jb 0x403e4c
xor eax, eax
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
mov edx, dword [esp]
mov edx, dword [edx + ecx*4]
mov eax, dword [esp + 0x24]
add eax, edx
add esp, 0x10
pop ebx
pop edi
pop esi
pop ebp
ret 8
Function at 0x408e53
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
cmp dword [ebp + 0x18], 1
jne 0x408e72
mov dword [ebp + 0x18], 0
jmp 0x408e8f
cmp dword [ebp + 0x18], 2
jne 0x408e88
mov dword [ebp + 0x18], 7
jmp 0x408e8f
mov dword [ebp + 0x18], 1
push 0x80000004
push 0
push 0x4278e6
push 1
mov ebx, 0x168
call fcn.004152c0
add esp, 0x10
mov dword [ebp - 4], eax
push 0x80000004
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x408ec3
mov eax, 0x42725b
push eax
push 1
mov ebx, 0x198
call fcn.00415730
add esp, 0x10
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x408ee9
push ebx
call fcn.00414d9e
add esp, 4
call fcn.004037a5
mov dword [ebp - 0xc], eax
push 0x80000301
push 0
push 2
push 0x80000004
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x408f10
mov eax, 0x42725b
push eax
push 0x80000005
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x408f24
mov eax, 0x42725c
push eax
push 3
mov ebx, 0x10
mov eax, 0x4183b0
call fcn.004151b0
add esp, 0x28
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x408f4f
push ebx
call fcn.00414d9e
add esp, 4
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x408f5f
push ebx
call fcn.00414d9e
add esp, 4
push 0x80000005
push 0
mov eax, dword [ebp - 0x10]
test eax, eax
jne 0x408f72
mov eax, 0x42725c
push eax
push 1
mov ebx, 0x168
call fcn.004152c0
add esp, 0x10
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x408f98
push ebx
call fcn.00414d9e
add esp, 4
lea eax, [ebp - 0x14]
push eax
call fcn.00403877
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x408fb4
push ebx
call fcn.00414d9e
add esp, 4
push 0x80000004
push 0
mov eax, dword [ebp - 0x18]
test eax, eax
jne 0x408fc7
mov eax, 0x42725b
push eax
push 1
mov ebx, 0x168
call fcn.004152c0
add esp, 0x10
mov dword [ebp - 0x1c], eax
mov ebx, dword [ebp - 0x18]
test ebx, ebx
je 0x408fed
push ebx
call fcn.00414d9e
add esp, 4
push 0xa0000301
push 0
push 0x42725c
push 1
mov ebx, 0x168
call fcn.004152c0
add esp, 0x10
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], esp
push dword [ebp + 0x18]
push dword [ebp - 0x20]
mov ebx, dword [ebp + 0x10]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 0x1c]
push 0
xor eax, eax
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
cmp dword [ebp - 0x24], esp
je 0x40904f
push 0x1d4
push 0x402a781
push 6
call fcn.00414db6
add esp, 0xc
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x409062
push ebx
call fcn.00414d9e
add esp, 4
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x409072
push ebx
call fcn.00414d9e
add esp, 4
cmp dword [ebp - 0x28], 2
jne 0x40908b
mov eax, 0
jmp 0x409095
mov eax, 1
jmp 0x409095
mov esp, ebp
pop ebp
ret 0x18
Function at 0x415f30
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x415f4e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x415f43
pop esi
ret

Function at 0x416f20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x416f41
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x416f9b
inc edi
cmp edi, esi
jl 0x416f35
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x416fd0
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x416f8a
cmp byte [eax], bl
je 0x416fa5
cmp byte [eax + 1], bl
je 0x416fae
cmp byte [eax + 2], bl
je 0x416fb8
cmp byte [eax + 3], bl
je 0x416fc4
add eax, 4
cmp eax, edi
jb 0x416f61
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4

Function at 0x418000
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
xor ecx, ecx
xor eax, eax
push ebp
mov ebp, dword [esp + 0x18]
mov byte [eax + ebp], al
inc eax
cmp eax, 0x100
jl 0x41800c
mov eax, dword [esp + 0x14]
mov byte [ebp + 0x100], cl
cmp eax, ecx
mov byte [ebp + 0x101], cl
jle 0x41809f
push ebx
push esi
push edi
mov byte [esp + 0x24], cl
xor esi, esi
mov ebx, ebp
mov dword [esp + 0x10], pe_nt_image_headers32
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
and edi, 0xff
xor eax, eax
xor edx, edx
mov al, byte [edi + ecx]
mov dl, byte [ebx]
add esi, eax
add edx, esi
and edx, 0x800000ff
jns 0x418069
dec edx
or edx, 0xffffff00
inc edx
mov byte [esp + 0x14], dl
mov esi, dword [esp + 0x14]
and esi, 0xff
lea eax, [esi + ebp]
push eax
push ebx
call fcn.004180b0
lea eax, [edi + 1]
add esp, 8
cdq
idiv dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc ebx
dec eax
mov dword [esp + 0x10], eax
mov byte [esp + 0x24], dl
jne 0x41803e
pop edi
pop esi
pop ebx
pop ebp
add esp, 8
ret
Function at 0x4180d0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x14]
push ebx
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
mov al, byte [esi + 0x100]
mov cl, byte [esi + 0x101]
test edx, edx
mov byte [esp + 0x20], al
mov byte [esp + 8], cl
jle 0x4181cd
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x28]
and edi, 0xff
and ebp, 0xff
lea eax, [edi + 1]
and eax, 0x800000ff
jns 0x418122
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x28], al
xor ecx, ecx
mov edi, dword [esp + 0x28]
and edi, 0xff
mov cl, byte [edi + esi]
lea eax, [edi + esi]
add ecx, ebp
mov dword [esp + 0x18], eax
and ecx, 0x800000ff
jns 0x41814e
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ebp, dword [esp + 0x10]
and ebp, 0xff
lea ecx, [esi + ebp]
push ecx
push eax
mov dword [esp + 0x1c], ecx
call fcn.004180b0
mov eax, dword [esp + 0x1c]
xor edx, edx
xor ecx, ecx
add esp, 8
mov dl, byte [eax]
mov eax, dword [esp + 0x18]
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x41818f
dec edx
or edx, 0xffffff00
inc edx
mov eax, dword [esp + 0x20]
and edx, 0xff
mov cl, byte [edx + esi]
mov dl, byte [ebx + eax]
xor dl, cl
mov byte [ebx + eax], dl
mov eax, dword [esp + 0x24]
inc ebx
cmp ebx, eax
jl 0x418111
mov dl, byte [esp + 0x28]
mov al, byte [esp + 0x10]
pop edi
mov byte [esi + 0x100], dl
mov byte [esi + 0x101], al
pop ebp
pop esi
pop ebx
add esp, 0xc
ret
mov byte [esi + 0x100], al
mov byte [esi + 0x101], cl
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x419940
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x4319e4]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x419953
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x419994
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x431a8c]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x4199c6
mov bl, byte [esp + ecx + 0x4c]
jmp 0x4199ca
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x4199bb
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x4199e8
mov bl, byte [esp + ecx + 0x4c]
jmp 0x4199ec
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x4199dd
xor ecx, ecx
mov eax, 0x4319f4
xor ebx, ebx
mov bl, byte [ecx + 0x431a9c]
cmp byte [esp + ebx + 0x14], 0
je 0x419a17
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x431ab4]
cmp byte [esp + ebx + 0x14], 0
je 0x419a2e
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x4199fe
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x419987
lea edx, [esp + 0x84]
push edx
call fcn.00419a70
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x403870
Capabilities:
Read file on windows

Disassembly:
cmp dword [esi + 8], 0
push ebp
mov ebp, dword [esp + 8]
push edi
je 0x4038d9
xor edi, edi
test ebx, ebx
jbe 0x40389e
mov eax, dword [esi + 0xc]
cmp eax, dword [esi + 8]
je 0x4038ac
mov edx, dword [esi + 0xc]
mov ecx, dword [esi + 4]
mov al, byte [ecx + edx]
mov byte [edi + ebp], al
inc dword [esi + 0xc]
inc edi
cmp edi, ebx
jb 0x403882
add dword [esi + 0x10], edi
mov eax, edi
pop edi
adc dword [esi + 0x14], 0
pop ebp
ret 4
mov edx, dword [esi + 4]
mov eax, dword [esi]
push 0
lea ecx, [esp + 0x10]
push ecx
push 0x10000
push edx
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x40389e
mov dword [esi + 8], eax
mov dword [esi + 0xc], 0
jmp 0x40388a
push esi
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
call fcn.0040f740
mov dword [esi + 0x10], eax
mov dword [esi + 0x14], edx
jmp 0x40387c
Function at 0x40ec70
Capabilities:
Create process on windows
Get common file path
Set current directory

Disassembly:
sub esp, 0x438
push ebx
push esi
push edi
mov edi, eax
lea eax, [esp + 0x20]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
push edi
call fcn.00401a90
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
jne 0x43361f
mov eax, dword [0x4a571c]
test eax, eax
je 0x433638
mov byte [esp + 0xf], 0
mov esi, 0x4a68a8
cmp eax, 1
je 0x43364c
push 0x4a571c
lea ecx, [esp + 0x13]
mov eax, 0x4a5734
call fcn.00410760
test al, al
je 0x43366d
mov dl, byte [0x4a68a8]
mov bl, byte [0x4a68a9]
push 0x4a5718
lea eax, [esp + 0x234]
push eax
push 0x104
push 0x4a5734
mov byte [0x4a5720], dl
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov ecx, dword [0x4a571c]
push ecx
push 0x4a5734
call fcn.0040e9f0
test eax, eax
jne 0x433681
cmp bl, 1
je 0x4336a5
call fcn.004115d0
call fcn.004117c0
cmp byte [0x4a5720], 0
jne 0x40ed48
mov esi, 0x4a5ee0
call fcn.0040f420
push 1
mov ecx, 0x4a5940
call fcn.00404790
cmp byte [0x4a5720], 0
jne 0x40ed67
mov ecx, 0x4a5ee0
call fcn.00401090
mov ebx, 0x4a68a8
call fcn.0040ffc0
lea eax, [esp + 0x20]
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
pop edi
pop esi
pop ebx
add esp, 0x438
ret
push 0x10
push 0x4856d6
push str.This_is_a_compiled_AutoIt_script._AV_researchers_please_email_avsupport_autoitscript.com_for_support.
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x40ed7c
lea ecx, [esp + 0x20]
mov dword [0x494cbc], 0xffffffff
push ecx
jmp 0x40ed76
mov edx, dword [0x4a5724]
push 0xffffffffffffffff
push edx
push 1
xor bl, bl
call fcn.004039c0
mov al, byte [0x494cb0]
mov byte [0x4a68ab], al
jmp 0x40ed09
lea ecx, [esp + 0x20]
mov dword [0x494cbc], 1
push ecx
jmp 0x40ed76
mov ebx, 0x4a68a8
call fcn.0040ffc0
lea edx, [esp + 0x20]
push edx
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
mov dword [0x494cbc], 1
jmp 0x40ed7c
call fcn.00437bbb
test al, al
jne 0x40ed2b
push 0x104
lea eax, [esp + 0x234]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp byte [esp + 0xf], 0
je 0x433726
mov edi, 0x485740
lea esi, [esp + 0x10]
call fcn.00401640
mov edi, 0x4a5734
mov eax, esi
call fcn.004013b0
mov edi, 0x485740
mov eax, esi
call fcn.004013b0
mov edx, dword [esp + 0x10]
push 1
lea ecx, [esp + 0x24]
push ecx
push edx
lea eax, [esp + 0x23c]
push eax
push 0x485744
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, esi
call fcn.00402130
jmp 0x40ed67
push 1
lea ecx, [esp + 0x24]
push ecx
push edi
lea edx, [esp + 0x23c]
push edx
push 0x485744
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x40ed67
Function at 0x4104c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ecx
mov eax, dword [esp + 0x14]
lea ecx, [eax + eax]
lea eax, [esp]
push eax
xor edx, edx
push 1
push edx
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x18]
mov word [esi], dx
mov edx, dword [esp + 0x14]
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x41050f
mov ecx, dword [esp + 0x10]
mov edx, dword [esp]
lea eax, [esp + 0x14]
push eax
push esi
push 0
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov eax, dword [esp]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop ecx
ret
Function at 0x410800
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x10020
call fcn.00426a60
xor eax, eax
lea esp, [esp]
mov cl, byte [eax + 0x493380]
mov dl, byte [eax + 0x493378]
mov byte [esp + eax + 0xc], cl
mov byte [esp + eax + 0x14], dl
inc eax
cmp eax, 8
jl 0x410810
lea eax, [esp]
push str.AU3_
push eax
call fcn.00414e90
push 4
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x2c]
push edx
call fcn.00412480
add esp, 0x14
push ebx
push ebp
push esi
mov dword [esp + 0x14], 0
push edi
jmp 0x410860
mov eax, dword [esp + 0x10034]
mov ecx, dword [eax]
push ecx
push 0x10000
lea edx, [esp + 0x38]
push 1
push edx
call fcn.004167e9
add esp, 0x10
cmp eax, 0x18
jl 0x4108e1
mov ebp, eax
lea edi, [ebp - 0x14]
test edi, edi
jle 0x4108ad
xor edx, edx
mov edi, edi
xor ecx, ecx
lea esi, [esp + edx + 0x30]
mov al, byte [esp + ecx + 0x1c]
cmp al, byte [esi + ecx]
je 0x4108d1
cmp ecx, 0x14
je 0x42a7ca
inc edx
cmp edx, edi
jl 0x410890
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x10034]
lea edx, [ecx + ebp - 0x14]
mov ecx, dword [eax]
push 1
push 0xffffffffffffffec
push ecx
mov dword [esp + 0x24], edx
call fcn.00416aad
add esp, 0xc
jmp 0x410860
mov bl, byte [esp + ecx + 0x1d]
lea eax, [ecx + edx]
cmp bl, byte [esp + eax + 0x31]
je 0x4108f3
inc ecx
jmp 0x41089f
mov eax, 3
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10020
ret 4
mov bl, byte [esp + ecx + 0x1e]
lea eax, [ecx + edx]
cmp bl, byte [esp + eax + 0x32]
jne 0x41092a
mov bl, byte [esp + ecx + 0x1f]
lea eax, [ecx + edx]
cmp bl, byte [esp + eax + 0x33]
jne 0x42a7c2
mov bl, byte [esp + ecx + 0x20]
lea eax, [ecx + edx]
cmp bl, byte [esp + eax + 0x34]
je 0x42a7b1
add ecx, 4
jmp 0x41089f
add ecx, 2
jmp 0x41089f
add ecx, 5
cmp ecx, 0x14
jl 0x410896
jmp 0x41089f
add ecx, 3
jmp 0x41089f
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x10034]
lea ecx, [eax + edx + 0x14]
mov edx, dword [esi]
push 0
push ecx
push edx
call fcn.00416aad
mov eax, dword [esi]
push eax
push 4
lea ecx, [esp + 0x24]
push 1
push ecx
call fcn.004167e9
lea edx, [esp + 0x2c]
push str.EA06
push edx
mov byte [esp + 0x38], 0
call fcn.004154b0
add esp, 0x24
neg eax
sbb eax, eax
and eax, 4
jmp 0x4108e6
Function at 0x4109b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1ac
push esi
push 0x4858e8
or eax, 0xffffffff
call fcn.00410940
mov esi, eax
add esp, 4
lea eax, [esp + 0xa8]
push esi
push eax
call fcn.00414e90
push esi
call fcn.0041293d
add esp, 0xc
lea esi, [esp + 0x18]
call fcn.00410a80
lea eax, [esp + 0xa8]
mov ecx, esi
call fcn.00410ab0
mov dword [edi + 8], 0
mov eax, dword [edi + 8]
xor ecx, ecx
lea esp, [esp]
movzx edx, byte [esp + ecx + 0x18]
add eax, edx
movzx edx, byte [esp + ecx + 0x19]
add eax, edx
movzx edx, byte [esp + ecx + 0x1a]
add eax, edx
movzx edx, byte [esp + ecx + 0x1b]
add ecx, 4
add eax, edx
cmp ecx, 0x10
jl 0x410a10
mov dword [edi + 8], eax
mov eax, dword [ebp + 8]
push 0x488434
push eax
call fcn.0041643f
add esp, 8
mov dword [edi], eax
test eax, eax
je 0x42c7aa
push edi
call fcn.00410800
test eax, eax
je 0x42c7b4
mov ecx, dword [edi]
push ecx
mov esi, eax
call fcn.004164cd
add esp, 4
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 4
mov eax, 1
jmp 0x410a6f
mov edx, dword [edi]
push edx
push 0x10
lea eax, [esp + 0x10]
push 1
push eax
call fcn.004167e9
add esp, 0x10
push 0x99f2
push 0x10
lea ecx, [esp + 0x10]
push ecx
call fcn.0044d0de
xor eax, eax
mov dword [edi + 8], 0
xor ecx, ecx
movzx edx, byte [esp + eax + 8]
inc eax
imul ecx, edx
cmp eax, 0x10
jl 0x42c7e4
mov eax, dword [edi]
push eax
mov dword [edi + 8], ecx
call fcn.004169b5
add esp, 4
mov dword [edi + 4], eax
xor eax, eax
jmp 0x410a6f

Function at 0x410a80
Capabilities:
Hash data with md5

Disassembly:
push 8
lea eax, [esi + 0x44]
push 0
push eax
call fcn.00414700
add esp, 0xc
mov dword [esi + 0x34], 0x67452301
mov dword [esi + 0x38], 0xefcdab89
mov dword [esi + 0x3c], 0x98badcfe
mov dword [esi + 0x40], 0x10325476
ret

Function at 0x4117c0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x494ce8]
push esi
push 0
mov esi, dword [sym.imp.USER32.dll_CreateWindowExW]
push eax
push 0
push 0
push 0x64
push 0x12c
push accept
push accept
push 0xcf0000
push str.AutoIt_v3
push str.AutoIt_v3
push 0
call esi
mov ecx, dword [0x494ce8]
push 0
push ecx
push 1
push eax
push 0
push 0
push 0
push 0
push 0x50b008c4
push 0
push str.edit
push 0
mov dword [0x494ce0], eax
call esi
mov edx, dword [0x494ce0]
mov esi, dword [sym.imp.USER32.dll_ShowWindow]
push 0
push edx
mov dword [0x494cdc], eax
call esi
mov eax, dword [0x494ce0]
push 0
push eax
call esi
pop esi
ret
Function at 0x411d10
Capabilities:
Get keyboard layout
Log keystrokes

Disassembly:
sub esp, 0xc
push ebx
push esi
mov esi, eax
push edi
mov edi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebx, ebx
push ebx
push 0x5b
mov dword [esi], 5
mov dword [esi + 4], 5
mov dword [esi + 0x10], ebx
mov byte [esi + 8], 1
mov byte [esi + 9], bl
mov dword [esi + 0xc], ebx
mov dword [esi + 0x20], 0xa0
call edi
push ebx
push 0x10
mov byte [esi + 0x1d], al
call edi
mov byte [esi + 0x1a], al
mov eax, dword [esi + 0x20]
push ebx
push eax
call edi
push ebx
push 0xa1
mov byte [esi + 0x1b], al
call edi
push ebx
push 0x11
mov byte [esi + 0x1c], al
call edi
push ebx
push 0x12
mov byte [esi + 0x18], al
call edi
lea ecx, [esp + 0xc]
push ecx
mov byte [esi + 0x19], al
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
mov edi, dword [sym.imp.USER32.dll_VkKeyScanA]
mov esi, 1
mov bl, 0x20
mov edi, edi
movzx edx, byte [esi + 0x493e88]
push edx
call edi
cmp ax, 0xffff
je 0x411dff
inc esi
cmp esi, 7
jle 0x411d90
lea eax, [esp + 0x10]
push str.0409
push eax
call fcn.004154b0
add esp, 8
test eax, eax
je 0x42a965
lea edx, [esp + 0x10]
push str.0809
push edx
call fcn.004154b0
add esp, 8
test eax, eax
jne 0x42a992
mov byte [0x493e8a], bl
mov byte [0x493e8d], bl
mov byte [0x493e8e], bl
mov byte [0x493e8b], bl
mov byte [0x493e8c], bl
pop edi
pop esi
pop ebx
add esp, 0xc
ret
mov byte [esi + 0x493e88], bl
jmp 0x411da0
push 4
lea ecx, [esp + 0x10]
push str.0002
push ecx
call fcn.00415538
add esp, 0xc
mov byte [0x493e8a], bl
mov byte [0x493e8d], bl
test eax, eax
je 0x411df8
jmp 0x411de6
lea eax, [esp + 0x12]
push 0x4865e4
push eax
call fcn.004154b0
add esp, 8
test eax, eax
jne 0x42a9b3
mov byte [0x493e8d], bl
jmp 0x411df2
lea ecx, [esp + 0x12]
push 0x4865e8
push ecx
call fcn.004154b0
add esp, 8
test eax, eax
je 0x411dda
lea edx, [esp + 0x12]
push 0x4865ec
push edx
call fcn.004154b0
add esp, 8
test eax, eax
je 0x411df2
lea eax, [esp + 0x12]
push 0x4865f0
push eax
call fcn.004154b0
add esp, 8
test eax, eax
jne 0x411df8
jmp 0x411de0

Function at 0x423677
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x491e80]
jne 0x423681
repz ret
jmp fcn.004278f5
Function at 0x424608
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00417e60
and dword [ebp - 4], 0
cmp dword [0x49491c], 0
mov ebx, eax
jne 0x4246b9
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x42476a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x484de0
push edi
call esi
test eax, eax
je 0x42476a
push eax
call fcn.00417dee
mov dword [esp], 0x484dd0
push edi
mov dword [0x49491c], eax
call esi
push eax
call fcn.00417dee
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x494920], eax
call esi
push eax
call fcn.00417dee
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x494924], eax
call esi
push eax
call fcn.00417dee
pop ecx
mov dword [0x49492c], eax
test eax, eax
je 0x4246b9
push 0x484d88
push edi
call esi
push eax
call fcn.00417dee
pop ecx
mov dword [0x494928], eax
mov eax, dword [0x494928]
cmp eax, ebx
je 0x424711
cmp dword [0x49492c], ebx
je 0x424711
push eax
call fcn.00417e69
push dword [0x49492c]
mov esi, eax
call fcn.00417e69
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x424711
test edi, edi
je 0x424711
call esi
test eax, eax
je 0x424708
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x424708
test byte [ebp - 0xc], 1
jne 0x424711
or dword [ebp + 0x10], 0x200000
jmp 0x42474a
mov eax, dword [0x494920]
cmp eax, ebx
je 0x42474a
push eax
call fcn.00417e69
pop ecx
test eax, eax
je 0x42474a
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x42474a
mov eax, dword [0x494924]
cmp eax, ebx
je 0x42474a
push eax
call fcn.00417e69
pop ecx
test eax, eax
je 0x42474a
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x49491c]
call fcn.00417e69
pop ecx
test eax, eax
je 0x42476a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x42476c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret