joyce8/EMBER2024-capa huggingface dataset:
Function at 0x410640
Capabilities:
Encrypt data using salsa20 or chacha

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, ecx
mov esi, edx
push 0x78
push 0
lea eax, [edi + 0x10]
push eax
call fcn.004a30c0
mov dword [edi], 0x61707865
add esp, 0xc
mov dword [edi + 4], 0x3320646e
mov dword [edi + 8], 0x79622d32
mov dword [edi + 0xc], 0x6b206574
movzx ecx, byte [esi + 3]
shl ecx, 8
movzx eax, byte [esi + 2]
or ecx, eax
movzx eax, byte [esi + 1]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x10], ecx
movzx ecx, byte [esi + 7]
movzx eax, byte [esi + 6]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 5]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 4]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x14], ecx
movzx ecx, byte [esi + 0xb]
movzx eax, byte [esi + 0xa]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 9]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 8]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x18], ecx
movzx ecx, byte [esi + 0xf]
movzx eax, byte [esi + 0xe]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0xd]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0xc]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x1c], ecx
movzx ecx, byte [esi + 0x13]
movzx eax, byte [esi + 0x12]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x11]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x10]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x20], ecx
movzx ecx, byte [esi + 0x17]
movzx eax, byte [esi + 0x16]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x15]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x14]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x24], ecx
movzx ecx, byte [esi + 0x1b]
movzx eax, byte [esi + 0x1a]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x19]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x18]
shl ecx, 8
or ecx, eax
mov dword [edi + 0x28], ecx
movzx ecx, byte [esi + 0x1f]
movzx eax, byte [esi + 0x1e]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x1d]
shl ecx, 8
or ecx, eax
movzx eax, byte [esi + 0x1c]
shl ecx, 8
or ecx, eax
mov eax, dword [ebp + 8]
mov dword [edi + 0x2c], ecx
mov dword [edi + 0x38], eax
mov eax, dword [ebp + 0xc]
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x3c], eax
pop edi
pop esi
pop ebp
ret
Function at 0x4107b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
lea eax, [ebp - 0x14]
mov esi, fcn.004107b0
xor esi, dword [ebp + 8]
push eax
call dword [0x4c21b0]
mov eax, dword [ebp - 0x10]
mov edi, dword [0x4fb8f8]
mov edx, dword [0x4fb8fc]
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov eax, edi
or eax, edx
jne 0x410829
lea eax, [ebp - 0x1c]
push eax
call dword [0x4c21a0]
push 0
push 0x3e8
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.004c0d00
mov edi, eax
mov dword [0x4fb8fc], edx
mov ecx, edi
mov dword [0x4fb8f8], edi
or ecx, edx
jne 0x410829
mov edi, 1
xor edx, edx
mov dword [0x4fb8f8], edi
mov dword [0x4fb8fc], edx
push edx
push edi
push dword [ebp - 8]
push ebx
call fcn.004c0d00
xor esi, eax
mov edx, esi
shr edx, 0x11
xor edx, esi
and edx, 0xf
add edx, 1
je 0x41087b
mov edi, 0x11
nop word [eax + eax]
test esi, esi
cmove esi, edi
mov eax, esi
shr eax, 0x10
xor eax, esi
imul ecx, eax, 0x7feb352d
mov eax, ecx
shr eax, 0xf
xor eax, ecx
imul eax, eax, 0x846ca68b
mov esi, eax
shr esi, 0x10
xor esi, eax
sub edx, 1
jne 0x410850
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4118f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, ecx
mov dword [ebp - 0x18], edx
xor ecx, ecx
test esi, esi
je 0x4119f4
push ebx
mov ebx, dword [ebp + 8]
cmp esi, 0x40
jb 0x4119d4
lea eax, [esi - 1]
add eax, ebx
cmp edi, eax
ja 0x41192d
lea eax, [esi - 1]
add eax, edi
cmp eax, ebx
jae 0x4119d4
lea eax, [esi - 1]
add eax, edx
cmp edi, eax
ja 0x411943
lea eax, [esi - 1]
add eax, edi
cmp eax, edx
jae 0x4119d4
mov eax, esi
mov esi, edx
sub esi, ebx
and eax, 0xffffffc0
mov dword [ebp - 4], esi
mov esi, edi
sub esi, ebx
mov dword [ebp - 0x14], eax
mov eax, ebx
mov dword [ebp - 8], esi
mov ebx, edx
lea esi, [edx + 0x30]
mov edx, dword [ebp - 8]
sub ebx, edi
mov dword [ebp - 0xc], ebx
mov ebx, dword [ebp - 4]
mov dword [ebp - 0x10], esi
lea esi, [edi + 0x10]
movups xmm1, xmmword [ebx + eax]
mov ebx, dword [ebp - 0xc]
lea eax, [eax + 0x40]
movups xmm0, xmmword [eax - 0x40]
lea esi, [esi + 0x40]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x30]
movups xmmword [edx + eax - 0x40], xmm1
movups xmm1, xmmword [ebx + esi - 0x40]
mov ebx, dword [ebp - 0x10]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x20]
movups xmmword [esi - 0x40], xmm1
movups xmm1, xmmword [ebx + ecx - 0x10]
pxor xmm1, xmm0
movups xmm0, xmmword [eax - 0x10]
movups xmmword [esi - 0x30], xmm1
movups xmm1, xmmword [ebx + ecx]
mov ebx, dword [ebp - 4]
add ecx, 0x40
pxor xmm1, xmm0
movups xmmword [esi - 0x20], xmm1
cmp ecx, dword [ebp - 0x14]
jb 0x411971
mov esi, dword [ebp + 0xc]
mov edx, dword [ebp - 0x18]
mov ebx, dword [ebp + 8]
cmp ecx, esi
jae 0x4119f3
sub edx, ebx
lea eax, [ecx + ebx]
sub edi, ebx
sub esi, ecx
mov cl, byte [eax + edx]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
mov byte [eax + edi - 1], cl
sub esi, 1
jne 0x4119e1
pop ebx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x412370
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], edx
mov eax, ecx
mov dword [ebp - 8], eax
test edx, edx
je 0x412390
cmp edx, 1
je 0x412390
mov eax, 0xffffff8c
mov esp, ebp
pop ebp
ret
mov dword [eax], 0
test edx, edx
mov dword [eax + 4], 0
mov ecx, 0x367cd507
push ebx
mov eax, 0xbb67ae85
mov ebx, 0xa54ff53a
cmovne eax, ecx
mov edx, 0x510e527f
mov dword [ebp - 0xc], eax
mov ecx, 0x3070dd17
push esi
mov eax, 0x3c6ef372
mov esi, 0x9b05688c
cmovne eax, ecx
mov ecx, 0xffc00b31
mov dword [ebp - 0x10], eax
mov eax, 0xf70e5939
cmovne ebx, eax
mov eax, 0x64f98fa7
push edi
mov edi, 0x1f83d9ab
mov dword [ebp - 0x14], ebx
cmovne edi, eax
mov ebx, 0xbefa4fa4
mov eax, 0x68581511
cmovne esi, eax
mov eax, dword [ebp - 4]
test eax, eax
mov eax, 0x6a09e667
cmovne edx, ecx
mov ecx, 0x5be0cd19
cmovne ecx, ebx
cmp dword [ebp - 4], 0
mov ebx, 0xc1059ed8
cmovne eax, ebx
mov ebx, dword [ebp - 8]
mov dword [ebx + 8], eax
mov eax, dword [ebp - 0xc]
mov dword [ebx + 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [ebx + 0x10], eax
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0x14]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], esi
mov dword [eax + 0x20], edi
mov dword [eax + 0x24], ecx
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
pop edi
pop esi
mov dword [ecx + 0x68], eax
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x414f50
Capabilities:
Hash data using sha224
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 0x30], edx
test edx, edx
je 0x414f6b
cmp edx, 1
je 0x414f6b
mov eax, 0xffffff8b
mov esp, ebp
pop ebp
ret
mov dword [ecx], 0
mov dword [ecx + 4], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0xc], 0
push ebx
push esi
push edi
test edx, edx
jne 0x414ff7
mov eax, 0x137e2179
mov dword [ebp - 0x20], 0x2b3e6c1f
mov esi, 0x5be0cd19
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], esi
mov edi, 0xfb41bd6b
mov ebx, 0x1f83d9ab
mov dword [ebp - 0x24], 0x9b05688c
mov dword [ebp - 0x1c], 0x510e527f
mov edx, 0xade682d1
mov dword [ebp - 0x14], 0x5f1d36f1
mov esi, 0xfe94f82b
mov dword [ebp - 0x18], 0xa54ff53a
mov eax, 0xf3bcc908
mov dword [ebp - 0x10], 0x3c6ef372
mov dword [ebp - 8], 0x84caa73b
mov dword [ebp - 0xc], 0xbb67ae85
mov dword [ebp - 4], 0x6a09e667
jmp 0x41505f
mov eax, 0xbefa4fa4
mov dword [ebp - 0x20], 0x68581511
mov esi, 0x47b5481d
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], esi
mov edi, 0x64f98fa7
mov ebx, 0xdb0c2e0d
mov dword [ebp - 0x24], 0x8eb44a87
mov edx, 0xffc00b31
mov dword [ebp - 0x1c], 0x67332667
mov dword [ebp - 0x14], 0xf70e5939
mov esi, 0x3070dd17
mov dword [ebp - 0x18], 0x152fecd8
mov eax, 0xc1059ed8
mov dword [ebp - 0x10], 0x9159015a
mov dword [ebp - 8], 0x367cd507
mov dword [ebp - 0xc], 0x629a292a
mov dword [ebp - 4], 0xcbbb9d5d
mov dword [ecx + 0x10], eax
mov eax, dword [ebp - 4]
mov dword [ecx + 0x14], eax
mov eax, dword [ebp - 8]
mov dword [ecx + 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ecx + 0x1c], eax
mov eax, dword [ebp - 0x28]
mov dword [ecx + 0x20], esi
mov esi, dword [ebp - 0x10]
mov dword [ecx + 0x24], esi
mov esi, dword [ebp - 0x14]
mov dword [ecx + 0x28], esi
mov esi, dword [ebp - 0x18]
mov dword [ecx + 0x2c], esi
mov esi, dword [ebp - 0x2c]
mov dword [ecx + 0x30], edx
mov edx, dword [ebp - 0x1c]
mov dword [ecx + 0x34], edx
mov edx, dword [ebp - 0x20]
mov dword [ecx + 0x38], edx
mov edx, dword [ebp - 0x24]
mov dword [ecx + 0x3c], edx
mov edx, dword [ebp - 0x30]
mov dword [ecx + 0x40], edi
mov dword [ecx + 0x44], ebx
mov dword [ecx + 0x48], eax
xor eax, eax
pop edi
mov dword [ecx + 0x4c], esi
pop esi
mov dword [ecx + 0xd0], edx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x429490
Capabilities:
Encode data using xor

Disassembly:
add ebx, dword [eax]
mov esi, 0xf8bf630b
mov byte [0xe36c830d], al
add ch, byte [ebp + 0x1d]
invalid
Function at 0x430130
Capabilities:
Encode data using xor

Disassembly:
dec eax
or byte cs:[edi], al
mov al, byte [0x983ccc24]
add eax, esp
add dh, byte [eax + 0x5c4fa40d]
add eax, edi
pop ss
or byte [edx - 0x5777dc18], ch
cmp al, 1
sbb byte [eax], al
pop esp
and al, 0xbc
dec eax
sub al, 0xb5
mov ah, 0x7a
invalid
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40a063
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x433030
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43301e
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x10011ac4
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10011ade
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x10011b29
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10011b0c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10011b29
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10018004
mov dword [eax], 1
jmp 0x10011b01
mov esp, ebp
pop ebp
ret

Function at 0x10012f1a
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10012f4f
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10012f4d
push 0
push 0x187c
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x10012f9a
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10012f7d
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10012f9a
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x18]
call fcn.10018004
mov dword [eax], 0xfffffffe
jmp 0x10012f72
mov esp, ebp
pop ebp
ret
Function at 0x1001b803
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1001b82e
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001b829
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
jmp 0x1001b96c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0
je 0x1001b8cf
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0x42af
jl 0x1001b886
mov dword [ebp - 0x10], 1
jmp 0x1001b88a
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp dword [ebp - 0x10], eax
jl 0x1001b8a5
mov dword [ebp - 0x18], 1
jmp 0x1001b8a9
and dword [ebp - 0x18], 0
cmp dword [ebp - 0x18], 0xce3051eb
jb 0x1001b8bb
mov dword [ebp - 0x1c], 1
jmp 0x1001b8bf
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
dec eax
jne 0x1001b8cf
xor eax, eax
jne 0x1001b8cf
mov eax, dword [ebp - 8]
cmp dword [eax], 0
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0xffff
jne 0x1001b8e3
mov dword [ebp - 0x20], 1
jmp 0x1001b8e7
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, dword [ebp - 0x20]
jne 0x1001b8fc
xor eax, eax
inc eax
jne 0x1001b8fc
and dword [ebp - 0x24], 0
jmp 0x1001b903
mov dword [ebp - 0x24], 1
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x24]
sub ecx, dword [eax]
imul eax, ecx, 0
mov ecx, dword [ebp - 8]
cmp eax, dword [ecx]
jne 0x1001b91e
mov dword [ebp - 0x28], 1
jmp 0x1001b922
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
add eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 8]
cmp eax, dword [ecx]
jg 0x1001b93a
mov dword [ebp - 0x2c], 1
jmp 0x1001b93e
and dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
cmp dword [ebp - 0x2c], eax
je 0x1001b951
mov dword [ebp - 0x14], 1
jmp 0x1001b955
and dword [ebp - 0x14], 0
push 0
mov ecx, dword [ebp - 0x48]
call fcn.10018004
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0x14]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret

Function at 0x1001cfff
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001d018
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
jmp 0x1001d038
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001d038
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov esp, ebp
pop ebp
ret
Function at 0x1001dd84
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001dddf
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001ddc0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1001dddd
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10018004
mov dword [eax], 0x6e32
jmp 0x1001ddb5
jmp 0x1001ddf8
push 0
push 0
push 0
push 0
push 0
push 0
push 0x11e7
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov esp, ebp
pop ebp
ret
Function at 0x1002ed95
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
and dword [ebp - 4], 0
push 0x90d
lea eax, [ebp + 8]
push eax
push 0x18fd
lea eax, [ebp - 0x10]
push eax
push 0x7a07
push 0
call fcn.1002ebe6
add esp, 0x18
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
cmp eax, 0x5a4d
je 0x1002edd4
xor eax, eax
jmp 0x1002ef26
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 8]
add ecx, dword [eax + 0x3c]
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
cmp dword [eax], 0x4550
je 0x1002edf2
xor eax, eax
jmp 0x1002ef26
lea eax, [ebp - 0xc]
push eax
push 1
lea eax, [ebp - 8]
push eax
call fcn.1002eb91
add esp, 0xc
cmp dword [ebp - 0xc], 0
jne 0x1002ee11
xor eax, eax
jmp 0x1002ef26
push dword [ebp - 0x10]
lea eax, [ebp - 0x24]
push eax
push 0x603f
push 0x30d9
push 0x38ab
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
push 0x1abd
push 1
call fcn.1002ea28
add esp, 0x28
push 0
push 0x64e9
push dword [ebp + 8]
push 0x78a3
push dword [ebp - 4]
push dword [ebp - 8]
call fcn.10026655
add esp, 0x18
lea eax, [ebp - 0xc]
push eax
push 0xcee
lea eax, [ebp - 8]
push eax
push 0x19b3
lea eax, [ebp - 0x14]
push eax
push 1
call fcn.1002ebe6
add esp, 0x18
cmp dword [ebp - 0x14], 0
je 0x1002eea0
push 1
push 0x2458
push 0x1ba2
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 4]
push eax
call fcn.1002ec52
add esp, 0x14
push dword [ebp - 4]
call fcn.1002e808
pop ecx
test eax, eax
jne 0x1002eeb1
xor eax, eax
jmp 0x1002ef26
push 1
lea eax, [ebp - 4]
push eax
call fcn.1002ecdd
pop ecx
pop ecx
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [eax + 0x28], 0
je 0x1002ef0e
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
add ecx, dword [eax + 0x28]
mov dword [ebp - 0x18], ecx
jne 0x1002eedd
xor eax, eax
jmp 0x1002ef26
push 0
push 1
push 0xdeadbeef
call dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0
jne 0x1002eef6
xor eax, eax
jmp 0x1002ef26
lea eax, [ebp - 4]
push eax
push 0xc1
push 0x634
push 1
call fcn.1002ed1e
add esp, 0x10
mov eax, dword [ebp - 4]
cmp dword [eax + 0x10], 0
je 0x1002ef1f
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
jmp 0x1002ef23
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x100442e8
Capabilities:
Compare security identifiers
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10044301
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x1004432b
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1004432b
push 0x3c1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov esp, ebp
pop ebp
ret

Function at 0x10045003
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10045033
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10045031
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x10045060
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
mov eax, dword [eax + 0x14]
sub eax, dword [ecx + 0xc]
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret

Function at 0x10045d41
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10045db1
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 0
mov eax, dword [ebp - 0x18]
push dword [eax]
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x20]
mov ecx, dword [ecx]
add ecx, dword [eax + 0xc]
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
add eax, ecx
push eax
mov ecx, dword [ebp - 0x28]
call fcn.1004b59f
jmp 0x10045dbc
push 0x73d
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esp, ebp
pop ebp
ret