joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4410a0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x24]
cmp dword [eax + 0x28], 0
jne 0x4410c7
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov ecx, dword [ebp - 0x24]
mov dword [ecx + 0x28], eax
mov edx, dword [ebp + 0xc]
push edx
movzx eax, word [ebp + 8]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x4410ee
mov eax, dword [ebp - 0x20]
jmp 0x4411de
mov eax, dword [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x24]
mov edx, dword [ecx + 0x28]
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x441110
mov eax, dword [ebp - 0x20]
jmp 0x4411de
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jne 0x441135
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0x20]
jmp 0x4411de
mov edx, dword [ebp - 0x18]
push edx
mov eax, dword [ebp - 0x24]
mov ecx, dword [eax + 0x28]
push ecx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xc], eax
mov edx, dword [ebp - 0xc]
push edx
push 2
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x441162
jmp 0x4411d1
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
mov eax, dword [ebp - 8]
push eax
call fcn.004194b0
add esp, 0xc
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [ebp - 4], 0
lea edx, [ebp - 4]
push edx
push 1
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x4411c7
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.0040c820
add esp, 8
mov dword [ebp - 0x20], eax
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [eax + 8]
call edx
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp - 0x20]
mov esp, ebp
pop ebp
ret 8
Function at 0x442550
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x446dfc
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x459080]
xor eax, ebp
mov dword [ebp - 0x3c], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x6c], ecx
push 0
push 0
push 0
push str.DISPLAY
call dword [sym.imp.GDI32.dll_CreateDCW]
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x20], eax
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x20]
push edx
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.GDI32.dll_SelectObject]
mov dword [ebp - 0x1c], eax
push 0xcc0020
push 0
push 0
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
mov edx, dword [ebp - 0x20]
push edx
push 0
push 0
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.GDI32.dll_BitBlt]
push 0
mov ecx, dword [ebp - 0x10]
push ecx
lea ecx, [ebp - 0x38]
call fcn.0040cb00
mov dword [ebp - 4], 0
lea edx, [ebp - 0x28]
push edx
mov ecx, 0x44e944
call fcn.004056c0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 0xc]
push eax
lea ecx, [ebp - 0x28]
call fcn.0040cdc0
lea ecx, [ebp - 0x4c]
push ecx
lea eax, [ebp - 0x28]
call fcn.00405900
push eax
mov ecx, dword [ebp - 0x6c]
call sym.Install_time.exe_public:_int___thiscall_CNsImage::GetEncoderClsid_wchar_t_const___struct__GUID__
push 0
lea edx, [ebp - 0x4c]
push edx
mov eax, dword [ebp + 8]
push eax
lea ecx, [ebp - 0x38]
call fcn.0040c910
cmp dword [ebp - 0x18], 0
je 0x442673
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.GDI32.dll_DeleteDC]
cmp dword [ebp - 0x10], 0
je 0x442683
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.GDI32.dll_DeleteObject]
cmp dword [ebp - 0x14], 0
je 0x442693
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
mov byte [ebp - 0x4d], 1
mov byte [ebp - 4], 0
lea eax, [ebp - 0x28]
call fcn.004058e0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.0040ca80
mov al, byte [ebp - 0x4d]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x3c]
xor ecx, ebp
call fcn.00417bfa
mov esp, ebp
pop ebp
ret 8
Function at 0x4436c0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x14], 0
mov ecx, dword [ebp + 8]
push ecx
mov ecx, dword [ebp - 0x10]
call sym.Install_time.exe_public:_bool___thiscall_CNsImage::isStop_int_
movzx edx, al
test edx, edx
jne 0x4436e5
jmp 0x443750
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 0x10]
call sym.Install_time.exe_public:_int___thiscall_CNsImage::GetMovieIndex_int_
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x4436fc
jmp 0x443750
mov ecx, dword [ebp - 4]
push ecx
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.0040d1e0
mov dword [eax + 0x3c], 0
mov edx, dword [ebp - 4]
push edx
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.0040d1e0
mov dword [ebp - 8], eax
push 0
push 0
mov eax, dword [ebp - 8]
push eax
push sym.Install_time.exe_private:_static_unsigned_int___stdcall_CNsImage::MovieThread_void__
push 0
push 0
call fcn.00424324
add esp, 0x18
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x443750
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret 4

Function at 0x443780
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x41c
mov eax, dword [0x459080]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x41c], ecx
xor eax, eax
mov word [ebp - 0x418], ax
push 0x206
push 0
lea ecx, [ebp - 0x416]
push ecx
call fcn.00418aa0
add esp, 0xc
xor edx, edx
mov word [ebp - 0x210], dx
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.00418aa0
add esp, 0xc
push 0
push 0x14
lea ecx, [ebp - 0x210]
push ecx
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
push 0x44e9b8
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpW]
test eax, eax
jne 0x443872
lea eax, [ebp - 0x210]
push eax
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.msyh.ttf
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x44383d
mov eax, 1
jmp 0x443874
lea ecx, [ebp - 0x210]
push ecx
lea edx, [ebp - 0x418]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push str.msyh.ttc
lea eax, [ebp - 0x418]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcatW]
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
jmp 0x443874
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00417bfa
mov esp, ebp
pop ebp
ret 4
Function at 0x444820
Capabilities:
Create process memory minidump

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4472d3
mov eax, dword fs:[0]
push eax
sub esp, 0x62c
mov eax, dword [0x459080]
xor eax, ebp
mov dword [ebp - 0x18], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
movzx eax, byte [0x45cd64]
test eax, eax
je 0x444860
or eax, 0xffffffff
jmp 0x444a2e
mov byte [0x45cd64], 1
push 0x44d3d8
mov eax, dword [0x45c50c]
add eax, 8
call fcn.00405900
push eax
push str.http:__api.hofosoft.com_api.ashx
call sym.Install_time.exe_void___cdecl_DoReport_wchar_t_const___wchar_t_const___wchar_t_const__
add esp, 0xc
xor ecx, ecx
mov word [ebp - 0x224], cx
push 0x206
push 0
lea edx, [ebp - 0x222]
push edx
call fcn.00418aa0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x224]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea esi, [ebp - 0x14]
call fcn.00405680
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea ecx, [ebp - 0x224]
push ecx
push str._s__d.dmp
lea edi, [ebp - 0x14]
call fcn.00405e60
add esp, 0xc
mov byte [ebp - 0x605], 0
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0x228], eax
mov edx, dword [ebp - 0x228]
push edx
push 0
push 0x1f0fff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0xffffffff
je 0x4449ae
push 0
push 0
push 2
push 0
push 0
push 0x1f01ff
lea eax, [ebp - 0x14]
call fcn.00405900
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x60c], eax
cmp dword [ebp - 0x60c], 0xffffffff
je 0x4449a4
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov dword [ebp - 0x618], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x614], eax
mov dword [ebp - 0x610], 1
push 0
push 0
lea ecx, [ebp - 0x618]
push ecx
push 0
mov edx, dword [ebp - 0x60c]
push edx
mov eax, dword [ebp - 0x228]
push eax
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.dbghelp.dll_MiniDumpWriteDump]
test eax, eax
je 0x444997
mov byte [ebp - 0x605], 1
mov edx, dword [ebp - 0x60c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x604]
push ecx
call fcn.00409170
mov byte [ebp - 4], 1
mov dword [ebp - 0x234], 0xea9d
push 9
push 8
push 0xc8
push 0x12c
push 5
push 0
call fcn.00401000
mov esi, eax
add esi, 0x212
call fcn.00401000
mov edx, dword [eax + 4]
push edx
mov edi, esi
xor edx, edx
lea eax, [ebp - 0x604]
call fcn.00409ad0
mov dword [ebp - 0x61c], 1
mov byte [ebp - 4], 0
lea eax, [ebp - 0x604]
push eax
call fcn.004092f0
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x14]
call fcn.004058e0
mov eax, dword [ebp - 0x61c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.00417bfa
mov esp, ebp
pop ebp
ret 4
Function at 0x444bc0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 8], 0
je 0x444be1
cmp dword [ebp + 0xc], 0
je 0x444be1
mov eax, dword [ebp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x1e
jl 0x444be6
jmp 0x444c84
push 0x294
call fcn.00418306
add esp, 4
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
push 0x294
push 0
mov edx, dword [ebp - 4]
push edx
call fcn.00418aa0
add esp, 0xc
mov eax, dword [ebp + 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 4]
add eax, 0x190
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
cmp dword [ebp + 0x10], 0
je 0x444c58
mov ecx, dword [ebp + 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
cmp eax, 0x64
jge 0x444c58
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 4]
add eax, 0x1cc
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea ecx, [ebp - 0xc]
push ecx
push 0
mov edx, dword [ebp - 4]
push edx
push 0x444ac0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x444c84
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x11032
Capabilities:
Complete processing asynchronous io request

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
xor dl, dl
mov dword [ecx + 0x18], esi
mov dword [ecx + 0x1c], eax
call dword [sym.imp.ntoskrnl.exe_IofCompleteRequest]
mov eax, esi
pop esi
pop ebp
ret 0xc

Function at 0x110c6
Capabilities:
Create device object

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x98
mov eax, dword [0x61278]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, 0x87c50
push edi
push 0x2e
call fcn.000141ac
mov esi, dword [sym.imp.ntoskrnl.exe_swprintf]
push eax
lea eax, [ebp - 0x84]
push eax
call esi
add esp, 0xc
push edi
push 0x2f
call fcn.000141ac
push eax
lea eax, [ebp - 0x44]
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x90]
push eax
call dword [0x61348]
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x98]
push eax
call dword [0x61348]
lea eax, [ebp - 0x88]
push eax
push 0
push 0x100
push 0x22
lea eax, [ebp - 0x90]
push eax
push 0
push ebx
call dword [sym.imp.ntoskrnl.exe_IoCreateDevice]
test eax, eax
jl 0x111a4
mov eax, dword [ebp - 0x88]
mov dword [0x61280], eax
or dword [eax + 0x1c], 0x10
mov eax, dword [ebp - 0x88]
mov dword [eax + 0x5c], 1
lea eax, [ebp - 0x90]
push eax
lea eax, [ebp - 0x98]
push eax
call dword [sym.imp.ntoskrnl.exe_IoCreateSymbolicLink]
mov esi, eax
test esi, esi
jge 0x111a2
push dword [ebp - 0x88]
call dword [sym.imp.ntoskrnl.exe_IoDeleteDevice]
mov eax, esi
jmp 0x111a4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0001512b
leave
ret 4

Function at 0x113e4
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0x3c]
mov eax, dword [eax + esi + 0x78]
and dword [ebp + 8], 0
add eax, esi
mov ebx, dword [eax + 0x1c]
mov ecx, dword [eax + 0x24]
push edi
mov edi, dword [eax + 0x20]
mov eax, dword [eax + 0x18]
add ecx, esi
add edi, esi
add ebx, esi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test eax, eax
jbe 0x11438
mov eax, dword [ebp + 8]
mov eax, dword [edi + eax*4]
add eax, esi
push eax
call fcn.000113bc
cmp eax, dword [ebp + 0xc]
je 0x11441
inc dword [ebp + 8]
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
jb 0x1141a
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 8]
movzx eax, word [eax + ecx*2]
mov eax, dword [ebx + eax*4]
add eax, esi
jmp 0x1143a
Function at 0x136fe
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
xor edx, edx
cmp dword [ebp + 8], edx
je 0x1378f
cmp dword [ebp + 0xc], 1
jl 0x1378f
cmp dword [ebp + 0xc], edx
mov eax, dword [ebp + 0x10]
mov cl, byte [eax + 0x100]
mov byte [ebp + 0x13], cl
mov cl, byte [eax + 0x101]
mov byte [ebp - 1], cl
jle 0x13778
push ebx
push esi
push edi
inc byte [ebp + 0x13]
movzx ecx, byte [ebp + 0x13]
mov bl, byte [ebp - 1]
lea esi, [ecx + eax]
add bl, byte [esi]
mov cl, byte [esi]
movzx edi, bl
add edi, eax
mov byte [ebp - 1], bl
mov bl, byte [edi]
mov byte [esi], bl
mov byte [edi], cl
movzx esi, byte [esi]
mov edi, dword [ebp + 8]
mov byte [0x612b4], cl
movzx ecx, cl
add esi, ecx
and esi, 0xff
mov cl, byte [esi + eax]
add edi, edx
xor byte [edi], cl
inc edx
cmp edx, dword [ebp + 0xc]
jl 0x13732
pop edi
pop esi
pop ebx
mov cl, byte [ebp + 0x13]
mov byte [eax + 0x100], cl
mov cl, byte [ebp - 1]
mov byte [eax + 0x101], cl
xor eax, eax
inc eax
jmp 0x13791
xor eax, eax
leave
ret 0xc

Function at 0x89006
Capabilities:
Register minifilter driver
Start minifilter driver

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push esi
push edi
push 0x54
push 0
mov esi, 0x62120
push esi
call sub.ntoskrnl.exe_memset
mov edi, dword [sym.imp.ntoskrnl.exe_RtlInitUnicodeString]
add esp, 0xc
push 0x89182
lea eax, [ebp - 0xc]
push eax
call edi
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.ntoskrnl.exe_MmGetSystemRoutineAddress]
mov dword [0x62124], eax
test eax, eax
jne 0x89050
mov dword [0x62124], 0x885b6
push esi
push 0x61188
push dword [ebp + 8]
call sub.FLTMGR.SYS_FltRegisterFilter
test eax, eax
jl 0x8911c
push 0x1f0001
lea eax, [ebp - 4]
push eax
call sub.FLTMGR.SYS_FltBuildDefaultSecurityDescriptor
mov esi, eax
test esi, esi
jl 0x890ed
push 0x89170
lea eax, [ebp - 0x14]
push eax
call edi
and dword [ebp - 0x28], 0
and dword [ebp - 0x18], 0
push 1
push 0x88664
push 0x8864c
lea eax, [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
push 0x88634
push 0
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x2c]
push eax
push 0x62128
push dword [0x62120]
mov dword [ebp - 0x2c], 0x18
mov dword [ebp - 0x20], 0x240
call sub.FLTMGR.SYS_FltCreateCommunicationPort
push dword [ebp - 4]
mov esi, eax
call sub.FLTMGR.SYS_FltFreeSecurityDescriptor
test esi, esi
jl 0x890ed
push dword [0x62120]
call sub.FLTMGR.SYS_FltStartFiltering
mov esi, eax
test esi, esi
jge 0x8910b
mov eax, dword [0x62128]
test eax, eax
je 0x890fc
push eax
call sub.FLTMGR.SYS_FltCloseCommunicationPort
mov eax, dword [0x62120]
test eax, eax
je 0x8910b
push eax
call sub.FLTMGR.SYS_FltUnregisterFilter
call fcn.000149a0
call fcn.0001473c
call fcn.000145a8
mov eax, esi
pop edi
pop esi
leave
ret 8

Function at 0x89160
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
call fcn.00089127
pop ebp
jmp fcn.000120a2
Function at 0x401020
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
lea eax, [ebp - 0x10]
mov dword [ebp - 0x58], 0x44
push eax
lea eax, [ebp - 0x58]
mov dword [ebp - 0x54], 0
push eax
push 0
push 0
push 0x200
push 0
push 0
push 0
push 0x404450
push 0
mov dword [ebp - 0x50], 0x403188
mov dword [ebp - 0x4c], 0
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x28], 5
mov dword [ebp - 0x24], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x401097
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret
xor al, al
mov esp, ebp
pop ebp
ret
Function at 0x4016d0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x234
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 2
mov dword [ebp - 0x234], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x230], 0x22c
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x401725
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401896
mov esp, ebp
pop ebp
ret
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Process32NextW]
lea eax, [ebp - 0x230]
push eax
push esi
mov dword [ebp - 0x230], 0x22c
call edi
test eax, eax
je 0x40178a
push ebx
mov ebx, dword [sym.imp.MSVCR120.dll_wcsstr]
jmp 0x401750
lea eax, [ebp - 0x20c]
push str.FTPTool.exe
push eax
call ebx
add esp, 8
test eax, eax
jne 0x40177f
lea eax, [ebp - 0x230]
mov dword [ebp - 0x230], 0x22c
push eax
push esi
call edi
test eax, eax
jne 0x401750
jmp 0x401789
mov dword [ebp - 0x234], 1
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x234]
xor ecx, ebp
pop edi
pop esi
call fcn.00401896
mov esp, ebp
pop ebp
ret
Function at 0x4dd1134b
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov edi, edi
push ebx
push esi
mov esi, ecx
xor ebx, ebx
mov dword [esi + 0x20], ebx
call fcn.4dd11340
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp eax, ebx
mov dword [esi + 0x14], eax
mov dword [esi + 0x1c], ebx
jne 0x4dd1139b
push esi
mov dword [esi], 1
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov byte [esi + 0x10], bl
mov byte [esi + 0x11], bl
mov byte [esi + 0x12], bl
call fcn.4dd11340
push dword [eax + 0x10]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esi + 0x14], esi
pop esi
pop ebx
ret
inc dword [eax]
jmp 0x4dd11398
Function at 0x4dd166cc
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb4
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
cmp ebx, edi
mov esi, ecx
mov eax, 0x40ec6
jl 0x4dd1e5c8
cmp ebx, eax
je 0x4dd1efe3
push dword [ebp + 0x1c]
mov ecx, esi
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.4dd165e3
mov ebx, eax
cmp ebx, edi
jl 0x4dd16727
cmp dword [ebp + 0xc], edi
je 0x4dd1d3ab
mov word [esi + 0x1be], di
mov word [esi + 0x1bc], di
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 0x18
cmp byte [ebp + 0x10], 0
jne 0x4dd1efa0
cmp word [esi + 0x1bc], di
jne 0x4dd3d9b8
cmp word [esi + 0x1bc], di
jne 0x4dd3d9ab
cmp byte [ebp + 0x10], 0
mov ecx, esi
jne 0x4dd1efac
call fcn.4dd14b0f
jmp 0x4dd16727
cmp ebx, eax
jne 0x4dd2b71c
lea ecx, [esi + 0x30]
call fcn.4dd13559
test eax, eax
jne 0x4dd3d8f7
cmp ebx, 0x80040e1e
je 0x4dd2b72d
cmp ebx, 0x80040e12
je 0x4dd2b72d
cmp ebx, edi
jge 0x4dd166f6
jmp 0x4dd16727
cmp word [esi + 0x1be], di
jmp 0x4dd1d3bc
call fcn.4dd164d6
jmp 0x4dd16727
cmp dword [esi + 0x208], edi
je 0x4dd166f6
jmp 0x4dd1e5c8
cmp ebx, 0x80040e1e
je 0x4dd1e5d0
jmp 0x4dd1e5ec
push edi
push edi
mov dword [ebp + 0xc], edi
call dword [sym.imp.OLEAUT32.dll_CreateErrorInfo]
jmp 0x4dd166f6
push edi
push 0x11
push esi
lea ecx, [ebp - 0xb4]
call fcn.4dd44eed
mov di, word [esi + 0x1bc]
mov bx, word [esi + 0x1be]
and dword [ebp - 4], 0
and dword [ebp - 0xc], 0
xor eax, eax
inc eax
push eax
mov dword [ebp - 8], eax
lea ecx, [ebp - 4]
lea eax, [ebp - 8]
mov dword [ebp - 0x8c], ecx
push eax
lea ecx, [ebp - 0xb4]
mov word [ebp - 0x94], 0x400b
call fcn.4dd731f0
lea eax, [ebp - 0xb4]
push eax
lea eax, [ebp - 0xc]
push eax
lea ecx, [esi + 0x30]
call fcn.4dd60a15
test eax, eax
jl 0x4dd3d97e
cmp word [ebp - 4], 0
je 0x4dd3d97e
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x4dd3d96c
mov byte [eax], 1
lea ecx, [ebp - 0xb4]
call fcn.4dd45059
xor eax, eax
jmp 0x4dd16729
mov eax, dword [ebp + 0x14]
test eax, eax
mov word [esi + 0x1bc], di
mov word [esi + 0x1be], bx
je 0x4dd3d996
mov byte [eax], 0
lea ecx, [ebp - 0xb4]
call fcn.4dd45059
mov ebx, dword [ebp + 8]
xor edi, edi
jmp 0x4dd1e5e0
cmp word [esi + 0x1be], di
je 0x4dd1d3cf
call fcn.4dd11340
push dword [eax + 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call esi
test eax, eax
je 0x4dd3d9fb
call fcn.4dd11340
push dword [eax + 0x10]
call esi
cmp dword [eax + 4], edi
je 0x4dd3d9fb
call fcn.4dd11340
push dword [eax + 0x10]
call esi
mov eax, dword [eax + 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
call fcn.4dd11340
push dword [eax + 0x10]
call esi
mov dword [eax + 4], edi
mov eax, 0x800a0bcd
jmp 0x4dd16729
Function at 0x4dd2ae61
Capabilities:
Check if file exists

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push 4
push dword [ebp + 8]
xor ebx, ebx
lea ecx, [ebp - 0x10]
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
call fcn.4dd1167d
push ebx
lea ecx, [ebp - 0x10]
call fcn.4dd11757
test eax, eax
je 0x4dd41894
push edi
push ebx
push dword [ebp + 8]
call dword [sym.imp.msvcrt.dll__waccess]
mov edi, dword [ebp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_GetLastError]
pop ecx
pop ecx
mov dword [edi], eax
call esi
cmp eax, 0x78
je 0x4dd418b6
cmp eax, 6
je 0x4dd418b6
cmp eax, 2
jne 0x4dd4189e
mov esi, dword [ebp - 4]
pop edi
lea ecx, [ebp - 0x10]
call fcn.4dd11434
mov eax, esi
pop esi
pop ebx
leave
ret 8
mov esi, 0x80030103
jmp 0x4dd2aeca
cmp eax, ebx
jg 0x4dd418aa
mov dword [ebp - 4], eax
jmp 0x4dd2aec6
and eax, 0xffff
or eax, 0x80070000
jmp 0x4dd418a2
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 0x10]
call fcn.4dd74f17
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x4dd2aec6
cmp dword [ebp - 8], ebx
je 0x4dd2aec6
push ebx
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll__access]
pop ecx
pop ecx
mov dword [edi], eax
call esi
cmp eax, 2
je 0x4dd418fc
cmp eax, ebx
jle 0x4dd418f9
and eax, 0xffff
or eax, 0x80070000
mov dword [ebp - 4], eax
push dword [ebp - 8]
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
jmp 0x4dd2aec6