joyce8/EMBER2024-capa huggingface dataset:
Function at 0x47beb4
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffac
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x54], ebx
mov dword [ebp - 8], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x47c09d
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 0xffffffff
jle 0x47c059
mov eax, dword [ebp - 4]
call fcn.0047d534
cmp ebx, eax
jge 0x47c059
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x118]
mov edx, ebx
call fcn.0047134c
mov edx, dword [0x47272c]
call fcn.004036b0
mov esi, eax
mov eax, esi
call fcn.00474268
test al, al
je 0x47c04f
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov eax, dword [esi + 0x50]
call fcn.004045d0
test eax, eax
jne 0x47c042
xor eax, eax
push ebp
push 0x47c03b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.0047c320
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
call fcn.0041b55c
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], edx
push dword [esi + 0x34]
push dword [esi + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
lea edx, [ebp - 0x46]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, 0x2e
mov esi, dword [eax]
call dword [esi + 0xc]
movzx eax, word [ebp - 0x2a]
movzx edx, word [ebp - 0x28]
add eax, edx
xor edx, edx
push edx
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov dl, 1
mov ecx, dword [eax]
call dword [ecx + 0x18]
movzx esi, word [ebp - 0x26]
mov eax, dword [ebp - 8]
mov edx, esi
call fcn.0040495c
mov eax, dword [ebp - 8]
call fcn.00404828
mov edx, eax
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
mov ecx, esi
mov esi, dword [eax]
call dword [esi + 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov al, byte [eax + 0x28]
mov byte [ebp - 9], al
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.0047c21c
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x158]
mov dl, byte [ebp - 9]
mov byte [eax + 0x28], dl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c087
push dword [ebp - 0x14]
push dword [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x130]
xor edx, edx
mov ecx, dword [eax]
call dword [ecx + 0x18]
mov eax, dword [ebp - 4]
mov edx, dword [eax]
call dword [edx + 0x3c]
test al, al
jne 0x47c03a
mov eax, dword [ebp - 4]
call fcn.0047c3a4
ret
mov eax, dword [ebp - 8]
mov edx, dword [esi + 0x50]
call fcn.00404348
jmp 0x47c087
mov eax, dword [ebp - 8]
call fcn.004042f4
jmp 0x47c087
mov dword [ebp - 0x50], ebx
mov byte [ebp - 0x4c], 0
lea eax, [ebp - 0x50]
push eax
push 0
lea edx, [ebp - 0x54]
mov eax, 0xb3
call fcn.0040903c
mov ecx, dword [ebp - 0x54]
mov dl, 1
mov eax, dword [0x4164f8]
call fcn.0040ca84
call fcn.00403c8c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x47c0a4
lea eax, [ebp - 0x54]
call fcn.004042f4
ret
Function at 0x48a994
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x48a99c
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x48ab8e
push dword fs:[eax]
mov dword fs:[eax], esp
mov esi, dword [ebx + 8]
lea ecx, [ebp - 0xc]
mov edx, 0x48aba4
mov eax, esi
call fcn.00488724
mov edx, dword [ebp - 0xc]
lea eax, [ebx + 0xc]
call fcn.00404348
lea ecx, [ebp - 0x10]
mov edx, 0x48abb8
mov eax, esi
call fcn.00488724
mov edx, dword [ebp - 0x10]
lea eax, [ebx + 0x28]
call fcn.00404348
lea ecx, [ebp - 0x14]
mov edx, 0x48abd0
mov eax, esi
call fcn.00488724
mov edx, dword [ebp - 0x14]
lea eax, [ebx + 0x10]
call fcn.00404348
lea ecx, [ebp - 0x18]
mov edx, 0x48abec
mov eax, esi
call fcn.00488724
mov edx, dword [ebp - 0x18]
lea eax, [ebx + 0x14]
call fcn.00404348
lea ecx, [ebp - 0x1c]
mov edx, 0x48ac08
mov eax, esi
call fcn.00488724
mov edx, dword [ebp - 0x1c]
lea eax, [ebx + 0x24]
call fcn.00404348
lea ecx, [ebp - 0x24]
mov edx, 0x48ac20
mov eax, esi
call fcn.00488724
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.004087e4
mov eax, dword [ebp - 0x20]
or edx, 0xffffffff
call fcn.00408d2c
mov edi, eax
mov dword [ebx + 0x18], edi
test edi, edi
setge al
mov byte [ebx + 0x4c], al
lea ecx, [ebp - 0x28]
mov edx, 0x48ac38
mov eax, esi
call fcn.00488724
mov eax, dword [ebp - 0x28]
call fcn.004877b0
fstp qword [ebx + 0x30]
wait
lea ecx, [ebp - 0x2c]
mov edx, 0x48ac48
mov eax, esi
call fcn.00488724
mov eax, dword [ebp - 0x2c]
call fcn.004877b0
fstp qword [ebx + 0x40]
wait
lea ecx, [ebp - 0x30]
mov edx, 0x48ac60
mov eax, esi
call fcn.00488724
mov eax, dword [ebp - 0x30]
or edx, 0xffffffff
call fcn.00408d2c
inc eax
je 0x48ab31
lea ecx, [ebp - 0x34]
mov edx, 0x48ac60
mov eax, esi
call fcn.00488724
mov eax, dword [ebp - 0x34]
call fcn.00408cf0
mov edi, eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov dword [ebp - 8], eax
mov eax, edi
mov ecx, 0xe10
cdq
idiv ecx
mov ecx, edx
mov eax, ecx
push ecx
mov ecx, 0x3c
cdq
idiv ecx
pop ecx
mov dword [ebp - 4], eax
mov eax, ecx
mov ecx, 0x3c
cdq
idiv ecx
mov edi, edx
push 0
mov ecx, edi
mov dx, word [ebp - 4]
mov ax, word [ebp - 8]
call fcn.0040a950
fstp qword [ebp - 0x3c]
wait
call fcn.0040acb4
fadd qword [ebp - 0x3c]
fstp qword [ebx + 0x38]
wait
jmp 0x48ab4c
lea ecx, [ebp - 0x40]
mov edx, 0x48ac60
mov eax, esi
call fcn.00488724
mov eax, dword [ebp - 0x40]
call fcn.004877b0
fstp qword [ebx + 0x38]
wait
lea ecx, [ebp - 0x44]
mov edx, 0x48ac70
mov eax, esi
call fcn.00488724
mov edx, dword [ebp - 0x44]
lea eax, [ebx + 0x48]
call fcn.00404348
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x48ab95
lea eax, [ebp - 0x44]
mov edx, 2
call fcn.00404318
lea eax, [ebp - 0x34]
mov edx, 0xb
call fcn.00404318
ret
Function at 0x4a0b90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe0
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a0cca
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00419a74
mov eax, dword [ebp - 4]
cmp byte [eax + 0x30], 2
jne 0x4a0c0c
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
test eax, eax
jle 0x4a0c0c
lea ecx, [ebp - 0x18]
xor edx, edx
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00408594
mov edx, dword [ebp - 0x14]
mov ebx, dword [0x4af934]
mov ebx, dword [ebx]
mov eax, 0x4a0ce0
call ebx
dec eax
jne 0x4a0c0c
mov ebx, 1
jmp 0x4a0c0e
xor ebx, ebx
mov eax, dword [ebp - 8]
mov edx, dword [eax]
call dword [edx + 0x14]
dec eax
sub eax, ebx
jl 0x4a0caf
inc eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], ebx
lea ecx, [ebp - 0x1c]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov ebx, dword [eax]
call dword [ebx + 0xc]
mov eax, dword [ebp - 0x1c]
call fcn.00492300
test al, al
jne 0x4a0ca3
mov eax, dword [ebp - 4]
call fcn.004a0b84
mov ebx, eax
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov esi, dword [eax]
call dword [esi + 0xc]
mov edx, dword [ebp - 0x20]
lea eax, [ebx + 0x1c]
call fcn.00404348
xor edx, edx
push ebp
push 0x4a0c91
push dword fs:[edx]
mov dword fs:[edx], esp
mov eax, dword [ebp - 4]
mov al, byte [eax + 0x30]
test al, al
je 0x4a0c87
mov edx, eax
mov ecx, ebx
mov eax, dword [ebp - 4]
call fcn.004a0fa4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a0ca3
inc dword [ebp - 0xc]
dec dword [ebp - 0x10]
jne 0x4a0c26
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a0cd1
lea eax, [ebp - 0x20]
mov edx, 4
call fcn.00404318
ret
Function at 0x4a54dc
Capabilities:
Create http request
Read data from internet
Receive data

Disassembly:
push ebp
mov ebp, esp
push eax
mov eax, 8
add esp, 0xfffff004
push eax
dec eax
jne 0x4a54e5
mov eax, dword [ebp - 4]
add esp, 0xffffffec
push ebx
push esi
push edi
mov esi, ecx
mov ebx, edx
mov edi, eax
push 0
push 0
push 0
push 0
push 0x4a563c
call fcn.0042d32c
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4a5633
xor eax, eax
push ebp
push 0x4a5620
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0
push 0
push 0
mov eax, edi
call fcn.004047d0
push eax
mov eax, dword [ebp - 8]
push eax
call fcn.0042d334
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4a5616
xor ecx, ecx
mov dl, 1
mov eax, dword [0x417114]
call fcn.0041bdec
mov dword [ebp - 0x14], eax
xor eax, eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x10], 0x8000
test bl, bl
je 0x4a55a1
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x8018]
push eax
push 0x16
mov eax, dword [ebp - 4]
push eax
call fcn.0042d31c
test eax, eax
je 0x4a55a1
lea edx, [ebp - 0x8018]
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 0x10]
xor eax, eax
push ebp
push 0x4a55fb
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x4a55c2
lea edx, [ebp - 0x8018]
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x14]
mov ebx, dword [eax]
call dword [ebx + 0x10]
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 0x10]
push eax
lea eax, [ebp - 0x8018]
push eax
mov eax, dword [ebp - 4]
push eax
call fcn.0042d33c
test eax, eax
je 0x4a55e4
cmp dword [ebp - 0xc], 0
ja 0x4a55b1
mov eax, esi
mov edx, dword [ebp - 0x14]
mov edx, dword [edx + 4]
call fcn.00404348
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a5605
mov eax, dword [ebp - 0x14]
call fcn.00403500
mov eax, dword [ebp - 4]
push eax
call fcn.0042d324
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4a562a
mov eax, dword [ebp - 8]
push eax
call fcn.0042d324
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4a6d0c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x10c], ecx
mov dword [ebp - 8], ecx
mov edi, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004047c0
xor eax, eax
push ebp
push 0x4a6dc3
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 8]
call fcn.004042f4
mov eax, dword [ebp - 4]
call fcn.004047d0
push eax
lea eax, [ebp - 0x108]
push eax
call fcn.00406b00
mov eax, dword [ebp - 4]
call fcn.004045d0
mov esi, eax
dec esi
test esi, esi
jl 0x4a6d93
inc esi
lea ebx, [ebp - 0x108]
lea eax, [ebp - 0x10c]
mov dl, byte [ebx]
xor dl, 0xa
call fcn.004044dc
mov edx, dword [ebp - 0x10c]
lea eax, [ebp - 8]
call fcn.004045d8
inc ebx
dec esi
jne 0x4a6d71
mov eax, edi
mov edx, dword [ebp - 8]
call fcn.00404348
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a6dca
lea eax, [ebp - 0x10c]
call fcn.004042f4
lea eax, [ebp - 8]
mov edx, 2
call fcn.00404318
ret
Function at 0x4a78bc
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor eax, eax
push ebp
push 0x4a7990
push dword fs:[eax]
mov dword fs:[eax], esp
xor ebx, ebx
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x20
call fcn.004068c8
push eax
call fcn.004067a8
test eax, eax
je 0x4a793a
mov dword [ebp - 0x1c], 1
lea eax, [ebp - 0x18]
push eax
push 0x4a79a0
push 0
call fcn.004067a0
mov dword [ebp - 0x10], 2
xor eax, eax
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
push 0
push 0x10
lea eax, [ebp - 0x1c]
push eax
push 0
mov eax, dword [ebp - 8]
push eax
call fcn.00406798
call fcn.00406928
test eax, eax
sete bl
mov eax, dword [ebp - 8]
push eax
call fcn.004067e0
test bl, bl
je 0x4a7982
push 0
push 0x4a79b4
call fcn.00406eb0
test eax, eax
jle 0x4a7960
lea edx, [ebp - 4]
push edx
push eax
call fcn.00407040
mov eax, dword [ebp - 4]
call fcn.004a788c
push 0
push 0x4a79c4
call fcn.00406eb0
test eax, eax
jle 0x4a7982
lea edx, [ebp - 4]
push edx
push eax
call fcn.00407040
mov eax, dword [ebp - 4]
call fcn.004a788c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a7997
ret

Function at 0x4da406
Capabilities:
Hash data using murmur3

Disassembly:
xchg dword [esp], ecx
pop ecx
push eax
mov edx, eax
call fcn.004e0b5f
jmp 0x4e10fc
jmp loc.004c0a87
Function at 0x41ebd8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41ec17
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41ec17
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41ec17
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41ec17
cmp dword [ecx + 0x74], 0xe
jbe 0x41ec17
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x42637b
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x426418
push ebx
push esi
call fcn.00426344
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.004262d8
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x4263c5
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x426417
push edi
push eax
call fcn.00424e10
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x4263e5
call fcn.00424e5e
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x426416
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.004262d8
add esp, 0x20
test eax, eax
jne 0x426404
push edi
call fcn.00424e5e
jmp 0x42640c
push ebx
call fcn.00424e5e
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x427627
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42f9a0
push 0x42f998
push str.FlsAlloc
push 0x1f
call fcn.004274e6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42765b
push dword [ebp + 8]
mov ecx, esi
call dword [0x42d144]
call esi
jmp 0x427661
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4276a5
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42f9b0
push 0x42f9a8
push str.FlsGetValue
push 0x21
call fcn.004274e6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4276dc
push dword [ebp + 8]
mov ecx, esi
call dword [0x42d144]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4276e4
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x42f9b8
push 0x42f9b0
push str.FlsSetValue
push 0x22
call fcn.004274e6
mov esi, eax
add esp, 0x10
test esi, esi
je 0x42771e
push dword [ebp + 0xc]
mov ecx, esi
push dword [ebp + 8]
call dword [0x42d144]
call esi
pop esi
pop ebp
ret 8
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsSetValue]
Function at 0x42c9f0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x42ca1d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x42ca1d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10004469
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10004488
xor eax, eax
jmp 0x10004503
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000449e
xor eax, eax
jmp 0x10004503
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x100044e6
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jae 0x100044e6
mov eax, dword [ebp - 4]
movzx eax, word [eax]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax*2 + 2]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
jmp 0x100044bf
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jb 0x100044f2
xor eax, eax
jmp 0x10004503
mov eax, dword [ebp - 4]
movzx eax, word [eax]
test eax, eax
jne 0x10004500
xor eax, eax
jmp 0x10004503
mov eax, dword [ebp - 4]
leave
ret

Function at 0x10009d77
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x10009d80
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
shl eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
and dword [eax], 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
mov eax, dword [ebp - 0x10]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10009dbd
mov eax, dword [ebp - 0xc]
jmp 0x10009e13
cmp dword [ebp - 4], 1
je 0x10009dce
cmp dword [ebp - 4], 2
je 0x10009dce
push 0xd
pop eax
jmp 0x10009e13
cmp dword [ebp + 0xc], 0
je 0x10009e07
cmp dword [ebp - 8], 0
je 0x10009e00
mov eax, dword [ebp - 8]
xor edx, edx
push 2
pop ecx
div ecx
test edx, edx
jne 0x10009df9
mov eax, dword [ebp - 8]
shr eax, 1
mov ecx, dword [ebp + 0xc]
movzx eax, word [ecx + eax*2 - 2]
test eax, eax
je 0x10009dfe
push 0xd
pop eax
jmp 0x10009e13
jmp 0x10009e07
mov eax, dword [ebp + 0xc]
and word [eax], 0
mov eax, dword [ebp - 8]
shr eax, 1
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
leave
ret 0xc
Function at 0x10009e3e
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x100df3e0]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x228], ecx
lea ecx, [ebp - 0x10]
call fcn.10009c1c
push 0x2001f
push dword [ebp + 8]
mov eax, dword [ebp - 0x228]
push dword [eax]
lea ecx, [ebp - 0x10]
call fcn.10009b99
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10009e9c
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x21c], eax
lea ecx, [ebp - 0x10]
call fcn.10009c0b
mov eax, dword [ebp - 0x21c]
jmp 0x10009f2b
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x10009f01
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x10]
call fcn.10009e3e
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10009ef8
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x220], eax
lea ecx, [ebp - 0x10]
call fcn.10009c0b
mov eax, dword [ebp - 0x220]
jmp 0x10009f2b
mov dword [ebp - 4], 0x100
jmp 0x10009ea3
lea ecx, [ebp - 0x10]
call fcn.10009bde
push dword [ebp + 8]
mov ecx, dword [ebp - 0x228]
call fcn.10009cdd
mov dword [ebp - 0x224], eax
lea ecx, [ebp - 0x10]
call fcn.10009c0b
mov eax, dword [ebp - 0x224]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1006e071
leave
ret 4
Function at 0x1000f812
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x100df3e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], ecx
mov eax, dword [ebp - 0x218]
and dword [eax], 0
mov eax, dword [ebp - 0x218]
and dword [eax + 4], 0
mov eax, dword [ebp - 0x218]
and dword [eax + 8], 0
mov eax, dword [ebp - 0x218]
and dword [eax + 0xc], 0
mov eax, dword [ebp - 0x218]
and dword [eax + 0x10], 0
and word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.10070d10
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push 0x100c98f0
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x1000f8c9
jmp 0x1000f93d
mov eax, dword [ebp - 0x218]
mov dword [eax], 1
push str.OpenThemeData
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x218]
mov dword [ecx + 4], eax
push str.CloseThemeData
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x218]
mov dword [ecx + 8], eax
push str.DrawThemeBackground
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x218]
mov dword [ecx + 0xc], eax
push str.SetWindowTheme
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x218]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006e071
leave
ret

Function at 0x1001380a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.1002067f
test eax, eax
je 0x1001386f
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jl 0x10013865
cmp dword [ebp + 8], 0x1b
jne 0x1001384b
push 0
push 2
push 0x111
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.10020789
jmp 0x10013865
cmp dword [ebp + 8], 0xd
jne 0x10013865
push 0
push 1
push 0x111
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.10020789
push 0
mov ecx, dword [ebp - 4]
call fcn.10013919
leave
ret 0xc
Function at 0x10029123
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
call fcn.1000f9ee
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10029154
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10029154
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ShowWindow]
leave
ret

Function at 0x10032597
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
and dword [ebp - 0xc], 0
and dword [ebp - 4], 0
and dword [ebp - 8], 0
mov eax, dword [ebp - 0x34]
cmp dword [eax + 0x334], 0
je 0x100325c8
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [ebp - 0x34]
and dword [eax + 0x334], 0
mov eax, dword [ebp - 0x34]
cmp dword [eax + 0x324], 0
je 0x100326a6
mov eax, dword [ebp - 0x34]
push dword [eax + 0x324]
call fcn.1000f6df
pop ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1003269c
push 2
push 0
push dword [ebp - 8]
mov ecx, dword [ebp - 0x34]
call fcn.1003199a
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
mov eax, dword [eax + 0x324]
cmp eax, dword [ecx + 0x320]
jne 0x1003269c
mov eax, dword [ebp + 0xc]
and eax, 0xffff
movzx eax, ax
mov ecx, dword [ebp + 0x10]
and ecx, 0xffff
movzx ecx, cx
shl ecx, 0x10
or eax, ecx
push eax
push dword [ebp + 8]
push 0x202
mov ecx, dword [ebp - 8]
call fcn.1000f765
mov ecx, dword [ebp - 8]
call fcn.10025198
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1003267e
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
test eax, eax
je 0x1003267e
push 1
push 0
push 0
push dword [ebp - 0x10]
push 0x100ca68c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x14], eax
jmp 0x1003269c
mov ecx, dword [ebp - 8]
call fcn.10009602
test eax, eax
je 0x1003269c
mov dword [ebp - 0xc], 1
mov ecx, dword [ebp - 8]
call fcn.10009602
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x34]
and dword [eax + 0x324], 0
cmp dword [ebp - 0xc], 0
je 0x10032707
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x34]
add ecx, 4
call fcn.100346ff
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
call dword [eax + 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x24]
push 0x4e
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x34]
add ecx, 4
call fcn.10034774
mov ecx, eax
call fcn.10012148
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x2c], eax
leave
ret 0xc