joyce8/EMBER2024-capa huggingface dataset:
Function at 0x429ce0
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x429dd9
sub esp, 0x14
mov eax, dword [esp + 0x18]
movzx ecx, byte [eax + 6]
cmp cl, 1
je 0x429d64
cmp cl, 2
je 0x429d1d
cmp cl, 3
jne 0x429dc2
mov byte [eax + 8], 1
jmp 0x429dbe
mov ecx, dword [eax + 8]
mov dword [esp], ecx
mov ecx, dword [esp + 0x20]
mov dword [esp + 4], ecx
call fcn.0042efe0
lea eax, [0x6fbf3c]
mov dword [esp], eax
call fcn.0040a480
lea eax, [0x6fbeec]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00418220
lea eax, [0x6fbf3c]
mov dword [esp], eax
call fcn.0040a680
jmp 0x429dbe
mov ecx, dword [eax + 8]
mov edx, dword [eax + 0xc]
mov ebx, dword [eax + 0x10]
mov ebp, dword [eax + 0x14]
mov esi, dword [esp + 0x1c]
mov dword [esp], esi
mov dword [esp + 4], ecx
mov dword [esp + 8], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 0x10], ebp
call fcn.004172e0
lea eax, [0x6fbf3c]
mov dword [esp], eax
call fcn.0040a480
lea eax, [0x6fbec4]
mov dword [esp], eax
mov eax, dword [esp + 0x18]
mov dword [esp + 4], eax
call fcn.00418220
lea eax, [0x6fbf3c]
mov dword [esp], eax
call fcn.0040a680
add esp, 0x14
ret
lea eax, [0x5d33d0]
mov dword [esp], eax
mov dword [esp + 4], 0x10
call fcn.004376f0
nop
call fcn.00462e70
jmp fcn.00429ce0
Function at 0x45bc00
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x45bc9f
sub esp, 0x30
mov ecx, dword fs:[0x14]
mov ecx, dword [ecx]
mov dword [esp + 8], ecx
mov dword [esp + 4], 0
lea edi, [esp + 0xc]
xor eax, eax
call fcn.00464337
lea ecx, [0x45bcb0]
mov dword [esp + 0xc], ecx
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x10], ecx
lea ecx, [esp + 0x34]
mov dword [esp + 0x14], ecx
mov ecx, dword [esp + 8]
mov dword [esp + 0x18], ecx
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x1c], ecx
mov ecx, dword [esp + 0x38]
mov dword [esp + 0x20], ecx
mov ecx, dword [esp + 0x3c]
mov dword [esp + 0x24], ecx
mov ecx, dword [esp + 0x40]
mov dword [esp + 0x28], ecx
lea ecx, [esp + 4]
mov dword [esp + 0x2c], ecx
lea ecx, [esp + 0xc]
mov dword [esp], ecx
call fcn.00462d60
mov ecx, dword [esp + 4]
mov dword [esp + 0x44], ecx
add esp, 0x30
ret
call fcn.00462e70
jmp fcn.0045bc00
Function at 0x464140
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
movd xmm0, dword [esp + 8]
pinsrw xmm0, ebx, 4
pshufhw xmm0, xmm0, 0
movdqa xmm1, xmm0
pxor xmm0, xmmword [0x717d20]
aesenc xmm0, xmm0
cmp ebx, 0x10
jb 0x4628fb
je 0x46294e
cmp ebx, 0x20
jbe 0x462954
cmp ebx, 0x40
jbe 0x46299a
jmp 0x462a3b
test ebx, ebx
je 0x462944
add eax, 0x10
test ax, 0xff0
je 0x462930
movdqu xmm1, xmmword [eax - 0x10]
add ebx, ebx
pand xmm1, xmmword [ebx*8 + 0x5f15c0]
pxor xmm1, xmm0
aesenc xmm1, xmm1
aesenc xmm1, xmm1
aesenc xmm1, xmm1
movd dword [edx], xmm1
ret
movdqu xmm1, xmmword [eax + ebx - 0x20]
add ebx, ebx
pshufb xmm1, xmmword [ebx*8 + 0x5f16c0]
jmp 0x462918
aesenc xmm0, xmm0
movd dword [edx], xmm0
ret
movdqu xmm1, xmmword [eax]
jmp 0x462918
pxor xmm1, xmmword [0x717d30]
aesenc xmm1, xmm1
movdqu xmm2, xmmword [eax]
movdqu xmm3, xmmword [eax + ebx - 0x10]
pxor xmm2, xmm0
pxor xmm3, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
aesenc xmm2, xmm2
aesenc xmm3, xmm3
pxor xmm2, xmm3
movd dword [edx], xmm2
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x717d30]
pxor xmm2, xmmword [0x717d40]
pxor xmm3, xmmword [0x717d50]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax]
movdqu xmm5, xmmword [eax + 0x10]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
pxor xmm4, xmm0
pxor xmm5, xmm1
pxor xmm6, xmm2
pxor xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
movdqa xmm2, xmm1
movdqa xmm3, xmm1
pxor xmm1, xmmword [0x717d30]
pxor xmm2, xmmword [0x717d40]
pxor xmm3, xmmword [0x717d50]
aesenc xmm1, xmm1
aesenc xmm2, xmm2
aesenc xmm3, xmm3
movdqu xmm4, xmmword [eax + ebx - 0x40]
movdqu xmm5, xmmword [eax + ebx - 0x30]
movdqu xmm6, xmmword [eax + ebx - 0x20]
movdqu xmm7, xmmword [eax + ebx - 0x10]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
dec ebx
shr ebx, 6
movdqu xmm0, xmmword [eax]
movdqu xmm1, xmmword [eax + 0x10]
movdqu xmm2, xmmword [eax + 0x20]
movdqu xmm3, xmmword [eax + 0x30]
aesenc xmm4, xmm0
aesenc xmm5, xmm1
aesenc xmm6, xmm2
aesenc xmm7, xmm3
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
add eax, 0x40
dec ebx
jne 0x462a9a
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
aesenc xmm4, xmm4
aesenc xmm5, xmm5
aesenc xmm6, xmm6
aesenc xmm7, xmm7
pxor xmm4, xmm6
pxor xmm5, xmm7
pxor xmm4, xmm5
movd dword [edx], xmm4
ret
cmp byte [0x7178d9], 0
je 0x46415a
mov eax, dword [esp + 4]
mov ebx, dword [esp + 0xc]
lea edx, [esp + 0x10]
jmp 0x4628c0
jmp fcn.00408c10
Function at 0x1000dbbb
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100619bb
call fcn.10061530
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 0x14], 0x6832
cmp dword [ebp - 0x14], 0x6a37
push edi
mov dword [ebp - 0x10], esp
jle 0x1000dc11
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x1060a8b8
and eax, edi
xor eax, esi
cdq
push edx
push eax
call fcn.1000de0e
inc ebx
cmp ebx, 0x4a67
jl 0x1000dbe3
inc edi
cmp edi, 0x166f
jl 0x1000dbe1
inc esi
cmp esi, 0x5603
jl 0x1000dbdf
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x6602
jge 0x1000dc2d
mov edx, 0x10007770
mov ecx, 0x1060a8b8
call fcn.1000f7c5
mov ecx, dword [ebp - 0xc]
xor al, al
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001c3f5
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10061f29
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001c551
lea eax, [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1001c44d
push 0
push 0
push 0xaf9
call dword [sym.imp.ADVAPI32.dll_CopySid]
jmp 0x1001c54f
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x1001c54f
mov dword [ebp - 0x20], 0x18d8
mov dword [ebp - 0x38], 0x100083ac
cmp dword [ebp - 0x20], 0x1978
jle 0x1001c504
and dword [ebp - 0x14], 0
jmp 0x1001c48f
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x4950
jge 0x1001c504
and dword [ebp - 0x18], 0
jmp 0x1001c4a5
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x705f
jge 0x1001c502
and dword [ebp - 0x1c], 0
jmp 0x1001c4bb
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x1b48
jge 0x1001c500
mov eax, dword [ebp - 0x14]
and eax, dword [ebp - 0x18]
and eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
push dword [ebp - 0x44]
push dword [ebp - 0x48]
lea ecx, [ebp - 0x60]
call fcn.1000d990
pop ecx
pop ecx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
call fcn.1000ddee
push eax
call fcn.1004c266
pop ecx
lea ecx, [ebp - 0x60]
call fcn.1000dde4
jmp 0x1001c4b4
jmp 0x1001c49e
jmp 0x1001c488
push 0x11d2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x18a9
jge 0x1001c529
push dword [ebp - 0x38]
call fcn.1004c266
pop ecx
jmp 0x1001c545
or dword [ebp - 4], 0xffffffff
jmp 0x1001c54f
jmp 0x1001c590
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x40], eax
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push 0
push 0x4129
push 0x4f89
push 0x3dd
push 0x2f9b
push 0x4547
push 0x6e2f
push 0x4e9a
call fcn.1001c681
add esp, 0x28
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001c5c9
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1001c62a
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1001c5f7
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x1001c628
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1001c628
push 0
push 0x2487
push 0x23b0
push 0x690
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
jmp 0x1001c646
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x14]
push 0
push dword [ebp - 0x18]
call fcn.10035ee6
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1002e734
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100622fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002e8bc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x24], 0x28f8
mov dword [ebp - 0x2c], 0x10009dd8
cmp dword [ebp - 0x24], 0x29eb
jle 0x1002e83a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
and dword [ebp - 0x14], 0
jmp 0x1002e79a
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x48c4
jge 0x1002e83a
and dword [ebp - 0x18], 0
jmp 0x1002e7b4
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x127
jge 0x1002e835
and dword [ebp - 0x1c], 0
jmp 0x1002e7ca
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x1497
jge 0x1002e830
and dword [ebp - 0x20], 0
jmp 0x1002e7e0
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x7a2a
jge 0x1002e82e
mov ecx, dword [ebp - 0x14]
imul ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
cdq
idiv dword [ebp - 0x20]
and ecx, edx
mov eax, ecx
cdq
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
push dword [ebp - 0x54]
push dword [ebp - 0x58]
lea ecx, [ebp - 0x70]
call fcn.1000d990
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
call fcn.1000ddee
push eax
call fcn.1004c266
pop ecx
lea ecx, [ebp - 0x70]
call fcn.1000dde4
jmp 0x1002e7d9
jmp 0x1002e7c3
jmp 0x1002e7ad
jmp 0x1002e793
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x30], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x2548
jge 0x1002e856
push dword [ebp - 0x2c]
call fcn.1004c266
pop ecx
jmp 0x1002e872
or dword [ebp - 4], 0xffffffff
jmp 0x1002e87c
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x1002e8b0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x48]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x1002e8ba
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x1002e8dd
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x50], eax
push dword [ebp - 0x4c]
push 0x867
push dword [ebp - 0x50]
push 0
call fcn.1001c666
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002f4c0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1002f561
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002f514
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1002f512
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x1002f55f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1002f542
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x1002f55f
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x28]
call fcn.10015a22
mov dword [eax], 0xf75dcec3
jmp 0x1002f537
jmp 0x1002f58b
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x2c]
push 0
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push 0x11fc
call fcn.1001cf5a
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x100300fb
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10062335
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1003015e
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1003014f
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
and dword [eax], 0
jmp 0x10030159
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x1003026a
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], 0xf5b
mov dword [ebp - 0x40], 0x1000a070
cmp dword [ebp - 0x20], 0x1170
jle 0x10030214
push 0x160d
call dword [sym.imp.USER32.dll_IsIconic]
and dword [ebp - 0x14], 0
jmp 0x1003019d
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x2b6a
jge 0x10030214
and dword [ebp - 0x18], 0
jmp 0x100301b3
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x3a90
jge 0x10030212
and dword [ebp - 0x1c], 0
jmp 0x100301c9
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x58d8
jge 0x10030210
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
shl eax, cl
cdq
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
push dword [ebp - 0x44]
push dword [ebp - 0x48]
lea ecx, [ebp - 0x60]
call fcn.1000d990
pop ecx
pop ecx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
call fcn.1000ddee
push eax
call fcn.1004c266
pop ecx
lea ecx, [ebp - 0x60]
call fcn.1000dde4
jmp 0x100301c2
jmp 0x100301ac
jmp 0x10030196
push 0x8dc
push 0x13ff
push dword [ebp - 0x38]
push 0
push dword [ebp - 0x3c]
call fcn.1002771d
add esp, 0x14
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0xcdb
jge 0x10030244
push dword [ebp - 0x40]
call fcn.1004c266
pop ecx
jmp 0x10030260
or dword [ebp - 4], 0xffffffff
jmp 0x1003026a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10030c82
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x10030d28
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10030cdb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10030cd9
push 0x870
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x10030d26
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10030d09
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10030d26
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x28]
call fcn.10015a22
mov dword [eax], 0x3e24
jmp 0x10030cfe
jmp 0x10030d9a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
push 0
push 0x45bf
push 0x40a5
push 0x1f96
push 0x3f35
push 0x1016
push 0x2724
push 0x46cf
push 0x4db3
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push 0x6d8b
push 0x2cac
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
call fcn.1001d301
add esp, 0x44
mov esp, ebp
pop ebp
ret
Function at 0x10036618
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100624af
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10036668
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x24]
push 1
push dword [ebp - 0x28]
push 0x106d
call fcn.10036764
add esp, 0x10
jmp 0x10036753
lea eax, [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1003673c
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x1003673a
mov dword [ebp - 0x20], 0xa73
mov dword [ebp - 0x30], 0x1000a970
cmp dword [ebp - 0x20], 0xe2a
jle 0x100366f2
and dword [ebp - 0x18], 0
jmp 0x100366b0
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x6e68
jge 0x100366f2
and dword [ebp - 0x1c], 0
jmp 0x100366c6
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x1c67
jge 0x100366f0
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
shl eax, cl
cdq
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
push dword [ebp - 0x34]
push dword [ebp - 0x38]
mov ecx, 0x1060a8b8
call fcn.1000de0e
jmp 0x100366bf
jmp 0x100366a9
push 0
call dword [sym.imp.USER32.dll_IsRectEmpty]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x694
jge 0x10036714
mov edx, dword [ebp - 0x30]
mov ecx, 0x1060a8b8
call fcn.1000f7c5
jmp 0x10036730
or dword [ebp - 4], 0xffffffff
jmp 0x1003673a
jmp 0x10036753
mov byte [ebp - 0x12], 0
movzx eax, byte [ebp - 0x12]
test eax, eax
je 0x10036753
push 0x643
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10036f17
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10036fb2
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10036f98
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x10036f79
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x10036f96
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x2c]
call fcn.10015a22
mov dword [eax], 0x7979b389
jmp 0x10036f6e
jmp 0x10036fad
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [eax], 0xfab8d232
jmp 0x1003707e
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x10037021
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
jmp 0x10037002
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 1
jge 0x1003701f
mov eax, dword [ebp - 0xc]
push dword [eax]
mov ecx, dword [ebp - 0x50]
call fcn.10015a22
mov dword [eax], 7
jmp 0x10036ff7
jmp 0x1003707e
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp - 0x10]
call fcn.10015a22
and dword [eax], 0
jmp 0x10037054
push 0
mov ecx, dword [ebp - 0x10]
call fcn.10015a22
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
push 0
mov ecx, dword [ebp - 0x10]
call fcn.10015a22
cmp dword [eax], 0
jg 0x1003707e
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1003707c
push 0x870
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x1003703c
mov esp, ebp
pop ebp
ret
Function at 0x100370a1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10037127
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100370da
push 0x870
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x10037125
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10037108
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x10037125
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.10015a22
mov dword [eax], 0x67e307b5
jmp 0x100370fd
jmp 0x10037171
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x10037153
push 0x14a7
push 0
push 0
push 0x1525
call dword [sym.imp.USER32.dll_MessageBoxW]
jmp 0x10037171
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10037171
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
mov esp, ebp
pop ebp
ret