joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4db324
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
test dl, dl
je 0x4db33c
add esp, 0xfffffff0
call fcn.00406a5c
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4db439
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SizeofResource
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LoadResource
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
push eax
push 2
call sub.kernel32.dll_GlobalAlloc
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x4db423
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4db423
xor eax, eax
push ebp
push 0x4db41c
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
call fcn.0040f8d0
lea eax, [ebp - 0x1c]
call fcn.0040bbd0
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.ole32.dll_CreateStreamOnHGlobal
test eax, eax
jne 0x4db3fa
push 0
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x4cef1c]
call fcn.004d9b88
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db423
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_GlobalUnlock
lea eax, [ebp - 0x1c]
call fcn.0040bbd0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db440
lea eax, [ebp - 0x1c]
call fcn.0040bbd0
ret
Function at 0x4db4a8
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
test dl, dl
je 0x4db4c0
add esp, 0xfffffff0
call fcn.00406a5c
mov dword [ebp - 0xc], ecx
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4db5bd
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SizeofResource
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LoadResource
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
push eax
push 2
call sub.kernel32.dll_GlobalAlloc
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x4db5a7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_GlobalLock
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4db5a7
xor eax, eax
push ebp
push 0x4db5a0
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
call fcn.0040f8d0
lea eax, [ebp - 0x1c]
call fcn.0040bbd0
push eax
push 0
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.ole32.dll_CreateStreamOnHGlobal
test eax, eax
jne 0x4db57e
push 0
mov ecx, dword [ebp - 0x1c]
mov dl, 1
mov eax, dword [0x4ce20c]
call fcn.004d99c0
mov edx, dword [ebp - 4]
mov dword [edx + 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db5a7
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
push eax
call sub.kernel32.dll_GlobalUnlock
lea eax, [ebp - 0x1c]
call fcn.0040bbd0
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db5c4
lea eax, [ebp - 0x1c]
call fcn.0040bbd0
ret
Function at 0x4db62c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
xor edx, edx
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4db7a9
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x20]
mov ecx, dword [ebp - 4]
mov edx, 0x4db7c4
call fcn.00409094
mov eax, dword [ebp - 0x20]
mov dl, 1
call fcn.0041f78c
test al, al
je 0x4db78e
push 2
push 0
mov eax, dword [ebp - 4]
call fcn.00408e40
push eax
call sub.kernel32.dll_LoadLibraryExW_1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x4db76d
push 0xe
lea eax, [ebp - 0x24]
call fcn.004b0e48
mov eax, dword [ebp - 0x24]
call fcn.00408e40
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindResourceW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4db76d
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4db76d
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4db76d
push 0
push 0x10
push 0x10
push 0xffffffffffffffff
mov eax, dword [ebp - 0x18]
push eax
call sub.user32.dll_LookupIconIdFromDirectoryEx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
je 0x4db76d
push 3
mov eax, dword [ebp - 0x1c]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FindResourceW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4db76d
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_LoadResource
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4db76d
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_LockResource
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
je 0x4db76d
push 0
push 0x10
push 0x10
push 0x30000
push 0xffffffffffffffff
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_SizeofResource
push eax
mov eax, dword [ebp - 0x18]
push eax
call sub.user32.dll_CreateIconFromResourceEx
mov dword [ebp - 8], eax
jmp 0x4db785
push 1
lea eax, [ebp - 8]
push eax
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00408e40
push eax
call sub.shell32.dll_ExtractIconExW
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_FreeLibrary_2
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4db7b0
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.004081d0
ret
Function at 0x4e5b34
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e5c81
push dword fs:[eax]
mov dword fs:[eax], esp
mov ecx, 2
mov edx, dword [ebp - 4]
mov eax, 0x4e5c98
call fcn.0040935c
mov ecx, eax
inc ecx
mov edx, dword [ebp - 4]
mov eax, 0x4e5c98
call fcn.0040935c
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x10]
dec ecx
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00409204
mov word [ebp - 0xa], 0x61
mov eax, 0x1000
call fcn.004050b0
mov dword [ebp - 0x14], eax
push 0x1000
mov eax, dword [ebp - 0x14]
push eax
lea eax, [ebp - 0x18]
mov dx, word [ebp - 0xa]
call fcn.00408e68
lea eax, [ebp - 0x18]
mov edx, 0x4e5ca8
call fcn.0040903c
mov eax, dword [ebp - 0x18]
call fcn.00408e40
push eax
call sub.kernel32.dll_QueryDosDeviceW
test eax, eax
je 0x4e5c47
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 0x14]
call fcn.00408ea8
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
call fcn.0041e414
test al, al
je 0x4e5c47
mov ax, word [ebp - 0xa]
call fcn.00405594
mov edx, eax
lea eax, [ebp - 0x20]
call fcn.00408e68
push dword [ebp - 0x20]
push 0x4e5ca8
lea eax, [ebp - 0x24]
push eax
mov eax, dword [ebp - 4]
call fcn.00408668
mov ecx, eax
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 4]
call fcn.00409204
push dword [ebp - 0x24]
mov eax, dword [ebp - 8]
mov edx, 3
call fcn.0040911c
mov eax, dword [ebp - 0x14]
call fcn.004050cc
jmp 0x4e5c66
mov eax, dword [ebp - 0x14]
call fcn.004050cc
inc word [ebp - 0xa]
cmp word [ebp - 0xa], 0x7b
jne 0x4e5b9c
mov eax, dword [ebp - 8]
call fcn.00408170
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e5c88
lea eax, [ebp - 0x24]
mov edx, 4
call fcn.004081d0
ret
Function at 0x4e6074
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdb8
xor edx, edx
mov dword [ebp - 0x248], edx
mov dword [ebp - 0x240], edx
mov dword [ebp - 0x244], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e6194
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 8], eax
xor edx, edx
mov eax, 2
call fcn.004e5acc
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x23c], 0x22c
lea edx, [ebp - 0x23c]
mov eax, dword [ebp - 0x10]
call fcn.004e5aec
mov dword [ebp - 0xc], eax
jmp 0x4e6163
lea eax, [ebp - 0x244]
lea edx, [ebp - 0x218]
mov ecx, 0x104
call fcn.00408ee4
mov eax, dword [ebp - 0x244]
lea edx, [ebp - 0x240]
call fcn.0041ff88
mov edx, dword [ebp - 0x240]
mov eax, dword [ebp - 4]
call fcn.0041e414
test al, al
jne 0x4e6137
lea eax, [ebp - 0x248]
lea edx, [ebp - 0x218]
mov ecx, 0x104
call fcn.00408ee4
mov edx, dword [ebp - 0x248]
mov eax, dword [ebp - 4]
call fcn.0041e414
test al, al
je 0x4e6152
push 0
mov eax, dword [ebp - 0x234]
push eax
push 0
push 1
call sub.kernel32.dll_OpenProcess
push eax
call sub.kernel32.dll_TerminateProcess
mov dword [ebp - 8], eax
lea edx, [ebp - 0x23c]
mov eax, dword [ebp - 0x10]
call fcn.004e5b0c
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
jne 0x4e60d6
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e619b
lea eax, [ebp - 0x248]
mov edx, 3
call fcn.004081d0
ret
Function at 0x4e61a4
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4e630f
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 8]
mov edx, 0x4e6328
call fcn.00408550
lea eax, [ebp - 0x24]
mov ecx, dword [ebp - 4]
mov edx, 0x4e6338
call fcn.00409094
mov eax, dword [ebp - 0x24]
mov dl, 1
call fcn.0041f78c
test al, al
je 0x4e62f1
lea eax, [ebp - 0xc]
mov edx, dword [ebp - 4]
call fcn.00408598
lea eax, [ebp - 0xc]
call fcn.00408740
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00408e40
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x4e62f1
mov eax, dword [ebp - 0x10]
call fcn.004050b0
mov dword [ebp - 0x18], eax
xor eax, eax
push ebp
push 0x4e62ea
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x18]
push eax
mov eax, dword [ebp - 0x10]
push eax
mov eax, dword [ebp - 0x14]
push eax
mov eax, dword [ebp - 0xc]
call fcn.00408e40
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x4e62d4
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x1c]
push eax
push 0x4e6344
mov eax, dword [ebp - 0x18]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x4e62d4
mov eax, dword [ebp - 8]
push eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 8]
call fcn.0040f8c4
movzx eax, ax
mov dword [ebp - 0x44], eax
mov byte [ebp - 0x40], 0
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 8]
mov dword [ebp - 0x3c], eax
mov byte [ebp - 0x38], 0
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax + 0xc]
call fcn.0040f8c4
movzx eax, ax
mov dword [ebp - 0x34], eax
mov byte [ebp - 0x30], 0
mov eax, dword [ebp - 0x1c]
movzx eax, word [eax + 0xc]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0
lea edx, [ebp - 0x44]
mov ecx, 3
mov eax, 0x4e6354
call fcn.00420524
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e62f1
mov eax, dword [ebp - 0x18]
call fcn.004050cc
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4e6316
lea eax, [ebp - 0x24]
call fcn.00408170
lea eax, [ebp - 0xc]
call fcn.00408170
ret

Function at 0x4f9ba8
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
lea eax, [ebp - 5]
push eax
push 0x4f9b18
call sub.user32.dll_EnumWindows
cmp byte [ebp - 5], 0
jne 0x4f9bd3
mov eax, 0x4f9be4
call fcn.004e6074
pop ecx
pop ecx
pop ebp
ret
Function at 0x4f9e1c
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4f9ee7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 7
mov eax, dword [0x521aa0]
mov eax, dword [eax]
cmp byte [eax + 0xe], 0
je 0x4f9ecc
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
mov eax, dword [0x524c54]
push eax
push 0x4f9d68
push 5
call sub.user32.dll_SetWindowsHookExW
mov dword [ebp - 0xc], eax
push 0
push 0x20
push 0
lea edx, [ebp - 0x14]
mov eax, dword [0x5219c8]
call fcn.0040c110
push dword [ebp - 0x14]
push 0x4f9f04
mov eax, dword [0x521aa0]
mov eax, dword [eax]
push dword [eax + 8]
push 0x4f9f18
lea edx, [ebp - 0x18]
mov eax, dword [0x521a80]
call fcn.0040c110
push dword [ebp - 0x18]
lea eax, [ebp - 0x10]
mov edx, 5
call fcn.0040911c
mov eax, dword [ebp - 0x10]
xor ecx, ecx
mov dl, 2
call fcn.004c7970
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
push eax
call sub.user32.dll_UnhookWindowsHookEx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4f9eee
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.004081d0
ret
Function at 0x4fc2f8
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa0
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x60], ecx
test dl, dl
je 0x4fc314
add esp, 0xfffffff0
call fcn.00406a5c
mov byte [ebp - 5], dl
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4fc4a2
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0x60]
mov eax, dword [0x521cb0]
mov eax, dword [eax]
call fcn.004b7310
mov eax, dword [ebp - 0x60]
lea edx, [ebp - 0x5c]
call fcn.0041fe54
mov edx, dword [ebp - 0x5c]
mov eax, dword [0x521cb0]
mov eax, dword [eax]
add eax, 0x1c
mov ecx, 0x4fc4d8
call fcn.00409094
mov eax, dword [ebp - 4]
add eax, 8
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 8
mov eax, sub.user32.dll_DefWindowProcW
mov edx, dword [ebp - 0xc]
mov dword [edx + 4], eax
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [eax + 8], edx
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [eax + 0xc], edx
mov eax, dword [ebp - 0xc]
mov dword [eax + 0x1c], 0x10
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [eax + 0x20], edx
mov eax, 0x4fc500
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x24], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x10]
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x10], eax
mov eax, dword [ebp - 0xc]
xor edx, edx
mov dword [eax + 0x14], edx
mov eax, dword [0x521eac]
mov eax, dword [eax]
xor edx, edx
call fcn.004b453c
mov edx, dword [ebp - 0xc]
mov dword [edx + 0x18], eax
mov dword [ebp - 0x50], 0x50100
mov eax, dword [0x521cb0]
mov eax, dword [eax]
mov eax, dword [eax + 4]
call fcn.00408e40
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], 0x6ca0000
mov dword [ebp - 0x4c], 0x80000000
mov dword [ebp - 0x48], 0x80000000
mov dword [ebp - 0x44], 0x29f
mov dword [ebp - 0x40], 0x3c
xor eax, eax
mov dword [ebp - 0x38], eax
xor eax, eax
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
lea esi, [eax + 8]
lea edi, [ebp - 0x34]
mov ecx, 0xa
rep movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 4]
push eax
push 0x4fb3d8
call fcn.004991ec
mov edx, dword [ebp - 4]
mov dword [edx + 0x30], eax
lea edx, [ebp - 0x58]
mov eax, dword [0x521cb0]
mov eax, dword [eax]
call fcn.004b6c60
mov edx, dword [ebp - 4]
mov dword [edx + 4], eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x30]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 4]
mov edx, 0xfffffffc
call fcn.0040f7bc
mov eax, dword [ebp - 4]
call fcn.004faad4
mov dl, 1
mov eax, dword [0x4dc65c]
call fcn.004dcba8
mov edx, dword [0x521aa0]
mov dword [edx], eax
mov eax, dword [0x521cb0]
mov eax, dword [eax]
mov byte [eax + 0x21], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4fc4a9
lea eax, [ebp - 0x60]
mov edx, 2
call fcn.004081d0
ret
Function at 0x50243c
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
mov dword [ebp - 4], eax
mov byte [ebp - 5], 0
mov edx, dword [0x501860]
mov eax, 0xf0
call fcn.00409c58
mov dword [0x521910], eax
call sub.user32.dll_GetDesktopWindow
mov edx, dword [0x521910]
mov dword [edx + 0xec], eax
push 0
call sub.ole32.dll_CoInitialize
mov eax, dword [0x521910]
mov byte [eax + 0xe8], 1
push 0
push 0
push 0
push 0x5018a0
push 0
push 1
push 1
call sub.user32.dll_SetWinEventHook
mov edx, dword [0x521910]
mov dword [edx + 8], eax
mov eax, dword [0x521910]
cmp dword [eax + 8], 0
je 0x502522
push 0
push 0xfffffffffffffffc
mov eax, dword [0x521910]
mov eax, dword [eax + 0xec]
push eax
push 1
call sub.user32.dll_NotifyWinEvent
mov eax, dword [0x521910]
mov edx, dword [ebp - 4]
mov dword [eax + 0xc], edx
push 0
mov eax, dword [0x524c54]
push eax
mov eax, 0x501d88
push eax
push 0xe
call sub.user32.dll_SetWindowsHookExW
mov edx, dword [0x521910]
mov dword [edx], eax
mov eax, dword [0x521910]
cmp dword [eax], 0
je 0x502522
push 0
mov eax, dword [0x524c54]
push eax
mov eax, 0x502280
push eax
push 0xd
call sub.user32.dll_SetWindowsHookExW
mov edx, dword [0x521910]
mov dword [edx + 4], eax
mov eax, dword [0x521910]
cmp dword [eax + 4], 0
je 0x502522
mov byte [ebp - 5], 1
mov al, byte [ebp - 5]
pop ecx
pop ecx
pop ebp
ret
Function at 0x100037ab
Capabilities:
Encode data using xor
Get disk information

Disassembly:
mov eax, 0x10059090
call fcn.100589e8
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x28], 0x22eb
mov edi, ecx
xor esi, esi
mov dword [ebp - 0x10], esp
cmp dword [ebp - 0x28], 0x568
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x20], edi
jge 0x100038b5
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], esi
push eax
lea eax, [ebp - 0x14]
mov dword [ebp - 0x18], esi
push eax
push str._ld__ld
call fcn.1004235b
mov eax, dword [ebp - 0x14]
add esp, 0xc
xor ecx, ecx
push 4
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1003d41e
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x28], esi
pop ecx
test ebx, ebx
jle 0x10003847
mov ebx, eax
mov edi, esi
push ebx
push 0x10061a50
call fcn.1004235b
mov eax, dword [ebp - 0x1c]
add eax, dword [ebx]
inc edi
pop ecx
add ebx, 4
mov dword [ebp - 0x1c], eax
pop ecx
cmp edi, dword [ebp - 0x14]
jl 0x10003823
mov edi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x14]
mov eax, ebx
mov ecx, esi
cdq
idiv dword [ebp - 0x18]
mov eax, ebx
mov dword [ebp - 0x24], ecx
test edx, edx
cmove eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
test eax, eax
jle 0x100038a4
lea edx, [ecx + ebx]
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x30], edx
mov edi, esi
cmp ecx, edx
jge 0x1000388e
mov esi, ecx
mov ecx, edx
mov eax, esi
add esi, dword [ebp - 0x18]
cdq
idiv ebx
mov eax, dword [ebp - 0x34]
add edi, dword [eax + edx*4]
cmp esi, ecx
jl 0x10003874
mov ecx, dword [ebp - 0x24]
xor esi, esi
mov eax, dword [ebp - 0x38]
cmp edi, dword [ebp - 0x1c]
jge 0x10003899
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x28], ecx
inc ecx
mov dword [ebp - 0x24], ecx
cmp ecx, eax
jl 0x10003861
mov edi, dword [ebp - 0x20]
mov eax, dword [ebp - 0x28]
inc eax
push eax
push str._ld_n
call fcn.10042041
pop ecx
pop ecx
cmp byte [ebp + 0x14], 0
je 0x100038c5
mov eax, dword [ebp + 0x20]
mov dword [eax], esi
jmp 0x1000398e
mov dword [ebp - 0x28], 0x5cc1
cmp dword [ebp - 0x28], 0x5cd4
jle 0x10003918
mov ebx, esi
mov edi, esi
mov dword [ebp - 0x38], esi
lea eax, [edi + ebx]
mov ecx, 0x100742b8
xor eax, esi
cdq
push edx
push eax
call fcn.1000793a
inc esi
cmp esi, 0x5dd3
jl 0x100038dc
inc edi
push 0
pop esi
cmp edi, 0x2715
jl 0x100038d9
inc ebx
cmp ebx, 0x7cf4
jl 0x100038d7
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov edi, dword [ebp - 0x20]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x28], 0x591b
jge 0x10003952
mov edx, str.sfk_wxlr_sndkk_ctnfrn
mov ecx, 0x100742b8
call fcn.10009c90
jmp 0x10003952
or dword [ebp - 4], 0xffffffff
mov dword [edi], 0x10
cmp dword [edi], 0x14
jne 0x1000398e
mov esi, dword [ebp - 0x3c]
push dword [ebp + 0xc]
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0xc553
push dword [ebp + 8]
push esi
push dword [ebp + 0x24]
push eax
push dword [ebp + 0x10]
push ecx
xor cl, cl
call fcn.10003642
add esp, 0x1c
inc dword [edi]
cmp dword [edi], 0x14
je 0x10003964
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100039bc
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005909a
call fcn.100589e8
sub esp, 0x24
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x2c], ecx
je 0x10003a09
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x10003ad4
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xadc9
inc dword [edx]
cmp dword [edx], 3
jl 0x100039f2
jmp 0x10003ad4
mov dword [ebp - 0x1c], 0x4a9c
cmp dword [ebp - 0x1c], 0x4b59
jle 0x10003a79
xor esi, esi
xor edi, edi
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
and dword [ebp - 0x28], 0
mov ecx, ebx
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x24], edi
shl edi, cl
mov eax, edi
mov ecx, 0x100742b8
and eax, ebx
xor eax, esi
cdq
push edx
push eax
call fcn.1000793a
inc ebx
cmp ebx, 0x6d7d
jl 0x10003a33
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
inc ebx
mov dword [ebp - 0x14], ebx
cmp ebx, 0x7be9
jl 0x10003a25
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x675d
jl 0x10003a20
inc esi
cmp esi, 0x538c
jl 0x10003a1b
mov esi, dword [ebp - 0x20]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x4741
jge 0x10003ab4
mov edx, str.ilkiacnu_isfulp_perjql_vyjzwkfyd_tvaxem_tvv_tmgdbdhxa_pcssyqxx_ievzo_dwjbax_wre_ozcvuila_xwml
mov ecx, 0x100742b8
call fcn.10009c90
jmp 0x10003ab4
mov dword [esi], 0
cmp dword [esi], 2
jge 0x10003ad4
mov edx, dword [ebp - 0x2c]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0x3185
inc dword [esi]
cmp dword [esi], 2
jl 0x10003ac2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret