joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430dc0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov eax, dword [0x469738]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push str.Windows
push 0x40
push 0x46ca30
call fcn.0043a043
push 0x11c
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.004440d0
add esp, 0x18
lea ecx, [ebp - 0x128]
push ecx
mov dword [ebp - 0x128], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
movzx esi, byte [ebp - 0x124]
movzx edx, byte [ebp - 0x120]
movzx eax, byte [ebp - 0xe]
movzx ecx, byte [ebp - 0x14]
shl esi, 8
or esi, edx
shl esi, 8
or esi, eax
shl esi, 8
or esi, ecx
mov eax, esi
shr eax, 0x18
and eax, 0xf
cmp eax, 5
jne 0x430eaa
test esi, 0xf0000
jne 0x430e56
push str.2000
jmp 0x430fcf
cmp eax, 5
jne 0x430eaa
mov edx, esi
and edx, 0xf0000
cmp edx, 0x10000
jne 0x430e75
push 0x460234
jmp 0x430fcf
cmp eax, 5
jne 0x430eaa
mov ecx, esi
and ecx, 0xf0000
cmp ecx, 0x20000
jne 0x430eaa
mov edx, esi
and edx, 0xf00
mov eax, str.XP64
cmp edx, 0x100
je 0x430ea4
mov eax, str.2003
push eax
jmp 0x430fcf
cmp eax, 6
jne 0x430faf
test esi, 0xf0000
jne 0x430ed9
mov eax, esi
and eax, 0xf00
cmp eax, 0x100
mov eax, str.Vista
je 0x430ed3
mov eax, str.2008
push eax
jmp 0x430fcf
cmp eax, 6
jne 0x430faf
mov ecx, esi
and ecx, 0xf0000
cmp ecx, 0x10000
jne 0x430f12
mov edx, esi
and edx, 0xf00
mov eax, 0x46026c
cmp edx, 0x100
je 0x430f0c
mov eax, 0x460270
push eax
jmp 0x430fcf
cmp eax, 6
jne 0x430faf
mov ecx, esi
and ecx, 0xf0000
cmp ecx, 0x20000
jne 0x430f4b
mov edx, esi
and edx, 0xf00
mov eax, 0x460280
cmp edx, 0x100
je 0x430f45
mov eax, 0x460284
push eax
jmp 0x430fcf
cmp eax, 6
jne 0x430faf
mov ecx, esi
and ecx, 0xf0000
cmp ecx, 0x30000
jne 0x430f7d
mov edx, esi
and edx, 0xf00
mov eax, 0x460290
cmp edx, 0x100
je 0x430f7a
mov eax, str.2012_R2
push eax
jmp 0x430fcf
cmp eax, 6
jne 0x430faf
mov ecx, esi
and ecx, 0xf0000
cmp ecx, 0x40000
jne 0x430faf
mov edx, esi
and edx, 0xf00
cmp edx, 0x100
mov eax, 0x4602a8
je 0x430fac
mov eax, str.Server_10
push eax
jmp 0x430fcf
cmp eax, 0xa
jne 0x430fca
test esi, 0xf0000
jne 0x430fca
mov eax, esi
and eax, 0xf00
cmp eax, 0x100
jmp 0x430fa0
push str._Unknown_
push 0x40
push 0x46ca30
call fcn.0043a0a6
add esp, 0xc
and esi, 0xf
jbe 0x431015
push 0x4602d8
push 0x40
push 0x46ca30
call fcn.0043a0a6
push 0xa
push 3
lea ecx, [ebp - 0xc]
push ecx
push esi
call fcn.0043af5c
lea edx, [ebp - 0xc]
push edx
push 0x40
push 0x46ca30
call fcn.0043a0a6
add esp, 0x28
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 0x46ca30
pop esi
call fcn.00438351
mov esp, ebp
pop ebp
ret
Function at 0x431350
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov eax, dword [0x469738]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
xor ebx, ebx
push str.Kernel32.dll
mov dword [ebp - 0x124], ebx
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
cmp esi, ebx
je 0x431411
push 0x11c
lea eax, [ebp - 0x120]
push ebx
push eax
call fcn.004440d0
add esp, 0xc
lea ecx, [ebp - 0x120]
push ecx
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push str.GetProductInfo
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
cmp eax, ebx
je 0x43140a
movzx ecx, word [ebp - 0xa]
lea edx, [ebp - 0x124]
push edx
movzx edx, word [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 0x118]
push edx
mov edx, dword [ebp - 0x11c]
push ecx
push edx
call eax
mov eax, dword [ebp - 0x124]
cmp eax, 0x10
je 0x431408
cmp eax, 0x1b
je 0x431408
cmp eax, 5
je 0x431408
cmp eax, 0x1a
je 0x431408
cmp eax, 0x31
je 0x431408
cmp eax, 0x2f
je 0x431408
cmp eax, 0x1c
jne 0x43140a
mov bl, 1
push esi
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov ecx, dword [ebp - 4]
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00438351
mov esp, ebp
pop ebp
ret

Function at 0x4314d0
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x469738]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsSystemFolderW]
test eax, eax
jne 0x43160b
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsRootW]
test eax, eax
jne 0x43160b
xor bl, bl
mov eax, str.false
push esi
push eax
push str.System_folder_or_Root_:__s.
push 0x46a9d4
xor eax, eax
call fcn.0042d150
add esp, 0xc
lea eax, [ebp - 0x20c]
push eax
push 0
push 0
push 0x26
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, eax
test esi, esi
je 0x431599
lea ecx, [ebp - 0x418]
push ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call esi
cmp dword [ebp - 0x418], 0
setne al
test al, al
je 0x431599
lea edx, [ebp - 0x20c]
push edx
push edi
call fcn.00439f05
add esp, 8
test eax, eax
jne 0x431599
push str.Not_system__Program_Files_x86
push 0x46a9d4
mov bl, 1
call fcn.0042d150
add esp, 8
lea eax, [ebp - 0x20c]
push eax
lea ecx, [ebp - 0x414]
push 0x104
push ecx
call fcn.0043a043
add esp, 0xc
push str.Intel
lea edx, [ebp - 0x414]
push edx
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x414]
push eax
push edi
call fcn.00439f05
add esp, 8
pop esi
test eax, eax
jne 0x4315fa
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryEmptyW]
test eax, eax
jne 0x4315fa
push str.Intel_root_found_and_not_empty
push 0x46a9d4
mov bl, 1
call fcn.0042d150
add esp, 8
mov ecx, dword [ebp - 4]
mov al, bl
xor ecx, ebp
pop ebx
call fcn.00438351
mov esp, ebp
pop ebp
ret
mov bl, 1
mov eax, str.true
jmp 0x43150b
Function at 0x431750
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push 0
push 2
mov edi, eax
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x431789
push edi
push esi
mov dword [edi], 0x22c
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
jne 0x431794
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
mov eax, 2
pop esi
mov esp, ebp
pop ebp
ret
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Process32NextW]
jmp 0x4317a0
lea eax, [edi + 0x24]
push eax
mov eax, dword [ebp + 8]
push eax
call fcn.00439f05
add esp, 8
test eax, eax
je 0x4317cf
push edi
push esi
call ebx
test eax, eax
jne 0x4317a0
mov edi, dword [ebp - 4]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push esi
mov edi, 1
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4317f0
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x238
mov eax, dword [0x469738]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
push edi
lea eax, [ebp - 0x238]
call fcn.00431750
add esp, 4
cmp eax, 2
jne 0x431849
push edi
push str.TerminateProcess_failed_to_FindProcess___s_.
push 0x46a9d4
mov eax, 2
call fcn.0042d150
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00438351
mov esp, ebp
pop ebp
ret
call fcn.00432cc0
mov eax, dword [ebp - 0x230]
push eax
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
jne 0x431870
push edi
push str.TerminateProcess_failed_to_OpenProcess___s_
jmp 0x431821
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test edi, edi
je 0x431833
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00438351
mov esp, ebp
pop ebp
ret
Function at 0x4318a0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x86c
mov eax, dword [0x469738]
xor eax, esp
mov dword [esp + 0x868], eax
mov eax, dword [ebp + 0x10]
push esi
mov esi, ecx
push esi
lea ecx, [esp + 0x6c]
push 0x400
push ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x14], 0
call fcn.0043a043
add esp, 0xc
push 0x4574c0
lea edx, [esp + 0x6c]
push 0x400
push edx
call fcn.0043a0a6
add esp, 0xc
push edi
lea eax, [esp + 0x6c]
push 0x400
push eax
call fcn.0043a0a6
add esp, 0xc
push 0x44
lea ecx, [esp + 0x24]
push 0
push ecx
call fcn.004440d0
xor eax, eax
add esp, 0xc
mov dword [esp + 0x20], 0x44
mov dword [esp + 0xc], eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
cmp byte [ebp + 8], al
je 0x431945
or dword [esp + 0x4c], 1
xor edx, edx
mov word [esp + 0x50], dx
cmp byte [ebp + 0x14], al
je 0x43195f
lea eax, [esp + 0x20]
push eax
push ebx
push edi
push esi
call fcn.004329c0
add esp, 0x10
movzx eax, al
jmp 0x431984
lea ecx, [esp + 0xc]
push ecx
lea edx, [esp + 0x24]
push edx
push ebx
push 0
push 0
push 0
push 0
push 0
lea eax, [esp + 0x88]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x43199d
cmp byte [ebp + 0xc], 0
je 0x4319a7
mov ecx, dword [esp + 0xc]
push 0xffffffffffffffff
push ecx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
jmp 0x4319a7
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp + 8], eax
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0xc]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov ecx, dword [esp + 0xc]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push ecx
call esi
mov edx, dword [esp + 0x10]
push edx
call esi
mov ecx, dword [esp + 0x86c]
mov eax, dword [esp + 8]
pop esi
xor ecx, esp
call fcn.00438351
mov esp, ebp
pop ebp
ret

Function at 0x4319f0
Capabilities:
Shutdown system

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x469738]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov esi, eax
lea eax, [ebp - 0x18]
push eax
push 0x28
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x431a8b
lea ecx, [ebp - 0x10]
push ecx
push str.SeShutdownPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov eax, dword [ebp - 0x18]
push 0
push 0
push 0
lea edx, [ebp - 0x14]
push edx
push 0
push eax
mov dword [ebp - 0x14], 1
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
push 0x80040002
push 0x12
call dword [sym.imp.USER32.dll_ExitWindowsEx]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x431a82
mov ecx, dword [ebp - 0x18]
push ecx
call edi
push esi
call edi
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00438351
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x18]
push edx
call edi
push esi
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.00438351
mov esp, ebp
pop ebp
ret
Function at 0x432590
Capabilities:
Check if file exists
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4508a0
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x469738]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 4], ebx
xor eax, eax
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], ebx
mov word [ebp - 0x30], ax
lea ecx, [ebp - 0x38]
push ecx
push 0xf003f
push ebx
push str.SYSTEMCurrentControlSetControlSession_ManagerEnvironment
mov byte [ebp - 4], 1
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov dword [ebp - 0x3c], eax
cmp eax, ebx
jne 0x43270c
lea edx, [ebp - 0x30]
push edx
mov eax, edi
lea ecx, [ebp - 0x38]
call fcn.0042d620
test eax, eax
jne 0x432631
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 2
jne 0x432631
mov eax, dword [ebp - 0x38]
push ebx
push 0x4574a4
push 1
push ebx
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
lea ecx, [ebp - 0x30]
push ecx
mov eax, edi
lea ecx, [ebp - 0x38]
call fcn.0042d620
test eax, eax
je 0x4326f2
cmp byte [ebp + 8], bl
je 0x43267c
push 1
mov eax, 0x460a64
lea ecx, [ebp - 0x30]
call fcn.00403690
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x432660
sub eax, edx
sar eax, 1
push eax
mov eax, esi
lea ecx, [ebp - 0x30]
call fcn.00403690
jmp 0x43269b
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x432681
sub eax, edx
sar eax, 1
push eax
mov eax, esi
lea esi, [ebp - 0x30]
call fcn.004065b0
cmp dword [ebp - 0x1c], 8
mov edx, dword [ebp - 0x30]
jae 0x4326a7
lea edx, [ebp - 0x30]
mov eax, edx
lea esi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
cmp cx, bx
jne 0x4326b0
mov ecx, dword [ebp - 0x38]
sub eax, esi
sar eax, 1
add eax, eax
push eax
push edx
push 2
push ebx
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
jne 0x4326f2
push ebx
push 0x1388
push 2
push 0x460a68
push ebx
push 0x1a
push 0xffff
call dword [sym.imp.USER32.dll_SendMessageTimeoutW]
jmp 0x4326fb
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
cmp eax, ebx
je 0x432709
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x38], ebx
cmp dword [ebp - 0x1c], 8
jb 0x43271e
mov edx, dword [ebp - 0x30]
push edx
call fcn.004396db
add esp, 4
xor eax, eax
mov word [ebp - 0x30], ax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1c], 7
mov dword [ebp - 0x20], ebx
cmp eax, ebx
je 0x43273c
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.00438351
mov esp, ebp
pop ebp
ret
Function at 0x432cc0
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x469738]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x18]
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x432d15
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.OpenProcessToken_error:_0x_08X
push 0x46a9d4
mov eax, 2
call fcn.0042d150
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00438351
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x20]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
test eax, eax
jne 0x432d58
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.LookupPrivilegeValue_error:_0x_08X
push 0x46a9d4
mov eax, 2
call fcn.0042d150
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00438351
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x1c]
push 0
push 0
push 0x10
lea ecx, [ebp - 0x14]
push ecx
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 0x18]
push 0
push edx
mov dword [ebp - 0x14], 1
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x432dba
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push str.AdjustTokenPrivileges_error:_0x_08X
push 0x46a9d4
mov eax, 2
call fcn.0042d150
add esp, 0xc
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00438351
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x18]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x514
jne 0x432df8
push str.The_token_does_not_have_the_specified_privilege.
push 0x46a9d4
mov eax, 2
call fcn.0042d150
add esp, 8
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00438351
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov eax, 1
call fcn.00438351
mov esp, ebp
pop ebp
ret
Function at 0x433ee0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, eax
test ebx, ebx
je 0x433f8f
push 0
push 0
push 0x31
push esi
call dword [sym.imp.USER32.dll_SendMessageW]
test eax, eax
je 0x433f87
push edi
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push esi
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea edi, [eax + 1]
xor ecx, ecx
mov eax, edi
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004381d7
mov esi, eax
add esp, 4
test esi, esi
je 0x433f78
mov eax, dword [ebp + 8]
push edi
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov eax, esi
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x433f53
mov ecx, dword [ebp + 0xc]
sub eax, edx
push ecx
sar eax, 1
push eax
push esi
push ebx
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32W]
push esi
call fcn.0043a831
add esp, 4
mov edx, dword [ebp - 4]
push edx
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
mov esi, dword [ebp + 8]
pop edi
push ebx
push esi
call dword [sym.imp.USER32.dll_ReleaseDC]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x435b70
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
call fcn.00402500
test eax, eax
jne 0x435bc8
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x435c30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.B32CB6D5_61BD_49c8_AA8A_8B790D3B9008
push 0
push 0
push 0
mov dword [0x46bf5c], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x435bd0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
call fcn.00402500
test eax, eax
jne 0x435c28
lea eax, [ebp - 4]
push eax
push 0
push 0
push 0x435c80
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push str.B32CB6D5_61BD_49c8_AA8A_8B790D3B9008
push 0
push 0
push 0
mov dword [0x46bf5c], eax
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov esi, eax
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0xfa
call dword [sym.imp.KERNEL32.dll_Sleep]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x438351
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x469738]
jne 0x43835b
repz ret
jmp fcn.0043f8e1

Function at 0x449d87
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x469738]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00440c5b
and dword [ebp - 0x14], 0
cmp dword [0x46bd04], 0
mov dword [ebp - 0x18], eax
jne 0x449e3a
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x449ee2
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x456bf0
push ebx
call edi
test eax, eax
je 0x449ee2
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x46bd04], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x46bd08], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x46bd0c], eax
call edi
push eax
call esi
mov dword [0x46bd14], eax
test eax, eax
je 0x449e3a
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x46bd10], eax
mov eax, dword [0x46bd10]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x449e93
cmp dword [0x46bd14], ecx
je 0x449e93
push eax
call esi
push dword [0x46bd14]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x449e93
test ebx, ebx
je 0x449e93
call edi
test eax, eax
je 0x449e8a
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x449e8a
test byte [ebp - 8], 1
jne 0x449e93
or dword [ebp + 0x10], 0x200000
jmp 0x449ec6
mov eax, dword [0x46bd08]
cmp eax, dword [ebp - 0x18]
je 0x449ec6
push eax
call esi
test eax, eax
je 0x449ec6
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x449ec6
mov eax, dword [0x46bd0c]
cmp eax, dword [ebp - 0x18]
je 0x449ec6
push eax
call esi
test eax, eax
je 0x449ec6
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x46bd04]
call esi
test eax, eax
je 0x449ee2
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x449ee4
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00438351
leave
ret
Function at 0x10017cc0
Capabilities:
Encode data using xor
Encrypt data using aes via x86 extensions

Disassembly:
push ebp
push ebx
test eax, eax
je 0x100181e0
test edx, edx
je 0x100181e0
call fcn.10017cd7
mov eax, 0xffffffff
pop ebx
pop ebp
ret

Function at 0x10018220
Capabilities:
Encrypt data using aes via x86 extensions

Disassembly:
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
call fcn.10017cc0
mov edx, dword [esp + 0xc]
shl ecx, 4
test eax, eax
jne 0x10018291
lea eax, [edx + ecx + 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
movups xmmword [eax], xmm0
movups xmmword [edx], xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmm0, xmmword [edx]
movups xmm1, xmmword [eax]
aesimc xmm0, xmm0
aesimc xmm1, xmm1
lea edx, [edx + 0x10]
lea eax, [eax - 0x10]
movups xmmword [eax + 0x10], xmm0
movups xmmword [edx - 0x10], xmm1
cmp eax, edx
ja 0x10018256
movups xmm0, xmmword [edx]
aesimc xmm0, xmm0
movups xmmword [edx], xmm0
pxor xmm0, xmm0
pxor xmm1, xmm1
xor eax, eax
ret

Function at 0x10018ba0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
push ebx
push esi
push edi
sub esp, 0x10
mov ebp, dword [esp + 0x24]
mov esi, dword [esp + 0x28]
mov edi, dword [esp + 0x2c]
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov ecx, dword [esi + 8]
mov edx, dword [esi + 0xc]
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi], eax
mov dword [edi + 4], ebx
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
cmp ebp, 0x80
je 0x10018c24
mov eax, dword [esi + 0x10]
mov ebx, dword [esi + 0x14]
cmp ebp, 0xc0
je 0x10018bfc
mov ecx, dword [esi + 0x18]
mov edx, dword [esi + 0x1c]
jmp 0x10018c04
mov ecx, eax
mov edx, ebx
not ecx
not edx
bswap eax
bswap ebx
bswap ecx
bswap edx
mov dword [edi + 0x20], eax
mov dword [edi + 0x24], ebx
mov dword [edi + 0x28], ecx
mov dword [edi + 0x2c], edx
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
nop
call fcn.10018c29

Function at 0x1001fb30
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 0x10]
mov esi, ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
mov ecx, dword [esi + 8]
call fcn.1001f980
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x10]
test eax, eax
je 0x1001fb59
mov ecx, dword [esi + 8]
mov dword [ecx + 0xc], eax
mov edi, dword [esi + 8]
lea eax, [ebp + 0x10]
push eax
push 0
push edi
push 0x1001f900
push 0
push 0
mov dword [ebp + 0x10], 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [edi + 0x10], eax
test eax, eax
je 0x1001fb9d
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
jne 0x1001fb9d
push dword [edi + 0x10]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [edi + 0x10], 0
mov eax, dword [esi + 8]
pop edi
pop esi
mov al, byte [eax + 4]
pop ebp
ret 0xc