joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000a780
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.100095f0
test eax, eax
je 0x1000a7c6
lea ecx, [ebp - 0x14]
mov dword [ebp - 6], 0x6f646e69
push ecx
push eax
mov dword [ebp - 0x14], 0x46746553
mov word [ebp - 2], 0x77
mov dword [ebp - 0xc], 0x6e756f72
mov dword [ebp - 0x10], 0x6765726f
mov word [ebp - 8], 0x5764
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000acb0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.100095f0
test eax, eax
je 0x1000acf3
lea ecx, [ebp - 0x14]
mov word [ebp - 0xb], 0x776f
push ecx
push eax
mov dword [ebp - 0x10], 0x6e695767
mov dword [ebp - 0x14], 0x6e697242
mov dword [ebp - 9], 0x6f546f54
mov word [ebp - 5], 0x70
mov byte [ebp - 0xc], 0x64
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000ad00
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
sub esp, 0x114
cmp eax, 1
jne 0x1000adc5
push 0x104
lea eax, [ebp - 0x114]
push eax
push 0
call fcn.10009990
lea eax, [ebp - 0x10]
mov dword [ebp - 8], 0x70707573
push eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0xd], 0x746e6174
push eax
mov dword [ebp - 4], 0x74726f
mov byte [ebp - 9], 0x20
mov word [ebp - 0x10], 0x6e69
mov byte [ebp - 0xe], 0x73
call fcn.10009e60
add esp, 0x14
test eax, eax
jne 0x1000adf4
push sym.drvhlp.dll_hnchqr
push 0x1004b074
call fcn.1000a2b0
add esp, 8
test eax, eax
je 0x1000adf4
push sym.drvhlp.dll_n88ew1
push 0x1004b02c
call fcn.1000a2b0
add esp, 8
test eax, eax
je 0x1000adf4
push sym.drvhlp.dll_yzn1cp
push 0x1004b054
call fcn.1000a2b0
add esp, 8
test eax, eax
je 0x1000adf4
push sym.drvhlp.dll_s1xa8m
push 0x1004b04c
call fcn.1000a2b0
add esp, 8
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
test eax, eax
jne 0x1000adf4
push 0x1004b074
call fcn.1000a470
push 0x1004b02c
call fcn.1000a470
push 0x1004b054
call fcn.1000a470
push 0x1004b04c
call fcn.1000a470
add esp, 0x10
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1004f9c
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2ac
mov eax, dword [0x100710c]
mov edx, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
push 8
mov dword [ebp - 4], eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x24]
xor ebx, ebx
rep stosd dword es:[edi], eax
inc ebx
lea edi, [edx + 8]
mov dword [esi], ebx
mov dword [ebp - 0x2ac], esi
mov esi, dword [sym.imp.msvcrt.dll_wcslen]
push edi
mov dword [ebp - 0x2a8], edx
call esi
cmp eax, 0x40
pop ecx
jae 0x10050af
mov eax, dword [ebp - 0x2a8]
add eax, 0x888
push eax
call esi
test eax, eax
pop ecx
jbe 0x10050af
push ebx
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
push edi
call esi
mov esi, eax
push esi
lea eax, [ebp - 0xa4]
push edi
push eax
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0x10
lea eax, [esi + esi]
push 0x10
xor esi, esi
mov word [ebp - 0xa2], 0x5c
mov word [ebp + eax - 0xa4], 0x5c
mov word [ebp + eax - 0xa2], si
lea eax, [ebp - 0x24]
push eax
push esi
push esi
push esi
push 0x100
lea eax, [ebp - 0x2a4]
push eax
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
test eax, eax
mov edi, dword [sym.imp.msvcrt.dll_wcscmp]
je 0x1005082
mov eax, dword [ebp - 0x2a8]
add eax, 0x888
push eax
lea eax, [ebp - 0x24]
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x100508c
mov eax, dword [ebp - 0x2ac]
xor ebx, ebx
mov dword [eax], esi
mov eax, dword [ebp - 0x2a8]
add eax, 0x8a8
push eax
lea eax, [ebp - 0x2a4]
push eax
call edi
test eax, eax
pop ecx
pop ecx
je 0x10050af
mov eax, dword [ebp - 0x2ac]
mov dword [eax], esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
pop ebx
call fcn.01005413
leave
ret 8

Function at 0x1005339
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push edi
xor edi, edi
inc edi
xor esi, esi
cmp dword [0x100720c], esi
mov dword [0x1007200], edi
mov dword [0x1007204], edi
mov dword [0x1007208], esi
jne 0x1005368
call fcn.01004f5e
test eax, eax
je 0x1005387
push esi
push esi
push dword [ebp + 8]
push 0x1005179
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
je 0x1005387
cmp eax, 0xffffffff
je 0x1005387
mov eax, edi
jmp 0x1005395
mov dword [0x1007204], esi
mov dword [0x1007200], esi
xor eax, eax
pop edi
pop esi
pop ebp
ret 4

Function at 0x430004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x4e1f78bb
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x430024
nop
nop
nop
nop
mov eax, section..rdata
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0xc1a11e9
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x401360
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push edi
push 0
push 0
call ebx
mov edi, eax
test edi, edi
jne 0x401377
pop edi
pop ebx
ret
push esi
push edi
call fcn.004023ff
push edi
mov esi, eax
push 0
push esi
call fcn.00404870
add esp, 0x10
push edi
push esi
call ebx
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401395
sub eax, edx
cmp byte [eax + esi - 1], 0x5c
mov eax, esi
je 0x4013b4
push 0x411850
call fcn.00401260
add esp, 4
pop esi
pop edi
pop ebx
ret

Function at 0x4013c0
Capabilities:
Get common file path

Disassembly:
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push edi
push 0
push 0
call ebx
mov edi, eax
test edi, edi
jne 0x4013d7
pop edi
pop ebx
ret
push esi
push edi
call fcn.004023ff
push edi
mov esi, eax
push 0
push esi
call fcn.00404870
add esp, 0x10
push edi
push esi
call ebx
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4013f5
sub eax, edx
cmp byte [eax + esi - 1], 0x5c
mov eax, esi
je 0x401414
push 0x411850
call fcn.00401260
add esp, 4
pop esi
pop edi
pop ebx
ret
Function at 0x401490
Capabilities:
Get common file path

Disassembly:
mov ecx, str.temp
mov eax, ecx
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4014b7
test dl, dl
je 0x4014b3
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4014b7
add eax, 2
add ecx, 2
test dl, dl
jne 0x401497
xor eax, eax
jmp 0x4014bc
sbb eax, eax
sbb eax, 0xffffffff
push esi
test eax, eax
jne 0x401531
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetTempPathA]
push edi
push eax
push eax
call ebx
mov edi, eax
test edi, edi
jne 0x4014e4
push str.setup.exe
call fcn.00401260
add esp, 4
pop edi
pop ebx
pop esi
ret
push edi
call fcn.004023ff
push edi
mov esi, eax
push 0
push esi
call fcn.00404870
add esp, 0x10
push esi
push edi
call ebx
mov eax, esi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401501
sub eax, edx
cmp byte [eax + esi - 1], 0x5c
mov eax, esi
je 0x401520
push 0x411850
call fcn.00401260
add esp, 4
push str.setup.exe
call fcn.00401260
add esp, 4
pop edi
pop ebx
pop esi
ret
mov ecx, str.current
mov eax, str.temp
jmp 0x401540
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401560
test dl, dl
je 0x40155c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401560
add eax, 2
add ecx, 2
test dl, dl
jne 0x401540
xor eax, eax
jmp 0x401565
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4015a9
call fcn.00401420
mov esi, eax
push 0x5c
push esi
call fcn.00402540
add esp, 8
test eax, eax
jne 0x40158e
push str.setup.exe
call fcn.00401260
add esp, 4
pop esi
ret
sub eax, esi
inc eax
push esi
call fcn.004012f0
add esp, 4
push str.setup.exe
call fcn.00401260
add esp, 4
pop esi
ret
mov ecx, str.system
mov eax, str.temp
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x4015d3
test dl, dl
je 0x4015cf
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x4015d3
add eax, 2
add ecx, 2
test dl, dl
jne 0x4015b3
xor eax, eax
jmp 0x4015d8
sbb eax, eax
sbb eax, 0xffffffff
test eax, eax
jne 0x4015f0
push str.setup.exe
call fcn.00401360
call fcn.00401260
add esp, 4
pop esi
ret
mov ecx, str.windows
mov eax, str.temp
lea ebx, [ebx]
mov dl, byte [eax]
cmp dl, byte [ecx]
jne 0x401620
test dl, dl
je 0x40161c
mov dl, byte [eax + 1]
cmp dl, byte [ecx + 1]
jne 0x401620
add eax, 2
add ecx, 2
test dl, dl
jne 0x401600
xor eax, eax
jmp 0x401625
sbb eax, eax
sbb eax, 0xffffffff
push str.setup.exe
test eax, eax
jne 0x40163d
call fcn.004013c0
call fcn.00401260
add esp, 4
pop esi
ret
mov eax, str.temp
call fcn.00401260
mov ecx, eax
add esp, 4
lea esi, [ecx + 1]
nop
mov dl, byte [ecx]
inc ecx
test dl, dl
jne 0x401650
sub ecx, esi
cmp byte [ecx + eax - 1], 0x5c
je 0x40166d
push 0x411850
call fcn.00401260
add esp, 4
pop esi
ret
Function at 0x401670
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x140
mov eax, dword [0x41329c]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
push 0
push 2
mov dword [ebp - 0x13c], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
mov dword [ebp - 0x140], esi
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x124
lea ecx, [ebp - 0x130]
push 0
push ecx
mov dword [ebp - 0x138], 0
call fcn.00404870
add esp, 0xc
lea edx, [ebp - 0x134]
push edx
push esi
mov dword [ebp - 0x134], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
mov edi, dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov eax, dword [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x110]
push ecx
call fcn.00402570
add esp, 8
test eax, eax
je 0x401739
mov edx, dword [ebp - 0x12c]
push edx
push 0
push 1
call edi
mov esi, eax
lea eax, [ebp - 0x138]
push eax
push esi
call ebx
mov ecx, dword [ebp - 0x138]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
test eax, eax
je 0x401739
push 0xffffffffffffffff
push esi
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [ebp - 0x140]
lea edx, [ebp - 0x134]
push edx
push eax
call dword [sym.imp.KERNEL32.dll_Process32Next]
test eax, eax
jne 0x4016eb
mov ecx, dword [ebp - 8]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.0040205c
mov esp, ebp
pop ebp
ret 4
Function at 0x401770
Capabilities:
Create process on windows
Extract resource via kernel32 functions
Set registry value
Write and execute a file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov eax, dword [0x41329c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
push esi
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push esi
push 0
mov dword [ebp - 0x114], eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4017ba
or eax, 0xffffffff
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040205c
mov esp, ebp
pop ebp
ret
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
test eax, eax
je 0x4017a6
call fcn.00401490
push 0
push 0
push 2
push 0
push 0
mov ebx, eax
push 0x40000000
push ebx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
test esi, esi
je 0x4017a6
mov ecx, dword [ebp - 0x114]
push 0
lea eax, [ebp - 0x11c]
push eax
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str.setup.exe
call fcn.00401670
push str.setup.tmp
call fcn.00401670
push str.xuankusoso
lea edx, [ebp - 0x110]
push str.Software_s
push edx
call fcn.004025f6
add esp, 0xc
cmp byte [0x415bd7], 0
je 0x40189e
lea eax, [ebp - 0x114]
push eax
lea ecx, [ebp - 0x110]
push ecx
push 0x80000001
mov dword [ebp - 0x118], 1
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov eax, dword [ebp - 0x114]
push 4
lea edx, [ebp - 0x118]
push edx
push 4
push 0
push str.InstallMode
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0x114]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0
push str._VERYSILENT__SP_
jmp 0x4018f6
lea edx, [ebp - 0x114]
push edx
lea eax, [ebp - 0x110]
push eax
push 0x80000001
mov dword [ebp - 0x118], 0
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyA]
mov edx, dword [ebp - 0x114]
push 4
lea ecx, [ebp - 0x118]
push ecx
push 4
push 0
push str.InstallMode
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov eax, dword [ebp - 0x114]
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0
push 0
push 0x4118c9
push ebx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
xor eax, eax
pop ebx
call fcn.0040205c
mov esp, ebp
pop ebp
ret
Function at 0x401920
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x22c
mov eax, dword [0x41329c]
xor eax, esp
mov dword [esp + 0x228], eax
push ebx
push esi
push edi
push 0x104
lea eax, [esp + 0x12c]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x4157d8
push 0x4158d8
push 0x4159d8
lea ecx, [esp + 0x134]
push 0x415ad8
push ecx
call fcn.00402872
mov eax, 0x4158d8
add esp, 0x14
lea edx, [eax + 1]
mov edi, edi
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401980
sub eax, edx
lea edi, [eax + 1]
push edi
mov dword [esp + 0x18], edi
call fcn.00402076
mov esi, eax
mov eax, 0x4158d8
mov edx, esi
add esp, 4
mov dword [esp + 0x10], esi
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
test cl, cl
jne 0x4019a8
push str.xkss_
push 0x4158d8
call fcn.004023e8
add esp, 8
test eax, eax
je 0x401a12
push 0x4118d4
push esi
mov byte [0x415bd7], 1
dec edi
call fcn.004023e8
add esp, 8
test eax, eax
je 0x4019e6
sub eax, esi
jmp 0x4019e9
or eax, 0xffffffff
push edi
inc eax
push eax
lea edx, [esp + 0x18]
push edx
lea ebx, [esp + 0x24]
call fcn.004010b0
lea esi, [esp + 0x10]
call fcn.00401020
mov eax, dword [esp + 0x18]
push eax
call fcn.0040206b
add esp, 4
jmp 0x401a28
push 0x4118d8
push 0x4118dc
lea ebx, [esp + 0x18]
call fcn.004011b0
add esp, 8
push str.xuankusoso
lea ecx, [esp + 0x24]
push str.Software_s
push ecx
call fcn.004025f6
mov esi, dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
add esp, 0xc
push 0
lea edx, [esp + 0x10]
push edx
push 0
push 0xf003f
push 0
push 0
push 0
lea eax, [esp + 0x3c]
push eax
push 0x80000001
call esi
push 0
lea ecx, [esp + 0x10]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
lea edx, [esp + 0x3c]
push edx
push 0x80000001
call esi
mov edi, dword [esp + 0x10]
test eax, eax
jne 0x401a9b
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401a92
jmp 0x401acb
push 0
lea ecx, [esp + 0x10]
push ecx
push 0
push 0xf003f
push 0
push 0
push 0
lea edx, [esp + 0x3c]
push edx
push 0x80000001
call esi
test eax, eax
jne 0x401ae3
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x401ac4
sub eax, edx
push eax
mov eax, dword [esp + 0x10]
push edi
push 1
push 0
push str.TerminalNo
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
push 0xa
push str.IDR_LUA
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceA]
test eax, eax
je 0x401afd
mov ecx, eax
call fcn.00401770
mov ecx, dword [esp + 0xc]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push edi
call fcn.0040206b
mov ecx, dword [esp + 0x238]
add esp, 4
pop edi
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.0040205c
mov esp, ebp
pop ebp
ret 0x10

Function at 0x40205c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41329c]
jne 0x402066
repz ret
jmp fcn.00403580
Function at 0x408ecc
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41329c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004040a3
and dword [ebp - 0x14], 0
cmp dword [0x41534c], 0
mov dword [ebp - 0x18], eax
jne 0x408f7f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x409027
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x409027
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x41534c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x415350], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x415354], eax
call edi
push eax
call esi
mov dword [0x41535c], eax
test eax, eax
je 0x408f7f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x415358], eax
mov eax, dword [0x415358]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x408fd8
cmp dword [0x41535c], ecx
je 0x408fd8
push eax
call esi
push dword [0x41535c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x408fd8
test ebx, ebx
je 0x408fd8
call edi
test eax, eax
je 0x408fcf
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x408fcf
test byte [ebp - 8], 1
jne 0x408fd8
or dword [ebp + 0x10], 0x200000
jmp 0x40900b
mov eax, dword [0x415350]
cmp eax, dword [ebp - 0x18]
je 0x40900b
push eax
call esi
test eax, eax
je 0x40900b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40900b
mov eax, dword [0x415354]
cmp eax, dword [ebp - 0x18]
je 0x40900b
push eax
call esi
test eax, eax
je 0x40900b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x41534c]
call esi
test eax, eax
je 0x409027
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x409029
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040205c
leave
ret
Function at 0x100120df
Capabilities:
Query environment variable
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x22c
mov eax, dword [0x10026204]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
and dword [ebp - 0x228], 0
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0x10]
mov ebx, eax
mov esi, dword [edi + 0xc]
mov dword [ebp - 0x224], eax
lea eax, [ebp - 0x224]
push eax
push esi
lea eax, [ebp - 0x228]
shr ebx, 1
push eax
push 0
push dword [edi + 8]
push dword [edi]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov ecx, eax
mov dword [ebp - 0x22c], ecx
test ecx, ecx
jne 0x100121aa
cmp dword [ebp - 0x224], 2
jbe 0x100121a3
mov ecx, dword [ebp - 0x228]
sub ecx, 1
je 0x10012191
sub ecx, 1
je 0x1001215b
and dword [edi + 0x14], eax
push 0xd
mov word [esi], ax
pop ecx
jmp 0x100121a3
push 0x10d
lea eax, [ebp - 0x220]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
test eax, eax
je 0x10012179
cmp eax, 0x10e
jb 0x10012182
xor eax, eax
mov word [ebp - 0x220], ax
push ebx
lea eax, [ebp - 0x220]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov ecx, dword [ebp - 0x22c]
xor eax, eax
cmp word [esi], 0x3a
setne al
mov dword [edi + 0x14], eax
xor eax, eax
mov word [esi + ebx*2 - 2], ax
xor eax, eax
test ecx, ecx
mov ecx, dword [ebp - 4]
pop edi
sete al
xor ecx, ebp
pop esi
pop ebx
call fcn.100137a3
leave
ret 4

Function at 0x10016520
Capabilities:
Contain obfuscated stackstrings

Disassembly:
in al, dx
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
invalid
invalid
cld

Function at 0x1001661b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
movsb byte es:[edi], byte [esi]
and al, dh
inc ebp
movsd dword es:[edi], dword [esi]
xor eax, 0x41a645c6
call fcn.1001622f
push eax
push esi
push dword [ebp + 8]
call fcn.100161e4
invalid
invalid
inc esp

Function at 0x10016655
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc ebp
fimul dword [edx - 0x3a]
inc ebp
fisttp dword [edi - 0x3a]
inc ebp
fsub qword [edi - 0x3a]
inc ebp
fld qword [edx - 0x3a]
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x100166ba
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.1001622f
push eax
push esi
push dword [ebp + 8]
call fcn.100161e4
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.1001621f
invalid
mov byte [ebp - 0x80], 0x51
Function at 0x100166be
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.1001621f
push eax
mov edi, 0x858d5735
jl 0x1001670a
invalid
invalid

Function at 0x100168b6
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x100168d3
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x100168ce
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x100168b8
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x100168c0
cmp edx, ebx
jne 0x10016a0e
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x1001688f
add eax, dword [eax + 4]
jmp 0x1001687c
mov dword [ebp + 0xc], ebx
jmp 0x100168de
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x100168f6
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x10016914
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x10016972
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10016959
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x10016962
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x1001696c
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x1001694e
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x100168d8
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x100169bf
dec eax
je 0x100169b6
sub eax, 3
je 0x100169ad
mov dword [ebp - 4], 0x40
jmp 0x100169dc
mov dword [ebp - 4], 4
jmp 0x100169c2
mov dword [ebp - 4], 0x20
jmp 0x100169c2
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x10016a0e
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x1001698e
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.1001621f
sbb ecx, dword [edi - 0x21]
jmp 0x7a15e005