joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10059420
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x28
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
push eax
lea ecx, [ebp - 4]
call fcn.10059150
lea ecx, [ebp - 4]
call fcn.10059190
movzx eax, al
test eax, eax
jne 0x1005945d
mov dword [ebp - 0x14], 0
lea ecx, [ebp - 4]
call fcn.10059170
mov eax, dword [ebp - 0x14]
jmp 0x10059517
lea ecx, [ebp - 4]
call fcn.10059250
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
push ecx
call fcn.10059210
add esp, 4
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
sub edx, dword [ebp - 0xc]
sar edx, 1
mov dword [ebp - 0x10], edx
push 0x40
push str.minkernelcrtsucrt_srcdesktopcrtenvget_environment_from_os.cpp
push 2
mov eax, dword [ebp - 0x10]
shl eax, 1
push eax
call fcn.1001c5e0
add esp, 0x10
push eax
lea ecx, [ebp - 8]
call fcn.10017b50
lea ecx, [ebp - 8]
call fcn.10017bd0
movzx ecx, al
test ecx, ecx
jne 0x100594cd
mov dword [ebp - 0x1c], 0
lea ecx, [ebp - 8]
call fcn.10017b70
lea ecx, [ebp - 4]
call fcn.10059170
mov eax, dword [ebp - 0x1c]
jmp 0x10059517
lea ecx, [ebp - 4]
call fcn.10059250
mov dword [ebp - 0x20], eax
lea ecx, [ebp - 8]
call fcn.10017d00
mov dword [ebp - 0x24], eax
mov edx, dword [ebp - 0x10]
shl edx, 1
push edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x24]
push ecx
call fcn.10011970
add esp, 0xc
lea ecx, [ebp - 8]
call fcn.10017cd0
mov dword [ebp - 0x28], eax
lea ecx, [ebp - 8]
call fcn.10017b70
lea ecx, [ebp - 4]
call fcn.10059170
mov eax, dword [ebp - 0x28]
mov esp, ebp
pop ebp
ret

Function at 0x1005b740
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1005ade0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1005b774
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x10088154]
call dword [ebp - 8]
jmp 0x1005b77a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esp, ebp
pop ebp
ret 4

Function at 0x1005b7d0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1005ae20
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1005b804
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x10088154]
call dword [ebp - 8]
jmp 0x1005b80e
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret 4
Function at 0x1005b820
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1005ae40
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1005b858
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
mov eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
call dword [0x10088154]
call dword [ebp - 8]
jmp 0x1005b866
mov ecx, dword [ebp + 0xc]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esp, ebp
pop ebp
ret 8

Function at 0x1005b930
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
call fcn.1005aee0
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1005b970
mov eax, dword [ebp - 4]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0xc]
mov dword [ebp - 8], edx
mov ecx, dword [ebp - 8]
call dword [0x10088154]
call dword [ebp - 8]
jmp 0x1005b98e
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 0
mov eax, dword [ebp + 8]
push eax
call fcn.1005bcf0
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10069010
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x4c
lea ecx, [ebp - 0x4c]
call fcn.10054dd0
lea ecx, [ebp - 0x34]
call fcn.10054dd0
call fcn.10055160
push eax
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.10053ba0
add esp, 0xc
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x10069063
mov dword [ebp - 8], 0
lea ecx, [ebp - 0x34]
call fcn.10054ef0
lea ecx, [ebp - 0x4c]
call fcn.10054ef0
mov eax, dword [ebp - 8]
jmp 0x100690d8
call fcn.10055160
push eax
lea edx, [ebp - 0x34]
push edx
mov eax, dword [ebp + 0xc]
push eax
call fcn.10053ba0
add esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1006909e
mov dword [ebp - 0x10], 0
lea ecx, [ebp - 0x34]
call fcn.10054ef0
lea ecx, [ebp - 0x4c]
call fcn.10054ef0
mov eax, dword [ebp - 0x10]
jmp 0x100690d8
lea ecx, [ebp - 0x34]
call fcn.10055580
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x4c]
call fcn.10055580
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0x18]
push edx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x34]
call fcn.10054ef0
lea ecx, [ebp - 0x4c]
call fcn.10054ef0
mov eax, dword [ebp - 0x1c]
mov esp, ebp
pop ebp
ret
Function at 0x10078530
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.10084fb0
mov eax, dword [0x100a7008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x100a8478]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x1420], ecx
mov edx, dword [ebp - 0x1420]
cmp edx, dword [ebp - 0x1424]
jae 0x10078708
lea eax, [ebp - 5]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1418], ecx
mov edx, dword [ebp - 0x1418]
cmp edx, dword [ebp - 0x1430]
jae 0x10078657
mov eax, dword [ebp - 0x1420]
cmp eax, dword [ebp - 0x1424]
jae 0x10078657
mov ecx, dword [ebp - 0x1420]
mov dl, byte [ecx]
mov byte [ebp - 0x1419], dl
mov eax, dword [ebp - 0x1420]
add eax, 1
mov dword [ebp - 0x1420], eax
mov cl, byte [ebp - 0x1419]
mov byte [ebp - 0x1411], cl
movsx edx, byte [ebp - 0x1411]
cmp edx, 0xa
jne 0x10078635
mov eax, dword [ebp - 0x1408]
add eax, 1
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp - 0x1418]
mov byte [ecx], 0xd
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
mov eax, dword [ebp - 0x1418]
mov cl, byte [ebp - 0x1411]
mov byte [eax], cl
mov edx, dword [ebp - 0x1418]
add edx, 1
mov dword [ebp - 0x1418], edx
jmp 0x100785b9
mov eax, dword [ebp - 0x1418]
lea ecx, [ebp - 0x1404]
sub eax, ecx
mov dword [ebp - 0x142c], eax
push 0
lea edx, [ebp - 0x1428]
push edx
mov eax, dword [ebp - 0x142c]
push eax
lea ecx, [ebp - 0x1404]
push ecx
mov edx, dword [ebp - 0x1434]
push edx
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100786c1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
jmp 0x10078728
mov edx, dword [ebp - 0x140c]
add edx, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], edx
mov eax, dword [ebp - 0x1428]
cmp eax, dword [ebp - 0x142c]
jae 0x10078703
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x10078728
jmp 0x10078592
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x1410]
mov dword [eax], ecx
mov edx, dword [ebp - 0x140c]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0x1408]
mov dword [eax + 8], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003840
mov esp, ebp
pop ebp
ret
Function at 0x10078740
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x1434
call fcn.10084fb0
mov eax, dword [0x100a7008]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
sar eax, 6
mov ecx, dword [ebp + 0xc]
and ecx, 0x3f
imul edx, ecx, 0x38
mov eax, dword [eax*4 + 0x100a8478]
mov ecx, dword [eax + edx + 0x18]
mov dword [ebp - 0x1434], ecx
mov edx, dword [ebp + 0x10]
add edx, dword [ebp + 0x14]
mov dword [ebp - 0x1424], edx
xor eax, eax
mov dword [ebp - 0x1410], eax
mov dword [ebp - 0x140c], eax
mov dword [ebp - 0x1408], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 0x141c], ecx
mov edx, dword [ebp - 0x141c]
cmp edx, dword [ebp - 0x1424]
jae 0x1007892b
lea eax, [ebp - 6]
mov dword [ebp - 0x1430], eax
lea ecx, [ebp - 0x1404]
mov dword [ebp - 0x1414], ecx
mov edx, dword [ebp - 0x1414]
cmp edx, dword [ebp - 0x1430]
jae 0x10078876
mov eax, dword [ebp - 0x141c]
cmp eax, dword [ebp - 0x1424]
jae 0x10078876
mov ecx, dword [ebp - 0x141c]
mov dx, word [ecx]
mov word [ebp - 0x141e], dx
mov eax, dword [ebp - 0x141c]
add eax, 2
mov dword [ebp - 0x141c], eax
mov cx, word [ebp - 0x141e]
mov word [ebp - 0x1418], cx
movzx edx, word [ebp - 0x1418]
cmp edx, 0xa
jne 0x10078852
mov eax, dword [ebp - 0x1408]
add eax, 2
mov dword [ebp - 0x1408], eax
mov ecx, 0xd
mov edx, dword [ebp - 0x1414]
mov word [edx], cx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
mov ecx, dword [ebp - 0x1414]
mov dx, word [ebp - 0x1418]
mov word [ecx], dx
mov eax, dword [ebp - 0x1414]
add eax, 2
mov dword [ebp - 0x1414], eax
jmp 0x100787c9
mov ecx, dword [ebp - 0x1414]
lea edx, [ebp - 0x1404]
sub ecx, edx
sar ecx, 1
shl ecx, 1
mov dword [ebp - 0x142c], ecx
push 0
lea eax, [ebp - 0x1428]
push eax
mov ecx, dword [ebp - 0x142c]
push ecx
lea edx, [ebp - 0x1404]
push edx
mov eax, dword [ebp - 0x1434]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x100788e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 0x1410], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
jmp 0x1007894b
mov eax, dword [ebp - 0x140c]
add eax, dword [ebp - 0x1428]
mov dword [ebp - 0x140c], eax
mov ecx, dword [ebp - 0x1428]
cmp ecx, dword [ebp - 0x142c]
jae 0x10078926
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 0x1410]
mov dword [edx], eax
mov ecx, dword [ebp - 0x140c]
mov dword [edx + 4], ecx
mov eax, dword [ebp - 0x1408]
mov dword [edx + 8], eax
mov eax, dword [ebp + 8]
jmp 0x1007894b
jmp 0x100787a2
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x1410]
mov dword [ecx], edx
mov eax, dword [ebp - 0x140c]
mov dword [ecx + 4], eax
mov edx, dword [ebp - 0x1408]
mov dword [ecx + 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10003840
mov esp, ebp
pop ebp
ret
Function at 0x4030bb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x4030ca
pop dword [ebp - 0x20]
mov eax, 0x9a318e09
add eax, 0x660ea2c1
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x472f587b
sub dword [ebp - 0x30], 0xf8dd1330
mov dword [ebp - 0x2c], 0x548b17cd
add dword [ebp - 0x2c], 0xdda83478
mov dword [ebp - 0x28], 0x7429d78b
add dword [ebp - 0x28], 0xd8226ca3
mov dword [ebp - 0x24], 0x1cc53783
sub dword [ebp - 0x24], 0x1cc53783
lea eax, [ebp - 0x30]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x5090c342
sub dword [ebp - 0x30], 0xdc1e59ec
mov dword [ebp - 0x2c], 0x93102cea
sub dword [ebp - 0x2c], 0x51a3cb75
mov dword [ebp - 0x28], 0x32eddee
add dword [ebp - 0x28], 0x60408e7e
mov dword [ebp - 0x24], 0x9b0bc0ca
sub dword [ebp - 0x24], 0x9b0bc0ca
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3651c
push 0
call eax
mov ecx, 0xe26bdc39
add ecx, 0x1d94691b
mov edx, eax
mov edi, 0x531eb5ec
add edi, 0xad264e14
add edi, dword [ebp - 0x20]
mov esi, 0xe69cffc3
add esi, 0x59992cb6
xor dword [ebp - 0x10], esi
mov ebx, dword [edi]
xor dword [ebp - 0x14], 0x57b11203
sub ebx, esi
sub dword [ebp - 0x14], esi
mov dword [edx], ebx
add edx, 0xafb96478
add edx, 0x50469b8c
add edi, 0x9eb82ea9
sub edi, 0x9eb82ea5
loop 0x4031e2
add eax, 0x10823
xor ebx, ebx
add ebx, eax
add eax, 0xdb9d3f88
sub eax, 0xdb9d3f83
mov ecx, 0x400000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x63681fa8
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x35220365
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x40c96d
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41b558]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00409fc3
mov dword [ebp - 0x14], eax
cmp dword [0x437558], esi
jne 0x40ca60
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c9ed
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40cb40
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40cb40
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40cb40
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x437558], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x43755c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x437560], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x437568], eax
test eax, eax
je 0x40ca5d
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x437564], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40ca85
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40ca78
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40ca9a
push 4
pop eax
jmp 0x40cb42
cmp dword [ebp - 0x14], esi
je 0x40ca9a
push dword [0x437558]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40ca7f
mov eax, dword [0x437564]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40caf8
cmp dword [0x437568], edi
je 0x40caf8
push eax
call ebx
push dword [0x437568]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40caf8
test eax, eax
je 0x40caf8
call ecx
test eax, eax
je 0x40caed
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40caed
test byte [ebp - 8], 1
jne 0x40caf8
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40cb28
mov eax, dword [0x43755c]
cmp eax, edi
je 0x40cb25
push eax
call ebx
test eax, eax
je 0x40cb25
call eax
mov esi, eax
test esi, esi
je 0x40cb25
mov eax, dword [0x437560]
cmp eax, edi
je 0x40cb25
push eax
call ebx
test eax, eax
je 0x40cb25
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x437558]
call ebx
test eax, eax
je 0x40cb40
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40cb42
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404450
mov esp, ebp
pop ebp
ret
Function at 0x402ead
Capabilities:
Compare security identifiers

Disassembly:
push ebx
push esi
lea ebx, [ecx + 4]
push edi
mov edi, edx
test ebx, ebx
je 0x402ee3
lea esi, [edi + 4]
test esi, esi
je 0x402ee3
call fcn.00402e0f
test al, al
je 0x402ee3
mov ecx, edi
call fcn.00402e0f
test al, al
je 0x402ee3
push esi
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
test eax, eax
setne al
jmp 0x402ee5
xor al, al
pop edi
pop esi
pop ebx
ret

Function at 0x4062d4
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp byte [esi + 8], 0
jne 0x406355
mov byte [esi + 8], 1
call main
cmp dword [esi + 0x10], 0
je 0x406355
test al, al
je 0x4062f4
mov byte [esi + 0xa], 1
mov ecx, esi
call fcn.004069af
test al, al
jne 0x40631b
push dword [esi + 0xc]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
call fcn.004077ed
add esp, 0xc
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
pop esi
ret
mov ecx, esi
call main
cmp dword [esi + 0x18], 0
jne 0x406342
push dword [esi + 0x14]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_create_logging_file__s_n
call fcn.004077ed
add esp, 0xc
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
cmp dword [esi + 0x10], 0
mov byte [esi + 9], 1
je 0x406355
push dword [esi + 0x10]
call dword [sym.imp.kernel32.dll_ReleaseMutex]
pop esi
ret

Function at 0x4069af
Capabilities:
Print debug messages

Disassembly:
push esi
mov esi, ecx
cmp dword [esi + 0x10], 0
jne 0x4069bc
xor al, al
pop esi
ret
push 0x1f4
push dword [esi + 0x10]
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
test eax, eax
je 0x4069f5
cmp eax, 0x80
je 0x4069f5
push dword [esi + 0xc]
push dword [esi + 0x1c]
push str.LOG_SYSTEM:___s_:_Could_not_acquire_logging_mutex__s_n
call fcn.004077ed
add esp, 0xc
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov byte [esi + 9], 0
jmp 0x4069b8
mov al, 1
pop esi
ret

Function at 0x407e00
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
push ebx
push edi
mov edi, ecx
push edi
call dword [sym.imp.kernel32.dll_lstrlenW]
push 0
mov ebx, eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x407e6f
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
lea ebx, [ebx*2 + 2]
push ebx
push 0x2002
call dword [sym.imp.kernel32.dll_GlobalAlloc]
mov esi, eax
push esi
call dword [sym.imp.kernel32.dll_GlobalLock]
test eax, eax
je 0x407e4b
push ebx
push edi
push eax
call fcn.0040c6e0
add esp, 0xc
push esi
call dword [sym.imp.kernel32.dll_GlobalUnlock]
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x407e66
push esi
call dword [sym.imp.kernel32.dll_GlobalFree]
pop esi
pop edi
pop ebx
jmp dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop ebx
ret
Function at 0x10007c1f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x10007c2e
pop dword [ebp - 8]
mov eax, 0x2f8d88f2
sub eax, 0x1f8d0cc4
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0x50833dc1
add dword [ebp - 0x18], 0xfdcf078a
mov dword [ebp - 0x14], 0xd7cb90e0
sub dword [ebp - 0x14], 0xa598449b
mov dword [ebp - 0x10], 0x8036c897
sub dword [ebp - 0x10], 0x33ea8469
mov dword [ebp - 0xc], 0x3577c89d
sub dword [ebp - 0xc], 0x3577c89d
lea eax, [ebp - 0x18]
push eax
mov eax, 0xfed09fe5
add eax, 0x112fe06f
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x6bd2d22
add dword [ebp - 0x18], 0x6db53c34
mov dword [ebp - 0x14], 0x7660c655
add dword [ebp - 0x14], 0xcb0b9b20
mov dword [ebp - 0x10], 0x89064349
add dword [ebp - 0x10], 0xda692923
mov dword [ebp - 0xc], 0x9338e0b
add dword [ebp - 0xc], 0xf6cc71f5
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x8a236c3f
add eax, 0x85dd1411
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x35e5a
push 0
call eax
mov ecx, 0x44eb
xor esi, esi
add esi, eax
mov edi, 0x1000fa00
add edi, dword [ebp - 8]
mov edx, 0x91fb9b31
add edx, 0x2c0fda6b
xor dword [ebp - 4], 0x367c6aac
mov ebx, dword [edi]
add dword [ebp - 4], eax
xor ebx, edx
xor dword [ebp - 4], edi
mov dword [esi], ebx
add dword [ebp - 4], 0x195b6503
add esi, 4
add edi, 4
loop 0x10007d46
add eax, 0x4321edfb
sub eax, 0x4320e77c
mov ebx, eax
add eax, 0xc231d1a1
sub eax, 0xc231d19c
mov ecx, 0x9c8a4b51
sub ecx, 0x8c8a4b51
add ecx, dword [ebp - 8]
call ebx
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x4015a0
Capabilities:
Terminate process

Disassembly:
call fcn.00401940
jmp fcn.004012d0

Function at 0x4015b0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x403008]
jne 0x4015ba
repz ret
jmp fcn.004019f0
Function at 0x10003626
Capabilities:
Query or enumerate registry key

Disassembly:
sub esp, 0x11c
mov eax, dword [0x10041024]
xor eax, esp
mov dword [esp + 0x118], eax
push ebx
mov ebx, dword [esp + 0x124]
push ebp
push esi
push edi
mov edi, ecx
xor ebp, ebp
lea ecx, [esp + 0x14]
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], ebp
mov dword [esp + 0x1c], ebp
mov eax, dword [edi + 4]
or eax, 0x2001f
push eax
push ebx
push dword [edi]
call fcn.1000eda3
mov esi, eax
test esi, esi
jne 0x100036d5
lea eax, [esp + 0x20]
push eax
push ebp
push ebp
push ebp
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExA]
jmp 0x100036b0
lea eax, [esp + 0x28]
push eax
call fcn.10003626
mov esi, eax
test esi, esi
jne 0x100036d5
lea eax, [esp + 0x20]
xor ecx, ecx
push eax
push ecx
push ecx
push ecx
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x3c]
push eax
push ecx
push dword [esp + 0x30]
mov dword [esp + 0x30], 0x100
call ebp
lea ecx, [esp + 0x14]
test eax, eax
je 0x1000368b
call fcn.10002ded
push ebx
mov ecx, edi
call fcn.10002e76
mov esi, eax
lea ecx, [esp + 0x14]
call fcn.10002ded
mov ecx, dword [esp + 0x128]
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000be90
add esp, 0x11c
ret 4