joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405490
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x408cc5
mov eax, dword fs:[0]
push eax
sub esp, 0xe0
push esi
push edi
mov eax, dword [0x40e028]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push str.szca_guard_0ADBB70C_18A1_4BD9_86CE_92EC1E0E4629
push 1
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 0xb8], eax
cmp eax, edi
je 0x405509
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x405509
mov eax, dword [esi + 0xb8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0xb8], edi
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 0x14]
push ecx
mov dword [ebp - 0x14], 8
mov dword [ebp - 0x10], 0xff
call dword [sym.imp.COMCTL32.dll_InitCommonControlsEx]
mov ecx, esi
call dword [sym.imp.mfc100u.dll_CWinApp::InitInstance]
push edi
call dword [sym.imp.mfc100u.dll_AfxEnableControlContainer]
push 0xc
call dword [sym.imp.mfc100u.dll_new]
add esp, 8
mov dword [ebp - 0x18], eax
mov dword [ebp - 4], edi
cmp eax, edi
je 0x40554f
mov ecx, eax
call dword [sym.imp.mfc100u.dll_CShellManager::CShellManager]
mov edi, eax
lea edx, [ebp - 0xec]
push edx
mov dword [ebp - 4], 0xffffffff
call fcn.00405920
lea eax, [ebp - 0xec]
mov dword [ebp - 4], 1
mov ecx, eax
mov dword [esi + 0x20], eax
call dword [sym.imp.mfc100u.dll_CDialog::DoModal]
test edi, edi
je 0x405589
mov edx, dword [edi]
mov eax, dword [edx + 4]
push 1
mov ecx, edi
call eax
lea ecx, [ebp - 0xec]
push ecx
mov dword [ebp - 4], 0xffffffff
call fcn.004055b0
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x4061f0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x40e028]
jne 0x4061fa
repz ret
jmp fcn.00406724
Function at 0x407500
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push 0xffffffffffffffff
push 0x4085b8
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x40e028]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov eax, dword [0x40e030]
cmp eax, 0xffffffff
jne 0x407535
xor esi, esi
jmp 0x40753e
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esi, eax
mov dword [esp + 0x14], esi
mov ebp, dword [sym.imp.KERNEL32.dll_HeapFree]
mov dword [esp + 0x24], 0
test esi, esi
je 0x407585
cmp dword [esi + 0x1c], 0
jne 0x4075c8
cmp dword [esi + 0xc], 0
jne 0x4075d0
push 0x406910
push 0x40eb74
call fcn.00406f60
mov eax, dword [0x40e030]
add esp, 8
cmp eax, 0xffffffff
je 0x407585
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [esp + 0x24], 0xffffffff
test esi, esi
je 0x4075b4
lea ecx, [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_InterlockedDecrement]
test eax, eax
jne 0x4075b4
mov edx, dword [esi]
push eax
mov eax, dword [edx]
mov ecx, esi
call eax
push esi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
cmp dword [esi + 0xc], 0
je 0x407610
mov edi, edi
mov ebx, dword [esi + 0xc]
mov eax, dword [ebx + 4]
mov dword [esi + 0xc], eax
mov ecx, dword [ebx]
test ecx, ecx
je 0x4075fe
mov edx, dword [ecx]
mov eax, dword [edx + 4]
call eax
mov edi, dword [ebx]
mov edx, dword [edi]
mov eax, dword [edx]
push 0
mov ecx, edi
call eax
push edi
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call ebp
cmp dword [esi + 0xc], 0
jne 0x4075d0
cmp dword [esi + 0x1c], 0
je 0x40755a
lea ebx, [ebx]
mov ecx, dword [esi + 0x18]
mov edi, dword [ecx]
mov eax, dword [edi + 0x14]
test eax, eax
je 0x40763d
mov ecx, dword [edi + 0x18]
test ecx, ecx
je 0x40763d
mov edx, dword [edi + 0x10]
push ecx
push eax
call edx
add esp, 8
push edi
lea eax, [esp + 0x1c]
push eax
lea ecx, [esi + 0x14]
call fcn.00403060
cmp dword [esi + 0x1c], 0
jne 0x407620
jmp 0x407554

Function at 0x4076f0
Capabilities:
Create thread
Resume thread

Disassembly:
push ebx
push edi
mov edi, ecx
mov eax, dword [edi]
lea ecx, [eax + 0x10]
push ecx
push 4
push eax
push 0x407660
push 0
push 0
call dword [sym.imp.MSVCR100.dll__beginthreadex]
mov ebx, eax
add esp, 0x18
test ebx, ebx
jne 0x40771a
pop edi
xor al, al
pop ebx
ret
mov edx, dword [edi]
push esi
add edx, 4
push edx
call dword [sym.imp.KERNEL32.dll_InterlockedIncrement]
mov esi, dword [edi]
mov eax, dword [esi + 8]
test eax, eax
je 0x40773c
cmp eax, 0xffffffff
je 0x40773c
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 8], ebx
mov eax, dword [edi]
mov ecx, dword [eax + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
pop edi
mov al, 1
pop ebx
ret
Function at 0x407900
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x408670
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x40e028]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 0x14], esi
mov dword [esi], vtable.boost::exception_detail::clone_base.0
mov ebp, dword [esp + 0x2c]
lea edi, [esi + 4]
xor ebx, ebx
push ebp
mov ecx, edi
mov dword [esp + 0x28], ebx
mov dword [esp + 0x1c], edi
call dword [sym.imp.MSVCR100.dll_public:_void___thiscall_std::exception::constructor_class_std::exception_const__]
mov dword [edi], vtable.boost::system::system_error.0
mov eax, dword [ebp + 0xc]
mov dword [edi + 0xc], eax
mov ecx, dword [ebp + 0x10]
mov dword [edi + 0x10], ecx
mov edx, dword [ebp + 0x14]
push 0xffffffffffffffff
lea ecx, [edi + 0x18]
mov dword [edi + 0x14], edx
push ebx
add ebp, 0x18
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], ebx
push ebp
mov byte [esp + 0x30], 1
mov byte [ecx], bl
call fcn.00402b80
mov dword [edi], vtable.boost::lock_error.0
mov dword [esi + 0x38], vtable.boost::exception.0
mov dword [esi + 0x3c], ebx
mov dword [esi + 0x40], ebx
mov dword [esi + 0x44], ebx
mov dword [esi + 0x48], 0xffffffff
mov dword [esi], vtable.boost::wrapexcept_class_boost::lock_error_.2.0
mov dword [edi], vtable.boost::wrapexcept_class_boost::lock_error_.1.0
mov dword [esi + 0x38], vtable.boost::wrapexcept_class_boost::lock_error_.0
mov eax, esi
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret 4
Function at 0x101b3220
Capabilities:
Get geographical location
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xe4
push ebx
push esi
push edi
lea edi, [ebp - 0x24]
mov ecx, 9
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x102890dd
call fcn.100bd3a9
nop
call fcn.101b1470
mov dword [ebp - 8], eax
mov esi, esp
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
cmp esi, esp
call fcn.100bc3e1
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
shr eax, 0x10
and eax, 0xffff
movzx ecx, ax
mov dword [ebp - 0x20], ecx
mov esi, esp
push 4
mov eax, dword [ebp - 8]
add eax, 0x24
push eax
push 0x20001004
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
cmp esi, esp
call fcn.100bc3e1
test eax, eax
jne 0x101b32a2
mov eax, dword [ebp - 8]
mov dword [eax + 0x24], 0
pop edi
pop esi
pop ebx
add esp, 0xe4
cmp ebp, esp
call fcn.100bc3e1
mov esp, ebp
pop ebp
ret

Function at 0x101b4e90
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc4
push ebx
push esi
push edi
lea edi, [ebp - 4]
mov ecx, 1
mov eax, 0xcccccccc
rep stosd dword es:[edi], eax
mov ecx, 0x102890dd
call fcn.100bd3a9
nop
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cmp esi, esp
call fcn.100bc3e1
movsx ecx, ax
and ecx, 0x8000
je 0x101b4ee0
mov dword [ebp - 0xc4], 1
jmp 0x101b4eea
mov dword [ebp - 0xc4], 0
movzx eax, byte [ebp - 0xc4]
pop edi
pop esi
pop ebx
add esp, 0xc4
cmp ebp, esp
call fcn.100bc3e1
mov esp, ebp
pop ebp
ret
Function at 0x10226620
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov dword [ebp - 0xc], 0xcccccccc
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov dword [ebp - 4], 0
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov ecx, dword [ebp + 8]
mov dword [ecx + 4], 0
mov edx, dword [ebp + 8]
mov dword [edx + 8], 0
mov eax, dword [ebp + 8]
push eax
call fcn.102263e0
add esp, 4
test eax, eax
jne 0x1022667c
mov dword [ebp - 4], 9
jmp 0x10226709
mov ecx, dword [ebp + 8]
cmp dword [ecx], 0
je 0x10226709
mov dword [ebp - 8], 0
jmp 0x1022669a
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax + 8]
jae 0x10226709
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov esi, esp
mov ecx, dword [ebp - 8]
mov edx, dword [eax + ecx*4]
push edx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.100bc3e1
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10226707
mov esi, esp
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp esi, esp
call fcn.100bc3e1
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp - 0xc]
push eax
call fcn.10226200
add esp, 0xc
mov esi, esp
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100bc3e1
jmp 0x10226691
mov eax, dword [ebp - 4]
pop esi
add esp, 0xc
cmp ebp, esp
call fcn.100bc3e1
mov esp, ebp
pop ebp
ret

Function at 0x10226720
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 8]
cmp dword [eax], 0
je 0x102267cb
mov dword [ebp - 4], 0
jmp 0x10226753
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 8]
jae 0x102267ae
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
mov esi, esp
mov eax, dword [ebp - 4]
mov ecx, dword [edx + eax*4]
push ecx
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp esi, esp
call fcn.100bc3e1
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x102267ac
mov esi, esp
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp esi, esp
call fcn.100bc3e1
mov esi, esp
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, esp
call fcn.100bc3e1
jmp 0x1022674a
mov esi, esp
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
push edx
push 0
mov eax, dword [0x10284a54]
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
cmp esi, esp
call fcn.100bc3e1
pop esi
add esp, 8
cmp ebp, esp
call fcn.100bc3e1
mov esp, ebp
pop ebp
ret
Function at 0x102267e0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
push edi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
imul eax, dword [ebp + 8], 0x2c
add eax, dword [0x10284ea0]
mov dword [ebp - 4], eax
mov dword [ebp - 0x14], 5
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x10226843
mov eax, dword [ebp - 0x18]
sub eax, 5
mov dword [ebp - 0x18], eax
mov ecx, dword [ebp - 0x14]
add ecx, 2
mov dword [ebp - 0x14], ecx
mov esi, esp
lea edx, [ebp - 0xc]
push edx
push 0x40
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.100bc3e1
test eax, eax
jne 0x1022686e
mov eax, 0xa
jmp 0x10226970
cmp dword [ebp + 0xc], 0
je 0x102268ba
mov edx, dword [ebp - 0x18]
mov dword [ebp - 0x1c], edx
mov eax, dword [ebp - 0x1c]
mov byte [eax], 0xe9
mov ecx, dword [ebp - 0x18]
add ecx, 5
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + 1], eax
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 1
movzx ecx, al
test ecx, ecx
je 0x102268b8
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
mov byte [ecx], 0xeb
mov edx, dword [ebp - 0x20]
mov byte [edx + 1], 0xf9
jmp 0x102268f6
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 1
movzx edx, cl
test edx, edx
je 0x102268e1
push 7
mov eax, dword [ebp - 4]
add eax, 0xc
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call fcn.100bd101
add esp, 0xc
jmp 0x102268f6
push 5
mov edx, dword [ebp - 4]
add edx, 0xc
push edx
mov eax, dword [ebp - 0x18]
push eax
call fcn.100bd101
add esp, 0xc
mov esi, esp
lea ecx, [ebp - 0xc]
push ecx
mov edx, dword [ebp - 0xc]
push edx
mov eax, dword [ebp - 0x14]
push eax
mov ecx, dword [ebp - 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.100bc3e1
mov esi, esp
mov edx, dword [ebp - 0x14]
push edx
mov eax, dword [ebp - 0x18]
push eax
mov edi, esp
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
cmp edi, esp
call fcn.100bc3e1
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
cmp esi, esp
call fcn.100bc3e1
mov cl, byte [ebp + 0xc]
and cl, 1
shl cl, 1
mov edx, dword [ebp - 4]
mov al, byte [edx + 0x14]
and al, 0xfd
or al, cl
mov ecx, dword [ebp - 4]
mov byte [ecx + 0x14], al
mov dl, byte [ebp + 0xc]
and dl, 1
shl dl, 2
mov eax, dword [ebp - 4]
mov cl, byte [eax + 0x14]
and cl, 0xfb
or cl, dl
mov edx, dword [ebp - 4]
mov byte [edx + 0x14], cl
xor eax, eax
push edx
mov ecx, ebp
push eax
lea edx, [0x10226994]
call fcn.100bbdc4
pop eax
pop edx
pop edi
pop esi
add esp, 0x20
cmp ebp, esp
call fcn.100bc3e1
mov esp, ebp
pop ebp
ret
Function at 0x102275f0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov dword [ebp - 8], 0xcccccccc
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [0x10284e94]
mov dword [ebp - 4], eax
jmp 0x10227617
mov ecx, dword [ebp - 4]
mov edx, dword [ecx]
mov dword [ebp - 4], edx
cmp dword [ebp - 4], 0
je 0x10227630
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
je 0x1022762e
mov eax, dword [ebp - 4]
jmp 0x102276b4
jmp 0x1022760f
mov esi, esp
push 0x40
push 0x3000
push 0x1000
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp esi, esp
call fcn.100bc3e1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x102276b1
mov ecx, dword [ebp - 4]
add ecx, 0x20
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 4]
mov dword [edx + 4], 0
mov eax, dword [ebp - 4]
mov dword [eax + 8], 0
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 4]
mov eax, dword [edx + 4]
mov dword [ecx], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [ecx + 4], edx
mov eax, dword [ebp - 8]
add eax, 0x20
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
sub ecx, dword [ebp - 4]
cmp ecx, 0xfe0
jbe 0x10227673
mov edx, dword [ebp - 4]
mov eax, dword [0x10284e94]
mov dword [edx], eax
mov ecx, dword [ebp - 4]
mov dword [0x10284e94], ecx
mov eax, dword [ebp - 4]
pop esi
add esp, 8
cmp ebp, esp
call fcn.100bc3e1
mov esp, ebp
pop ebp
ret

Function at 0x10227c70
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp + 8]
movzx eax, byte [edx + ecx]
test eax, eax
je 0x10227cb9
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x90
je 0x10227cb9
mov edx, 1
imul eax, edx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + eax]
cmp edx, 0xcc
je 0x10227cb9
xor eax, eax
jmp 0x10227cfa
mov dword [ebp - 4], 1
jmp 0x10227ccb
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10227cf5
mov edx, dword [ebp + 8]
add edx, dword [ebp - 4]
movzx eax, byte [edx]
mov ecx, 1
imul edx, ecx, 0
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + edx]
cmp eax, edx
je 0x10227cf3
xor eax, eax
jmp 0x10227cfa
jmp 0x10227cc2
mov eax, 1
mov esp, ebp
pop ebp
ret
Function at 0x405770
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x40577f
pop dword [ebp - 0x4c]
mov eax, 0xf4ed0d8c
sub eax, 0xf4acb60d
sub dword [ebp - 0x4c], eax
push 0x40
push 0x1000
push 0x4e22f
push 0
mov eax, 0xe0c5c547
sub eax, 0xe081128b
add eax, dword [ebp - 0x4c]
call dword [eax]
mov ecx, 0xed3d1907
sub ecx, 0xed3cd917
mov ebx, eax
mov edi, 0x487e00
add edi, dword [ebp - 0x4c]
mov edx, 0x5947be6d
add edx, 0x15cd6b5c
xor dword [ebp - 0x3c], edx
mov esi, dword [edi]
add dword [ebp - 0x14], 0xeb97ebf3
add esi, edx
xor dword [ebp - 0xc], edi
mov dword [ebx], esi
mov dword [ebp - 0x30], 0xbf967766
add ebx, 0x775266f5
add ebx, 0x88ad990f
add edi, 4
loop 0x4057d8
add eax, 0x2b68f328
add eax, 0xd497ff6b
xor ebx, ebx
add ebx, eax
add eax, 0xf576b6d3
sub eax, 0xf576b6ce
mov ecx, 0x2dcc2193
sub ecx, 0x2d8c2193
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret

Function at 0x43fcae
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46b5d8
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x43fcf1
push str.SystemFunction040
push dword [0x46b5d8]
call edi
push str.SystemFunction041
push dword [0x46b5d8]
mov dword [0x46b5e0], eax
call edi
mov dword [0x46b5e4], eax
jmp 0x43fcf6
mov eax, dword [0x46b5e4]
cmp dword [0x46b5e0], 0
je 0x43fd07
test eax, eax
jne 0x43fdae
push 0x46b5dc
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x43fdb8
push str.CryptProtectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e0], 0
mov dword [0x46b5e8], eax
jne 0x43fd6c
test eax, eax
jne 0x43fd6c
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fd56
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fd5d
mov esi, 0x80004005
push esi
push 0x28
push str.cryputil.cpp
call fcn.00403821
jmp 0x43fdb8
push str.CryptUnprotectMemory
push dword [0x46b5dc]
call edi
cmp dword [0x46b5e4], 0
mov dword [0x46b5ec], eax
jne 0x43fdae
test eax, eax
jne 0x43fdae
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x43fda2
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x43fda9
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x43fd60
mov dword [0x46b5f0], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x6fd91260
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
mov ecx, 0x81
mov ebp, esp
push edi
push esi
lea edi, [ebp - 0x66c]
push ebx
sub esp, 0xc94
mov dword [ebp - 0xc94], eax
movzx eax, word [0x6fd9a14a]
mov esi, dword [sym.imp.msvcrt.dll_wcscpy]
mov word [ebp - 0x670], ax
xor eax, eax
mov word [ebp - 0x66e], ax
xor eax, eax
rep stosd dword es:[edi], eax
lea edi, [ebp - 0xc88]
mov dword [esp + 4], edx
mov dword [esp], edi
call esi
mov eax, dword [sym.imp.msvcrt.dll_wcslen]
mov dword [esp], edi
mov dword [ebp - 0xc98], eax
call eax
cmp word [ebp + eax*2 - 0xc8a], 0x5c
je 0x6fd912d9
mov dword [esp + 4], 0x6fd9a12e
mov dword [esp], edi
call dword [sym.imp.msvcrt.dll_wcscat]
lea ebx, [ebp - 0x468]
mov dword [esp + 4], edi
mov dword [esp], ebx
call esi
mov dword [esp + 4], 0x6fd9a132
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_wcscat]
lea eax, [ebp - 0x260]
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._FindFirstFileW_8
mov dword [ebp - 0xc90], 0
sub esp, 8
mov dword [ebp - 0xc8c], eax
cmp eax, 0xffffffff
je 0x6fd9137d
lea ebx, [ebp - 0xa80]
lea eax, [ebp - 0x234]
mov dword [esp], ebx
mov dword [esp + 4], eax
call esi
mov dword [esp + 4], 0x6fd9a136
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
jne 0x6fd91390
lea eax, [ebp - 0x260]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc8c]
mov dword [esp], eax
call sym._FindNextFileW_8
sub esp, 8
test eax, eax
jne 0x6fd91329
mov eax, dword [ebp - 0xc8c]
mov dword [esp], eax
call sym._FindClose_4
sub esp, 4
mov eax, dword [ebp - 0xc90]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 4], 0x6fd9a13a
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_wcscmp]
test eax, eax
je 0x6fd9134d
test byte [ebp - 0x260], 0x10
je 0x6fd91400
lea edx, [ebp - 0x878]
mov dword [esp + 4], edi
mov dword [esp], edx
call esi
lea edx, [ebp - 0x878]
mov dword [esp + 4], ebx
mov dword [esp], edx
call dword [sym.imp.msvcrt.dll_wcscat]
mov eax, dword [ebp - 0xc94]
lea edx, [ebp - 0x878]
call sym._SearchDriverRecursive
test eax, eax
je 0x6fd9134d
mov dword [ebp - 0xc90], 1
jmp 0x6fd9134d
mov dword [esp + 4], 0x2e
mov dword [esp], ebx
call dword [sym.imp.msvcrt.dll_wcsrchr]
test eax, eax
je 0x6fd91490
mov dword [esp + 4], 0x6fd9a140
mov dword [esp], eax
call dword [sym.imp.msvcrt.dll__wcsicmp]
test eax, eax
jne 0x6fd9134d
lea edx, [ebp - 0x670]
mov dword [esp + 4], edi
mov dword [esp], edx
call dword [sym.imp.msvcrt.dll_wcscmp]
lea edx, [ebp - 0x670]
test eax, eax
je 0x6fd9134d
mov dword [esp + 4], edi
mov dword [esp], edx
call esi
mov dword [esp], edi
mov eax, dword [ebp - 0xc98]
call eax
cmp eax, 0x104
ja 0x6fd9134d
mov eax, dword [ebp - 0xc94]
xor ecx, ecx
mov edx, edi
call sym._SearchDriver
test eax, eax
jne 0x6fd913e9
jmp 0x6fd9134d
mov eax, 0x6fd9a12c
jmp 0x6fd91415
Function at 0x6fd915b0
Capabilities:
Get disk information
Get graphical window text

Disassembly:
push ebp
xor eax, eax
mov ebp, esp
push edi
push esi
xor esi, esi
push ebx
xor ebx, ebx
sub esp, 0x2c
mov word [ebp - 0x12], ax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x16], 0x3a003f
test eax, eax
jne 0x6fd916e0
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x1c], 0
test edi, edi
jne 0x6fd916c2
mov eax, dword [ebp + 8]
mov edi, dword [eax + 0x654]
call sym._GetProcessHeap_0
mov dword [esp + 4], 0
mov dword [esp + 8], edi
mov dword [esp], eax
call sym._HeapFree_12
sub esp, 0xc
call sym._GetProcessHeap_0
lea edx, [esi + esi + 2]
mov dword [esp + 4], 0
mov dword [esp + 8], edx
mov dword [esp], eax
call sym._HeapAlloc_12
mov edi, eax
mov eax, dword [ebp + 8]
sub esp, 0xc
mov dword [eax + 0x654], edi
test edi, edi
je 0x6fd91762
mov esi, dword [ebp + 0xc]
test esi, esi
je 0x6fd916a5
mov ecx, 0x41
mov esi, 1
mov word [ebp - 0x16], cx
jmp 0x6fd91673
movzx eax, word [ebp - 0x16]
add esi, esi
add eax, 1
mov word [ebp - 0x16], ax
cmp ax, 0x5a
ja 0x6fd916a5
test ebx, esi
je 0x6fd91660
lea eax, [ebp - 0x16]
mov dword [esp], eax
call sym._GetDriveTypeW_4
sub esp, 4
cmp eax, 2
je 0x6fd9168f
cmp eax, 5
jne 0x6fd91660
lea eax, [ebp - 0x16]
mov dword [esp], edi
mov dword [esp + 4], eax
call dword [sym.imp.msvcrt.dll_swprintf]
lea edi, [edi + eax*2 + 2]
jmp 0x6fd91660
mov edx, dword [ebp + 0x10]
test edx, edx
jne 0x6fd91740
xor eax, eax
mov word [edi], ax
lea esp, [ebp - 0xc]
mov eax, 1
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [ebp + 0x14]
mov dword [esp], eax
call sym._GetWindowTextLengthW_4
add eax, 1
sub esp, 4
mov dword [ebp - 0x1c], eax
add esi, eax
jmp 0x6fd915e7
call sym._GetLogicalDrives_0
mov edi, 1
mov ebx, eax
mov eax, 0x41
mov word [ebp - 0x16], ax
jmp 0x6fd91717
movzx eax, word [ebp - 0x16]
add edi, edi
add eax, 1
mov word [ebp - 0x16], ax
cmp ax, 0x5a
ja 0x6fd915d5
test ebx, edi
je 0x6fd91700
lea eax, [ebp - 0x16]
mov dword [esp], eax
call sym._GetDriveTypeW_4
sub esp, 4
cmp eax, 2
je 0x6fd91733
cmp eax, 5
jne 0x6fd91700
add esi, 3
jmp 0x6fd91700
mov eax, dword [ebp - 0x1c]
mov dword [esp + 4], edi
mov dword [esp + 8], eax
mov eax, dword [ebp + 0x14]
mov dword [esp], eax
call sym._GetWindowTextW_12
sub esp, 0xc
lea edi, [edi + eax*2 + 2]
jmp 0x6fd916b0
test byte [section..data], 8
jne 0x6fd91784
mov dword [esp], 8
call sym._SetLastError_4
xor eax, eax
sub esp, 4
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 0x14], 0x6fd9a367
mov dword [esp + 0x10], 0x1f3
mov dword [esp + 0xc], str.PrepareFoldersToScan
mov dword [esp + 8], 0x6fd9a071
mov dword [esp + 4], 0x6fd99000
mov dword [esp], 3
call sym._ros_dbg_log
jmp 0x6fd9176b