joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44fb0c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44fcb7
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x44fc98
mov dl, 1
mov eax, dword [0x411ca4]
call fcn.004035e4
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00404380
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x44fc87
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.0043d278
test al, al
je 0x44fc7a
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x44fcc8
lea eax, [ebp - 0x254]
call fcn.004090d8
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44fc7a
xor eax, eax
push ebp
push 0x44fc73
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x44fd00
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44fc5c
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004045e8
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x44fc5c
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004045e8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44fc7a
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x44fb7d
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00415e04
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44fcbe
lea eax, [ebp - 0x260]
call fcn.00404380
ret

Function at 0x4505ec
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x46cc28]
cmp byte [eax + 0xa5], 0
jne 0x45065d
cmp dword [0x46cc40], 0
jne 0x45061e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x4505a8
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x46cc40], eax
cmp dword [0x46cc3c], 0
jne 0x450639
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x46cc3c], eax
cmp dword [0x46cc44], 0
jne 0x45065d
push esp
push 0
push 0
push 0x45054c
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x46cc44], eax
pop edx
ret
Function at 0x450754
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x45076b
add esp, 0xfffffff0
call fcn.00403978
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041b76c
mov eax, dword [0x46b740]
cmp word [eax + 2], 0
jne 0x450793
mov eax, dword [0x46b740]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00451e18
mov eax, dword [0x46b7d4]
cmp word [eax + 2], 0
jne 0x4507ad
mov eax, dword [0x46b7d4]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00452010
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x4117b4]
call fcn.004035e4
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x4117b4]
call fcn.004035e4
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0x80000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41dc1c]
call fcn.0042547c
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x450934
mov eax, dword [0x46b678]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042584c
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x452590
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x46b678]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040a9e8
test eax, eax
je 0x4508a2
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408a34
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040aa10
test eax, eax
je 0x4508b6
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004045e8
mov eax, dword [0x46b574]
cmp byte [eax], 0
jne 0x4508ea
mov eax, ebx
call fcn.00450a5c
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0045276c
mov eax, ebx
call fcn.004530ac
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45092a
call fcn.004039d0
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x450cd0
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x46cc28]
cmp dword [eax + 0x30], 0
je 0x450d7a
cmp dword [ebx + 0x94], 0
jne 0x450d74
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x450c60
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x450d74
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x450d3a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x450d74
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00413e54
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x450d49
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x451858
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45188d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404470
jmp 0x45189a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004043d4
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x452948
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x452989
mov eax, esi
call fcn.004389b0
test al, al
je 0x452989
mov eax, dword [ebx + 0x84]
call fcn.004386ac
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x452989
push 0
mov eax, dword [ebx + 0x84]
call fcn.004386ac
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x456020
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x45604e
mov eax, ebx
call fcn.00456ad8
cmp dword [ebx + 0x3c], 0
je 0x456047
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x4560bf
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x4560b1
cmp dword [ebx + 8], 0
je 0x456070
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x456082
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x4560b1
cmp dword [ebx + 8], 0
je 0x456063
cmp eax, 3
je 0x456095
dec eax
jne 0x456063
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x456063
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x456063
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x4560dd
cmp dword [ebx + 0x10], 0xcc
je 0x4560dd
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.004560e8
pop ebx
ret
Function at 0x46931c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor ebx, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.00404820
mov eax, dword [ebp - 8]
call fcn.00404820
mov eax, dword [ebp + 8]
call fcn.00404820
xor eax, eax
push ebp
push 0x4694c6
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.004686b8
test al, al
je 0x4694a3
push 1
push 0x4694d4
push 0x4694d4
push dword [0x46cc8c]
push dword [ebp - 8]
push 0x4694e0
push dword [ebp + 8]
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004046f8
mov eax, dword [ebp - 0x10]
call fcn.00404830
push eax
push 0x4694e4
mov eax, ebx
call fcn.004386ac
push eax
call sub.shell32.dll_ShellExecuteA
cmp eax, 5
jg 0x4693c6
je 0x46943f
sub eax, 1
jb 0x4693dd
dec eax
je 0x469402
jmp 0x4694a3
sub eax, 8
je 0x469483
sub eax, 0x16
je 0x469461
jmp 0x4694a3
lea eax, [ebp - 0xc]
mov edx, 0x4694f4
call fcn.00404418
push 0
mov cx, word [0x469528]
mov dl, 1
mov eax, dword [ebp - 0xc]
call fcn.0042bae4
jmp 0x4694a3
push 0x469534
push dword [0x46cc8c]
push dword [ebp - 8]
push 0x4694e0
push dword [ebp + 8]
push 0x469554
lea eax, [ebp - 0xc]
mov edx, 6
call fcn.004046f8
push 0
mov cx, word [0x469528]
mov dl, 1
mov eax, dword [ebp - 0xc]
call fcn.0042bae4
jmp 0x4694a3
lea eax, [ebp - 0xc]
mov edx, 0x46956c
call fcn.00404418
push 0
mov cx, word [0x469528]
mov dl, 1
mov eax, dword [ebp - 0xc]
call fcn.0042bae4
jmp 0x4694a3
lea eax, [ebp - 0xc]
mov edx, 0x4695b0
call fcn.00404418
push 0
mov cx, word [0x469528]
mov dl, 1
mov eax, dword [ebp - 0xc]
call fcn.0042bae4
jmp 0x4694a3
lea eax, [ebp - 0xc]
mov edx, 0x469618
call fcn.00404418
push 0
mov cx, word [0x469528]
mov dl, 1
mov eax, dword [ebp - 0xc]
call fcn.0042bae4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4694cd
lea eax, [ebp - 0x10]
mov edx, 4
call fcn.004043a4
lea eax, [ebp + 8]
call fcn.00404380
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x40915c
nop
nop
mov ecx, 0x3fd36429
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x431024
nop
mov eax, section..reloc
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, 0x2a210e8
nop
test eax, eax
nop
nop
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43106c
nop
nop
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x10a50ff0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x10a50ffa
pushal
call 0x10a51000
pop ebp
sub ebp, 0x10
sub ebp, 0xa50ff0
mov al, byte [esp + 0x28]
cmp al, 1
je 0x10a51024
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x10a5102d
mov eax, 0xa50ff0
add eax, ebp
add eax, 0x63
mov ecx, 0x5af
mov edx, 0x10c14702
xor byte [eax], dl
inc eax
dec ecx
jne 0x10a51044
jmp 0x10a51057
mov edi, ecx
mov dword [ebx + 0x202023e], ecx
add ebx, 0xfffffffa
add al, byte [edx]
add al, byte [ecx]
iretd
Function at 0x10001c71
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
push 0x80000301
push 0
push 0xff
push 1
mov ebx, 0x184
call fcn.100037b0
add esp, 0x10
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10001cb6
push ebx
call fcn.1000217b
add esp, 4
pop eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], esp
push dword [ebp - 4]
push 0xff
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x10001ce1
push 6
call fcn.1000218d
add esp, 4
push 0x80000004
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10001cf4
mov eax, 0x1000e268
push eax
push 1
mov ebx, 0x174
call fcn.100037f0
add esp, 0x10
mov dword [ebp - 8], eax
push 0x80000004
push 0
mov eax, dword [ebp - 4]
test eax, eax
jne 0x10001d1d
mov eax, 0x1000e268
push eax
push 1
mov ebx, 0x174
call fcn.100037f0
add esp, 0x10
mov dword [ebp - 0xc], eax
push 0x80000004
push 0
mov eax, dword [ebp - 0xc]
test eax, eax
jne 0x10001d46
mov eax, 0x1000e268
push eax
push 1
mov ebx, 0x130
call fcn.10003880
add esp, 0x10
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x10001d6c
push ebx
call fcn.1000217b
add esp, 4
push 0x80000301
push 0
push dword [ebp - 0x10]
push 0x80000004
push 0
mov eax, dword [ebp - 8]
test eax, eax
jne 0x10001d89
mov eax, 0x1000e268
push eax
push 2
mov ebx, 0x134
call fcn.10003360
add esp, 0x1c
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x10001daf
push ebx
call fcn.1000217b
add esp, 4
mov eax, dword [ebp - 0x14]
jmp 0x10001db7
push eax
mov ebx, dword [ebp - 4]
test ebx, ebx
je 0x10001dc8
push ebx
call fcn.1000217b
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret

Function at 0x100033c0
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp]
mov dword [esp], 0xc
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0xc
ret

Function at 0x100033f0
Capabilities:
Get file size

Disassembly:
mov eax, dword [esp + 8]
push esi
push edi
push 0
push 0x20
push 3
push 0
push 3
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10003418
pop edi
or eax, eax
pop esi
ret
lea ecx, [esp + 0x10]
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [esp + 0x10], 0xffffffff
jne 0x1000343a
pop edi
or eax, 0xffffffff
pop esi
ret
mov eax, edi
pop edi
pop esi
ret
Function at 0x10003450
Capabilities:
Query or enumerate registry value

Disassembly:
sub esp, 0x10
mov eax, dword [esp + 0x18]
push ebx
push ebp
push esi
push edi
push eax
call fcn.10003ae0
mov esi, dword [esp + 0x38]
mov ebx, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
add esp, 4
xor ebp, ebp
repne scasb al, byte es:[edi]
not ecx
dec ecx
mov dword [esp + 0x10], ebp
test ebx, ebx
je 0x100035a0
test ecx, ecx
je 0x100035a0
inc ecx
push ecx
call fcn.10004129
mov ebp, eax
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x5c
mov edx, ecx
mov esi, edi
mov edi, ebp
push ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.100042b0
mov edi, eax
add esp, 0xc
test edi, edi
je 0x100034c9
mov byte [edi], 0
inc edi
lea eax, [esp + 0x1c]
push eax
push ebp
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x1000358d
push 0x400
mov dword [esp + 0x18], 0x400
mov dword [esp + 0x1c], 1
call fcn.10004129
add esp, 4
mov ebx, dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
lea ecx, [esp + 0x14]
mov esi, eax
mov eax, dword [esp + 0x1c]
push ecx
lea edx, [esp + 0x1c]
push esi
push edx
push 0
push edi
push eax
call ebx
test eax, eax
je 0x10003551
cmp eax, 0xea
jne 0x10003579
push esi
call fcn.10004137
mov ecx, dword [esp + 0x18]
push ecx
call fcn.10004129
mov ecx, dword [esp + 0x24]
add esp, 8
lea edx, [esp + 0x14]
mov esi, eax
push edx
lea eax, [esp + 0x1c]
push esi
push eax
push 0
push edi
push ecx
call ebx
test eax, eax
jne 0x1000351c
mov eax, dword [esp + 0x18]
cmp eax, 1
je 0x1000355f
cmp eax, 2
jne 0x10003579
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push esi
call fcn.10003aa0
add esp, 8
mov dword [esp + 0x10], eax
push esi
call fcn.10004137
mov edx, dword [esp + 0x20]
add esp, 4
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push ebp
call fcn.10004137
mov eax, dword [esp + 0x14]
add esp, 4
test eax, eax
jne 0x100035ce
mov ebp, eax
mov eax, dword [esp + 0x48]
test eax, eax
je 0x100035da
mov edx, dword [esp + 0x40]
test edx, edx
je 0x100035da
mov edi, edx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
call fcn.10003aa0
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
pop edi
mov eax, ebp
pop esi
pop ebp
pop ebx
add esp, 0x10
ret
Function at 0x100035f0
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
lea eax, [esp + 0x14]
push edi
push eax
mov dword [esp + 0x1c], 0x44
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
mov eax, dword [esp + 0x84]
xor edi, edi
cmp eax, edi
mov dword [esp + 0x54], edi
mov dword [esp + 0x58], edi
mov dword [esp + 0x44], 1
je case.0x10003631.2
mov ecx, dword [esp + 0x7c]
lea eax, [ecx - 1]
cmp eax, 5
ja case.0x10003631.2
jmp dword [eax*4 + 0x100036bc]
mov word [esp + 0x48], di
jmp 0x1000366a
mov word [esp + 0x48], 2
jmp 0x1000366a
mov word [esp + 0x48], 3
jmp 0x1000366a
mov word [esp + 0x48], 4
jmp 0x1000366a
mov word [esp + 0x48], 7
jmp 0x1000366a
mov word [esp + 0x48], 5
lea edx, [esp + 8]
mov ecx, dword [esp + 0x64]
lea eax, [esp + 0x18]
push edx
push eax
push edi
push edi
push edi
push 1
push edi
push edi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esi, eax
cmp esi, edi
je 0x100036b4
cmp dword [esp + 0x70], edi
je 0x100036a0
mov edx, dword [esp + 8]
push 0xffffffffffffffff
push edx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [esp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
mov ecx, dword [esp + 0xc]
push ecx
call edi
mov eax, esi
pop edi
pop esi
add esp, 0x54
ret

Function at 0x100036f0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x10003782
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x10003774
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x1000376c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x10003735
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
Function at 0x40113c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x425044]
jne 0x401146
repz ret
jmp fcn.00403223

Function at 0x40b1f9
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.00403533
xor ebx, ebx
cmp dword [0x4274a8], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40b2ce
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x40b239
xor eax, eax
jmp 0x40b392
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40b232
push eax
call fcn.004034d0
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4274a8], eax
call esi
push eax
call fcn.004034d0
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4274ac], eax
call esi
push eax
call fcn.004034d0
mov dword [0x4274b0], eax
lea eax, [ebp - 8]
push eax
call fcn.004055c1
test eax, eax
pop ecx
pop ecx
je 0x40b29c
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403331
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40b2ce
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.004034d0
cmp eax, ebx
pop ecx
mov dword [0x4274b8], eax
je 0x40b2ce
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004034d0
pop ecx
mov dword [0x4274b4], eax
mov eax, dword [0x4274b4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40b347
cmp dword [0x4274b8], esi
je 0x40b347
push eax
call fcn.0040353c
pop ecx
call eax
cmp eax, ebx
je 0x40b314
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4274b8]
call fcn.0040353c
pop ecx
call eax
test eax, eax
je 0x40b314
test byte [ebp - 0x18], 1
jne 0x40b347
lea eax, [ebp - 0xc]
push eax
call fcn.004055f8
test eax, eax
pop ecx
je 0x40b32f
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403331
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40b33e
or dword [ebp + 0x10], 0x200000
jmp 0x40b378
or dword [ebp + 0x10], 0x40000
jmp 0x40b378
mov eax, dword [0x4274ac]
cmp eax, esi
je 0x40b378
push eax
call fcn.0040353c
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40b378
mov eax, dword [0x4274b0]
cmp eax, esi
je 0x40b378
push dword [ebp - 4]
push eax
call fcn.0040353c
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x4274a8]
call fcn.0040353c
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret