joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10030100
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10057034
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10076658]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov edi, dword [esp + 0x40]
xor ebx, ebx
mov dword [esp + 0x38], ebx
mov eax, dword [esp + 0x44]
mov dword [edi], vtable.YAML::NodeBuilder.0
mov dword [edi + 4], eax
mov word [edi + 8], bx
lea esi, [edi + 0xc]
push 8
mov dword [esi], ebx
call fcn.100407c7
add esp, 4
cmp eax, ebx
je 0x100302bb
mov dword [esi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov ecx, dword [esi]
mov dword [ecx], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov byte [esp + 0x38], 1
lea esi, [edi + 0x24]
push 8
mov dword [esi], ebx
call fcn.100407c7
add esp, 4
cmp eax, ebx
je 0x10030292
mov dword [esi], eax
xor edx, edx
mov dword [eax + 4], edx
xor ecx, ecx
mov dword [eax], ecx
mov edx, dword [esi]
mov dword [edx], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov byte [esp + 0x38], 2
lea esi, [edi + 0x3c]
push 8
mov dword [esi], ebx
call fcn.100407c7
add esp, 4
cmp eax, ebx
je 0x10030269
mov dword [esi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov eax, dword [esi]
mov dword [eax], esi
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
mov dword [esi + 0x10], ebx
mov dword [edi + 0x54], ebx
mov dword [edi + 0x58], ebx
mov dword [edi + 0x5c], ebx
mov byte [esp + 0x38], 4
mov ecx, dword [edi + 4]
call fcn.10029d20
mov eax, dword [edi + 0x58]
lea ecx, [esp + 0x44]
mov dword [esp + 0x44], ebx
cmp ecx, eax
jae 0x10030237
mov ecx, dword [edi + 0x54]
lea edx, [esp + 0x44]
cmp ecx, edx
ja 0x10030237
mov ebp, edx
sub ebp, ecx
sar ebp, 2
cmp eax, dword [edi + 0x5c]
jne 0x10030226
lea eax, [edi + 0x54]
call fcn.1002f800
mov eax, dword [edi + 0x58]
cmp eax, ebx
je 0x1003024d
mov ecx, dword [edi + 0x54]
mov edx, dword [ecx + ebp*4]
mov dword [eax], edx
jmp 0x1003024d
cmp eax, dword [edi + 0x5c]
jne 0x10030244
lea eax, [edi + 0x54]
call fcn.1002f800
mov eax, dword [edi + 0x58]
cmp eax, ebx
je 0x1003024d
mov dword [eax], ebx
add dword [edi + 0x58], 4
mov eax, edi
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret 8
lea eax, [esp + 0x44]
push eax
lea ecx, [esp + 0x1c]
mov dword [esp + 0x48], ebx
call fcn.10040109
push 0x1006d4b8
lea ecx, [esp + 0x1c]
push ecx
mov dword [esp + 0x20], vtable.std::bad_alloc.0
call fcn.100424f0
lea edx, [esp + 0x14]
push edx
lea ecx, [esp + 0x28]
mov dword [esp + 0x18], ebx
call fcn.10040109
push 0x1006d4b8
lea eax, [esp + 0x28]
push eax
mov dword [esp + 0x2c], vtable.std::bad_alloc.0
call fcn.100424f0
lea ecx, [esp + 0x44]
push ecx
lea ecx, [esp + 0x1c]
mov dword [esp + 0x48], ebx
call fcn.10040109
push 0x1006d4b8
lea edx, [esp + 0x1c]
push edx
mov dword [esp + 0x20], vtable.std::bad_alloc.0
call fcn.100424f0
int3
Function at 0x10030c10
Capabilities:
Get process heap force flags

Disassembly:
push 0xffffffffffffffff
push 0x100569c6
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebp
push esi
push edi
mov eax, dword [0x10076658]
xor eax, esp
push eax
lea eax, [esp + 0x20]
mov dword fs:[0], eax
mov edi, dword [esp + 0x30]
mov eax, dword [esp + 0x34]
push 0x18
mov dword [edi], eax
mov dword [edi + 4], ecx
call fcn.100407c7
mov esi, eax
add esp, 4
mov dword [esp + 0x10], esi
xor ebp, ebp
mov dword [esp + 0x28], ebp
cmp esi, ebp
je 0x10030cb3
push 8
mov dword [esi], ebp
call fcn.100407c7
add esp, 4
cmp eax, ebp
je 0x10030c8a
mov dword [esi], eax
xor ecx, ecx
mov dword [eax], ecx
xor edx, edx
mov dword [eax + 4], edx
mov edx, dword [esi]
mov dword [edx], esi
mov dword [esi + 4], ebp
mov dword [esi + 8], ebp
mov dword [esi + 0xc], ebp
mov dword [esi + 0x10], ebp
jmp 0x10030cb5
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], ebp
call fcn.10040109
push 0x1006d4b8
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x1c], vtable.std::bad_alloc.0
call fcn.100424f0
xor esi, esi
mov dword [edi + 8], esi
mov dword [esp + 0x28], 1
push 0x30
mov dword [edi + 0x14], ebp
call fcn.100407c7
add esp, 4
cmp eax, ebp
je 0x10030d0a
mov dword [edi + 0x10], eax
mov dword [eax], eax
mov eax, dword [edi + 0x10]
mov dword [eax + 4], eax
mov eax, dword [edi + 0x10]
mov dword [eax + 8], eax
mov edx, dword [edi + 0x10]
mov byte [edx + 0x2c], 1
mov eax, dword [edi + 0x10]
mov byte [eax + 0x2d], 1
mov dword [edi + 0x1c], ebp
mov eax, edi
mov ecx, dword [esp + 0x20]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
add esp, 0x1c
ret 8
lea ecx, [esp + 0x34]
push ecx
lea ecx, [esp + 0x18]
mov dword [esp + 0x38], ebp
call fcn.10040109
push 0x1006d4b8
lea edx, [esp + 0x18]
push edx
mov dword [esp + 0x1c], vtable.std::bad_alloc.0
call fcn.100424f0
int3
Function at 0x1003c120
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
mov esi, eax
xor eax, eax
cmp dword [esi + 0x10], 2
push edi
setne al
mov edi, eax
call fcn.1003c2d0
mov byte [esp + 0x18], al
call fcn.1003c2d0
mov byte [esp + 0x19], al
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
cmp dword [edx + eax + 0xc], 0
jne 0x1003c2c8
movzx ebx, byte [esp + edi + 0x18]
lea ebp, [esp + edi + 0x18]
xor edi, 1
movzx eax, byte [esp + edi + 0x18]
lea edi, [esp + edi + 0x18]
shl ebx, 8
or ebx, eax
lea ecx, [ebx - 0xdc00]
mov dword [esp + 0x20], ebp
mov dword [esp + 0x1c], edi
cmp ecx, 0x3ff
ja 0x1003c1c6
lea edx, [esp + 0x17]
add esi, 0x20
push edx
mov eax, esi
mov byte [esp + 0x1b], 0xef
call fcn.100309b0
lea eax, [esp + 0x17]
push eax
mov eax, esi
mov byte [esp + 0x1b], 0xbf
call fcn.100309b0
lea ecx, [esp + 0x17]
push ecx
mov eax, esi
mov byte [esp + 0x1b], 0xbd
call fcn.100309b0
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
lea edx, [ebx - 0xd800]
cmp edx, 0x3ff
ja 0x1003c2be
call fcn.1003c2d0
mov byte [esp + 0x18], al
call fcn.1003c2d0
mov byte [esp + 0x19], al
mov eax, dword [esi]
mov ecx, dword [eax]
mov edx, dword [ecx + 4]
cmp dword [edx + eax + 0xc], 0
jne 0x1003c2a9
lea esp, [esp]
movzx edi, byte [ebp]
mov eax, dword [esp + 0x1c]
movzx ecx, byte [eax]
shl edi, 8
or edi, ecx
cmp edi, 0xdc00
jb 0x1003c239
cmp ebx, 0xe000
jae 0x1003c239
and ebx, 0x3ff
shl ebx, 0xa
and edi, 0x3ff
or ebx, edi
add ebx, 0x10000
jmp 0x1003c285
lea edx, [esp + 0x17]
push edx
lea eax, [esi + 0x20]
mov byte [esp + 0x1b], 0xef
call fcn.100309b0
lea eax, [esp + 0x17]
push eax
lea eax, [esi + 0x20]
mov byte [esp + 0x1b], 0xbf
call fcn.100309b0
lea ecx, [esp + 0x17]
push ecx
lea eax, [esi + 0x20]
mov byte [esp + 0x1b], 0xbd
call fcn.100309b0
cmp edi, 0xd800
jb 0x1003c2be
cmp ebx, 0xe000
jae 0x1003c2be
mov ebp, dword [esp + 0x20]
mov ebx, edi
call fcn.1003c2d0
mov byte [esp + 0x18], al
call fcn.1003c2d0
mov byte [esp + 0x19], al
mov eax, dword [esi]
mov edx, dword [eax]
mov ecx, dword [edx + 4]
cmp dword [ecx + eax + 0xc], 0
je 0x1003c200
mov eax, 0xfffd
add esi, 0x20
call fcn.1003b940
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov eax, ebx
add esi, 0x20
call fcn.1003b940
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x1003eba0
Capabilities:
Create service

Disassembly:
push 0xffffffffffffffff
push 0x1005a0b8
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x10076658]
xor eax, esp
mov dword [esp + 0x30], eax
push ebx
push ebp
push esi
mov eax, dword [0x10076658]
xor eax, esp
push eax
lea eax, [esp + 0x44]
mov dword fs:[0], eax
cmp dword [edi + 0x154], 0
mov eax, dword [esp + 0x58]
mov esi, dword [esp + 0x54]
mov ebp, dword [esp + 0x5c]
mov ebx, dword [esp + 0x60]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x64]
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], eax
je 0x1003ed18
mov eax, dword [edi + 0x158]
test eax, eax
je 0x1003ec1d
push eax
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov dword [edi + 0x158], 0
lea edx, [edi + 0x15c]
push 0
or eax, 0xffffffff
mov ecx, esi
call fcn.10003280
xor ecx, ecx
xor esi, esi
mov word [esp + 0x24], cx
push esi
or eax, 0xffffffff
mov ecx, ebx
lea edx, [esp + 0x28]
mov dword [esp + 0x3c], 7
mov dword [esp + 0x38], esi
call fcn.10003280
mov dword [esp + 0x4c], esi
lea ebx, [esi + 2]
lea esi, [esp + 0x24]
call fcn.100055b0
mov edx, dword [esp + 0x24]
mov ebx, 8
cmp dword [esp + 0x38], ebx
jae 0x1003ec74
mov edx, esi
cmp dword [ebp + 0x14], ebx
jb 0x1003ec7c
mov ebp, dword [ebp]
mov ecx, dword [esp + 0x18]
cmp dword [ecx + 0x14], ebx
jb 0x1003ec87
mov ecx, dword [ecx]
cmp dword [edi + 0x170], ebx
lea esi, [edi + 0x15c]
jb 0x1003ec99
mov eax, dword [esi]
jmp 0x1003ec9b
mov eax, esi
push 0
push 0
push edx
mov edx, dword [esp + 0x2c]
push 0
push ebp
push ecx
mov ecx, dword [esp + 0x2c]
push 1
push edx
mov edx, dword [edi + 0x154]
push ecx
push 0xf01ff
push 0
push eax
push edx
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov dword [edi + 0x158], eax
test eax, eax
jne 0x1003ecfc
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x1003ecfc
cmp dword [esi + 0x14], ebx
jb 0x1003ece3
mov esi, dword [esi]
mov eax, dword [edi + 0x154]
push 0xf01ff
push esi
push eax
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov dword [edi + 0x158], eax
cmp dword [edi + 0x158], 0
jne 0x1003ed1c
cmp dword [esp + 0x38], ebx
jb 0x1003ed18
mov ecx, dword [esp + 0x24]
push ecx
call fcn.1004076b
add esp, 4
xor al, al
jmp 0x1003ed41
mov ecx, dword [esp + 0x1c]
cmp dword [ecx + 0x10], 0
je 0x1003ed2c
push edi
call fcn.1003edb0
cmp dword [esp + 0x38], ebx
jb 0x1003ed3f
mov edx, dword [esp + 0x24]
push edx
call fcn.1004076b
add esp, 4
mov al, 1
mov ecx, dword [esp + 0x44]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x30]
xor ecx, esp
call fcn.10040061
add esp, 0x40
ret 0x14
Function at 0x1003f120
Capabilities:
Start service

Disassembly:
push 0xffffffffffffffff
push 0x100597d0
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x10076658]
xor eax, esp
mov dword [esp + 0x34], eax
push ebx
push ebp
push esi
push edi
mov eax, dword [0x10076658]
xor eax, esp
push eax
lea eax, [esp + 0x4c]
mov dword fs:[0], eax
mov ebp, dword [esp + 0x5c]
xor edi, edi
mov esi, ecx
cmp dword [ebp + 0x158], edi
jne 0x1003f166
xor al, al
jmp 0x1003f1e1
xor eax, eax
xor ebx, ebx
mov dword [esp + 0x30], 7
mov dword [esp + 0x2c], edi
mov word [esp + 0x1c], ax
mov dword [esp + 0x54], edi
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], edi
mov dword [esp + 0x40], edi
mov eax, esi
lea ecx, [esp + 0x14]
mov byte [esp + 0x54], 1
call fcn.1000b290
cmp dword [esi + 0x10], edi
je 0x1003f1a8
mov edi, dword [esp + 0x14]
mov ebx, dword [esp + 0x18]
mov ecx, dword [ebp + 0x158]
push ebx
push edi
push ecx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
jne 0x1003f1d6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x420
lea esi, [esp + 0x14]
sete bl
call fcn.1000b180
mov al, bl
jmp 0x1003f1e1
lea esi, [esp + 0x14]
call fcn.1000b180
mov al, 1
mov ecx, dword [esp + 0x4c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.10040061
add esp, 0x44
ret 4

Function at 0x1003f210
Capabilities:
Stop service

Disassembly:
sub esp, 0x20
mov eax, dword [0x10076658]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0x158]
test eax, eax
jne 0x1003f23f
xor al, al
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.10040061
add esp, 0x20
ret 4
lea ecx, [esp]
push ecx
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov ecx, dword [esp + 0x1c]
test eax, eax
setne al
xor ecx, esp
call fcn.10040061
add esp, 0x20
ret 4

Function at 0x1003f380
Capabilities:
Read pipe
Write pipe

Disassembly:
push 0xffffffffffffffff
push 0x1005b998
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x10076658]
xor eax, esp
push eax
lea eax, [esp + 0x18]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 0x1c]
mov edx, dword [eax + 4]
lea edi, [esi + 0x1c]
mov ecx, edi
mov dword [esp + 0x14], edi
call edx
mov ecx, esi
lea esi, [esp + 0x10]
mov dword [esp + 0x20], 0
call fcn.1003f270
mov ebx, dword [esp + 0x10]
cmp ebx, 0xffffffff
jne 0x1003f3d9
xor esi, esi
jmp 0x1003f40e
mov ecx, dword [esp + 0x2c]
mov edx, dword [esp + 0x28]
push 0
lea eax, [esp + 0x14]
push eax
push 0
push 0
push ecx
push edx
push ebx
mov dword [esp + 0x2c], 0
call dword [sym.imp.KERNEL32.dll_TransactNamedPipe]
mov esi, eax
neg esi
sbb esi, esi
and esi, dword [esp + 0x10]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esp + 0x20], 0xffffffff
mov eax, dword [edi]
mov edx, dword [eax + 8]
mov ecx, edi
call edx
mov eax, esi
mov ecx, dword [esp + 0x18]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
add esp, 0x14
ret 8
Function at 0x1003f460
Capabilities:
Find taskbar

Disassembly:
sub esp, 0x18
mov eax, dword [0x10076658]
xor eax, esp
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x1c]
push ebx
push ebp
push esi
push edi
push eax
push str.ToolbarWindow32
mov esi, dword [sym.imp.USER32.dll_FindWindowExW]
push 0
push 0x10064464
push str.SysPager
push 0
push 0x10064464
push str.TrayNotifyWnd
push 0
push 0x10064464
push str.Shell_TrayWnd
push 0
push 0
call esi
push eax
call esi
push eax
call esi
push eax
call esi
mov ebx, eax
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetClientRect]
test eax, eax
je 0x1003f513
xor edi, edi
mov dword [esp + 0x10], edi
cmp dword [esp + 0x1c], edi
jle 0x1003f513
mov ebp, dword [sym.imp.USER32.dll_SendMessageW]
mov eax, dword [esp + 0x20]
lea ecx, [ecx]
xor esi, esi
test eax, eax
jle 0x1003f506
push edi
push 0
push 0x200
push ebx
call ebp
mov eax, dword [esp + 0x20]
add esi, 5
add edi, 0x50000
cmp esi, eax
jl 0x1003f4e6
mov edi, dword [esp + 0x10]
add edi, 5
mov dword [esp + 0x10], edi
cmp edi, dword [esp + 0x1c]
jl 0x1003f4e0
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.10040061
add esp, 0x18
ret

Function at 0x10040061
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10076658]
jne 0x1004006b
repz ret
jmp fcn.10044767
Function at 0x100501ae
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10076658]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10047d59
and dword [ebp - 0x14], 0
cmp dword [0x1007a4b0], 0
mov dword [ebp - 0x18], eax
jne 0x10050261
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10050309
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x10063f9c
push ebx
call edi
test eax, eax
je 0x10050309
mov esi, dword [0x100772a4]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1007a4b0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1007a4b4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1007a4b8], eax
call edi
push eax
call esi
mov dword [0x1007a4c0], eax
test eax, eax
je 0x10050261
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1007a4bc], eax
mov eax, dword [0x1007a4bc]
mov ecx, dword [ebp - 0x18]
mov esi, dword [0x100772a0]
cmp eax, ecx
je 0x100502ba
cmp dword [0x1007a4c0], ecx
je 0x100502ba
push eax
call esi
push dword [0x1007a4c0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x100502ba
test ebx, ebx
je 0x100502ba
call edi
test eax, eax
je 0x100502b1
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x100502b1
test byte [ebp - 8], 1
jne 0x100502ba
or dword [ebp + 0x10], 0x200000
jmp 0x100502ed
mov eax, dword [0x1007a4b4]
cmp eax, dword [ebp - 0x18]
je 0x100502ed
push eax
call esi
test eax, eax
je 0x100502ed
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100502ed
mov eax, dword [0x1007a4b8]
cmp eax, dword [ebp - 0x18]
je 0x100502ed
push eax
call esi
test eax, eax
je 0x100502ed
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1007a4b0]
call esi
test eax, eax
je 0x10050309
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x1005030b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10040061
leave
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x403203
pop dword [ebp - 0x44]
mov eax, 0x403203
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x2c38bab6
sub dword [ebp - 0x54], 0xdde6756b
mov dword [ebp - 0x50], 0x998c9806
sub dword [ebp - 0x50], 0x67594bc1
mov dword [ebp - 0x4c], 0x2f564623
add dword [ebp - 0x4c], 0x1cf5fe0b
mov dword [ebp - 0x48], 0x4ef9a504
add dword [ebp - 0x48], 0xb1065afc
lea eax, [ebp - 0x54]
push eax
mov eax, 0x9faf95ad
add eax, 0x6090eadf
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x39f04164
add dword [ebp - 0x54], 0x3a8227f2
mov dword [ebp - 0x50], 0x8f69204f
sub dword [ebp - 0x50], 0x4dfcbeda
mov dword [ebp - 0x4c], 0x62ff50fb
sub dword [ebp - 0x4c], 0xff8fe48f
mov dword [ebp - 0x48], 0x5720cb9a
sub dword [ebp - 0x48], 0x5720cb9a
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x3b129
push 0
call eax
mov ecx, 0x59ea
mov edi, eax
mov ebx, 0xa28ca658
add ebx, 0x5db469a8
add ebx, dword [ebp - 0x44]
mov edx, 0xb3718699
add edx, 0x9769b53d
xor dword [ebp - 0x24], edi
mov esi, dword [ebx]
add esi, edx
add dword [ebp - 8], ecx
mov dword [edi], esi
sub dword [ebp - 0x34], ebx
add edi, 0xedb9eb9d
sub edi, 0xedb9eb99
add ebx, 4
loop 0x403315
add eax, 0xc486dc98
sub eax, 0xc485821d
mov ebx, eax
add eax, 0xd2c01d56
sub eax, 0xd2c01d51
mov ecx, 0x400000
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43100c
nop
pop eax
nop
nop
nop
nop
nop
add eax, 0x403e6a
sub eax, 0x403e10
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x403c11
Capabilities:
Create thread
Inject thread

Disassembly:
push dword [0x51b6b0]
pop dword [0x51b724]
mov edx, dword [0x51b698]
push dword [0x51be34]
call fcn.004123e0
lea ecx, [0x51b680]
pop edx
call fcn.00405000
push dword [0x51b680]
call fcn.004052d0
mov ebx, eax
inc ebx
mov dword [0x51b758], ebx
push dword [0x51b724]
push 0
push 0x1f0fff
call sub.KERNEL32.dll_OpenProcess
mov dword [0x51b720], eax
cmp dword [0x51b720], 0
je 0x403d99
push 4
push 0x1000
push dword [0x51b758]
push 0
push dword [0x51b720]
call sub.KERNEL32.dll_VirtualAllocEx
mov dword [0x51b738], eax
cmp dword [0x51b738], 0
je 0x403d8e
push 0x51b640
push dword [0x51b758]
push dword [0x51b680]
push dword [0x51b738]
push dword [0x51b720]
call sub.KERNEL32.dll_WriteProcessMemory
mov ebx, dword [0x51b640]
cmp ebx, dword [0x51b758]
jl 0x403d72
push str.Kernel32.dll
push 0
call fcn.00406ad0
and eax, eax
je 0x403d72
push 0x414194
push 0
call fcn.00406b20
mov dword [0x51b6f4], eax
push 0
call fcn.00406a50
cmp dword [0x51b6f4], 0
je 0x403d72
push 0
push 0
push dword [0x51b738]
push dword [0x51b6f4]
push 0
push 0
push dword [0x51b720]
call sub.KERNEL32.dll_CreateRemoteThread
mov dword [0x51b6ac], eax
cmp dword [0x51b6ac], 0
je 0x403d72
push 0xffffffff
push dword [0x51b6ac]
call sub.KERNEL32.dll_WaitForSingleObject
push 0x51b744
push dword [0x51b6ac]
call sub.KERNEL32.dll_GetExitCodeThread
push 0x4000
push dword [0x51b758]
push dword [0x51b738]
push dword [0x51b720]
call sub.KERNEL32.dll_VirtualFreeEx
push dword [0x51b720]
call sub.KERNEL32.dll_CloseHandle
push dword [0x51b698]
call fcn.00411a90
mov dword [0x51b744], eax
ret

Function at 0x4062de
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
cmp dword [ebp + 8], 0
je 0x4062f8
push dword [ebp + 8]
push 0x406270
call sub.USER32.dll_EnumWindows
jmp 0x40632f
mov edi, dword [0x518c60]
jmp 0x40632b
mov esi, dword [edi]
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [edi + 8], eax
jne 0x406329
push 1
push dword [edi + 0xc]
call sub.USER32.dll_EnableWindow
mov eax, edi
add eax, 8
push eax
push 0x518c60
call fcn.00412340
add esp, 8
mov edi, esi
or edi, edi
jne 0x406300
pop edi
pop esi
pop ebp
ret 4
Function at 0x41193a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
push 9
call sub.USER32.dll_GetKeyState
mov edi, eax
movsx edi, di
test di, 0x80
je 0x4119d3
push 0x11
call sub.USER32.dll_GetKeyState
mov edi, eax
movsx edi, di
test di, 0x80
jne 0x4119d3
push 0x10
call sub.USER32.dll_GetKeyState
mov edi, eax
movsx edi, di
test di, 0x80
jne 0x4119d3
push 0x12
call sub.USER32.dll_GetKeyState
mov edi, eax
movsx edi, di
test di, 0x80
jne 0x4119d3
call sub.USER32.dll_GetFocus
push 5
lea edi, [ebp - 0xd]
push edi
push eax
call sub.USER32.dll_GetClassNameA
push 4
push str.Rich
lea eax, [ebp - 0xd]
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
or eax, eax
jne 0x4119d3
call sub.USER32.dll_GetFocus
push 0
push 0
push 0x44e
push eax
call sub.USER32.dll_SendMessageA
test ax, 0x800
jne 0x4119d3
xor eax, eax
jmp 0x4119fe
push str.PB_WindowID
push dword [ebp + 8]
call sub.USER32.dll_GetPropA
mov dword [ebp - 4], eax
or eax, eax
je 0x4119fc
dec eax
push eax
push dword [0x51c030]
call fcn.00412112
mov dword [ebp - 8], eax
mov eax, dword [eax + 0xc]
jmp 0x4119fe
xor eax, eax
pop edi
leave
ret 4

Function at 0x411aa0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
and dword [ebp - 4], 0
cmp dword [edi + 0x14], 0
jne 0x411acf
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [edi + 8]
sub eax, dword [edi + 0xc]
push eax
push dword [edi + 4]
push dword [edi]
call sub.KERNEL32.dll_WriteFile
mov eax, dword [edi + 8]
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 4]
pop edi
leave
ret 4