joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45d770
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4786ce
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x49a324]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [ebp + 8]
mov edx, eax
shr edx, 0x10
test edx, edx
je 0x45d7ea
cmp word [eax], 0x3c
je 0x45d7ea
mov ecx, dword fs:[0x2c]
mov edx, dword [0xeb3a94]
mov edx, dword [ecx + edx*4]
mov ecx, dword [0xeb3898]
cmp ecx, dword [edx + 4]
jg 0x45d8f7
jmp 0x45d7d1
mov eax, dword [ebp + 8]
mov ecx, dword [0xeb3894]
push eax
call fcn.00415b40
mov ecx, eax
mov eax, dword [ebp + 8]
test ecx, ecx
cmovne eax, ecx
mov dword [ebp + 8], eax
mov ecx, eax
shr ecx, 0x10
test ecx, ecx
je 0x45d845
cmp word [eax], 0x3c
mov ecx, esi
jne 0x45d81f
push eax
call fcn.00430840
test al, al
jne 0x45d8d3
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push 0
push eax
call fcn.00430950
test al, al
jne 0x45d8d3
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov ebx, dword [esi + 0x148]
test ebx, ebx
jne 0x45d859
call fcn.00405fc0
mov ebx, eax
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
je 0x45d809
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x10], eax
test eax, eax
jne 0x45d896
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
mov eax, dword [ebp + 0x10]
push 0
push edi
push ebx
mov dword [esi + 0x140], eax
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push eax
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_LockResource]
push eax
mov ecx, esi
call fcn.00430d70
test al, al
je 0x45d809
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, dword [ebp + 0xc]
mov dword [esi + 0x144], eax
push dword [ebp + 0x18]
mov ecx, esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call fcn.0045c600
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push 0xeb3898
call fcn.0045f437
add esp, 4
cmp dword [0xeb3898], 0xffffffff
jne 0x45d7ce
push 0x1f8
mov dword [ebp - 4], 0
call fcn.0045ed12
mov edi, eax
add esp, 4
mov dword [ebp - 0x10], edi
mov byte [ebp - 4], 1
test edi, edi
je 0x45d94b
push 0x1f8
push 0
push edi
call fcn.004619b0
add esp, 0xc
mov ecx, edi
call fcn.00415810
jmp 0x45d94f
xor eax, eax
jmp 0x45d94f
push 0xeb3898
mov dword [0xeb3894], eax
mov dword [ebp - 4], 0xffffffff
call fcn.0045f3ed
add esp, 4
jmp 0x45d7ce
Function at 0x45e210
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, ecx
push dword [esi + 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x45e255
cmp byte [ebp + 8], 0
je 0x45e249
cmp byte [ebp + 0xc], 0
mov ecx, 1
mov eax, 4
cmovne eax, ecx
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8
xor eax, eax
push eax
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
pop ebp
ret 8

Function at 0x470762
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004705e1
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404399

Function at 0x409607
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00404f19
and dword [ebp - 4], 0
cmp dword [0x412990], 0
mov ebx, eax
jne 0x4096b8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x409769
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x409769
push eax
call fcn.00404ea7
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x412990], eax
call esi
push eax
call fcn.00404ea7
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [str.lP_3_], eax
call esi
push eax
call fcn.00404ea7
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x412998], eax
call esi
push eax
call fcn.00404ea7
pop ecx
mov dword [0x4129a0], eax
test eax, eax
je 0x4096b8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404ea7
pop ecx
mov dword [0x41299c], eax
mov eax, dword [0x41299c]
cmp eax, ebx
je 0x409710
cmp dword [0x4129a0], ebx
je 0x409710
push eax
call fcn.00404f22
push dword [0x4129a0]
mov esi, eax
call fcn.00404f22
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x409710
test edi, edi
je 0x409710
call esi
test eax, eax
je 0x409707
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x409707
test byte [ebp - 0xc], 1
jne 0x409710
or dword [ebp + 0x10], 0x200000
jmp 0x409749
mov eax, dword [str.lP_3_]
cmp eax, ebx
je 0x409749
push eax
call fcn.00404f22
pop ecx
test eax, eax
je 0x409749
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x409749
mov eax, dword [0x412998]
cmp eax, ebx
je 0x409749
push eax
call fcn.00404f22
pop ecx
test eax, eax
je 0x409749
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x412990]
call fcn.00404f22
pop ecx
test eax, eax
je 0x409769
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x40976b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40d673
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x40d6a4
call fcn.00403763
mov dword [eax], esi
call fcn.00403750
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.004036e8
add esp, 0x14
push 0x16
pop eax
jmp 0x40d6f9
test dword [ebp + 0xc], 0xfffffff9
jne 0x40d680
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x40d6d1
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00403776
pop ecx
call fcn.00403750
mov eax, dword [eax]
jmp 0x40d6f9
test al, 0x10
jne 0x40d6f7
test al, 1
je 0x40d6f7
test byte [ebp + 0xc], 2
je 0x40d6f7
call fcn.00403763
mov dword [eax], 5
call fcn.00403750
mov dword [eax], 0xd
jmp 0x40d6c8
xor eax, eax
pop esi
pop ebp
ret
Function at 0x10003200
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10087de0
mov eax, dword fs:[0]
push eax
push ecx
mov dword [ebp - 0x10], 0xcccccccc
mov eax, dword [0x10186040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.10001a60
mov ecx, dword [ebp - 0x10]
add ecx, 0x38
call fcn.100019e0
mov ecx, dword [ebp - 0x10]
add ecx, 0x64
call fcn.100035a0
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x7c
call fcn.10001070
mov ecx, dword [ebp - 0x10]
add ecx, 0x84
call fcn.10001070
mov ecx, dword [ebp - 0x10]
add ecx, 0x8c
call fcn.10001070
mov ecx, dword [ebp - 0x10]
add ecx, 0x94
call fcn.10001070
mov eax, 4
shl eax, 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + eax + 0x28], 0xffffffff
mov edx, 4
imul eax, edx, 0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + eax + 0x28], 0xffffffff
mov edx, 4
shl edx, 0
mov eax, dword [ebp - 0x10]
mov dword [eax + edx + 0x30], 0
mov ecx, 4
imul edx, ecx, 0
mov eax, dword [ebp - 0x10]
mov dword [eax + edx + 0x30], 0
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
cmp ebp, esp
call fcn.10086a70
mov esp, ebp
pop ebp
ret
Function at 0x10007560
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x10]
not eax
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 8]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0x1008c948
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp + 0xc]
sub eax, 1
mov dword [ebp + 0xc], eax
cmp dword [ebp - 0x10], 0
je 0x10007599
mov dword [ebp - 0x14], 1
jmp 0x100075a0
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0
je 0x100075d7
mov ecx, dword [ebp - 4]
shr ecx, 8
mov edx, dword [ebp - 4]
and edx, 0xff
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
xor edx, eax
mov eax, dword [ebp - 0xc]
xor ecx, dword [eax + edx*4]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov edx, dword [ebp - 0x18]
mov dword [ebp - 4], edx
jmp 0x1000757b
mov eax, dword [ebp - 4]
not eax
mov esp, ebp
pop ebp
ret

Function at 0x100075e0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [ebp + 0x10]
not eax
mov dword [ebp + 0x10], eax
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 8], edx
mov dword [ebp - 0xc], 0x1008c948
cmp dword [ebp + 0xc], 0
je 0x100076af
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp + 0xc]
sub ecx, 1
mov dword [ebp + 0xc], ecx
cmp dword [ebp - 0x14], 0
je 0x10007629
mov dword [ebp - 0x18], 1
jmp 0x10007630
mov dword [ebp - 0x18], 0
cmp dword [ebp - 0x18], 0
je 0x100076ad
mov edx, dword [ebp - 8]
mov al, byte [edx]
mov byte [ebp - 0x19], al
mov ecx, dword [ebp - 8]
add ecx, 1
mov dword [ebp - 8], ecx
mov dl, byte [ebp - 0x19]
mov byte [ebp - 0xd], dl
movzx eax, byte [ebp - 0xd]
cmp eax, 0x23
jne 0x1000768a
cmp dword [ebp + 0xc], 2
jb 0x1000768a
mov ecx, 1
imul edx, ecx, 0
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x23
jne 0x1000768a
mov edx, 1
shl edx, 0
mov eax, dword [ebp - 8]
movzx ecx, byte [eax + edx]
cmp ecx, 0x23
jne 0x1000768a
mov edx, dword [ebp + 0x10]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
shr eax, 8
mov ecx, dword [ebp - 4]
and ecx, 0xff
movzx edx, byte [ebp - 0xd]
xor ecx, edx
mov edx, dword [ebp - 0xc]
xor eax, dword [edx + ecx*4]
mov dword [ebp - 4], eax
jmp 0x1000760b
jmp 0x10007724
mov eax, dword [ebp - 8]
mov cl, byte [eax]
mov byte [ebp - 0x1a], cl
mov edx, dword [ebp - 8]
add edx, 1
mov dword [ebp - 8], edx
mov al, byte [ebp - 0x1a]
mov byte [ebp - 0xe], al
movzx ecx, byte [ebp - 0xe]
test ecx, ecx
je 0x10007724
movzx edx, byte [ebp - 0xe]
cmp edx, 0x23
jne 0x10007705
mov eax, 1
imul ecx, eax, 0
mov edx, dword [ebp - 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x23
jne 0x10007705
mov ecx, 1
shl ecx, 0
mov edx, dword [ebp - 8]
movzx eax, byte [edx + ecx]
cmp eax, 0x23
jne 0x10007705
mov ecx, dword [ebp + 0x10]
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
shr edx, 8
mov eax, dword [ebp - 4]
and eax, 0xff
movzx ecx, byte [ebp - 0xe]
xor eax, ecx
mov ecx, dword [ebp - 0xc]
xor edx, dword [ecx + eax*4]
mov dword [ebp - 4], edx
jmp 0x100076af
mov eax, dword [ebp - 4]
not eax
mov esp, ebp
pop ebp
ret
Function at 0x100079e0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, esp
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ucrtbased.dll_fread]
add esp, 0x10
cmp esi, esp
call fcn.10086a70
xor edx, edx
pop esi
cmp ebp, esp
call fcn.10086a70
pop ebp
ret

Function at 0x10007a20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, esp
mov eax, dword [ebp + 0x1c]
push eax
mov ecx, dword [ebp + 0x14]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.ucrtbased.dll_fwrite]
add esp, 0x10
cmp esi, esp
call fcn.10086a70
xor edx, edx
pop esi
cmp ebp, esp
call fcn.10086a70
pop ebp
ret

Function at 0x1000aeb0
Capabilities:
Get number of processors
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10088231
mov eax, dword fs:[0]
push eax
push ecx
mov dword [ebp - 0x10], 0xcccccccc
mov eax, dword [0x10186040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.10001070
mov ecx, dword [ebp - 0x10]
add ecx, 8
call fcn.10001070
mov ecx, dword [ebp - 0x10]
add ecx, 0x10
call fcn.10001070
mov ecx, dword [ebp - 0x10]
add ecx, 0x18
call fcn.10001070
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.10001070
mov ecx, dword [ebp - 0x10]
add ecx, 0x28
call fcn.10001070
mov ecx, dword [ebp - 0x10]
add ecx, 0x30
call fcn.10001070
mov ecx, dword [ebp - 0x10]
add ecx, 0x44
call fcn.10002300
mov ecx, dword [ebp - 0x10]
add ecx, 0x48
call fcn.10002300
mov ecx, dword [ebp - 0x10]
add ecx, 0x4c
call fcn.10002300
mov ecx, dword [ebp - 0x10]
add ecx, 0x50
call fcn.10001070
mov ecx, dword [ebp - 0x10]
add ecx, 0x64
call fcn.10001070
mov ecx, dword [ebp - 0x10]
add ecx, 0x6c
call fcn.10002d30
mov ecx, dword [ebp - 0x10]
add ecx, 0x90
call fcn.10029040
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0xb8
call fcn.10029040
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0xc4
call fcn.10029040
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
cmp ebp, esp
call fcn.10086a70
mov esp, ebp
pop ebp
ret
Function at 0x1003f340
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10088508
mov eax, dword fs:[0]
push eax
push ecx
mov dword [ebp - 0x10], 0xcccccccc
mov eax, dword [0x10186040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
call fcn.10029040
mov dword [ebp - 4], 0
mov ecx, dword [ebp - 0x10]
add ecx, 0x14
call fcn.10029040
mov byte [ebp - 4], 1
mov ecx, dword [ebp - 0x10]
add ecx, 0x20
call fcn.10029040
mov eax, dword [ebp - 0x10]
xorps xmm0, xmm0
movss dword [eax + 0x10], xmm0
mov ecx, dword [ebp - 0x10]
xorps xmm0, xmm0
movss dword [ecx + 0xc], xmm0
mov edx, 0xffff
mov eax, dword [ebp - 0x10]
mov word [eax + 0x3a], dx
mov ecx, 0xffff
mov edx, dword [ebp - 0x10]
mov word [edx + 0x3c], cx
mov eax, dword [ebp - 0x10]
xorps xmm0, xmm0
movss dword [eax + 0x44], xmm0
mov ecx, dword [ebp - 0x10]
xorps xmm0, xmm0
movss dword [ecx + 0x40], xmm0
xor edx, edx
mov eax, dword [ebp - 0x10]
mov word [eax + 0x3e], dx
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x2c], 0
mov edx, dword [ebp - 0x10]
mov dword [edx + 0x30], 0
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x34], 0
xor ecx, ecx
mov edx, dword [ebp - 0x10]
mov word [edx + 0x38], cx
mov eax, dword [ebp - 0x10]
mov byte [eax + 0x48], 0
mov ecx, dword [ebp - 0x10]
movss xmm0, dword [0x10182788]
movss dword [ecx + 0x4c], xmm0
mov edx, dword [ebp - 0x10]
xorps xmm0, xmm0
movss dword [edx + 0x54], xmm0
mov eax, dword [ebp - 0x10]
xorps xmm0, xmm0
movss dword [eax + 0x50], xmm0
mov ecx, dword [ebp - 0x10]
mov dword [ecx + 0x58], 0
xor edx, edx
mov eax, dword [ebp - 0x10]
add eax, 0x5c
mov word [eax], dx
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
add esp, 0x10
cmp ebp, esp
call fcn.10086a70
mov esp, ebp
pop ebp
ret

Function at 0x10044d90
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0xcccccccc
mov esi, esp
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.USER32.dll_GetKeyState]
cmp esi, esp
call fcn.10086a70
movsx ecx, ax
and ecx, 0x8000
je 0x10044dc3
mov dword [ebp - 4], 1
jmp 0x10044dca
mov dword [ebp - 4], 0
movzx eax, byte [ebp - 4]
pop esi
add esp, 4
cmp ebp, esp
call fcn.10086a70
mov esp, ebp
pop ebp
ret
Function at 0x10074400
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov eax, dword [0x10186040]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 5
jge 0x10074438
xor al, al
jmp 0x100744a6
mov esi, esp
lea eax, [ebp - 0xc]
push eax
push 0x40
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10086a70
mov eax, dword [ebp + 0x10]
push eax
push 0x90
mov ecx, dword [ebp + 8]
push ecx
call sub.VCRUNTIME140D.dll_memset
add esp, 0xc
mov edx, dword [ebp + 0xc]
sub edx, dword [ebp + 8]
sub edx, 5
mov dword [ebp - 0x14], edx
mov eax, dword [ebp + 8]
mov byte [eax], 0xe9
mov ecx, dword [ebp + 8]
mov edx, dword [ebp - 0x14]
mov dword [ecx + 1], edx
mov esi, esp
lea eax, [ebp - 0x1c]
push eax
mov ecx, dword [ebp - 0xc]
push ecx
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp esi, esp
call fcn.10086a70
mov al, 1
push edx
mov ecx, ebp
push eax
lea edx, [0x100744d0]
call fcn.10086a10
pop eax
pop edx
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10084db0
add esp, 0x20
cmp ebp, esp
call fcn.10086a70
mov esp, ebp
pop ebp
ret

Function at 0x10074d60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov dword [ebp - 4], 0xcccccccc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
je 0x10074d7d
jmp 0x10074e08
mov esi, esp
push 0
push 0
push 0
push 0x1006eb30
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.10086a70
mov dword [0x101867c8], eax
mov esi, esp
push 0
push 0
push 0
push 0x1006ebf0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.10086a70
mov dword [0x101867c8], eax
mov esi, esp
push 0
push 0
mov ecx, dword [ebp + 8]
push ecx
push 0x10074be0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.10086a70
mov dword [0x101867c8], eax
mov esi, esp
push 0
push 0
mov edx, dword [ebp + 8]
push edx
push 0x10074ed0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp esi, esp
call fcn.10086a70
mov eax, 1
pop esi
add esp, 4
cmp ebp, esp
call fcn.10086a70
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10074e20
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
mov eax, 0xcccccccc
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov dword [ebp - 4], eax
mov dword [ebp - 4], ecx
call fcn.1007ea70
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call fcn.1006e8c0
add esp, 4
movzx ecx, al
test ecx, ecx
je 0x10074e80
push 0x100745e0
push 4
call fcn.1007eb50
add esp, 8
mov dword [0x10186868], eax
mov edx, 1
imul eax, edx, 5
add eax, dword [0x10186868]
mov dword [0x10186860], eax
jmp 0x10074e9e
mov dword [ebp - 0x14], 0x64
lea ecx, [ebp - 0x14]
push ecx
lea ecx, [ebp - 0x10]
call fcn.1007ec40
push eax
call fcn.1007ec60
add esp, 4
mov esi, esp
push 0x23
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
cmp esi, esp
call fcn.10086a70
movsx edx, ax
test edx, edx
jne 0x10074eb8
jmp 0x10074e82
call fcn.1006e9c0
xor eax, eax
pop esi
add esp, 0x14
cmp ebp, esp
call fcn.10086a70
mov esp, ebp
pop ebp
ret 4
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x408ed0
mov ecx, 0x305b3a3a
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
jne 0x430024
nop
mov eax, section..data
mov ebx, 0x42e1d0
nop
nop
mov ecx, 0x4b7766ca
nop
test eax, eax
nop
nop
nop
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
add eax, 4
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x402cdc
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x41200c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402d74
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402d54
xor eax, eax
push ebp
push 0x402d4d
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402d90
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402d54
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x41200c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x41200c], ax
mov esp, ebp
pop ebp
ret

Function at 0x4035d4
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x413040], 0
je 0x403635
cmp word [0x413214], 0xd7b2
jne 0x4035fd
cmp dword [0x41321c], 0
jbe 0x4035fd
mov eax, 0x413210
call dword [0x41322c]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x412070
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x40365c
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x412018], 0
jne 0x403651
push 0
push 0x412090
push 0x412070
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret

Function at 0x405150
Capabilities:
Accept command line arguments

Disassembly:
push edi
mov edi, edx
test eax, eax
jne 0x40517e
sub esp, 0x104
mov ecx, esp
push 0x104
push ecx
push 0
call sub.kernel32.dll_GetModuleFileNameA
xchg ecx, eax
mov edx, esp
mov eax, edi
call fcn.00403860
add esp, 0x104
pop edi
ret
push eax
call sub.kernel32.dll_GetCommandLineA_1
pop ecx
inc ecx
call fcn.0040849c
mov edx, eax
call fcn.004084ac
loop 0x405186
mov ecx, eax
sub ecx, edx
cmp ecx, 2
jl 0x4051aa
cmp byte [edx], 0x22
jne 0x4051aa
cmp byte [eax - 1], 0x22
jne 0x4051aa
inc edx
dec eax
sub eax, edx
xchg ecx, eax
xchg edi, eax
call fcn.00403860
pop edi
ret

Function at 0x407678
Capabilities:
Hide graphical window

Disassembly:
and byte [eax + 0x27], 0xef
test dl, dl
je 0x407684
or byte [eax + 0x27], 0x10
mov ecx, dword [eax + 0x1c]
jecxz 0x40769d
push eax
je 0x40769e
call dword [0x412110]
pop eax
push 5
push dword [eax + 0x1c]
call sub.user32.dll_ShowWindow
ret
and byte [eax + 0x37], 0xfe
push 0
push ecx
call sub.user32.dll_ShowWindow
pop eax
call dword [0x412110]
ret

Function at 0x408538
Capabilities:
Get file attributes

Disassembly:
call fcn.00404c18
push eax
call sub.kernel32.dll_GetFileAttributesA
inc eax
je 0x40854c
dec eax
and al, 0x10
sete al
ret