joyce8/EMBER2024-capa huggingface dataset:
Function at 0x502e65
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x69c24c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, ecx
call fcn.00491d72
mov dword [ebp - 0x18], eax
xor eax, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x14]
push eax
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowRect]
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x21
call esi
push 0x20
mov ebx, eax
call esi
mov ecx, edi
mov dword [ebp - 0x1c], eax
call fcn.0048c51d
mov edi, dword [ebp - 0x18]
mov esi, eax
test edi, 0x1000
je 0x502edd
cmp esi, 3
jne 0x502ecc
push 2
pop esi
push 2
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x502edd
xor eax, eax
jmp 0x502f32
cmp esi, 0xa
jl 0x502ee7
cmp esi, 0x11
jle 0x502eec
cmp esi, 4
jne 0x502f30
test edi, 0x800
je 0x502ef9
push 2
pop eax
jmp 0x502f32
mov eax, dword [ebp - 0x1c]
neg ebx
push ebx
neg eax
push eax
lea eax, [ebp - 0x14]
push eax
call dword [sym.imp.USER32.dll_InflateRect]
test edi, 0x200
je 0x502f30
mov eax, esi
sub eax, 4
je 0x502f7d
sub eax, 9
je 0x502f69
sub eax, 1
je 0x502f59
dec eax
sub eax, 1
je 0x502f45
sub eax, 1
je 0x502f7d
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.005bb105
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp ecx, dword [ebp - 8]
setle al
dec eax
and eax, 5
add eax, 0xa
jmp 0x502f32
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp ecx, dword [ebp - 0x10]
setl al
add eax, 0xb
jmp 0x502f32
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp ecx, dword [ebp - 0x10]
setl al
lea eax, [eax*2 + 0xa]
jmp 0x502f32
mov ecx, dword [ebp + 0xc]
xor eax, eax
cmp ecx, dword [ebp - 8]
setg al
lea eax, [eax*4 + 0xb]
jmp 0x502f32
Function at 0x507f90
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x69c24c]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
jne 0x507fb3
xor eax, eax
jmp 0x508089
cmp dword [ebp + 0xc], 0
je 0x507fac
xor ebx, ebx
call fcn.00496f4c
push dword [ebp + 0xc]
push dword [ebp + 8]
mov esi, dword [eax + 0xc]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x507fac
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x507fac
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0xc], eax
test eax, eax
je 0x50809f
push eax
call fcn.005caba0
inc eax
pop ecx
mov dword [ebp - 8], eax
lea edx, [eax + eax]
lea ecx, [edx + 8]
cmp edx, ecx
sbb eax, eax
test ecx, eax
je 0x508057
lea ecx, [edx + 8]
cmp edx, ecx
sbb eax, eax
and eax, ecx
lea ecx, [edx + 8]
cmp eax, 0x400
ja 0x508039
cmp edx, ecx
sbb eax, eax
and eax, ecx
call fcn.005bbdd0
mov esi, esp
test esi, esi
je 0x50809f
mov dword [esi], 0xcccc
jmp 0x508052
cmp edx, ecx
sbb eax, eax
and eax, ecx
push eax
call fcn.005c3f21
mov esi, eax
pop ecx
test esi, esi
je 0x50809f
mov dword [esi], 0xdddd
add esi, 8
jmp 0x508059
mov esi, ebx
test esi, esi
je 0x50809f
push dword [ebp - 8]
push dword [ebp - 0xc]
push esi
call fcn.00488795
test eax, eax
je 0x508079
mov ecx, dword [ebp - 0x10]
push eax
call fcn.00509934
xor ebx, ebx
inc ebx
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
push esi
call fcn.00509950
pop ecx
mov eax, ebx
lea esp, [ebp - 0x1c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005bb105
mov esp, ebp
pop ebp
ret 8
call fcn.00487999
int3
Function at 0x5186f5
Capabilities:
Get keyboard layout
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x69c24c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, 0x8000
lea eax, [esi - 0x60]
cmp eax, 9
ja 0x518727
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test bx, ax
je 0x518752
cmp dword [0x6b01e4], 0
jne 0x518752
lea ecx, [esi - 0x41]
cmp ecx, 0x19
jbe 0x518745
push 0x12
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test bx, ax
je 0x518749
mov eax, esi
jmp 0x5187c5
push esi
call fcn.005d0e3c
pop ecx
jmp 0x5187c5
push 4
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.005bd7e0
add esp, 0xc
lea eax, [ebp - 0x104]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x5187d7
call fcn.0049aac6
push dword [eax + 0x30]
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push eax
push 1
push 2
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
push eax
push esi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
xor eax, eax
mov word [ebp - 0x106], ax
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.USER32.dll_CharUpperW]
movzx eax, word [ebp - 0x108]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.005bb105
mov esp, ebp
pop ebp
ret 4
call fcn.00487999
int3
Function at 0x518ce8
Capabilities:
Get common file path

Disassembly:
push 0x7c
mov eax, 0x60147e
call fcn.005bb1b8
mov ebx, ecx
mov dword [ebp - 0x20], ebx
mov ecx, dword [ebp + 0xc]
call fcn.004ec005
test eax, eax
je 0x518e89
lea ecx, [ebp - 0x1c]
xor edi, edi
push ecx
lea ecx, [ebp + 8]
mov dword [ebp - 0x1c], edi
push ecx
lea ecx, [ebx + 4]
call fcn.00518b8f
test eax, eax
je 0x518d2b
push dword [ebp - 0x1c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
call fcn.004887ac
push eax
lea ecx, [ebp - 0x18]
call fcn.0040654d
mov esi, 0x104
mov dword [ebp - 4], edi
push esi
lea ecx, [ebp - 0x18]
call fcn.00406dda
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x18]
call fcn.0042b3cc
call fcn.004887ac
push eax
lea ecx, [ebp - 0x14]
call fcn.0040654d
push esi
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 1
call fcn.00406dda
mov esi, dword [ebp - 0x18]
push eax
push edi
push 0x637280
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 0xffffffffffffffff
lea ecx, [ebp - 0x14]
call fcn.0042b3cc
push edi
push 0x4000100
push 2
push edi
push edi
mov edi, dword [ebp - 0x14]
push 0xc0000000
push edi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x1c], eax
cmp eax, 0xffffffff
jne 0x518dc3
lea ecx, [edi - 0x10]
call fcn.00406e44
lea ecx, [esi - 0x10]
jmp 0x518e84
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.00495067
push 0
push 0x1000
push 0
lea eax, [ebp - 0x40]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x88]
call fcn.00493b00
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x88]
mov dword [ebx + 0x20], 1
push edx
mov byte [ebp - 4], 4
mov eax, dword [ecx]
call dword [eax + 8]
lea ecx, [ebp - 0x88]
call fcn.004940bd
and dword [ebx + 0x20], 0
lea ecx, [ebp - 0x88]
call fcn.00493c10
lea ecx, [ebp - 0x40]
call fcn.0049510f
lea eax, [ebp + 8]
mov dword [ebp - 4], 1
push eax
lea ecx, [ebx + 4]
call fcn.004e9579
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
lea ecx, [edi - 0x10]
call fcn.00406e44
lea ecx, [esi - 0x10]
call fcn.00406e44
xor eax, eax
inc eax
jmp 0x518e8b
call fcn.00406e44
xor eax, eax
call fcn.005bb116
ret 8
Function at 0x565264
Capabilities:
Get file system object information

Disassembly:
push 0x4c8
mov eax, 0x604f9c
call fcn.005bb181
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00406a4a
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x4d0], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x4d0]
push 0
push 0x60c688
call fcn.0040963b
cmp eax, 0xffffffff
jne 0x565318
push 0
push 0x631ac0
lea ecx, [ebp - 0x4d0]
call fcn.0040963b
cmp eax, 0xffffffff
jne 0x565318
push 0
push 0x629214
lea ecx, [ebp - 0x4d0]
call fcn.0040963b
cmp eax, 0xffffffff
jne 0x565318
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00406a4a
pop ecx
lea edi, [eax + 0x10]
mov dword [ebp - 0x4d4], edi
xor ecx, ecx
mov byte [ebp - 4], 1
push ecx
lea eax, [ebp - 0x218]
push eax
push 0x104
push ecx
push edi
push ecx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x5652f4
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
lea ecx, [edi - 0x10]
mov ebx, eax
call fcn.00406e44
jmp 0x565347
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x4d0]
call fcn.0048806c
lea ecx, [edi - 0x10]
mov byte [ebp - 4], 0
call fcn.00406e44
mov esi, dword [ebp - 0x4d0]
push 0x105
push 0x2b4
lea eax, [ebp - 0x4cc]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x56533e
mov ebx, dword [ebp - 0x4cc]
jmp 0x565347
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x14]
mov ebx, eax
lea ecx, [esi - 0x10]
call fcn.00406e44
mov eax, ebx
call fcn.005bb12b
ret

Function at 0x56b483
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x69ba0c], 0
push esi
je 0x56b564
cmp dword [0x69bd58], 0xfffffffe
jne 0x56b551
mov esi, dword [ebp + 8]
cmp esi, 0xffffffff
je 0x56b564
mov eax, dword fs:[0x2c]
mov ecx, dword [0x6b3154]
push ebx
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x6b2230]
cmp eax, dword [ecx + 4]
jle 0x56b4fb
mov ebx, 0x6b2230
push ebx
call fcn.005bb616
cmp dword [0x6b2230], 0xffffffff
pop ecx
jne 0x56b4fb
mov ecx, 0x6b2210
call fcn.00453692
push 0x6093bf
call fcn.005bb4b0
push ebx
call fcn.005bb5d7
pop ecx
pop ecx
mov ebx, 0x6b2218
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [0x6b21fc], 0
jne 0x56b567
push 0
push 0
push 0x56b56d
call fcn.005cdccd
add esp, 0xc
mov dword [0x6b21fc], eax
test eax, eax
je 0x56b540
cmp eax, 0xffffffff
je 0x56b540
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [0x69bd58], esi
jmp 0x56b547
and dword [0x6b21fc], 0
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop ebx
jmp 0x56b564
mov eax, dword [ebp + 8]
mov dword [0x69bd58], eax
inc eax
neg eax
sbb eax, eax
and dword [0x6b21fc], eax
pop esi
pop ebp
ret
call fcn.00487999
int3
Function at 0x571c41
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push ebx
push esi
mov esi, ecx
push edi
mov eax, dword [esi]
call dword [eax + 0x1b8]
test al, al
jns 0x571c60
or ecx, 0xffffffff
jmp 0x571c66
mov ecx, dword [0x69bb94]
mov eax, dword [esi]
lea edx, [ebp - 4]
push edx
push ecx
mov ecx, esi
call dword [eax + 0x2b4]
push dword [ebp - 4]
mov dword [ebp - 8], eax
push 0x69be2c
call fcn.00493a4d
mov edi, eax
pop ecx
pop ecx
cmp edi, esi
je 0x571d0a
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
js 0x571d0a
test edi, edi
je 0x571cbb
mov eax, dword [edi]
mov ecx, edi
push 0
call dword [eax + 0x228]
push eax
push 0x69bbe0
call fcn.00493a4d
pop ecx
pop ecx
mov ebx, eax
jmp 0x571cbd
xor ebx, ebx
mov eax, dword [ebp - 8]
cmp eax, 2
jne 0x571d15
test ebx, ebx
je 0x571cf6
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c0]
test al, 0x40
je 0x571d0a
cmp dword [ebp - 4], 0
je 0x571cf6
mov eax, dword [ebx]
mov ecx, ebx
push esi
call dword [eax + 0x24c]
mov ecx, dword [ebp + 8]
neg eax
sbb eax, eax
inc eax
mov dword [ecx], eax
mov eax, esi
jmp 0x571d0c
mov eax, dword [esi]
mov ecx, esi
push 5
push 0
push edi
call dword [eax + 0x1f8]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
cmp eax, 3
jne 0x571d0a
test edi, edi
je 0x571d0a
mov eax, dword [edi]
mov ecx, edi
push esi
call dword [eax + 0x184]
test eax, eax
je 0x571d0a
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x18c]
test eax, eax
je 0x571d0a
mov eax, dword [esi]
mov ecx, esi
push 0
call dword [eax + 0x240]
mov eax, dword [esi]
mov ecx, esi
push 0
push 1
push 5
push edi
call dword [eax + 0x34c]
mov ecx, dword [ebp + 8]
xor edx, edx
test eax, eax
setne dl
mov dword [ecx], edx
jmp 0x571d0c
Function at 0x573ae8
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0x2c]
mov edx, dword [0x6b3154]
push ebx
push esi
push edi
mov edx, dword [eax + edx*4]
mov ebx, ecx
mov eax, dword [0x6b234c]
cmp eax, dword [edx + 4]
jle 0x573b43
mov esi, 0x6b234c
push esi
call fcn.005bb616
cmp dword [0x6b234c], 0xffffffff
pop ecx
jne 0x573b43
call fcn.004887ac
push eax
mov ecx, 0x6b2348
call fcn.0040654d
push 0x6093d7
call fcn.005bb4b0
push esi
call fcn.005bb5d7
pop ecx
pop ecx
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x573be5
mov eax, dword [ebx + 0x34c]
test eax, eax
je 0x573bdc
cmp dword [eax + 0x20], 0
je 0x573bdc
test eax, eax
je 0x573b69
mov eax, dword [eax + 0x20]
cmp dword [edi], eax
jne 0x573bdc
mov eax, dword [edi + 4]
sub eax, 1
je 0x573bb0
sub eax, 1
je 0x573b86
sub eax, 1
jne 0x573bdc
mov esi, 0x428e
jmp 0x573bb5
push 0x11
mov esi, 0x3ea1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x573bb5
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0x340]
test eax, eax
je 0x573bb5
add esi, 3
jmp 0x573bb5
mov esi, 0x3ea0
push esi
call fcn.004884b8
test eax, eax
je 0x573be5
push esi
push eax
mov ecx, 0x6b2348
call fcn.00406d3f
test eax, eax
je 0x573be5
mov eax, dword [0x6b2348]
mov dword [edi + 0xc], eax
xor eax, eax
inc eax
jmp 0x573bde
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret 0xc
call fcn.00487999
int3
Function at 0x597140
Capabilities:
Get common file path

Disassembly:
push 0x228
mov eax, 0x6074a5
call fcn.005bb181
mov ebx, ecx
mov dword [ebp - 0x230], ebx
call fcn.005a6a88
push 0x1c4
call fcn.004878b4
pop ecx
mov dword [ebp - 0x22c], eax
and dword [ebp - 4], 0
test eax, eax
je 0x597183
push 0
push dword [ebx + 0x60]
mov ecx, eax
call fcn.005a709f
jmp 0x597185
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov ecx, ebx
push eax
call fcn.005a5ed2
call fcn.00496f4c
mov eax, dword [eax + 4]
mov edi, dword [eax + 0x8c]
lea eax, [ebp - 0x218]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
lea eax, [ebp - 0x218]
push eax
call fcn.005cab7e
mov esi, eax
pop ecx
push 0x5c
pop eax
mov word [ebp + esi*2 - 0x218], ax
inc esi
mov dword [ebp - 0x22c], esi
lea eax, [esi + esi]
cmp eax, 0x208
jae 0x59739c
xor ecx, ecx
mov word [ebp + eax - 0x218], cx
xor eax, eax
mov dword [ebp - 0x228], eax
test edi, edi
je 0x597396
xor ebx, ebx
cmp dword [edi + 4], eax
jle 0x597396
call fcn.004887ac
push eax
lea ecx, [ebp - 0x21c]
call fcn.0040654d
mov eax, dword [edi]
xor ecx, ecx
inc ecx
push ecx
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x218]
push esi
push ecx
push ebx
lea ecx, [ebp - 0x21c]
push ecx
mov ecx, edi
call dword [eax + 0xc]
test eax, eax
je 0x59737a
push 0x6347c0
mov esi, 0x6347c8
lea ecx, [ebp - 0x21c]
push esi
call fcn.004097ea
push esi
push 0x60bc30
lea ecx, [ebp - 0x21c]
call fcn.004097ea
push esi
push 0x6347c0
lea ecx, [ebp - 0x21c]
call fcn.004097ea
call fcn.004887ac
push eax
lea ecx, [ebp - 0x220]
call fcn.0040654d
mov eax, dword [ebp - 0x228]
mov byte [ebp - 4], 2
cmp eax, 9
jne 0x5972b0
push dword [ebp - 0x21c]
lea eax, [ebp - 0x220]
push str.10__Ts
push eax
call fcn.00406c3b
add esp, 0xc
jmp 0x5972e2
jge 0x5972d0
push dword [ebp - 0x21c]
inc eax
push eax
lea eax, [ebp - 0x220]
push str._d__Ts
push eax
call fcn.00406c3b
add esp, 0x10
jmp 0x5972e2
lea eax, [ebp - 0x21c]
push eax
lea ecx, [ebp - 0x220]
call fcn.004067de
push 0x1c4
call fcn.004878b4
pop ecx
mov dword [ebp - 0x234], eax
mov byte [ebp - 4], 3
test eax, eax
je 0x59730c
mov ecx, eax
call fcn.0054d30f
mov ecx, eax
mov dword [ebp - 0x224], eax
jmp 0x597314
xor ecx, ecx
mov dword [ebp - 0x224], ecx
mov eax, dword [ecx]
mov esi, dword [ebp - 0x220]
push esi
mov byte [ebp - 4], 2
call dword [eax + 0xb4]
mov ecx, dword [ebp - 0x224]
lea eax, [ebx + 0xe110]
push eax
mov edx, dword [ecx]
call dword [edx + 0xb0]
push ebx
mov ecx, edi
call fcn.0044883c
mov ecx, dword [ebp - 0x224]
push dword [eax]
mov edx, dword [ecx]
call dword [edx + 0xc8]
mov ecx, dword [ebp - 0x224]
push ecx
mov ecx, dword [ebp - 0x230]
call fcn.005a5ed2
inc dword [ebp - 0x228]
lea ecx, [esi - 0x10]
call fcn.00406e44
mov esi, dword [ebp - 0x22c]
mov ecx, dword [ebp - 0x21c]
or dword [ebp - 4], 0xffffffff
lea ecx, [ecx - 0x10]
call fcn.00406e44
inc ebx
cmp ebx, dword [edi + 4]
jl 0x597205
call fcn.005bb12b
ret
call fcn.005bbf1f
int3

Function at 0x5d8ef4
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005d8bb7

Function at 0x5d8eff
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005d8d38
Function at 0x5dbed4
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005db842

Function at 0x5dbedf
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.005dba7d
Function at 0x106c4f1
Capabilities:
Delete registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1075fb8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov eax, dword [0x1075004]
mov esi, 0x1075004
mov ebx, 0x10064f8
cmp eax, esi
je 0x106c536
test byte [eax + 0x1c], 2
je 0x106c536
cmp byte [eax + 0x19], 5
jb 0x106c536
push ebx
push 0x65
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.010090c5
push dword [ebp + 0xc]
lea eax, [ebp - 0x20c]
push dword [ebp + 8]
push 0x1006acc
push 0x104
push eax
call fcn.01009a76
mov edi, eax
add esp, 0x14
test edi, edi
jge 0x106c59c
mov eax, dword [0x1075004]
cmp eax, esi
je 0x106c57f
test byte [eax + 0x1c], 2
je 0x106c57f
cmp byte [eax + 0x19], 2
jb 0x106c57f
push edi
push ebx
push 0x66
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101463a
mov eax, edi
and eax, 0x1fff0000
cmp eax, 0x70000
jne 0x106c632
and edi, 0xffff
jmp 0x106c632
push 0x10000
push 0
push 0x1004dc8
push 0x80000002
call fcn.0105fce9
mov dword [ebp - 0x210], eax
test eax, eax
jne 0x106c5ea
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov edi, eax
mov eax, dword [0x1075004]
cmp eax, esi
je 0x106c632
test byte [eax + 0x1c], 2
je 0x106c632
cmp byte [eax + 0x19], 2
jb 0x106c632
push edi
push ebx
push 0x67
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101463a
jmp 0x106c632
push 0
push 0
lea ecx, [ebp - 0x20c]
push ecx
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyExW]
mov edi, eax
test edi, edi
je 0x106c626
mov eax, dword [0x1075004]
cmp eax, esi
je 0x106c626
test byte [eax + 0x1c], 2
je 0x106c626
cmp byte [eax + 0x19], 2
jb 0x106c626
push edi
push ebx
push 0x68
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.0101463a
push dword [ebp - 0x210]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0105b7af
leave
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x1005e64
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100a028]
jne 0x1005e6d
ret
jmp 0x1005e72
push ebp
lea ebp, [esp - 0x2a8]
sub esp, 0x328
mov eax, dword [0x100a028]
mov dword [ebp + 0x2a4], eax
mov eax, dword [0x101b0cc]
test eax, eax
je 0x1005e96
call eax
cmp dword [0x101b0d0], 0
je 0x1005edd
push edi
xor eax, eax
and dword [ebp - 0x28], eax
push 0x13
pop ecx
lea edi, [ebp - 0x7c]
rep stosd dword es:[edi], eax
mov ecx, 0xb2
lea edi, [ebp - 0x24]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x80]
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x28]
push 0
mov dword [ebp - 0x80], 0xc0000409
mov dword [ebp - 0x2c], eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x30]
push eax
call dword [0x101b0d0]
pop edi
push 0x502
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp + 0x2a4]
call fcn.01005e64
add ebp, 0x2a8
leave
ret

Function at 0x10070fe
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [esp + 0x14]
jle 0x1007139
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x1007116
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x1007155
dec esi
je 0x100714e
dec esi
jne 0x100715a
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
ret 0xc

Function at 0x409986
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x409986
lcall 0x5de5, 0x8b10c483
jmp fcn.00781ad0
Function at 0x401210
Capabilities:
Hash data using sha256

Disassembly:
endbr32
push ebp
mov ebp, esp
push edi
mov edx, dword [ebp + 8]
lea edi, [edx + 0x20]
xor eax, eax
mov ecx, 0x13
rep stosd dword es:[edi], eax
mov dword [edx], 0x6a09e667
mov dword [edx + 4], 0xbb67ae85
mov dword [edx + 8], 0x3c6ef372
mov dword [edx + 0xc], 0xa54ff53a
mov dword [edx + 0x10], 0x510e527f
mov dword [edx + 0x14], 0x9b05688c
mov dword [edx + 0x18], 0x1f83d9ab
mov dword [edx + 0x1c], 0x5be0cd19
mov dword [edx + 0x6c], 0x20
mov eax, 1
pop edi
pop ebp
ret

Function at 0x402c10
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x402c3c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x402c64
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x402c6a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x402cd2
jg 0x402c81
test esi, esi
je 0x402cd2
test ecx, ecx
jl 0x402ccd
jg 0x402c8b
test eax, eax
je 0x402ccd
cmp edi, ecx
jg 0x402c9f
jl 0x402c95
cmp esi, eax
jae 0x402c9f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x402cd5
mov ecx, dword [ebp + 8]
jmp 0x402cdf
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x402cf9
jg 0x402cdf
test esi, esi
je 0x402cf9
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x402cf9
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc