joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100a5847
Capabilities:
Hide graphical window

Disassembly:
push 0x84
mov eax, 0x100f3d0e
call fcn.100bb090
mov ebx, ecx
mov ecx, dword [ebx + 0x6c4]
mov eax, dword [ecx]
call dword [eax + 0x30]
cmp eax, 0xffffffff
jne 0x100a5874
mov ecx, ebx
call fcn.100a55a4
jmp 0x100a59b2
push eax
lea eax, [ebp - 0x28]
lea ecx, [ebx + 0x67c]
push eax
call fcn.10001bef
xor esi, esi
mov dword [ebp - 4], esi
mov eax, dword [ebx + 0x6c4]
push esi
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push 0x64
lea eax, [ebp - 0x90]
push esi
push eax
call fcn.100d8940
mov ecx, dword [ebx + 0x788]
mov eax, 0x7e6
test ecx, ecx
mov dword [ebp - 0x64], ecx
mov dword [ebp - 0x4c], ecx
mov dword [ebp - 0x68], esi
lea esi, [ebp - 0x90]
lea edx, [eax - 8]
cmovg eax, edx
mov dword [ebp - 0x88], eax
movsx eax, byte [ebp + 8]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebx + 0x6c8]
sub eax, dword [ebx + 0x6cc]
cmp dword [ebp - 0x14], 0x10
mov dword [ebp - 0x84], eax
mov dword [ebp - 0x60], eax
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
sub esp, 0x58
mov dword [ebp - 0x74], eax
mov eax, dword [ebx]
push 0x19
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
call dword [eax + 0x88]
lea ecx, [ebx + 0x67c]
cmp byte [ecx], 0
je 0x100a59aa
call fcn.10001c63
cmp dword [ebx + 0x788], 0
jg 0x100a59aa
mov ecx, dword [ebx + 0x260]
mov eax, dword [ebx + 0x238]
add ecx, ecx
cmp byte [ebx + 0x6d2], 0
mov eax, dword [eax + ecx*8]
je 0x100a595b
mov ecx, dword [ebx + 0x298]
push 1
push 1
push eax
call fcn.1000bffc
mov edx, dword [ebp - 0x84]
cmp eax, edx
jl 0x100a59aa
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
push dword [ebp - 0x18]
cmovae ecx, dword [ebp - 0x28]
sub eax, edx
push ecx
push eax
push edx
mov ecx, ebx
call fcn.100a4ef3
mov ecx, ebx
call fcn.10011761
mov eax, dword [ebx]
lea esi, [ebp - 0x90]
sub esp, 0x64
mov dword [ebp - 0x88], 0x7ee
push 0x19
pop ecx
mov edi, esp
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
call dword [eax + 0x88]
lea ecx, [ebp - 0x28]
call fcn.10002065
call fcn.100bb03a
ret 8

Function at 0x100a6d4a
Capabilities:
Hash data using murmur3

Disassembly:
imul eax, dword [esp + 8], 0xcc9e2d51
push esi
push 0xf
push eax
call fcn.100e2dcd
mov esi, dword [esp + 0x10]
imul eax, eax, 0x1b873593
push 0xd
xor dword [esi], eax
push dword [esi]
call fcn.100e2dcd
imul eax, eax, 5
add esp, 0x10
sub eax, 0x19ab949c
mov dword [esi], eax
pop esi
ret
Function at 0x100b3fcb
Capabilities:
Enumerate pe sections

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx + 8]
mov dword [ecx + 8], eax
mov eax, dword [edx + 0xc]
mov dword [ecx + 0xc], eax
mov eax, dword [edx + 0x10]
mov dword [ecx + 0x10], eax
mov eax, dword [edx + 0x14]
mov dword [ecx + 0x14], eax
mov eax, dword [edx + 0x18]
mov dword [ecx + 0x18], eax
mov ax, word [edx + 4]
mov word [ecx + 4], ax
mov ax, word [edx + 6]
mov word [ecx + 6], ax
mov eax, dword [ecx + 0xc]
cmp dword [ecx], eax
jle 0x100b400a
mov dword [ecx], eax
mov eax, ecx
ret 4

Function at 0x100b4191
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
push esi
push edi
xor esi, esi
mov edi, ecx
push esi
push esi
push dword [esp + 0x1c]
push dword [edi + 4]
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
mov ebp, eax
cdq
sub eax, edx
push esi
mov esi, dword [esp + 0x14]
mov ecx, esi
sar eax, 1
push eax
call fcn.1003ad2e
cmp dword [esi + 0x14], 8
mov eax, esi
jb 0x100b41c5
mov eax, dword [esi]
push ebp
push eax
push dword [esp + 0x1c]
push dword [edi + 4]
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringW]
pop edi
mov eax, esi
pop esi
pop ebp
ret 8

Function at 0x100b4770
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push 0x12
mov esi, ecx
call dword [sym.imp.USER32.dll_GetKeyState]
cwde
mov edx, esi
shr eax, 0x1f
add eax, eax
shr edx, 3
and edx, 1
shr esi, 2
or eax, edx
and esi, 1
add eax, eax
or eax, esi
pop esi
ret
Function at 0x100b537d
Capabilities:
Get keyboard layout

Disassembly:
push 8
push 0x48
mov eax, 0x100f465c
call fcn.100eeffc
mov edi, ecx
mov eax, dword [edi + 0x23c]
mov esi, dword [edi + 0x238]
sub eax, esi
sar eax, 4
cmp eax, 1
ja 0x100b54a3
mov eax, dword [edi + 0x260]
mov ecx, dword [edi + 0x298]
add eax, eax
mov esi, dword [esi + eax*8]
push esi
mov dword [ebp - 0x4c], esi
call fcn.1000a4ce
mov dword [ebp - 0x48], eax
cmp eax, 2
jl 0x100b54a3
xor eax, eax
mov dword [ebp - 0x18], 0xf
push eax
push 5
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x2c], al
call fcn.10003f32
and dword [ebp - 4], 0
mov edx, dword [edi + 0x298]
push dword [ebp - 0x48]
add edx, 4
cmp dword [ebp - 0x18], 0x10
push esi
mov eax, dword [edx]
mov ecx, dword [eax + 0xc]
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push eax
push edx
call ecx
cmp dword [ebp - 0x18], 0x10
lea esi, [ebp - 0x2c]
mov ecx, edi
cmovae esi, dword [ebp - 0x2c]
call fcn.100b5b23
push dword [ebp - 0x1c]
mov edx, eax
lea ecx, [ebp - 0x44]
push esi
call fcn.100b4aa5
pop ecx
pop ecx
mov eax, dword [edi + 0x2a4]
push eax
mov dword [ebp - 0x54], eax
call dword [sym.imp.IMM32.dll_ImmGetContext]
mov dword [ebp - 0x50], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x100b5493
mov ecx, edi
call fcn.100b51a1
cmp dword [ebp - 0x30], 8
lea esi, [ebp - 0x44]
push 0
cmovae esi, dword [ebp - 0x44]
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push esi
mov esi, dword [ebp - 0x50]
push 0x1008
push esi
push eax
call dword [sym.imp.IMM32.dll_ImmEscapeW]
test eax, eax
je 0x100b5489
mov ecx, dword [ebp - 0x4c]
mov eax, dword [ebp - 0x48]
add eax, ecx
push eax
push ecx
mov ecx, edi
call fcn.10010b7a
push esi
push dword [ebp - 0x54]
call dword [sym.imp.IMM32.dll_ImmReleaseContext]
lea ecx, [ebp - 0x44]
call fcn.1000dca0
lea ecx, [ebp - 0x2c]
call fcn.10002065
mov ecx, dword [ebp - 0x14]
call fcn.100eefd7
ret
Function at 0x100b7780
Capabilities:
Open clipboard

Disassembly:
push esi
push edi
mov edi, ecx
xor esi, esi
test esi, esi
jle 0x100b7799
xor eax, eax
lea ecx, [esi - 1]
inc eax
shl eax, cl
push eax
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
jne 0x100b77ae
inc esi
cmp esi, 8
jl 0x100b7786
xor al, al
jmp 0x100b77b0
mov al, 1
pop edi
pop esi
ret
Function at 0x100b85fc
Capabilities:
Write clipboard data

Disassembly:
sub esp, 0xc
push ebx
mov ebx, ecx
push edi
mov edi, dword [esp + 0x18]
mov ecx, dword [ebx + 0x2a4]
call fcn.100b7780
test al, al
je 0x100b87c6
push ebp
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov ecx, ebx
call fcn.1001c346
mov ebp, dword [sym.imp.USER32.dll_SetClipboardData]
test al, al
je 0x100b8696
mov eax, dword [edi + 0x10]
mov ecx, edi
inc eax
mov dword [esp + 0x20], ecx
cmp dword [edi + 0x14], 0x10
mov dword [esp + 0x10], eax
jb 0x100b864d
mov ecx, dword [edi]
mov dword [esp + 0x20], ecx
push eax
push ecx
call fcn.1003a8ca
pop ecx
pop ecx
mov dword [esp + 0x14], eax
lea ecx, [eax + eax]
push ecx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x100b8713
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x100b8713
push dword [esp + 0x10]
mov edx, dword [esp + 0x18]
mov ecx, eax
push dword [esp + 0x24]
call fcn.1003a906
pop ecx
pop ecx
jmp 0x100b8707
mov ecx, dword [edi + 0x20]
mov edx, dword [edi + 0x1c]
call fcn.100b5a0c
mov edx, eax
mov ecx, edi
mov eax, dword [edi + 0x10]
inc eax
mov dword [esp + 0x18], edx
cmp dword [edi + 0x14], 0x10
mov dword [esp + 0x10], eax
mov dword [esp + 0x20], ecx
jb 0x100b86c1
mov ecx, dword [edi]
mov dword [esp + 0x20], ecx
push eax
push ecx
mov ecx, edx
call fcn.100b4a15
pop ecx
pop ecx
mov dword [esp + 0x14], eax
lea ecx, [eax + eax]
push ecx
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x100b8713
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x100b8713
push dword [esp + 0x14]
mov ecx, dword [esp + 0x1c]
mov edx, eax
push dword [esp + 0x14]
push dword [esp + 0x28]
call fcn.100b49fe
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 0xd
jmp 0x100b8754
mov eax, dword [edi + 0x10]
inc eax
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x100b8756
push esi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x100b8756
mov ecx, dword [edi + 0x10]
mov edx, edi
inc ecx
cmp dword [edi + 0x14], 0x10
jb 0x100b873f
mov edx, dword [edi]
push ecx
push edx
push eax
call fcn.100d8120
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push esi
push 1
call ebp
cmp byte [edi + 0x18], 0
je 0x100b87a0
movzx eax, word [ebx + 0x7b2]
push 0
push eax
call ebp
push 1
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov dword [esp + 0x20], eax
test eax, eax
je 0x100b87a0
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
test eax, eax
je 0x100b87a0
push dword [esp + 0x20]
mov byte [eax], 2
movzx esi, word [ebx + 0x7b4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [esp + 0x20]
push esi
call ebp
cmp byte [edi + 0x19], 0
je 0x100b87be
movzx eax, word [ebx + 0x7b6]
push 0
push eax
call ebp
movzx eax, word [ebx + 0x7b8]
push 0
push eax
call ebp
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ebp
pop edi
pop ebx
add esp, 0xc
ret 4
Function at 0x100bc7a0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xf4
mov eax, dword [0x10125074]
xor eax, esp
mov dword [esp + 0xf0], eax
mov dword [esp], 0x100f9c5a
mov dword [esp + 4], 0x100fa048
mov dword [esp + 8], 0x100fa04c
mov dword [esp + 0xc], 0x100fa050
mov dword [esp + 0x10], 0x100fa054
mov dword [esp + 0x14], 0x100fa058
mov dword [esp + 0x18], str.___.____
mov dword [esp + 0x1c], 0x100fa05c
mov dword [esp + 0x20], 0x100fa060
mov dword [esp + 0x24], 0x100fa064
mov dword [esp + 0x28], 0x100fa068
mov dword [esp + 0x2c], 0x100fa06c
mov dword [esp + 0x30], 0x100fa070
mov dword [esp + 0x34], 0x100fa074
mov dword [esp + 0x38], 0x100fa078
mov dword [esp + 0x3c], 0x100fa07c
mov dword [esp + 0x40], 0x100fa080
mov dword [esp + 0x44], 0x100fa084
mov dword [esp + 0x48], 0x100f9c5c
mov dword [esp + 0x4c], 0x100f9c60
mov dword [esp + 0x50], 0x100fa090
mov dword [esp + 0x54], 0x100fa094
mov dword [esp + 0x58], 0x100f9c5a
mov dword [esp + 0x5c], 0x100f9c5a
mov dword [esp + 0x60], 0x100fa098
mov dword [esp + 0x64], 0x100fa09c
mov dword [esp + 0x68], str._n_:_
mov dword [esp + 0x6c], 0x100fa0a4
mov dword [esp + 0x70], 0x100f9c64
mov dword [esp + 0x74], 0x100f9c68
mov dword [esp + 0x78], 0x100f9c6c
mov dword [esp + 0x7c], 0x100f9c70
mov dword [esp + 0x80], 0x100f9c74
mov dword [esp + 0x84], 0x100f9c78
mov dword [esp + 0x88], 0x100f9c7c
mov dword [esp + 0x8c], 0x100f9c80
mov dword [esp + 0x90], 0x100fa0a8
mov dword [esp + 0x94], 0x100fa0ac
mov dword [esp + 0x98], 0x100f9c84
mov dword [esp + 0x9c], 0x100f9c5a
mov dword [esp + 0xa0], 0x100f9c5a
mov dword [esp + 0xa4], 0x100f9c5a
mov dword [esp + 0xa8], 0x100f9c5a
mov dword [esp + 0xac], 0x100f9c5a
mov dword [esp + 0xb0], 0x100f9c5a
mov dword [esp + 0xb4], 0x100f9c5a
mov dword [esp + 0xb8], 0x100f9c5a
mov dword [esp + 0xbc], 0x100f9c88
mov dword [esp + 0xc0], 0x100f9c8c
mov dword [esp + 0xc4], 0x100f9c90
mov dword [esp + 0xc8], str.CbBafnrtvxceEQXZGpPNKR
mov dword [esp + 0xcc], 0x100f9c94
mov dword [esp + 0xd0], 0x100f9c98
mov dword [esp + 0xd4], 0x100fa0b0
mov dword [esp + 0xd8], 0x100f9c9c
mov dword [esp + 0xdc], 0x100f9ca0
mov dword [esp + 0xe0], 0x100f9ca4
mov dword [esp + 0xe4], 0x100fa0b4
mov dword [esp + 0xe8], 0x100f9ca8
mov dword [esp + 0xec], 0x100f9cac
cmp cl, 0x3c
jb 0x100bca06
mov eax, 0x100f9c5a
mov ecx, dword [esp + 0xf0]
xor ecx, esp
call fcn.100ba4f0
add esp, 0xf4
ret
movzx eax, cl
mov ecx, dword [esp + 0xf0]
xor ecx, esp
mov eax, dword [esp + eax*4]
call fcn.100ba4f0
add esp, 0xf4
ret
Function at 0x100bca30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x9c
mov eax, dword [0x10125074]
xor eax, esp
mov dword [esp + 0x98], eax
mov edx, 0x361
mov dword [esp], 0x3610300
mov dword [esp + 4], 0x4860483
lea eax, [esp + 2]
mov dword [esp + 8], 0x9030903
mov dword [esp + 0xc], 0x940093e
mov dword [esp + 0x10], 0x94c0949
mov dword [esp + 0x14], 0x9830982
mov dword [esp + 0x18], 0x9c009be
mov dword [esp + 0x1c], 0x9cc09c7
mov dword [esp + 0x20], 0x9d709d7
mov dword [esp + 0x24], 0xa400a3e
mov dword [esp + 0x28], 0xa830a83
mov dword [esp + 0x2c], 0xac00abe
mov dword [esp + 0x30], 0xacc0ac9
mov dword [esp + 0x34], 0xb030b02
mov dword [esp + 0x38], 0xb3e0b3e
mov dword [esp + 0x3c], 0xb400b40
mov dword [esp + 0x40], 0xb4c0b47
mov dword [esp + 0x44], 0xb570b57
mov dword [esp + 0x48], 0xb830b83
mov dword [esp + 0x4c], 0xbbf0bbe
mov dword [esp + 0x50], 0xbcc0bc1
mov dword [esp + 0x54], 0xbd70bd7
mov dword [esp + 0x58], 0xc030c01
mov dword [esp + 0x5c], 0xc440c41
mov dword [esp + 0x60], 0xc830c82
mov dword [esp + 0x64], 0xcbe0cbe
mov dword [esp + 0x68], 0xcc40cc0
mov dword [esp + 0x6c], 0xccb0cc7
mov dword [esp + 0x70], 0xcd60cd5
mov dword [esp + 0x74], 0xd030d02
mov dword [esp + 0x78], 0xd400d3e
mov dword [esp + 0x7c], 0xd4c0d46
mov dword [esp + 0x80], 0xd570d57
mov dword [esp + 0x84], 0xf7f0f7f
mov dword [esp + 0x88], 0x20e120d0
mov dword [esp + 0x8c], 0x309a3099
mov dword [esp + 0x90], 0xfe23fe20
mov dword [esp + 0x94], 0xffffffff
cmp dx, cx
jae 0x100bcb9b
add eax, 4
cmp word [eax], cx
jb 0x100bcb93
cmp cx, word [eax - 2]
jb 0x100bcbbd
cmp cx, word [eax]
ja 0x100bcbbd
mov al, 1
mov ecx, dword [esp + 0x98]
xor ecx, esp
call fcn.100ba4f0
add esp, 0x9c
ret
mov ecx, dword [esp + 0x98]
xor al, al
xor ecx, esp
call fcn.100ba4f0
add esp, 0x9c
ret
Function at 0x100bcdb0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100f4b8c
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
push esi
push edi
mov eax, dword [0x10125074]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 0xc]
lea eax, [ebp - 0x34]
push eax
mov dword [ebp - 0x10], 0
xorps xmm0, xmm0
mov dword [ebp - 0x38], vtable.std::exception.0
lea eax, [esi + 4]
movq qword [ebp - 0x34], xmm0
push eax
call fcn.100d8a9a
mov eax, dword [esi + 0xc]
add esp, 8
movaps xmm0, xmmword [0x100fa7a0]
mov dword [ebp - 0x2c], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 0x28], eax
movups xmmword [ebp - 0x20], xmm0
mov dword [ebp - 0x38], vtable.boost::exception_detail::error_info_injector_class_boost::regex_error_.0
mov dword [ebp - 0x24], vtable.boost::exception_detail::error_info_injector_class_boost::regex_error_.1.0
mov edi, dword [ebp + 8]
mov dword [ebp - 4], 0
mov dword [edi + 0x28], 0x100fa6c4
mov dword [edi + 0x30], vtable.boost::exception_detail::clone_base.0
lea eax, [ebp - 0x38]
mov byte [ebp - 4], 1
push eax
mov ecx, edi
mov dword [ebp - 0x10], 6
call fcn.100bd220
mov eax, dword [edi + 0x28]
lea esi, [edi + 0x14]
mov dword [edi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::regex_error__.0
mov dword [esi], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::regex_error__.1.0
mov dword [ebp - 4], 3
mov eax, dword [eax + 4]
mov dword [eax + edi + 0x28], vtable.boost::exception_detail::clone_impl_struct_boost::exception_detail::error_info_injector_class_boost::regex_error__.2.0
mov eax, dword [edi + 0x28]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi + 0x24], eax
lea eax, [ebp - 0x24]
push eax
push esi
call fcn.100a6c46
mov eax, dword [edi + 0x28]
add esp, 8
mov dword [edi], vtable.boost::wrapexcept_class_boost::regex_error_.0
mov dword [esi], vtable.boost::wrapexcept_class_boost::regex_error_.1.0
mov eax, dword [eax + 4]
mov dword [eax + edi + 0x28], vtable.boost::wrapexcept_class_boost::regex_error_.2.0
mov eax, dword [edi + 0x28]
mov ecx, dword [eax + 4]
lea eax, [ecx - 8]
mov dword [ecx + edi + 0x24], eax
mov dword [ebp - 0x38], vtable.boost::exception_detail::error_info_injector_class_boost::regex_error_.0
mov dword [ebp - 0x24], vtable.boost::exception.0
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 4], 4
test ecx, ecx
je 0x100bcee8
mov eax, dword [ecx]
mov eax, dword [eax + 0x10]
call eax
mov ecx, dword [ebp - 0x20]
xor edx, edx
test al, al
cmovne ecx, edx
mov dword [ebp - 0x20], ecx
lea eax, [ebp - 0x34]
mov dword [ebp - 4], 0xffffffff
push eax
mov dword [ebp - 0x38], vtable.std::exception.0
call fcn.100d8afd
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x406273
Capabilities:
Write file on windows

Disassembly:
push 0x3c
mov eax, 0x424aa1
call fcn.00416b41
mov edi, ecx
cmp dword [edi + 0x2c], 0xffffffff
jne 0x4063a9
cmp byte [edi + 0x10], 0
je 0x4063a9
lea esi, [edi + 0x14]
xor ebx, ebx
cmp dword [esi + 0x14], 8
mov dword [esi + 0x10], ebx
jb 0x4062a7
mov eax, dword [esi]
jmp 0x4062a9
mov eax, esi
xor ecx, ecx
mov word [eax], cx
xor eax, eax
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], ebx
call fcn.004076fe
test al, al
jne 0x40630b
lea ecx, [ebp - 0x40]
call fcn.00406c81
push eax
lea ecx, [ebp - 0x28]
call fcn.004065fe
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.00405e0a
cmp dword [ebp - 0x18], 0
jbe 0x40639e
mov ebx, 0x42d714
push ebx
call fcn.00413c34
pop ecx
push eax
push ebx
lea ecx, [ebp - 0x28]
call fcn.00402dc8
xor ebx, ebx
cmp dword [ebp - 0x18], 0
jbe 0x40639e
lea eax, [ebp - 0x28]
cmp esi, eax
je 0x406327
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
call fcn.00405b55
mov ebx, 0x42d718
push ebx
call fcn.00413c34
pop ecx
push eax
push ebx
mov ecx, esi
call fcn.00402dc8
cmp dword [esi + 0x14], 8
jb 0x406344
mov esi, dword [esi]
xor ebx, ebx
push ebx
push 0x80
push 4
push ebx
push 1
push 4
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [edi + 0x2c], eax
cmp eax, 0xffffffff
je 0x40639e
push ebx
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x48], ebx
push ecx
push 3
lea ecx, [ebp - 0x44]
mov word [ebp - 0x44], 0xbbef
push ecx
push eax
mov byte [ebp - 0x42], 0xbf
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40638b
cmp dword [ebp - 0x48], 3
je 0x40639e
cmp dword [edi + 0x2c], 0xffffffff
je 0x40639e
push dword [edi + 0x2c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
or dword [edi + 0x2c], 0xffffffff
push ebx
push 1
lea ecx, [ebp - 0x28]
call fcn.00405e0a
xor eax, eax
cmp dword [edi + 0x2c], 0xffffffff
setne al
call fcn.00416af0
ret

Function at 0x4063b8
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
xor ebx, ebx
inc dword [esi + 0xc]
cmp dword [edi + 0x10], ebx
jbe 0x406460
cmp byte [esi + 0x10], 1
jne 0x40643e
call fcn.00406273
test al, al
je 0x40643b
cmp dword [edi + 0x14], 0x10
mov ecx, dword [edi + 0x10]
mov dword [ebp - 4], ebx
mov dword [ebp + 8], ecx
jb 0x4063f5
mov eax, dword [edi]
jmp 0x4063f7
mov eax, edi
push ebx
lea edx, [ebp - 4]
push edx
push ecx
push eax
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40643b
mov eax, dword [ebp + 8]
cmp eax, dword [ebp - 4]
jne 0x40643b
push ebx
lea eax, [ebp - 4]
mov word [ebp + 8], 0xa0d
push eax
push 2
lea eax, [ebp + 8]
push eax
push dword [esi + 0x2c]
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
je 0x40643b
cmp dword [ebp - 4], 2
jne 0x40643b
mov bl, 1
jmp 0x40643e
mov byte [esi + 0x10], bl
cmp byte [esi + 0x10], 0
jne 0x406460
mov eax, dword [esi + 4]
sub eax, dword [esi]
push 0x18
cdq
pop ecx
idiv ecx
cmp eax, 0x40000
jae 0x406460
push edi
mov ecx, esi
call fcn.0040664a
mov bl, 1
pop edi
pop esi
mov al, bl
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x406d66
Capabilities:
Check if file exists
Create directory
Get common file path
Get startup folder

Disassembly:
push 0x214
mov eax, 0x424bfe
call fcn.00416b41
mov esi, ecx
xor ebx, ebx
mov dword [ebp - 0x220], esi
mov dword [ebp - 0x21c], ebx
xor eax, eax
mov dword [esi + 0x14], 7
mov dword [esi + 0x10], ebx
mov word [esi], ax
lea eax, [ebp - 0x218]
mov dword [ebp - 4], ebx
push eax
push ebx
push ebx
push 0x1c
push ebx
mov dword [ebp - 0x21c], 1
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
jne 0x406e8f
cmp word [ebp - 0x218], ax
jne 0x406dc8
mov eax, ebx
jmp 0x406dd5
lea eax, [ebp - 0x218]
push eax
call fcn.00413c34
pop ecx
push eax
lea eax, [ebp - 0x218]
mov ecx, esi
push eax
call fcn.00405d76
mov ebx, 0x42d714
push ebx
call fcn.00413c34
pop ecx
push eax
push ebx
mov ecx, esi
call fcn.00402dc8
mov edi, 0x42d228
push edi
call fcn.00413c34
pop ecx
push eax
push edi
mov ecx, esi
call fcn.00402dc8
cmp dword [esi + 0x14], 8
jb 0x406e18
mov eax, dword [esi]
jmp 0x406e1a
mov eax, esi
mov ebx, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push eax
call ebx
mov edi, dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x406e3e
cmp dword [esi + 0x14], 8
jb 0x406e37
mov eax, dword [esi]
jmp 0x406e39
mov eax, esi
push 0
push eax
call edi
push str.Application
call fcn.00413c34
pop ecx
push eax
push str.Application
mov ecx, esi
call fcn.00402dc8
cmp dword [esi + 0x14], 8
jb 0x406e60
mov eax, dword [esi]
jmp 0x406e62
mov eax, esi
push eax
call ebx
test eax, eax
jne 0x406e7a
cmp dword [esi + 0x14], 8
jb 0x406e73
mov eax, dword [esi]
jmp 0x406e75
mov eax, esi
push 0
push eax
call edi
mov edi, 0x42d714
push edi
call fcn.00413c34
pop ecx
push eax
push edi
mov ecx, esi
call fcn.00402dc8
mov eax, esi
call fcn.00416af0
ret

Function at 0x40710d
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x38
mov eax, 0x424d19
call fcn.00416b41
mov dword [ebp - 0x38], edx
mov eax, ecx
mov dword [ebp - 0x30], eax
mov esi, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 0x3c], edx
xor ecx, ecx
mov dword [eax + 0x14], 7
mov dword [eax + 0x10], edx
mov dword [ebp - 0x44], eax
mov word [eax], cx
mov dword [ebp - 4], edx
mov edi, pe_nt_image_headers32
push 0x101
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x34], edi
call fcn.004164a6
pop ecx
mov edx, esi
lea ecx, [ebp - 0x2c]
mov ebx, eax
call fcn.00406b9b
mov esi, dword [ebp - 0x38]
mov dword [ebp - 4], 1
cmp dword [ebp - 0x18], 8
lea ecx, [ebp - 0x34]
push ecx
push ebx
lea ecx, [ebp - 0x40]
push ecx
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push 0
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp eax, 0xea
jne 0x4071b1
add edi, edi
cmp edi, 0x100000
ja 0x4071cd
push edi
push ebx
call fcn.00416570
pop ecx
pop ecx
test eax, eax
je 0x4071cd
mov ebx, eax
mov dword [ebp - 0x34], edi
jmp 0x40716e
test eax, eax
jne 0x4071cd
cmp dword [ebp - 0x40], 1
jne 0x4071cd
mov esi, dword [ebp - 0x30]
cmp dword [ebp - 0x34], eax
jbe 0x4071d0
push ebx
mov ecx, esi
call fcn.00405a55
jmp 0x4071d0
mov esi, dword [ebp - 0x30]
push ebx
call fcn.00416538
pop ecx
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00405e0a
mov eax, esi
call fcn.00416af0
ret