joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40b750
Capabilities:
Print debug messages

Disassembly:
push 0xffffffffffffffff
push 0x41ffe8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
push esi
mov esi, ecx
lea eax, [esp + 8]
push edi
mov ecx, dword [esi + 0x40]
push eax
push ecx
mov dword [esi + 0x18], 1
call dword [sym.imp.USER32.dll_GetWindowRect]
lea edi, [esi + 0x1c]
push edi
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [esi + 0x40]
push edi
push edx
call dword [sym.imp.USER32.dll_ScreenToClient]
mov eax, dword [esi + 0x20]
mov edx, dword [esp + 0x10]
mov ecx, dword [edi]
add eax, edx
push eax
mov eax, dword [esp + 0x10]
add ecx, eax
push ecx
call dword [sym.imp.USER32.dll_SetCursorPos]
push str.doub
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
mov eax, dword [esp + 0x6c]
push eax
mov dword [esp + 0x28], eax
call dword [sym.imp.MSVCRT.dll_wcslen]
add esp, 4
dec eax
mov dword [esp + 0x20], eax
xor edi, edi
inc eax
lea ecx, [esp + 8]
mov dword [esp + 0x38], edi
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], edi
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], edi
mov dword [esp + 0x4c], eax
call sub.MFC42u.DLL_CString::CString_3
mov eax, dword [esp + 0x20]
mov dword [esp + 0x60], edi
lea edx, [eax + 1]
push edx
push eax
lea eax, [esp + 0x10]
push str.words.nCurrIdx__d_words.WordsRange.nEnd_d
push eax
call sub.MFC42u.DLL_CString::Format
add esp, 0x10
lea ecx, [esp + 0x1c]
push edi
push edi
push 1
push 1
push ecx
mov ecx, dword [esi + 0x60]
call fcn.00418f40
lea ecx, [esp + 8]
mov dword [esp + 0x60], 0xffffffff
call fcn.0041b9ac
mov ecx, dword [esp + 0x58]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x5c
ret 8

Function at 0x40e7b0
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [esp + 4]
push ebx
push esi
push 0
push eax
push 0
push 0
push 0x190
push 0xc8
push 0xffffface
push 0xfffffa88
push 0xcf0000
push str.RealDictTest
push str.RealDictTest
push 0
mov dword [0x42f6f0], eax
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
mov esi, eax
push 0
push esi
call ebx
test esi, esi
jne 0x40e803
pop esi
xor eax, eax
pop ebx
ret
push edi
mov edi, dword [sym.imp.USER32.dll_RegisterWindowMessageW]
push str.iscOpQuickDict
call edi
push str.iscQuickDict
mov dword [0x42f6c4], eax
call edi
push str.iscDictQuery
mov dword [0x42f6dc], eax
call edi
push str.enableMultiViewer
mov dword [0x42f6d8], eax
call edi
push str.DreyeMobileSearchWord
mov dword [0x42f6d4], eax
call edi
push str.ChangeWindowMessageFilter
push str.User32.dll
mov dword [0x42f6cc], eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov edi, eax
test edi, edi
je 0x40e87e
push 1
push 0x204
call edi
push 1
push 0xa4
call edi
push 1
push 0x100
call edi
mov eax, dword [esp + 0x14]
push eax
push esi
call ebx
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
push 0
push esi
call ebx
mov eax, esi
pop edi
pop esi
pop ebx
ret
Function at 0x412dc0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x4204a7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
push ebx
push ebp
push esi
push edi
mov esi, ecx
xor edi, edi
mov eax, 0x4215c0
mov dword [esp + 0x10], esi
mov dword [esi + 0x20], edi
mov dword [esi + 0x1c], eax
mov dword [esp + 0x1c], edi
mov dword [esi + 0x3c], edi
mov dword [esi + 0x38], eax
lea ebp, [esi + 0x68]
mov byte [esp + 0x1c], 1
mov ecx, ebp
call sub.MFC42u.DLL_CString::CString_3
lea ebx, [esi + 0x6c]
mov byte [esp + 0x1c], 2
mov ecx, ebx
call sub.MFC42u.DLL_CString::CString_3
mov dword [esi + 0x74], edi
mov dword [esi + 0x70], 0x4216bc
mov dword [esi + 0x78], edi
push 0x42f700
mov ecx, ebp
mov byte [esp + 0x20], 4
mov dword [esi], 0x4216b8
call sub.MFC42u.DLL_CString::operator_2
push 0x42f700
mov ecx, ebx
call sub.MFC42u.DLL_CString::operator_2
mov eax, 0x2e
mov dword [esi + 0x2c], edi
mov dword [esi + 0x64], eax
mov dword [esi + 0x60], eax
lea eax, [esi + 0x7c]
mov dword [esi + 0x4c], edi
push eax
mov dword [esi + 0x50], edi
mov dword [esi + 0x54], edi
mov dword [esi + 0x5c], edi
mov dword [esi + 0x58], 0x1e
mov dword [esi + 0x28], edi
mov dword [esi + 0x24], edi
mov dword [esi + 0x34], edi
mov dword [esi + 0x30], edi
mov dword [eax], 0x114
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
push 0x426b1c
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [esp + 0x14]
mov dword [esi + 0x190], eax
mov dword [esi + 0x14], 0x112
mov dword [esi + 0x18], 0xe3
mov dword [esi + 0xc], 0xb9
mov dword [esi + 0x10], 0xd3
mov dword [esi + 8], 0x92
mov dword [esi + 4], 2
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret
Function at 0x418050
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
call fcn.00417d90
test eax, eax
jne 0x418109
mov ecx, 0x42f768
call fcn.0040cf70
mov ecx, dword [0x42f778]
mov eax, dword [0x42f774]
push ecx
push eax
mov esi, eax
mov edi, ecx
call fcn.00417db0
mov eax, dword [0x42f77c]
add esp, 8
test eax, eax
je 0x4180b5
mov dword [0x42f77c], 0
call fcn.0040e8a0
mov ecx, dword [eax + 0x7ec4]
test ecx, ecx
jne 0x4180b5
push 1
call fcn.0040e8a0
mov ecx, eax
add ecx, 4
call fcn.00419bb0
call fcn.0040e8a0
mov ecx, dword [eax + 0x7f30]
test ecx, ecx
je 0x4180ea
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
sar ax, 8
cmp ax, 0xffff
jne 0x4180ea
push edi
push esi
call fcn.0040e8a0
mov ecx, eax
add ecx, 4
call fcn.00419990
pop edi
pop esi
ret
push edi
push esi
call fcn.0040e8a0
mov ecx, eax
add ecx, 4
call fcn.00419770
test eax, eax
je 0x418109
mov dword [0x42f77c], 1
pop edi
pop esi
ret
Function at 0x10001210
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
mov word [ebp - 6], 0x7274
mov dword [ebp - 0xb], 0x20657479
mov byte [ebp - 4], 0
mov byte [ebp - 0xc], 0x62
mov byte [ebp - 7], 0x70
mov word [ebp - 0x15], 0x2064
mov word [ebp - 0x12], 0x7274
mov byte [ebp - 0x13], 0x70
mov byte [ebp - 0x10], 0
mov word [ebp - 0x17], 0x726f
mov byte [ebp - 0x18], 0x77
mov dword [ebp - 0x22], 0x2064726f
mov word [ebp - 0x1d], 0x7274
mov byte [ebp - 0x1b], 0
mov word [ebp - 0x24], 0x7764
mov byte [ebp - 0x1e], 0x70
mov dword [ebp - 0x41], 0x727470
mov word [ebp - 0x44], 0x6574
mov word [ebp - 0x47], 0x625f
mov byte [ebp - 0x42], 0x20
mov byte [ebp - 0x48], 0x36
mov byte [ebp - 0x45], 0x79
mov word [ebp - 0x2a], 0x7470
mov word [ebp - 0x2d], 0x6472
mov word [ebp - 0x30], 0x7771
mov word [ebp - 0x28], 0x72
mov byte [ebp - 0x2b], 0x20
mov byte [ebp - 0x2e], 0x6f
mov dword [ebp - 0x51], 0x65747962
mov dword [ebp - 0x4d], 0x72747020
mov word [ebp - 0x53], 0x5f30
mov byte [ebp - 0x49], 0
mov byte [ebp - 0x54], 0x31
mov word [ebp - 0x5a], 0x2044
mov dword [ebp - 0x60], 0x41564e49
mov word [ebp - 0x57], 0x5254
mov byte [ebp - 0x55], 0
mov word [ebp - 0x5c], 0x494c
mov byte [ebp - 0x58], 0x50
mov dword [ebp - 0x66], 0x54502044
mov dword [ebp - 0x6c], 0x41564e49
mov word [ebp - 0x68], 0x494c
mov word [ebp - 0x62], 0x52
mov dword [ebp - 0x36], 0x727470
mov word [ebp - 0x3b], 0x6f77
mov word [ebp - 0x38], 0x2064
mov byte [ebp - 0x3c], 0x6f
mov byte [ebp - 0x39], 0x72
cmp ecx, 8
ja case.default.0x10001322
jmp dword [ecx*4 + 0x100013f0]
lea eax, [ebp - 0xc]
push eax
push 0x104
push edx
call fcn.10016950
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
push eax
push 0x104
push edx
call fcn.10016950
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
push 0x104
push edx
call fcn.10016950
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x48]
push eax
push 0x104
push edx
call fcn.10016950
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x30]
push eax
push 0x104
push edx
call fcn.10016950
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x54]
push eax
push 0x104
push edx
call fcn.10016950
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x60]
push eax
push 0x104
push edx
call fcn.10016950
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x6c]
push eax
push 0x104
push edx
call fcn.10016950
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x3c]
push eax
push 0x104
push edx
call fcn.10016950
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10001420
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov word [ebp - 3], 0x73
mov byte [ebp - 4], 0x65
mov word [ebp - 8], 0x7363
mov byte [ebp - 6], 0
mov word [ebp - 0xc], 0x7373
mov byte [ebp - 0xa], 0
mov word [ebp - 0x10], 0x7364
mov byte [ebp - 0xe], 0
mov word [ebp - 0x13], 0x73
mov byte [ebp - 0x14], 0x66
mov word [ebp - 0x17], 0x73
mov byte [ebp - 0x18], 0x67
mov word [ebp - 0x1d], 0x524f
mov word [ebp - 0x20], 0x5245
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1b], 0
mov dword [ebp - 0x26], 0x524f52
mov word [ebp - 0x28], 0x5245
cmp ecx, 7
ja case.default.0x1000148c
jmp dword [ecx*4 + 0x10001544]
lea eax, [ebp - 4]
push eax
push 0x104
push edx
call fcn.10016950
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 8]
push eax
push 0x104
push edx
call fcn.10016950
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0xc]
push eax
push 0x104
push edx
call fcn.10016950
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x10]
push eax
push 0x104
push edx
call fcn.10016950
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x14]
push eax
push 0x104
push edx
call fcn.10016950
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x18]
push eax
push 0x104
push edx
call fcn.10016950
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x20]
push eax
push 0x104
push edx
call fcn.10016950
add esp, 0xc
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x28]
push eax
push 0x104
push edx
call fcn.10016950
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x10009c20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [ebp - 9], 0x6c642e32
push eax
mov word [ebp - 5], 0x6c
mov dword [ebp - 0xf], 0x656e7265
mov word [ebp - 0xb], 0x336c
mov byte [ebp - 0x10], 0x4b
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov esp, ebp
pop ebp
ret

Function at 0x10009c60
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 0x10]
mov dword [ebp - 7], 0x6c6c64
push eax
mov dword [ebp - 0xb], 0x2e323369
mov word [ebp - 0xd], 0x7061
mov word [ebp - 0x10], 0x6441
mov byte [ebp - 0xe], 0x76
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esp, ebp
pop ebp
ret

Function at 0x10009ca0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
mov word [ebp - 8], 0x3233
push eax
mov dword [ebp - 6], 0x6c6c642e
mov word [ebp - 0xb], 0x6573
mov byte [ebp - 2], 0
mov byte [ebp - 0xc], 0x55
mov byte [ebp - 9], 0x72
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esp, ebp
pop ebp
ret

Function at 0x10009ce0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0x776c6853
push eax
mov dword [ebp - 8], 0x2e697061
mov word [ebp - 3], 0x6c6c
mov byte [ebp - 1], 0
mov byte [ebp - 4], 0x64
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esp, ebp
pop ebp
ret
Function at 0x1000a810
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.10009ca0
test eax, eax
je 0x1000a85f
lea ecx, [ebp - 0x14]
mov dword [ebp - 0x11], 0x65726f46
push ecx
push eax
mov dword [ebp - 5], 0x776f646e
mov dword [ebp - 0xa], 0x57646e75
mov word [ebp - 0x14], 0x6553
mov word [ebp - 0xd], 0x7267
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 1], 0
mov byte [ebp - 6], 0x69
mov byte [ebp - 0xb], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000a8c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.10009ca0
test eax, eax
je 0x1000a901
lea ecx, [ebp - 0x10]
mov dword [ebp - 5], 0x776f646e
push ecx
push eax
mov dword [ebp - 0xb], 0x65766974
mov dword [ebp - 0x10], 0x41746553
mov word [ebp - 7], 0x6957
mov byte [ebp - 1], 0
mov byte [ebp - 0xc], 0x63
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000a960
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
call fcn.10009ca0
test eax, eax
je 0x1000a9a3
lea ecx, [ebp - 0x14]
mov word [ebp - 0xf], 0x6957
push ecx
push eax
mov dword [ebp - 0x14], 0x6e697242
mov dword [ebp - 0xd], 0x776f646e
mov dword [ebp - 7], 0x706f54
mov byte [ebp - 0x10], 0x67
mov word [ebp - 9], 0x6f54
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000aa30
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x134
push esi
push 0x104
lea eax, [ebp - 0x130]
mov esi, ecx
push 0
push eax
mov dword [ebp - 0x10], esi
call fcn.1000e340
add esp, 0xc
mov dword [ebp - 5], 0x73255c45
lea ecx, [ebp - 0x28]
mov dword [ebp - 0xa], 0x41575446
mov word [ebp - 0xc], 0x4f53
mov byte [ebp - 1], 0
mov byte [ebp - 6], 0x52
call fcn.1000b8f0
cmp dword [eax + 0x14], 0x10
jb 0x1000aa81
mov eax, dword [eax]
push eax
lea eax, [ebp - 0xc]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x130]
push 0x104
push eax
call fcn.1000b7f0
mov edx, dword [ebp - 0x14]
add esp, 0x14
cmp edx, 0x10
jb 0x1000aacc
mov ecx, dword [ebp - 0x28]
inc edx
mov eax, ecx
cmp edx, 0x1000
jb 0x1000aac2
mov ecx, dword [ecx - 4]
add edx, 0x23
sub eax, ecx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1000aae1
push edx
push ecx
call fcn.1000c1a3
add esp, 8
lea eax, [ebp - 0x130]
mov ecx, esi
push eax
call fcn.1000b990
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret
call fcn.1001f487
int3

Function at 0x1000ad50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [0x1006e584], 0
jne 0x1000ad77
call fcn.1000a0e0
mov edx, 0x100
mov ecx, 0x1006e590
call fcn.1000a700
mov dword [0x1006e584], 1
jmp fcn.1000a760

Function at 0x1002b023
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002a8cf

Function at 0x1002b02e
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1002ab0a
Function at 0x1003598e
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100357cc

Function at 0x1003bb80
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call fcn.10009ca0
test eax, eax
je 0x1003bbbe
lea ecx, [ebp - 0x10]
mov dword [ebp - 0xf], 0x69577465
push ecx
push eax
mov dword [ebp - 8], 0x736f5077
mov word [ebp - 0xb], 0x646e
mov byte [ebp - 0x10], 0x53
mov byte [ebp - 4], 0
mov byte [ebp - 9], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esp, ebp
pop ebp
ret
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1003c080
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword [ebp + 0xc]
sub esp, 0x118
cmp eax, 1
jne 0x1003c130
push ecx
lea edx, [esp + 0x14]
call fcn.10009fa0
add esp, 4
mov dword [esp + 6], 0x75732074
lea edx, [esp]
mov dword [esp + 0xc], 0x74726f
lea ecx, [esp + 0x10]
mov dword [esp + 1], 0x6174736e
mov word [esp + 0xa], 0x7070
mov byte [esp], 0x69
mov byte [esp + 5], 0x6e
call fcn.1000a510
test eax, eax
jne 0x1003c15c
mov edx, sym.drvhlp.dll_tr7e12
mov ecx, 0x1006e574
call fcn.1000b020
test eax, eax
je 0x1003c15c
mov edx, sym.drvhlp.dll_q56ks7
mov ecx, 0x1006e52c
call fcn.1000b020
test eax, eax
je 0x1003c15c
mov edx, sym.drvhlp.dll_y4yhvw
mov ecx, 0x1006e554
call fcn.1000b020
test eax, eax
je 0x1003c15c
mov edx, sym.drvhlp.dll_dmps0h
mov ecx, 0x1006e550
call fcn.1000b020
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
test eax, eax
jne 0x1003c15c
mov ecx, 0x1006e574
call fcn.1000b1f0
mov ecx, 0x1006e52c
call fcn.1000b1f0
mov ecx, 0x1006e554
call fcn.1000b1f0
mov ecx, 0x1006e550
call fcn.1000b1f0
mov eax, 1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
pushal
call 0x402c00
pop dword [ebp - 0xc]
mov eax, 0x402c00
sub dword [ebp - 0xc], eax
mov dword [ebp - 0x1c], 0x4d24dd9a
sub dword [ebp - 0x1c], 0xfed2984f
mov dword [ebp - 0x18], 0x7b6229a2
sub dword [ebp - 0x18], 0x492edd5d
mov dword [ebp - 0x14], 0x22d3acda
add dword [ebp - 0x14], 0x29789754
mov dword [ebp - 0x10], 0xbe624b64
sub dword [ebp - 0x10], 0xbe624b64
lea eax, [ebp - 0x1c]
push eax
mov eax, 0x12834206
sub eax, 0x1242c17a
add eax, dword [ebp - 0xc]
call dword [eax]
mov dword [ebp - 0x1c], 0xbcd8788
add dword [ebp - 0x1c], 0x68a4e1ce
mov dword [ebp - 0x18], 0xb353ec7b
sub dword [ebp - 0x18], 0x71e78b06
mov dword [ebp - 0x14], 0xb17ffaa0
add dword [ebp - 0x14], 0xb1ef71cc
mov dword [ebp - 0x10], 0x32262829
sub dword [ebp - 0x10], 0x32262829
lea ebx, [ebp - 0x1c]
push ebx
push eax
mov eax, 0x42ac6516
add eax, 0xbd941bbe
add eax, dword [ebp - 0xc]
call dword [eax]
push 0x40
push 0x1000
push 0x363f2
push 0
call eax
mov ecx, 0xd53a1536
add ecx, 0x2ac63105
mov ebx, eax
mov esi, str.3_31
add esi, dword [ebp - 0xc]
mov edi, 0xb0dfab66
sub dword [ebp - 8], eax
mov edx, dword [esi]
mov dword [ebp - 8], 0xeb41e401
xor edx, edi
xor dword [ebp - 4], edi
mov dword [ebx], edx
add ebx, 0xa55a167a
sub ebx, 0xa55a1676
add esi, 4
loop 0x402d11
add eax, 0xfb4d4a9f
add eax, 0x4b3c120
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x400000
add ecx, dword [ebp - 0xc]
call ebx
leave
ret
Function at 0x10007f3f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x18], esp
mov ebx, dword [ebp + 0x10]
push dword [ebx]
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x10007f8f
push 6
call fcn.1000ad74
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0x18], esp
push dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
push dword [ebx]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_FindResourceA]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x10007fbc
push 6
call fcn.1000ad74
add esp, 4
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10008079
mov dword [ebp - 0x18], esp
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_SizeofResource]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x10007fee
push 6
call fcn.1000ad74
add esp, 4
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x18], esp
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.DLL_LoadResource]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x10008016
push 6
call fcn.1000ad74
add esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x10008079
mov dword [ebp - 0x18], esp
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.DLL_LockResource]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x10008045
push 6
call fcn.1000ad74
add esp, 4
mov dword [ebp - 0x14], eax
push 0x80000301
push 0
push dword [ebp - 0xc]
push 0x80000301
push 0
push dword [ebp - 0x14]
push 2
mov ebx, 0x910
call fcn.1000c5d0
add esp, 0x1c
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
jmp 0x10008083
mov eax, 0x100167e9
jmp 0x10008083
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1000a12e
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], esp
mov eax, 0
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x10]
push eax
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1000a173
push 6
call fcn.1000ad74
add esp, 4
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1000a195
push 6
call fcn.1000ad74
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push 1
push dword [ebp - 4]
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_AttachThreadInput]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x1000a1c2
push 6
call fcn.1000ad74
add esp, 4
mov dword [ebp - 0xc], esp
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_SetFocus]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1000a1e4
push 6
call fcn.1000ad74
add esp, 4
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], esp
call dword [sym.imp.KERNEL32.DLL_GetCurrentThreadId]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1000a206
push 6
call fcn.1000ad74
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push 0
push dword [ebp - 4]
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_AttachThreadInput]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x1000a233
push 6
call fcn.1000ad74
add esp, 4
mov dword [ebp - 0xc], esp
call dword [sym.imp.USER32.dll_GetFocus]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x1000a252
push 6
call fcn.1000ad74
add esp, 4
cmp dword [ebp - 8], eax
mov eax, 0
setne al
jmp 0x1000a262
mov esp, ebp
pop ebp
ret 4