joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10019010
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov esi, ecx
call dword [sym.imp.mfc140u.dll_CDialog::OnInitDialog]
push 0x3e80000
push 0
push 0x401
push dword [esi + 0xd0]
call dword [sym.imp.USER32.dll_SendMessageW]
lea ecx, [esi + 0xb0]
test ecx, ecx
je 0x10019045
mov ecx, dword [ecx + 0x20]
mov eax, dword [esi + 0x130]
push 0x1391
mov dword [eax + 0x38], ecx
mov ecx, esi
call dword [sym.imp.mfc140u.dll_CWnd::GetDlgItem]
test eax, eax
jne 0x10019063
xor ecx, ecx
jmp 0x10019066
mov ecx, dword [eax + 0x20]
mov eax, dword [esi + 0x130]
mov dword [ebp - 0x18], 0x10
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
mov dword [eax + 0x34], ecx
mov eax, dword [esi + 0x20]
mov dword [ebp - 0x1c], eax
mov eax, dword [esi + 0xa8]
test eax, eax
jne 0x10019102
mov ecx, dword [esi + 0x134]
movups xmm0, xmmword [ebp - 0x1c]
mov eax, dword [ebp - 4]
movups xmmword [ecx], xmm0
movq xmm0, qword [ebp - 0xc]
movq qword [ecx + 0x10], xmm0
mov dword [ecx + 0x18], eax
mov edi, dword [esi + 0x130]
mov eax, dword [esi + 0x134]
cmp dword [edi + 0x48], 0
jne 0x1001913f
push 0
push 4
push 0
push 0
push edi
push sym.MrtDataBase.dll_private:_static_unsigned_int___cdecl_CDataBaseManager::DiskWorkThreadProc_void__
mov dword [edi + 0x30], 0
mov dword [edi + 0x3c], sym.MrtDataBase.dll_public:_static_int___cdecl_CDataBaseManager::ExportRes_class_CDataBaseManager___struct_CDataBaseManager::StrExportParm__
mov dword [edi + 0x40], edi
mov dword [edi + 0x44], eax
call dword [sym.imp.mfc140u.dll_AfxBeginThread]
mov dword [edi + 0x48], eax
push dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
cmp eax, 1
jne 0x1001913f
mov ecx, dword [esi + 0x138]
movups xmm0, xmmword [ebp - 0x1c]
mov eax, dword [ebp - 4]
movups xmmword [ecx], xmm0
movq xmm0, qword [ebp - 0xc]
movq qword [ecx + 0x10], xmm0
mov dword [ecx + 0x18], eax
push dword [esi + 0x138]
mov ecx, dword [esi + 0x130]
push ecx
push sym.MrtDataBase.dll_public:_static_int___cdecl_CDataBaseManager::ImportRes_class_CDataBaseManager___struct_CDataBaseManager::StrImportParm__
call sym.MrtDataBase.dll_public:_int___thiscall_CDataBaseManager::StartThread_unsigned_long_int____cdecl___void___void____void___void__
test eax, eax
jne 0x10019150
push 0
push 0
push str.Other_database_task_running_
mov ecx, esi
call dword [sym.imp.mfc140u.dll_CWnd::MessageBoxW]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10024dc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003bcaf
mov eax, dword fs:[0]
push eax
sub esp, 0x64
mov eax, dword [0x10055014]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov eax, dword [esi + 8]
test eax, eax
je 0x10024ea4
mov edx, dword [sym.imp.mfc140u.dll_operator_1]
xor ecx, ecx
xor ebx, ebx
cmp cx, word [eax + 0x10]
jge 0x10024e95
mov dword [ebp - 0x6c], ecx
nop
mov edi, dword [esi + 8]
add edi, ecx
mov eax, dword [edi + 0x1c]
test eax, eax
je 0x10024e61
movsx ecx, word [edi + 0x14]
and ecx, 0xfffffffe
add ecx, 0xfffffe40
cmp ecx, 0x84
ja case.0x10024e3c.449
movzx ecx, byte [ecx + 0x10024fc4]
jmp dword [ecx*4 + 0x10024fb0]
push 4
jmp 0x10024e55
push eax
call edx
add esp, 4
jmp 0x10024e5e
push 2
jmp 0x10024e55
push 8
push eax
call fcn.100364cd
add esp, 8
mov ecx, dword [ebp - 0x6c]
mov eax, dword [edi + 0x20]
test eax, eax
je 0x10024e76
push 2
push eax
call fcn.100364cd
mov ecx, dword [ebp - 0x6c]
add esp, 8
mov eax, dword [esi + 8]
inc ebx
mov edx, dword [sym.imp.mfc140u.dll_operator_1]
add ecx, 0x98
mov dword [ebp - 0x6c], ecx
movsx eax, word [eax + 0x10]
cmp ebx, eax
jl 0x10024e10
push dword [esi + 8]
call edx
add esp, 4
mov dword [esi + 8], 0
mov eax, dword [esi + 0xc]
push dword [ebp - 0x6c]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x18]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x24]
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x30]
mov dword [esi + 0x34], eax
mov eax, dword [esi + 0x3c]
mov dword [esi + 0x40], eax
mov eax, dword [esi + 0x48]
mov dword [esi + 0x4c], eax
mov edx, dword [esi + 0x58]
push ecx
mov ecx, dword [esi + 0x54]
call fcn.1002f670
mov eax, dword [esi + 0x54]
add esp, 8
mov dword [esi + 0x58], eax
mov dword [ebp - 4], 1
xor edx, edx
mov eax, dword [esi + 0x6c]
mov edi, dword [esi + 0x60]
test eax, eax
je 0x10024f69
mov edx, eax
test edx, edx
jns 0x10024f5e
neg eax
je 0x10024f5e
or ecx, 0xffffffff
mov eax, 0xfffffffc
sub ecx, edx
shr ecx, 5
shl ecx, 2
sub eax, ecx
add edi, eax
jmp 0x10024f66
push 0xd
push str.RowImpl::Free
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
call fcn.1000dc30
push str.Found_an_unknown_sqltype__
lea eax, [ebp - 0x28]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x68]
push eax
call fcn.1001f830
add esp, 0xc
lea eax, [ebp - 0x68]
push 0x10050054
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
mov eax, edx
shr eax, 5
lea edi, [edi + eax*4]
and edx, 0x1f
push edx
push edi
push 0
push dword [esi + 0x60]
lea eax, [ebp - 0x70]
push eax
lea ecx, [esi + 0x60]
call fcn.1002e430
mov dword [esi + 0x70], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x78], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100364bc
mov esp, ebp
pop ebp
ret
Function at 0x10025860
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003bda0
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x10055014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [edi], 0
mov dword [ebp - 4], 0
mov dword [edi], vtable.ibpp_internals::RowImpl.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
lea esi, [edi + 0x60]
mov byte [ebp - 4], 7
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
push 0
mov ecx, esi
mov dword [ebp - 0x10], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.1002f380
mov dword [esi + 0xc], 0
push dword [ebp + 8]
mov ecx, edi
mov byte [ebp - 4], 8
call fcn.100254d0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4

Function at 0x100259d0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003bda0
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x10055014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x14], edi
mov dword [ebp - 4], 0
mov dword [edi], vtable.ibpp_internals::RowImpl.0
mov dword [edi + 4], 0
mov dword [edi + 8], 0
mov dword [edi + 0xc], 0
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x18], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov dword [edi + 0x34], 0
mov dword [edi + 0x38], 0
mov dword [edi + 0x3c], 0
mov dword [edi + 0x40], 0
mov dword [edi + 0x44], 0
mov dword [edi + 0x48], 0
mov dword [edi + 0x4c], 0
mov dword [edi + 0x50], 0
mov dword [edi + 0x54], 0
mov dword [edi + 0x58], 0
mov dword [edi + 0x5c], 0
lea esi, [edi + 0x60]
mov byte [ebp - 4], 7
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
push 0
mov ecx, esi
mov dword [ebp - 0x10], 0
mov dword [esi], 0
mov dword [esi + 4], 0
mov dword [esi + 8], 0
call fcn.1002f380
mov dword [esi + 0xc], 0
push dword [ebp + 0xc]
mov ecx, edi
mov byte [ebp - 4], 8
call fcn.10025050
mov eax, dword [ebp + 8]
mov dword [edi + 0x70], eax
mov eax, dword [ebp + 0x10]
mov dword [edi + 0x74], eax
mov eax, dword [ebp + 0x14]
mov dword [edi + 0x78], eax
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1002cc90
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003c33f
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x10055014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], 0
mov dword [esi], vtable.ibpp_internals::TransactionImpl.0
mov dword [esi + 4], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
mov dword [esi + 0x28], 0
mov dword [esi + 0x2c], 0
mov dword [esi + 0x30], 0
mov dword [esi + 0x34], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
mov dword [esi + 0x44], 0
push dword [ebp + 0x18]
mov byte [ebp - 4], 5
push dword [ebp + 0x14]
mov dword [esi + 8], 0
mov eax, dword [esi + 0xc]
push dword [ebp + 0x10]
mov dword [esi + 0x10], eax
mov eax, dword [esi + 0x3c]
push dword [ebp + 0xc]
mov dword [esi + 0x40], eax
mov eax, dword [esi + 0x18]
push dword [ebp + 8]
mov dword [esi + 0x1c], eax
mov eax, dword [esi + 0x24]
mov dword [esi + 0x28], eax
mov eax, dword [esi + 0x30]
mov dword [esi + 0x34], eax
call fcn.1002c880
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret 0x14
Function at 0x10030510
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
push edi
mov edi, ecx
call dword [sym.imp.mfc140u.dll_CDialog::OnInitDialog]
push 0x1395
mov ecx, edi
call dword [sym.imp.mfc140u.dll_CWnd::GetDlgItem]
test eax, eax
jne 0x10030535
xor ecx, ecx
jmp 0x10030538
mov ecx, dword [eax + 0x20]
mov eax, dword [edi + 0xac]
push 0x28
mov dword [ebp - 0x18], 0x10
mov dword [ebp - 0x14], 0
mov dword [eax + 0x34], ecx
mov eax, dword [edi + 0x20]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0
call dword [sym.imp.mfc140u.dll_operator_2]
movups xmm0, xmmword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
add esp, 4
mov dword [edi + 0xb0], eax
movups xmmword [eax], xmm0
movq xmm0, qword [ebp - 0xc]
movq qword [eax + 0x10], xmm0
mov dword [eax + 0x18], ecx
mov ecx, dword [edi + 0xb0]
mov eax, dword [edi + 0xa8]
push 0
push 0
mov dword [ecx + 0x1c], eax
mov eax, dword [edi + 0xb0]
push 0
push 0
mov dword [eax + 0x20], 1
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov ecx, dword [edi + 0xb0]
push 0
mov dword [ecx + 0x24], eax
mov esi, dword [edi + 0xac]
mov eax, dword [edi + 0xb0]
cmp dword [esi + 0x48], 0
jne 0x10030608
push 4
push 0
push 0
push esi
push sym.MrtDataBase.dll_private:_static_unsigned_int___cdecl_CDataBaseManager::DiskWorkThreadProc_void__
mov dword [esi + 0x30], 0
mov dword [esi + 0x3c], sym.MrtDataBase.dll_public:_static_int___cdecl_CDataBaseManager::CreateDbPathTree_class_CDataBaseManager___struct_CDataBaseManager::StrCreatTreeParm__
mov dword [esi + 0x40], esi
mov dword [esi + 0x44], eax
call dword [sym.imp.mfc140u.dll_AfxBeginThread]
mov dword [esi + 0x48], eax
push dword [eax + 0x2c]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
push 0
push str.Other_database_task_running_
mov ecx, edi
call dword [sym.imp.mfc140u.dll_CWnd::MessageBoxW]
pop edi
mov eax, 1
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100309c0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test edx, edx
jne 0x100309cb
xor eax, eax
pop ebp
ret
pop ebp
jmp fcn.100309e0
Function at 0x10031a00
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [edi + 0x2c]
nop
mov eax, dword [edi + 0x2c]
mov edx, dword [edi + 0x3c]
add eax, 0xfffffefa
sub edx, dword [edi + 0x74]
add eax, esi
sub edx, dword [edi + 0x6c]
mov dword [ebp - 4], edx
cmp dword [edi + 0x6c], eax
jb 0x10031a8f
mov ecx, dword [edi + 0x38]
push esi
lea eax, [ecx + esi]
push eax
push ecx
call sub.VCRUNTIME140.dll_memcpy
mov edx, dword [edi + 0x4c]
add esp, 0xc
mov eax, dword [edi + 0x44]
sub dword [edi + 0x70], esi
sub dword [edi + 0x6c], esi
sub dword [edi + 0x5c], esi
lea ecx, [eax + edx*2]
nop
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x10031a5f
sub eax, esi
jmp 0x10031a61
xor eax, eax
mov word [ecx], ax
sub edx, 1
jne 0x10031a50
mov eax, dword [edi + 0x40]
mov edx, esi
lea ecx, [eax + esi*2]
movzx eax, word [ecx - 2]
lea ecx, [ecx - 2]
cmp eax, esi
jb 0x10031a80
sub eax, esi
jmp 0x10031a82
xor eax, eax
mov word [ecx], ax
sub edx, 1
jne 0x10031a71
mov edx, dword [ebp - 4]
add edx, esi
mov ebx, dword [edi]
cmp dword [ebx + 4], 0
je 0x10031b4b
mov eax, dword [edi + 0x74]
add eax, dword [edi + 0x6c]
add eax, dword [edi + 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebx + 4]
cmp eax, edx
mov ecx, eax
cmova ecx, edx
mov dword [ebp - 4], ecx
test ecx, ecx
jne 0x10031abc
xor eax, eax
jmp 0x10031b0f
sub eax, ecx
mov dword [ebx + 4], eax
mov eax, dword [ebx + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x10031ad9
mov edx, dword [ebx]
push ecx
mov ecx, dword [ebx + 0x30]
call fcn.100306b0
jmp 0x10031af1
cmp eax, 2
jne 0x10031af7
mov edx, dword [ebx]
test edx, edx
jne 0x10031ae8
xor eax, eax
jmp 0x10031af4
push ecx
mov ecx, dword [ebx + 0x30]
call fcn.100309e0
add esp, 4
mov dword [ebx + 0x30], eax
push dword [ebp - 4]
push dword [ebx]
push dword [ebp - 8]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebp - 4]
add esp, 0xc
add dword [ebx], eax
add dword [ebx + 8], eax
add dword [edi + 0x74], eax
mov ebx, dword [edi + 0x74]
cmp ebx, 3
jb 0x10031b37
mov eax, dword [edi + 0x38]
add eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x58]
movzx edx, byte [eax]
mov dword [edi + 0x48], edx
movzx eax, byte [eax + 1]
shl edx, cl
xor edx, eax
and edx, dword [edi + 0x54]
mov dword [edi + 0x48], edx
cmp ebx, 0x106
jae 0x10031b4b
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x10031a10
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403520
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42068b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x4283dc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.004058b3
push 4
mov dword [ebp - 4], 0
call fcn.00406923
mov edi, eax
add esp, 4
test edi, edi
je 0x40359c
call fcn.004056ae
mov dword [edi], eax
call fcn.0040546d
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.00405874
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x403592
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0040589c
jmp 0x40359e
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405c75
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4283dc]
jne 0x405c7f
repz ret
jmp fcn.00409adc
Function at 0x4126d1
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4283dc]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040aae3
and dword [ebp - 0x14], 0
cmp dword [0x42d6f8], 0
mov dword [ebp - 0x18], eax
jne 0x412784
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x41282c
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x41282c
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42d6f8], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42d6fc], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42d700], eax
call edi
push eax
call esi
mov dword [0x42d708], eax
test eax, eax
je 0x412784
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42d704], eax
mov eax, dword [0x42d704]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4127dd
cmp dword [0x42d708], ecx
je 0x4127dd
push eax
call esi
push dword [0x42d708]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4127dd
test ebx, ebx
je 0x4127dd
call edi
test eax, eax
je 0x4127d4
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4127d4
test byte [ebp - 8], 1
jne 0x4127dd
or dword [ebp + 0x10], 0x200000
jmp 0x412810
mov eax, dword [0x42d6fc]
cmp eax, dword [ebp - 0x18]
je 0x412810
push eax
call esi
test eax, eax
je 0x412810
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x412810
mov eax, dword [0x42d700]
cmp eax, dword [ebp - 0x18]
je 0x412810
push eax
call esi
test eax, eax
je 0x412810
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42d6f8]
call esi
test eax, eax
je 0x41282c
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x41282e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00405c75
leave
ret
Function at 0x401000
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push ebx
push esi
mov bl, byte [eax]
cmp bl, 0xd8
je 0x40102e
cmp bl, 0xd7
je 0x40102e
mov esi, dword [ebp + 0x10]
lea ecx, [eax + 1]
test esi, esi
jle 0x40104f
mov eax, dword [ebp + 0xc]
sub ecx, eax
mov dl, byte [ecx + eax]
mov byte [eax], dl
inc eax
dec esi
jne 0x401023
jmp 0x40104f
mov esi, dword [ebp + 0xc]
inc eax
push esi
push eax
call fcn.00401af0
cmp bl, 0xd8
jne 0x40104f
xor eax, eax
cmp dword [ebp + 0x10], eax
jle 0x40104f
xor byte [eax + esi], 0xf0
inc eax
cmp eax, dword [ebp + 0x10]
jl 0x401045
pop esi
pop ebx
pop ebp
ret

Function at 0x4010c1
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push esi
xor esi, esi
push edi
push esi
push dword [esp + 0x14]
push esi
push 0x8000040
push esi
push 0xffffffffffffffff
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, eax
cmp ebx, esi
je 0x4010fc
push esi
push esi
push esi
push 0xf001f
push ebx
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
push ebx
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, esi
jne 0x40112a
push 0x40
push 0x101000
push dword [esp + 0x18]
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40112a
push esi
mov eax, 0x401130
push esi
push eax
push eax
push 0x80030008
call fcn.00401057
add esp, 0x14
mov eax, edi
pop edi
pop esi
pop ebx
ret

Function at 0x401315
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x800
push ebx
xor ebx, ebx
cmp byte [ebp + 8], bl
je 0x401371
push esi
push edi
push ebx
mov edi, 0x400
push ebx
lea eax, [ebp - 0x800]
push edi
mov esi, dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push eax
push 0xffffffffffffffff
push dword [ebp + 0xc]
push ebx
push ebx
call esi
push ebx
push ebx
lea eax, [ebp - 0x400]
push edi
push eax
push 0xffffffffffffffff
push dword [ebp + 0x10]
push ebx
push ebx
call esi
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x800]
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
pop edi
pop esi
jmp 0x40137d
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop ebx
leave
ret
Function at 0x402cd0
Capabilities:
Accept command line arguments

Disassembly:
push ebx
push esi
add esp, 0xfffffef4
mov ebx, edx
mov esi, eax
mov eax, ebx
call fcn.00403ea4
test esi, esi
jne 0x402d07
push 0x105
lea eax, [esp + 8]
push eax
push 0
call sub.kernel32.dll_GetModuleFileNameA
mov ecx, eax
lea edx, [esp + 4]
mov eax, ebx
call fcn.00403f94
jmp 0x402d28
call sub.kernel32.dll_GetCommandLineA
mov dword [esp], eax
mov edx, ebx
mov eax, dword [esp]
call fcn.00402b6c
mov dword [esp], eax
test esi, esi
je 0x402d28
cmp dword [ebx], 0
je 0x402d28
dec esi
jmp 0x402d0f
add esp, 0x10c
pop esi
pop ebx
ret

Function at 0x403258
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x414020]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x4032f0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x4032d0
xor eax, eax
push ebp
push 0x4032c9
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x40330c
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4032d0
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x414020]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x414020], ax
mov esp, ebp
pop ebp
ret

Function at 0x403d20
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x415044], 0
je 0x403d81
cmp word [0x415218], 0xd7b2
jne 0x403d49
cmp dword [0x415220], 0
jbe 0x403d49
mov eax, 0x415214
call dword [0x415230]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x414068
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x403da8
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
push eax
call sub.kernel32.dll_WriteFile
pop edx
ret
cmp byte [0x41402c], 0
jne 0x403d9d
push 0
push 0x414060
push 0x414068
push 0
call sub.user32.dll_MessageBoxA
pop edx
ret