joyce8/EMBER2024-capa huggingface dataset:
Function at 0x45fe34
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x4cac34]
cmp dword [eax + 0x30], 0
je 0x45fede
cmp dword [ebx + 0x94], 0
jne 0x45fed8
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x45fdc4
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x45fed8
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x45fe9e
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x45fed8
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00417ac8
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x45fead
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x4609bc
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x4609f1
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.0040456c
jmp 0x4609fe
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.004044d0
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x461ab4
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x461af5
mov eax, esi
call fcn.004477ac
test al, al
je 0x461af5
mov eax, dword [ebx + 0x84]
call fcn.004474a8
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x461af5
push 0
mov eax, dword [ebx + 0x84]
call fcn.004474a8
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret

Function at 0x46518c
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x4651ba
mov eax, ebx
call fcn.00465c44
cmp dword [ebx + 0x3c], 0
je 0x4651b3
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x46522b
mov edx, dword [ebx + 0x1ac]
cmp dword [edx + 0x10], 0
je 0x46521d
cmp dword [ebx + 8], 0
je 0x4651dc
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1ac]
call dword [edx]
test eax, eax
jne 0x4651ee
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x46521d
cmp dword [ebx + 8], 0
je 0x4651cf
cmp eax, 3
je 0x465201
dec eax
jne 0x4651cf
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4651cf
mov edx, dword [ebx + 0x138]
add dword [eax + 8], edx
jmp 0x4651cf
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x465249
cmp dword [ebx + 0x10], 0xcc
je 0x465249
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00465254
pop ebx
ret
Function at 0x478868
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
push esi
push edi
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
mov dword [ebp - 4], eax
lea eax, [ebp + 0xc]
push eax
push edi
lea eax, [ebp - 4]
push eax
push 0
mov eax, esi
call fcn.0040492c
push eax
mov eax, dword [ebx + 4]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x4788c0
mov dword [ebp - 0xc], esi
mov byte [ebp - 8], 0xb
lea eax, [ebp - 0xc]
push eax
push 0
mov ecx, dword [0x4c9ff4]
mov dl, 1
mov eax, dword [0x47838c]
call fcn.0040c008
call fcn.00403edc
mov ebx, dword [ebp + 0xc]
mov eax, dword [ebp - 4]
call fcn.00478494
mov edx, dword [ebp + 8]
mov byte [edx], al
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x478958
Capabilities:
Query or enumerate registry value

Disassembly:
add esp, 0xffffff54
cmp byte [0x4c96d8], 0
jne 0x478a2a
mov byte [0x4c96d8], 1
xor eax, eax
mov dword [0x4c96d0], eax
mov dword [esp + 0x18], 0x94
lea eax, [esp + 0x18]
push eax
call sub.kernel32.dll_GetVersionExA
cmp dword [esp + 0x1c], 3
ja 0x4789a0
cmp dword [esp + 0x1c], 3
jne 0x478a00
cmp dword [esp + 0x20], 0x33
jbe 0x478a00
mov dword [esp + 4], 9
push esp
push 0x20019
push 0
push 0x478a34
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x478a2a
lea eax, [esp + 4]
push eax
lea eax, [esp + 0xc]
push eax
lea eax, [esp + 0x1c]
push eax
push 0
push 0x478a64
mov eax, dword [esp + 0x14]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x478a2a
mov eax, dword [esp]
push eax
call sub.advapi32.dll_RegCloseKey_1
cmp byte [esp + 8], 0x31
jne 0x478a2a
cmp byte [esp + 9], 0
jne 0x478a2a
jmp 0x478a15
push 0
push 0x478a64
push 0x478a6c
call sub.kernel32.dll_GetProfileIntA
test eax, eax
je 0x478a2a
mov eax, dword [0x4c96cc]
call fcn.0040492c
push eax
call sub.kernel32.dll_LoadLibraryA
mov dword [0x4c96d0], eax
add esp, 0xac
ret
Function at 0x49f080
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffef8
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x108], edx
mov edi, eax
xor eax, eax
push ebp
push 0x49f256
push dword fs:[eax]
mov dword fs:[eax], esp
mov byte [ebp - 1], 0
cmp dword [edi + 0x38], 0
jne 0x49f23d
mov eax, dword [edi + 0x30]
call fcn.00404734
test eax, eax
jne 0x49f0d6
mov eax, dword [edi + 0x34]
call fcn.00404734
test eax, eax
jne 0x49f0d6
mov eax, edi
call fcn.0049f2f4
jmp 0x49f23d
cmp dword [edi + 0xa0], 0
jne 0x49f10d
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x30]
call fcn.00408fe4
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4cadc8]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa0], eax
cmp dword [edi + 0xa4], 0
jne 0x49f144
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0x34]
call fcn.00408fe4
push 0x3ec
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x4cadc8]
mov eax, dword [eax + 0x44]
push eax
call sub.user32.dll_DdeCreateStringHandleA
mov dword [edi + 0xa4], eax
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.0049f334
mov ebx, eax
test bl, bl
jne 0x49f1f2
mov eax, dword [edi + 0x30]
call fcn.00404734
test eax, eax
jne 0x49f17c
mov eax, dword [edi + 0xc0]
call fcn.00404734
test eax, eax
je 0x49f1f2
mov eax, dword [edi + 0xc0]
call fcn.00404734
test eax, eax
je 0x49f19e
lea eax, [ebp - 0x101]
mov edx, dword [edi + 0xc0]
call fcn.00408fe4
jmp 0x49f1ca
push dword [edi + 0x30]
push 0x49f270
push dword [edi + 0x34]
lea eax, [ebp - 0x108]
mov edx, 3
call fcn.004047f4
mov edx, dword [ebp - 0x108]
lea eax, [ebp - 0x101]
call fcn.00408fe4
push 7
lea eax, [ebp - 0x101]
push eax
call sub.kernel32.dll_WinExec
cmp eax, 0x20
jb 0x49f1f2
mov ecx, dword [edi + 0xa4]
mov edx, dword [edi + 0xa0]
mov eax, edi
call fcn.0049f334
mov ebx, eax
test bl, bl
jne 0x49f1ff
mov eax, edi
call fcn.0049f2f4
jmp 0x49f23d
mov eax, dword [edi + 0x58]
test eax, eax
je 0x49f20e
mov dword [edi + 0xa8], eax
jmp 0x49f218
mov dword [edi + 0xa8], 1
mov eax, edi
call fcn.0049f3ac
test al, al
je 0x49f23d
mov eax, edi
mov si, 0xffee
call fcn.0040390c
xor ecx, ecx
xor edx, edx
mov eax, edi
call fcn.0049f458
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x49f25d
lea eax, [ebp - 0x108]
call fcn.0040447c
ret
Function at 0x4a1b14
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 0x21c], ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x214], ecx
mov dword [ebp - 0x210], ecx
mov dword [ebp - 0x20c], ecx
mov ebx, edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x4a1d74
push dword fs:[eax]
mov dword fs:[eax], esp
cmp ebx, 1
jl 0x4a1b77
lea edx, [ebp - 0x20c]
mov eax, dword [ebp - 4]
call fcn.004a15dc
mov eax, dword [ebp - 0x20c]
mov edx, ebx
call fcn.0040c7dc
cmp al, 1
jne 0x4a1b77
dec ebx
mov dword [ebp - 8], ebx
mov eax, dword [ebp - 4]
call fcn.004a18f4
test al, al
je 0x4a1d03
cmp dword [ebp - 8], 0
jge 0x4a1b95
xor eax, eax
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
inc ebx
lea edx, [ebp - 0x210]
mov eax, dword [ebp - 4]
call fcn.004a15dc
mov eax, dword [ebp - 0x210]
call fcn.00404734
cmp ebx, eax
jge 0x4a1bdf
lea edx, [ebp - 0x214]
mov eax, dword [ebp - 4]
call fcn.004a15dc
mov eax, dword [ebp - 0x214]
mov al, byte [eax + ebx - 1]
mov edx, dword [0x4c9fd0]
and eax, 0xff
bt dword [edx], eax
jae 0x4a1bdf
inc ebx
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x228]
cmp eax, dword [ebp - 8]
jg 0x4a1bf3
mov dword [ebp - 8], eax
mov ebx, dword [ebp - 8]
mov ecx, ebx
mov edx, ebx
mov eax, dword [ebp - 4]
call fcn.004a1af0
cmp ebx, dword [ebp - 8]
je 0x4a1cf5
lea eax, [ebp - 0x108]
push eax
call sub.user32.dll_GetKeyboardState
mov edx, pe_nt_image_headers32
lea eax, [ebp - 0x208]
mov byte [eax], 0
inc eax
dec edx
jne 0x4a1c1f
mov byte [ebp - 0x1f8], 0x81
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0040390c
and eax, 0x7f
movzx eax, word [eax*2 + 0x4c9a70]
mov byte [ebp + eax - 0x208], 0x81
lea eax, [ebp - 0x208]
push eax
call sub.user32.dll_SetKeyboardState
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 1
xor eax, eax
push ebp
push 0x4a1ce2
push dword fs:[eax]
mov dword fs:[eax], esp
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0040390c
and eax, 0x7f
movzx eax, word [eax*2 + 0x4c9a70]
push eax
push pe_nt_image_headers32
mov eax, dword [ebp - 4]
call fcn.004474a8
push eax
call sub.user32.dll_SendMessageA
push 1
mov eax, dword [ebp - 4]
mov si, 0xffc8
call fcn.0040390c
and eax, 0x7f
movzx eax, word [eax*2 + 0x4c9a70]
push eax
push 0x101
mov eax, dword [ebp - 4]
call fcn.004474a8
push eax
call sub.user32.dll_SendMessageA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a1ce9
mov eax, dword [ebp - 4]
mov byte [eax + 0x23c], 0
ret
mov eax, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [eax + 0x230], edx
jmp 0x4a1d56
cmp dword [ebp - 8], 0
jge 0x4a1d0e
xor eax, eax
mov dword [ebp - 8], eax
lea edx, [ebp - 0x218]
mov eax, dword [ebp - 4]
call fcn.004a15dc
mov eax, dword [ebp - 0x218]
call fcn.00404734
cmp eax, dword [ebp - 8]
jg 0x4a1d48
lea edx, [ebp - 0x21c]
mov eax, dword [ebp - 4]
call fcn.004a15dc
mov eax, dword [ebp - 0x21c]
call fcn.00404734
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
call fcn.004a1af0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a1d7b
lea eax, [ebp - 0x21c]
mov edx, 5
call fcn.004044a0
ret
Function at 0x4ac5b4
Capabilities:
Swap mouse buttons

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff34
mov dword [esp], edx
push edi
push edx
push eax
call sub.kernel32.dll_EnumTimeFormatsW
lea eax, [esp + 4]
push eax
push esi
lea eax, [esp + 0x9c]
push eax
push ebp
call sub.kernel32.dll_ReadConsoleInputA
mov eax, ebx
call fcn.0042b1b0
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0xc4]
push eax
mov eax, dword [esp + 0x2c]
push eax
lea eax, [esp + 0xbc]
push eax
mov eax, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x30]
push eax
mov eax, dword [esp + 0x30]
push eax
call sub.advapi32.dll_AccessCheckByTypeResultList
mov eax, dword [esp + 0x2c]
push eax
call sub.user32.dll_SwapMouseButton
mov eax, dword [esp + 0x30]
push eax
call sub.gdi32.dll_GetPixelFormat
mov eax, dword [esp + 0x40]
push eax
mov eax, dword [esp + 0x48]
push eax
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x58]
push eax
mov ecx, dword [esp + 0x4c]
mov edx, dword [esp + 0x48]
mov eax, dword [esp + 0x44]
call fcn.00478a74
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x60]
push eax
mov eax, dword [esp + 0x60]
push eax
mov eax, dword [esp + 0x60]
push eax
mov eax, dword [esp + 0x60]
push eax
call sub.wininet.dll_HttpQueryInfoW
mov ecx, dword [esp + 0x6c]
mov edx, dword [esp + 0x68]
mov eax, dword [esp + 0x64]
call fcn.0042ae7c
mov eax, dword [esp + 0x74]
push eax
mov eax, dword [esp + 0x74]
push eax
call sub.kernel32.dll_FlushViewOfFile
mov eax, dword [esp + 0x7c]
push eax
lea eax, [esp + 0x7c]
push eax
call sub.kernel32.dll_InterlockedExchangeAdd
mov eax, dword [esp + 0x80]
call fcn.0042ade8
mov eax, dword [esp + 0x90]
push eax
mov eax, dword [esp + 0x90]
push eax
mov eax, dword [esp + 0x90]
push eax
mov eax, dword [esp + 0x90]
push eax
call sub.wininet.dll_InternetSetOptionA
add esp, 0xcc
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4ac6e8
Capabilities:
Create mailslot
Manipulate console buffer

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff2c
lea edx, [esp + 0x5c]
call fcn.0042adb8
mov eax, ebx
call fcn.0042b1a0
lea eax, [esp + 4]
push eax
push dword [esp + 4]
push ebp
push edi
push esi
call sub.kernel32.dll_WriteConsoleOutputCharacterA
mov eax, dword [esp + 8]
call fcn.00435f50
mov eax, dword [esp + 0x10]
push eax
mov eax, dword [esp + 0x10]
push eax
call sub.user32.dll_EndDialog
lea edx, [esp + 0x84]
mov eax, dword [esp + 0x14]
call fcn.0042b188
mov eax, dword [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push eax
call sub.kernel32.dll_BeginUpdateResourceA
mov eax, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x2c]
push eax
mov eax, dword [esp + 0x2c]
push eax
call sub.kernel32.dll_CreateMailslotA
lea edx, [esp + 0xcc]
mov eax, dword [esp + 0x30]
call fcn.004075ec
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x4c]
push eax
mov eax, dword [esp + 0x4c]
push eax
mov eax, dword [esp + 0x4c]
push eax
mov eax, dword [esp + 0x4c]
push eax
mov eax, dword [esp + 0x4c]
push eax
lea eax, [esp + 0xc4]
push eax
mov eax, dword [esp + 0x50]
push eax
call sub.mpr.dll_WNetUseConnectionA
mov eax, dword [esp + 0x58]
push eax
mov eax, dword [esp + 0x58]
push eax
mov eax, dword [esp + 0x58]
push eax
call sub.user32.dll_EnumDesktopWindows
add esp, 0xd4
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x4ac844
Capabilities:
Create mailslot

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffff38
push edi
push edx
push eax
call sub.kernel32.dll_EnumDateFormatsA
lea eax, [esp + 0x74]
push eax
call sub.comctl32.dll_PropertySheetA
push ebp
call sub.gdi32.dll_AddFontResourceA
mov ecx, dword [esp]
mov edx, ebx
mov eax, esi
call fcn.0042ad00
lea eax, [esp + 0xa8]
push eax
mov eax, dword [esp + 8]
push eax
call sub.kernel32.dll_GetCPInfo
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push eax
mov eax, dword [esp + 0x14]
push eax
call sub.kernel32.dll_CreateMailslotA
mov eax, dword [esp + 0x18]
call fcn.0042afcc
mov eax, dword [esp + 0x28]
push eax
lea eax, [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push eax
mov eax, dword [esp + 0x28]
push eax
call sub.wininet.dll_InternetCanonicalizeUrlA
lea eax, [esp + 0x44]
push eax
lea eax, [esp + 0x44]
push eax
mov eax, dword [esp + 0x44]
push eax
lea eax, [esp + 0x44]
push eax
mov eax, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x44]
push eax
mov eax, dword [esp + 0x44]
push eax
call sub.advapi32.dll_LookupAccountSidA
mov edx, dword [esp + 0x4c]
mov eax, dword [esp + 0x48]
call fcn.0042b1bc
lea eax, [esp + 0x58]
push eax
mov eax, dword [esp + 0x58]
push eax
lea eax, [esp + 0xc4]
push eax
mov eax, dword [esp + 0x5c]
push eax
call sub.advapi32.dll_QueryServiceLockStatusA
mov eax, dword [esp + 0x5c]
call fcn.00435f5c
lea eax, [esp + 0x6c]
push eax
mov eax, dword [esp + 0x6c]
push eax
mov eax, dword [esp + 0x6c]
push eax
mov eax, dword [esp + 0x6c]
push eax
call sub.gdi32.dll_GetTextExtentPoint32A
add esp, 0xc8
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x4ac990
Capabilities:
Create process on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffc30
lea edx, [esp + 0x58]
push edx
push eax
call sub.kernel32.dll_FindNextFileA
push edi
push ebp
push ebx
call sub.kernel32.dll_FindFirstChangeNotificationA
mov eax, dword [esp + 4]
push eax
mov eax, dword [esp + 4]
push eax
push esi
call sub.user32.dll_OpenWindowStationA
lea eax, [esp + 0x198]
push eax
mov eax, dword [esp + 0xc]
push eax
call sub.gdi32.dll_GetTextMetricsA
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
call fcn.0042acf0
mov eax, dword [esp + 0x1c]
push eax
lea eax, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push eax
call sub.kernel32.dll_ClearCommError
mov eax, dword [esp + 0x24]
push eax
mov eax, dword [esp + 0x24]
push eax
call sub.user32.dll_ReleaseDC
lea eax, [esp + 0x1d0]
push eax
call sub.user32.dll_RegisterClassW
lea eax, [esp + 0x23c]
push eax
lea eax, [esp + 0x1fc]
push eax
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x50]
push eax
mov eax, dword [esp + 0x50]
push eax
call sub.advapi32.dll_CreateProcessAsUserA
lea eax, [esp + 0x24c]
push eax
call sub.gdi32.dll_CreateColorSpaceA
mov eax, dword [esp + 0x54]
push eax
mov eax, dword [esp + 0x54]
push eax
mov eax, dword [esp + 0x54]
push eax
call sub.gdi32.dll_GetObjectW
lea eax, [esp + 0x394]
push eax
call sub.gdi32.dll_CreateFontIndirectA
add esp, 0x3d0
pop ebp
pop edi
pop esi
pop ebx
ret
Function at 0x100014b7
Capabilities:
Packed with generic packer

Disassembly:
xchg dword [esp + edi - 0x7fffffe0], ebp
mov edi, dword [esp + edi - 0x7fffffe4]
shl dword [esp + esi - 0x7fffffe8], 0xd7
je 0x1014383e
mov ebx, dword [esp + esi - 0x7fffffe8]
jae 0x101579f9
sub byte [esp + esi - 0x7fffffe8], 0x1b
mov esi, dword [esp + ebx*2 + 0x100000c]
sub dword [esp + ebx*4 + 0x2000018], 0x1d81d120
jns 0x100dd4ff
shl bl, 0x43
setbe bl
or ebx, dword [esp + ebx + 0x800017]
mov ebx, dword [esp + ebx + 0x1d03f]
add dword [esp], 0x1eea64
mov dword [esp + 0x18], 0xdebd4a35
cmp dword [esp + 0x18], 0x491f6130
ret 4
mov dword [esp + 0xc], edi
xchg dword [esp + 0x14], edx
mov edi, ebx
test dword [esp + ebp - 0x1586fc91], ebp
bswap ebx
jo 0x106a08cc
jno 0x106ba7a0
mov edi, 0x96bd2db2
dec eax
lea ecx, [edi*2 + 0x401f26a0]
inc esp
movzx edi, bh
inc edi
mov edx, dword [edi + ecx - 0xb2]
inc esp
movsx eax, bh
dec edi
lea ecx, [edi + ecx - 0xae]
dec esp
sub edi, edi
inc sp
adc edi, ecx
inc ebp
xor edx, esp
push edi
jmp fcn.101a8371
neg ecx
lea edx, [edx*4 - 0x79c33cd4]
call fcn.1024cc7a
push ebp
mov ebp, 0x422a7582
lea ecx, [ecx - 0x60e174e5]
and ebp, esi
xor cx, 0xb089
cmp esi, ebp
call fcn.100938e6
call fcn.10251fe7
mov di, bp
mov edi, dword [esp + edi - 0x1586fc89]
mov edi, dword [edi]
js fcn.106694cf
jl 0x1000dfe7
and bx, 0x7405
add ebx, dword [esp + ebp*4 - 0x561bf244]
lea edi, [edi + ebp - 0x5adb176b]
mov dword [esp + ebp*2 - 0x2b0df91a], ebp
jbe 0x1032b97d
push ebp
push ecx
jns 0x105bd78f
call fcn.10264238
dec ecx
not ecx
xadd al, dh
and dx, dx
sub edx, edx
lea ecx, [ecx + eax - 0x6991f605]
sar al, 0x85
jae 0x10243e16
Function at 0x10012c4b
Capabilities:
Encode data using base64
Parse pe header

Disassembly:
mov dword [esp], 0xf3cd9f9c
call fcn.102bed54
Function at 0x1001e850
Capabilities:
Check for software breakpoints

Disassembly:
push dword [esp + 0x24]
popfd
call fcn.10210b52
jge 0x103cfbde
cmp al, 0xcc
int3
add dword [esp + 0x18], 0x1c1c8e
mov ebx, 0xb320fe10
push edi
shr di, 0x24
test edi, edi
mov dword [esp + 4], 0x4c34cc24
mov ebx, dword [esp + 0x1c]
mov ebx, dword [ebx]
jno 0x10625507
cmovae edi, dword [esp + 4]
add edi, dword [esp + 4]
mov dword [esp + edi + 0x679667d4], edi
xor dword [esp + edi + 0x679667d4], 0x5806a23e
not dword [esp + edi + 0x679667d4]
lea ebx, [ebx + edi + 0x2a5278ec]
call fcn.10014e50
mov edx, 0x3b28c8b7
sar dx, 0x61
lea edi, [edi + edx*2 - 0x7651c8ba]
jnp 0x1000f783
mov ecx, 0xea14ba02
mov edx, dword [ebp]
add ebp, 4
xor edx, ebx
movzx eax, cl
sar al, cl
sbb ecx, 0x4a5b715
ror edx, 3
not ecx
inc edx
neg edx
dec eax
ror edx, 2
bswap edx
call fcn.1065957e

Function at 0x1001ea80
Capabilities:
Encode data using base64
Packed with generic packer

Disassembly:
lea esp, [esp + 4]
call eax
mov ebx, 0xe58d8ebc
movzx esi, bx
mov ebp, dword [esi + ebp - 0x8ec0]
lea ecx, [esi + ebx*4 - 0x3434765]
lea ecx, [ebx*8 - 0x3f942db]
mov dword [ebp + esi - 0x8ebc], eax
mov esi, ebp
mov ebp, 0xe7aa483e
not ebx
push ebx
mov ebx, dword [esp + ebx*2 - 0x34e4e282]
mov ebp, dword [esp + ecx*2 - 0x50e66602]
and cx, cx
jne 0x1032a353
call fcn.101b8e4f
call fcn.10246896

Function at 0x100214b7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
lea eax, [eax + edx - 0x3b85a369]
ror eax, 3
mov dword [esp], edx
mov dword [esp + 4], 0xa2b13d00
not eax
bswap eax
sal edx, 0x3f
and word [esp + edx - 0x7ffffffa], dx
shr dl, 0xc5
dec eax
and dword [esp + edx - 0x7ffffffc], ecx
xor ebx, eax
inc edx
add edi, eax
dec cx
or edx, 0xb9a2e90d
mov eax, dword [esp + 4]
movzx ecx, byte [esi + eax*4 - 0x4400]
lea esi, [esi + eax*2 - 0x21ff]
adc ax, word [esp + eax - 0x1100]
sbb byte [esp + eax - 0xbb0d], 0x98
xor cl, bl
jmp 0x101794d8
and dword [esp + eax - 0xbb0d], eax
dec al
dec cl
xor ax, 0xa01a
adc edx, eax
xor cl, 0x2c
sub cl, 0x2b
dec dword [esp + eax - 0x1b08]
not cl
not eax
xor bl, cl
sal edx, 0xc5
lea ebp, [ebp + edx*2 - 0x68c105c2]
mov word [ebp + edx*2 - 0x68c105c0], cx
call fcn.104a00bc

Function at 0x1006422a
Capabilities:
Encode data using base64
Encode data using xor

Disassembly:
mov edx, dword [esp + esi - 0x2537ffe4]
mov edx, dword [edx + esi*2 - 0x4a700000]

Function at 0x10092844
Capabilities:
Encode data using xor

Disassembly:
pop eax
call fcn.102c46da
push 0x23ba63a1
sub edi, 1
movzx ecx, byte [edi]
add dword [esp], 0xd5bba309
call fcn.103142e3
jb 0x10092898
pushal
sub cl, byte [ecx + 0x7505faed]
dec ebx
dec eax
push ebx
outsd dx, dword [esi]
sub dword [eax], 0x35
in eax, dx
push ds
xlatb
xor esi, dword [esi - 0x78]
xchg edx, eax
push ds
mov bl, 0x4d
dec esp
sub byte [ecx + edx + 0x32], bh
in al, dx
jl 0x10092895
xor ch, ah
push edi
xchg byte [ecx], bl
pop eax
add byte [ecx + eax*4], dl
push ds
inc esi
pop ebx
pop esp
loop 0x10092882
loope 0x10092866
insb byte es:[edi], dx
aaa
adc ah, dh
iretd
out 0xcf, al
iretd