joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c037b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0
push 0
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
nop
nop
mov dword [ebp - 4], eax
cmp dword [ebp + 0x18], 0
jne 0x5c03ce
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
jmp 0x5c03d6
mov eax, dword [ebp - 4]
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
cmp dword [ebp - 4], 0
mov eax, 0
setne al
jmp 0x5c03e7
mov esp, ebp
pop ebp
ret 0x14

Function at 0x5c65b6
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 4], 0
push 0xc
call fcn.005e3be4
add esp, 4
mov dword [ebp - 8], eax
mov ebx, eax
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
jmp 0x5c65fe
mov ebx, dword [ebp + 8]
push dword [ebx]
push 1
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CreateMutexA]
nop
nop
nop
nop
mov dword [ebp - 4], eax
push 0x64
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
nop
nop
nop
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x102
jne 0x5c665e
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
nop
nop
nop
nop
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
nop
nop
nop
nop
push 0
call fcn.005e3c0e
add esp, 4
jmp 0x5c666e
mov ebx, dword [ebp - 8]
push ebx
call fcn.005e3bea
add esp, 4
mov esp, ebp
pop ebp
ret 4
Function at 0x5e5e50
Capabilities:
Create directory

Disassembly:
sub esp, 0xc
mov ecx, dword [esp + 0x14]
xor eax, eax
mov dword [esp + 4], eax
mov dword [esp + 8], eax
lea eax, [esp]
mov dword [esp], 0xc
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0xc
ret

Function at 0x5e5ec0
Capabilities:
Get file size
Read file on windows

Disassembly:
mov eax, dword [esp + 8]
push edi
push 0
push 0x20
push 3
push 0
push 3
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x5e5f29
push ebx
lea ecx, [esp + 0x10]
push esi
push ecx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ebx, eax
lea edx, [ebx + 8]
push edx
call fcn.005e3e10
add esp, 4
mov esi, eax
lea eax, [esp + 0x14]
push 0
push eax
lea ecx, [esi + 8]
push ebx
push ecx
push edi
mov dword [esi], 1
mov dword [esi + 4], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, esi
pop esi
pop ebx
pop edi
ret

Function at 0x5e5f30
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x5e5fc2
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x5e5fb4
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x5e5fac
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x5e5f75
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret

Function at 0x5e6040
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x5e605e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x5e6053
pop esi
ret
Function at 0x5e6540
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
mov ebp, edx
push esi
push edi
mov esi, ebp
xor edi, edi
and esi, 3
mov eax, ecx
jle 0x5e6561
mov dl, byte [eax]
inc eax
cmp dl, bl
je 0x5e65bb
inc edi
cmp edi, esi
jl 0x5e6555
mov edi, ebx
and edi, 0xff
mov esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
shl esi, 8
or esi, edi
lea edi, [ecx + ebp]
cmp eax, edi
jae 0x5e65f0
mov edx, dword [eax]
xor edx, esi
lea ebp, [edx - 0x1010101]
not edx
and ebp, edx
test ebp, 0x80808080
je 0x5e65aa
cmp byte [eax], bl
je 0x5e65c5
cmp byte [eax + 1], bl
je 0x5e65ce
cmp byte [eax + 2], bl
je 0x5e65d8
cmp byte [eax + 3], bl
je 0x5e65e4
add eax, 4
cmp eax, edi
jb 0x5e6581
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
dec eax
pop ebx
ret 4
pop edi
pop esi
pop ebp
sub eax, ecx
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
inc eax
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 2
pop ebx
ret 4
pop edi
sub eax, ecx
pop esi
pop ebp
add eax, 3
pop ebx
ret 4
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret 4
Function at 0x5f7c50
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
mov ebx, ecx
push ebp
push esi
mov eax, dword [ebx + 0x13c]
push edi
test eax, eax
jle 0x5f7c9c
mov eax, dword [ebx + 0x140]
test eax, eax
jle 0x5f7c9c
mov ebp, dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
lea edi, [ebx + 0x150]
mov eax, dword [edi]
test eax, eax
je 0x5f7c86
push eax
call ebp
test ax, ax
jl 0x5f7c94
inc esi
add edi, 4
cmp esi, 6
jb 0x5f7c78
pop edi
pop esi
pop ebp
pop ebx
ret
push esi
mov ecx, ebx
call fcn.005f7950
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x5fa290
Capabilities:
Create thread

Disassembly:
push ecx
cmp dword [ecx + 0xcc], 1
je 0x5fa2f0
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x5fa2f0
mov eax, dword [ecx + 0xb0]
test eax, eax
je 0x5fa2f0
push esi
mov edx, 5
mov esi, dword [ecx + 0xbc]
cmp esi, edx
pop esi
je 0x5fa2f0
mov dword [ecx + 0xb4], eax
mov dword [ecx + 0x94], 0
mov dword [ecx + 0xbc], edx
lea eax, [esp]
push eax
push 0
push ecx
push 0x5fa300
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ecx
ret
Function at 0x5fe790
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0xb6363c]
xor edx, edx
cmp eax, edx
jne 0x5fe7b6
xor eax, eax
mov byte [eax + 0xb6353c], al
inc eax
cmp eax, 0x100
jl 0x5fe79e
mov dword [0xb6363c], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0xb6353c
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x5fe847
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x5fe81a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x5fe7e8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x5fe850
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x5fe8a3
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x5fe88a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x605260
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x66a1ae
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x18]
push esi
push edi
mov edi, ecx
mov ecx, dword [esp + 0x1c]
push eax
push ecx
mov ecx, edi
mov dword [esp + 0x10], edi
call fcn.00605b80
push 0x10
mov dword [esp + 0x18], 0
mov dword [edi], 0x95586c
call fcn.00655446
mov esi, eax
add esp, 4
mov dword [esp + 0x20], esi
mov al, 1
test esi, esi
mov byte [esp + 0x14], al
je 0x6052f3
push 4
mov byte [esi + 8], al
mov dword [esi], 0
mov dword [esi + 4], 0
call fcn.00655446
add esp, 4
mov dword [esp + 0x1c], eax
test eax, eax
mov byte [esp + 0x14], 2
je 0x6052ec
push 0
mov ecx, eax
call fcn.005fc3e0
mov dword [esi + 0xc], eax
jmp 0x6052f5
xor eax, eax
mov dword [esi + 0xc], eax
jmp 0x6052f5
xor esi, esi
mov ecx, dword [esp + 0xc]
mov dword [edi + 0x30], esi
mov dword [edi + 0x34], 0
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x10
ret 8
Function at 0x6171d0
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
test esi, esi
push edi
jne 0x6171e0
mov esi, 1
push esi
call fcn.00641027
mov ebx, eax
add esp, 4
test ebx, ebx
jne 0x617232
call fcn.00641b4d
mov edi, eax
call fcn.00619d20
mov ecx, dword [edi]
mov dword [eax], ecx
mov eax, dword [esp + 0x14]
mov edi, eax
and edi, 8
je 0x617216
mov edx, dword [0xa69970]
mov dword [0xa6996c], edx
test al, 0x18
je 0x617227
push esi
push 0x24
push 5
call fcn.0061a570
add esp, 0xc
test edi, edi
je 0x61724d
push 1
call fcn.00642eff
test byte [esp + 0x14], 0x20
je 0x61724d
mov ecx, esi
mov edx, ecx
shr ecx, 2
xor eax, eax
mov edi, ebx
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
pop edi
pop esi
mov eax, ebx
pop ebx
ret

Function at 0x618350
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov edx, dword [ebp + 0x10]
test edx, edx
push ebx
push esi
push edi
je 0x618444
cmp byte [edx], 0
je 0x618437
mov eax, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
add eax, 8
or ecx, 0xffffffff
mov dword [esp + 0xc], eax
xor eax, eax
mov edi, edx
repne scasb al, byte es:[edi]
not ecx
dec ecx
push ecx
push edx
lea ecx, [esp + 0x20]
push ecx
mov esi, ebx
call fcn.006182d0
mov edi, dword [ebp + 0xc]
push 8
lea edx, [esp + 0x20]
push edi
push edx
call fcn.006182d0
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x28]
xor eax, edx
push eax
xor ecx, dword [esp + 0x34]
push ecx
lea edx, [esp + 0x40]
push edx
call fcn.00618240
mov eax, dword [esp + 0x30]
add esp, 0x24
cmp edi, eax
jae 0x618401
sub eax, edi
mov edi, eax
lea eax, [esp + 0x20]
push eax
call fcn.00618280
fmul qword [0x956108]
push ecx
fstp qword [esp]
call fcn.0063f7a8
fadd qword [0x956100]
add esp, 8
call fcn.0063f878
mov byte [ebx], al
inc ebx
dec edi
jne 0x6183d4
lea ecx, [esp + 0x20]
push ecx
call fcn.00618280
fmul qword [0x956108]
push ecx
fstp qword [esp]
call fcn.0063f7a8
add esp, 8
call fcn.0063f878
cmp esi, ebx
je 0x61842d
xor byte [esi], al
inc esi
cmp esi, ebx
jne 0x618426
mov byte [ebx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 8]
mov byte [edx], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
pop edi
pop esi
mov byte [eax], 0
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x618810
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push ebp
push esi
lea eax, [ebx + 0x134]
push edi
lea esi, [ebx + 0x34]
mov dword [esp + 0x14], eax
xor edi, edi
mov ecx, dword [ebx + 0x1c]
mov ebp, edi
and ebp, 0xff
mov al, byte [ecx + ebp + 1]
test al, 3
je 0x618840
mov byte [edi + esi], 2
jmp 0x618877
test al, 4
je 0x61884a
mov byte [edi + esi], 0xd
jmp 0x618877
mov edx, dword [ebx + 0x240]
push edi
push ebx
call dword [edx + 4]
add esp, 8
cmp eax, 1
jle 0x618863
mov byte [edi + esi], 2
jmp 0x618877
mov eax, dword [ebx + 0x1c]
test byte [eax + ebp + 1], 0x17
jne 0x618873
mov byte [edi + esi], 0x19
jmp 0x618877
mov byte [edi + esi], 1
inc edi
cmp edi, 0x100
jb 0x618827
mov ecx, dword [esp + 0x14]
mov al, 7
mov byte [esi + 0x21], al
mov byte [esi + 0x3d], al
mov byte [esi + 0x3e], al
mov al, 0x10
mov byte [esi + 0x7c], al
mov byte [esi + 0x26], al
mov byte [esi + 0x24], 2
mov byte [esi + 0x5f], 2
mov byte [esi + 0x27], 9
mov byte [esi + 0x2e], 0xf
mov byte [esi + 0x3c], 8
mov byte [esi + 0x23], 0xa
mov byte [esi + 0x3b], 0x15
mov byte [esi + 0x3a], 0x16
mov byte [esi], 0x11
mov byte [esi + 0x5c], 0x12
mov byte [esi + 0x2f], 0x13
mov byte [esi + 0x2a], 0x14
mov byte [esi + 0x40], 0x17
mov byte [esi + 0x60], 0x1a
mov byte [esi + 0x22], 0x20
mov eax, esi
sub ecx, esi
mov edi, 0x100
mov dl, byte [eax]
cmp dl, 2
je 0x6188eb
cmp dl, 0xd
je 0x6188eb
xor edx, edx
jmp 0x6188f0
mov edx, 1
mov byte [ecx + eax], dl
inc eax
dec edi
jne 0x6188db
mov al, 0x1d
mov byte [esi + 0x58], al
mov byte [esi + 0x78], al
mov al, 0x1f
pop edi
mov byte [esi + 0x62], 0x1e
mov byte [esi + 0x4e], al
mov byte [esi + 0x6e], al
pop esi
pop ebp
pop ebx
ret

Function at 0x618910
Capabilities:
Read file on windows

Disassembly:
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
push ebx
push 0x4000
call fcn.006171d0
mov esi, eax
add esp, 8
test esi, esi
jne 0x618931
pop edi
pop esi
xor al, al
pop ebx
ret
mov eax, dword [esp + 0x10]
push ebx
push 0
push eax
call fcn.00619f60
mov edi, eax
add esp, 0xc
test edi, edi
jge 0x618956
push esi
call fcn.00617260
add esp, 4
pop edi
pop esi
mov al, 1
pop ebx
ret
push ebp
push 0x4000
push esi
push edi
call fcn.0064c10c
push ebx
push edi
mov ebp, eax
call fcn.00619fd0
push 0x618990
push ebp
push esi
call fcn.0061b300
push esi
call fcn.00617260
add esp, 0x24
pop ebp
pop edi
pop esi
xor al, al
pop ebx
ret
Function at 0x619c90
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebx
push esi
push 0xb81c00
xor bl, bl
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0xb81b20]
push eax
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
jne 0x619d0b
push 0x4c
push 1
call fcn.00641f75
mov esi, eax
add esp, 8
test esi, esi
jne 0x619cd3
push 0xb81c00
mov bl, 1
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret
mov ecx, dword [0xb81b20]
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, dword [0xb733d4]
inc eax
lea edx, [esi + 0xc]
mov dword [0xb733d4], eax
push edx
mov dword [esi + 0x30], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
lea eax, [esi + 4]
push 0
push eax
call fcn.0061d7d0
add esp, 8
mov byte [esi + 0x3c], 1
push 0xb81c00
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
mov al, bl
pop ebx
ret

Function at 0x61a190
Capabilities:
Read file on windows

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x1c], edi
call fcn.00641b4d
mov ebx, dword [esp + 0x14]
mov dword [eax], 0
mov eax, dword [esp + 0x18]
push edi
push eax
push ebx
call fcn.0064c10c
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x61a28a
call fcn.00641b4d
cmp dword [eax], 0
je 0x61a1d7
call fcn.00641b4d
mov ebp, dword [eax]
jmp 0x61a1da
or ebp, 0xffffffff
call fcn.00619d20
test esi, esi
mov dword [eax], ebp
jne 0x61a1ef
call fcn.00641b4d
cmp dword [eax], 4
je 0x61a23f
mov eax, dword [esp + 0x20]
test al, 0x1a
je 0x61a222
cmp esi, 0xffffffff
je 0x61a264
test al, 6
je 0x61a222
call fcn.00619d20
mov ecx, dword [eax]
push ecx
push ebx
call fcn.0061d800
add esp, 4
push eax
push 0x24
push 9
call fcn.0061a570
mov eax, dword [esp + 0x30]
add esp, 0x10
cmp esi, 0xffffffff
je 0x61a282
test al, 6
je 0x61a230
test ah, 2
je 0x61a282
test esi, esi
jbe 0x61a28e
test ah, 2
je 0x61a28e
add dword [esp + 0x18], esi
sub edi, esi
call fcn.00641b4d
mov edx, dword [esp + 0x18]
push edi
push edx
push ebx
mov dword [eax], 0
call fcn.0064c10c
mov esi, eax
add esp, 0xc
cmp esi, edi
je 0x61a28a
jmp 0x61a1c4
call fcn.00619d20
mov eax, dword [eax]
push eax
push ebx
call fcn.0061d800
add esp, 4
push eax
push 0x24
push 2
call fcn.0061a570
add esp, 0x10
pop edi
pop esi
pop ebp
or eax, 0xffffffff
pop ebx
ret
mov eax, dword [esp + 0x20]
test al, 6
je 0x61a29b
xor esi, esi
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret
test ah, 2
je 0x61a2a4
mov esi, dword [esp + 0x1c]
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
ret

Function at 0x6447f5
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push dword [esp + 4]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x644815
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.00641ada
pop ecx
or eax, 0xffffffff
ret
test al, 1
je 0x644838
test byte [esp + 8], 2
je 0x644838
call fcn.00641b4d
mov dword [eax], 0xd
call fcn.00641b56
mov dword [eax], 5
jmp 0x644811
xor eax, eax
ret
Function at 0x657bd1
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x657c09
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.00655bac
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.00655b84
jmp 0x657c15
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x6593d1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x659413
call fcn.0065f92f
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x659413
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x65940a
xor eax, eax
jmp 0x65941b
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00659421
pop edi
pop esi
pop ebx
ret 4

Function at 0x65fe5f
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x65fe8d
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x65feab
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0065fdc5
jmp 0x65feab
mov eax, dword [esi + 0x14]
test eax, eax
je 0x65feab
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0065fdc5
test edi, edi
mov eax, edi
jne 0x65fe95
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x4f3469a5
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x432024
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f314
nop
mov ecx, 0x6b673158
nop
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43206c
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x431219
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
mov ebx, 0x40de38
nop
mov ecx, 0x4c714cf0
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
nop
nop
nop
mov eax, section..data
mov ebx, 0x4304d8
nop
nop
mov ecx, 0xa9b1a7d
nop
nop
nop
test eax, eax
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x10004dc0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [esp + 0x18]
push ebp
push esi
mov eax, dword [ebx]
push edi
mov ebp, dword [ebx + 4]
push 0
mov edi, ecx
push 0x80
push 3
push 0
push 2
lea ecx, [edi + 0x20]
push 0x40000000
push ecx
mov dword [esp + 0x40], eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
lea edx, [esp + 0x24]
push 0
mov esi, eax
push edx
push ebp
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov ecx, dword [esp + 0x28]
lea eax, [esp + 0x10]
push 0
add ecx, 0xfffffff8
push eax
add ebx, 8
push ecx
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
mov edx, dword [esp + 0x24]
lea ecx, [esp + 0x14]
push 9
add eax, ebp
push ecx
mov ecx, edi
mov byte [esp + 0x1c], 0x70
mov dword [esp + 0x1d], edx
mov dword [esp + 0x21], eax
call fcn.10007280
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret 8

Function at 0x10005a70
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push esi
push edi
mov edi, dword [esp + 0x60]
push 0x2f
push edi
call dword [sym.imp.MSVCRT.dll_strrchr]
mov esi, eax
add esp, 8
inc esi
jne 0x10005a92
pop edi
xor al, al
pop esi
add esp, 0x54
ret
push esi
push edi
call fcn.1000a380
add esp, 8
test al, al
jne 0x10005aa6
pop edi
pop esi
add esp, 0x54
ret
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
lea eax, [esp + 8]
lea ecx, [esp + 0x18]
push eax
push ecx
push 0
push 0
push 0
push 0
push 0
push 0
push 0x10016338
push esi
mov dword [esp + 0x40], 0x44
mov dword [esp + 0x48], str.WinSta0Default
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
add esp, 0x54
ret

Function at 0x10005b80
Capabilities:
Access the windows event log
Clear windows event logs

Disassembly:
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
push ebp
mov ebp, dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
push esi
push edi
mov dword [esp + 0x14], str.Application
mov dword [esp + 0x18], str.Security
mov dword [esp + 0x1c], str.System
lea edi, [esp + 0x14]
mov dword [esp + 0x10], 3
mov eax, dword [edi]
push eax
push 0
call ebx
mov esi, eax
test esi, esi
je 0x10005bd0
push 0
push esi
call ebp
push esi
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
mov eax, dword [esp + 0x10]
add edi, 4
dec eax
mov dword [esp + 0x10], eax
jne 0x10005bb7
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10
ret