joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5d3458
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov esi, eax
cmp dword [esi + 4], 0
push edi
je 0x6a5c37
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov edx, dword [eax + 4]
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], ebx
test ecx, ecx
je 0x5d3499
movzx edi, word [edx + eax*2]
rol ebx, 7
inc eax
xor ebx, edi
cmp eax, ecx
jb 0x5d3488
mov dword [ebp - 8], ebx
xor edx, edx
mov eax, ebx
div dword [esi]
mov eax, dword [esi + 4]
mov eax, dword [eax + edx*4]
mov dword [ebp - 4], edx
test eax, eax
js 0x5d34c9
mov edx, dword [esi + 8]
shl eax, 4
add edx, eax
mov dword [ebp - 0x10], edx
cmp dword [edx], ebx
je 0x6a5c43
mov eax, dword [edx + 4]
test eax, eax
jns 0x5d34ac
mov edx, dword [ebp - 4]
mov eax, dword [esi + 0x18]
test eax, eax
jg 0x6a5c8a
mov eax, dword [esi]
cmp dword [esi + 0xc], eax
je 0x62f81a
mov ecx, dword [esi + 0xc]
lea edx, [ecx + 1]
mov dword [esi + 0xc], edx
mov edx, dword [ebp - 4]
mov edi, dword [esi + 4]
mov edi, dword [edi + edx*4]
mov ebx, dword [esi + 8]
mov eax, ecx
add eax, eax
mov dword [ebx + eax*8 + 4], edi
mov edi, dword [esi + 8]
mov ebx, dword [ebp + 8]
mov dword [edi + eax*8 + 8], ebx
mov edi, dword [esi + 8]
mov ebx, dword [ebp - 8]
mov dword [edi + eax*8], ebx
mov edi, dword [esi + 8]
mov ebx, dword [ebp + 0xc]
mov dword [edi + eax*8 + 0xc], ebx
mov eax, dword [esi + 4]
pop edi
mov dword [eax + edx*4], ecx
inc dword [esi + 0x10]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
call fcn.0062f832
mov eax, ebx
xor edx, edx
div dword [esi]
mov dword [ebp - 4], edx
jmp 0x5d34df

Function at 0x5d4da9
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 4]
push esi
push edi
test eax, eax
je 0x5d4e59
mov edi, dword [ebp + 0xc]
mov edx, dword [edi]
mov esi, dword [edi + 4]
xor eax, eax
xor ecx, ecx
test edx, edx
je 0x5d4de6
lea esp, [esp]
movzx ebx, word [esi + ecx*2]
rol eax, 7
inc ecx
xor eax, ebx
cmp ecx, edx
jb 0x5d4dd5
mov ebx, dword [ebp + 8]
and eax, 0x7fffffff
xor edx, edx
mov ecx, eax
div dword [ebx]
mov ebx, dword [ebx + 4]
mov dword [ebp - 4], ecx
mov ebx, dword [ebx + edx*4]
test ebx, ebx
js 0x5d4e59
mov eax, dword [ebp + 8]
mov edx, dword [eax + 8]
mov dword [ebp + 8], edx
mov edx, dword [ebp + 8]
lea eax, [ebx + ebx*4]
cmp dword [edx + eax*4], ecx
lea edx, [edx + eax*4]
jne 0x5d4e52
mov eax, dword [edi]
mov ecx, dword [edx + 8]
mov edi, dword [edi + 4]
mov esi, dword [edx + 0xc]
cmp ecx, eax
jne 0x5d4e4c
test ecx, ecx
je 0x5d4e39
mov ax, word [esi]
cmp ax, word [edi]
jne 0x5d4e44
add esi, 2
add edi, 2
dec ecx
jne 0x5d4e28
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
sbb eax, eax
and eax, 0xfffffffe
inc eax
je 0x5d4e39
mov ecx, dword [ebp - 4]
mov edi, dword [ebp + 0xc]
mov ebx, dword [edx + 4]
test ebx, ebx
jns 0x5d4e07
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5d536e
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [edi + 4], 0
lea eax, [edi + 4]
push ebx
push esi
mov dword [ebp - 4], eax
je 0x6afeea
mov edx, dword [ebp + 0xc]
xor eax, eax
xor ecx, ecx
test edx, edx
je 0x5d53a6
mov edi, edi
mov esi, dword [ebp + 0x10]
movzx esi, word [esi + ecx*2]
rol eax, 7
inc ecx
xor eax, esi
cmp ecx, edx
jb 0x5d5395
and eax, 0x7fffffff
mov ebx, eax
xor edx, edx
div dword [edi]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov dword [ebp - 0xc], ebx
mov eax, dword [ecx + edx*4]
mov dword [ebp - 8], edx
test eax, eax
jns 0x64a08f
mov eax, dword [edi + 0x14]
test eax, eax
jg 0x6aff48
mov eax, dword [edi]
cmp dword [edi + 0xc], eax
je 0x67b69f
mov ecx, dword [edi + 0xc]
lea eax, [ecx + 1]
mov dword [edi + 0xc], eax
mov edx, dword [edi + 8]
lea eax, [ecx + ecx*4]
add eax, eax
add eax, eax
mov dword [edx + eax], ebx
mov esi, dword [edi + 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov ebx, dword [ebp - 8]
mov edx, dword [edx + ebx*4]
mov dword [esi + eax + 4], edx
mov esi, dword [edi + 8]
mov edx, dword [ebp + 0xc]
mov dword [esi + eax + 8], edx
mov edx, dword [ebp + 0x10]
mov dword [esi + eax + 0xc], edx
mov edx, dword [edi + 8]
mov esi, dword [ebp + 8]
mov dword [edx + eax + 0x10], esi
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov eax, ebx
pop esi
mov dword [edx + eax*4], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov edi, edi
mov edx, dword [edi + 8]
lea eax, [eax + eax*4]
cmp dword [edx + eax*4], ebx
lea edx, [edx + eax*4]
je 0x6aff0c
mov eax, dword [edx + 4]
test eax, eax
js 0x5d53c7
jmp 0x64a091

Function at 0x5e1463
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
push ebx
push esi
push edi
mov edi, eax
xor ebx, ebx
xor eax, eax
test ecx, ecx
je 0x5e148a
mov edx, dword [ebp + 8]
movzx edx, byte [eax + edx]
rol ebx, 7
inc eax
xor ebx, edx
cmp eax, ecx
jb 0x5e1479
mov esi, dword [edi + 4]
test esi, esi
je 0x5e14bd
xor edx, edx
mov eax, ebx
div dword [edi]
mov esi, dword [esi + edx*4]
test esi, esi
js 0x5e14bd
mov eax, dword [edi + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
lea edx, [esi + esi*4]
cmp dword [eax + edx*4], ebx
lea edi, [eax + edx*4]
je 0x6013c0
mov esi, dword [edi + 4]
test esi, esi
jns 0x5e14a4
pop edi
pop esi
or eax, 0xffffffff
pop ebx
mov esp, ebp
pop ebp
ret 8
cmp dword [edi + 0xc], ecx
jne 0x5e14b6
mov edx, dword [edi + 8]
mov eax, dword [ebp + 8]
cmp edx, eax
je 0x6013e3
push ecx
mov ecx, eax
call fcn.006013f3
test al, al
je 0x688f12
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x5e18fc
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, eax
cmp dword [esi + 4], 0
push edi
je 0x688f32
mov ecx, dword [ebp + 0xc]
xor ebx, ebx
xor eax, eax
mov dword [ebp - 8], ebx
test ecx, ecx
je 0x5e1935
mov edx, dword [ebp + 8]
movzx edx, byte [eax + edx]
rol ebx, 7
inc eax
xor ebx, edx
cmp eax, ecx
jb 0x5e1921
mov dword [ebp - 8], ebx
xor edx, edx
mov eax, ebx
div dword [esi]
mov eax, dword [esi + 4]
mov eax, dword [eax + edx*4]
mov dword [ebp - 4], edx
test eax, eax
jns 0x62f139
mov eax, dword [esi + 0x18]
test eax, eax
jg 0x60161c
mov eax, dword [esi]
cmp dword [esi + 0xc], eax
je 0x60145d
mov ecx, dword [esi + 0xc]
mov edx, dword [ebp - 4]
lea eax, [ecx + 1]
mov dword [esi + 0xc], eax
mov edi, dword [esi + 4]
mov edi, dword [edi + edx*4]
mov ebx, dword [esi + 8]
lea eax, [ecx + ecx*4]
add eax, eax
add eax, eax
mov dword [eax + ebx + 4], edi
mov edi, dword [esi + 8]
mov ebx, dword [ebp + 8]
mov dword [edi + eax + 8], ebx
mov edi, dword [esi + 8]
mov ebx, dword [ebp + 0xc]
mov dword [eax + edi + 0xc], ebx
mov edi, dword [esi + 8]
mov ebx, dword [ebp - 8]
mov dword [eax + edi], ebx
mov edi, dword [esi + 8]
mov ebx, dword [ebp + 0x10]
mov dword [eax + edi + 0x10], ebx
mov eax, dword [esi + 4]
pop edi
mov dword [eax + edx*4], ecx
inc dword [esi + 0x10]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
call fcn.00601475
mov eax, ebx
xor edx, edx
div dword [esi]
mov dword [ebp - 4], edx
jmp 0x5e1962
mov ecx, dword [esi + 0x14]
mov ebx, dword [esi + 8]
lea edi, [ecx + ecx*4]
mov edi, dword [ebx + edi*4 + 4]
dec eax
mov dword [esi + 0x14], edi
mov dword [esi + 0x18], eax
jmp 0x5e196e
mov edi, dword [esi + 8]
lea edx, [eax + eax*4]
cmp dword [edi + edx*4], ebx
lea edi, [edi + edx*4]
je 0x688f3e
mov eax, dword [edi + 4]
test eax, eax
jns 0x62f139
mov edx, dword [ebp - 4]
jmp 0x5e194c
Function at 0x5e8055
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, dword [ebp + 0xc]
mov esi, eax
cmp edi, ebx
jbe 0x69a576
mov ecx, dword [ebp + 0x10]
lea eax, [ecx + 5]
cmp eax, 0x1a
ja 0x69a57f
test ecx, ecx
jle 0x63e47e
mov eax, edi
sub eax, ebx
lea eax, [ecx + eax + 1]
cmp eax, dword [ebp + 0x14]
jge 0x69a576
lea eax, [ecx + 5]
cmp eax, 0x1a
ja 0x69a5a2
test ecx, ecx
jle 0x63e492
cmp ebx, edi
jae 0x5e80c5
movzx eax, byte [ebx]
add ax, 0x30
mov word [esi], ax
add esi, 2
inc ebx
dec ecx
je 0x5e80dc
cmp ebx, edi
jb 0x5e80ad
mov dword [ebp + 0x10], ecx
test ecx, ecx
jg 0x61710f
xor ecx, ecx
pop edi
mov word [esi], cx
pop esi
lea eax, [ecx + 1]
pop ebx
pop ebp
ret 0x10
cmp ebx, edi
jae 0x5e80ed
mov edx, 0x2e
mov word [esi], dx
add esi, 2
jmp 0x5e80be
mov dword [ebp + 0x10], ecx
jmp 0x5e80cd
mov eax, 0x30
movzx edx, ax
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
mov edi, esi
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, dword [ebp + 0x10]
lea esi, [esi + eax*2]
xor ecx, ecx
pop edi
mov word [esi], cx
pop esi
lea eax, [ecx + 1]
pop ebx
pop ebp
ret 0x10
mov eax, ecx
cdq
xor eax, edx
sub eax, edx
mov edx, edi
sub edx, ebx
lea eax, [eax + edx + 3]
jmp 0x5e808c
mov dword [esi], 0x2e0030
add esi, 4
test ecx, ecx
js 0x63e6ee
cmp ebx, edi
jae 0x63e4bc
lea esp, [esp]
movzx ecx, byte [ebx]
add cx, 0x30
mov word [esi], cx
inc ebx
add esi, 2
cmp ebx, edi
jb 0x63e4aa
xor edx, edx
pop edi
mov word [esi], dx
pop esi
lea eax, [edx + 1]
pop ebx
pop ebp
ret 0x10
mov eax, 0x30
movzx edx, ax
neg ecx
mov dword [ebp + 0x10], ecx
mov eax, edx
shl edx, 0x10
or eax, edx
shr ecx, 1
mov edi, esi
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov eax, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
lea esi, [esi + eax*2]
jmp 0x63e4a3
Function at 0x601693
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [edi + 4]
sub esp, 0x10
push ebx
push esi
test eax, eax
je 0x688f6b
mov ecx, dword [ebp + 0xc]
xor eax, eax
mov dword [ebp - 4], 0
test ecx, ecx
je 0x6016cf
mov esi, dword [ebp + 8]
mov edx, dword [ebp - 4]
movzx esi, byte [eax + esi]
rol edx, 7
xor edx, esi
inc eax
mov dword [ebp - 4], edx
cmp eax, ecx
jb 0x6016b8
mov eax, dword [ebp - 4]
xor edx, edx
div dword [edi]
mov eax, dword [edi + 4]
mov dword [ebp - 0xc], 0xffffffff
mov esi, dword [eax + edx*4]
mov dword [ebp - 0x10], edx
test esi, esi
js 0x688f6b
mov ecx, dword [edi + 8]
mov edx, dword [ebp - 4]
lea eax, [esi + esi*4]
cmp dword [ecx + eax*4], edx
lea ebx, [ecx + eax*4]
jne 0x60deae
mov eax, dword [ebp + 0xc]
cmp dword [ebx + 0xc], eax
jne 0x60deae
mov edx, dword [ebx + 8]
cmp edx, dword [ebp + 8]
je 0x60172b
mov ecx, dword [ebp + 8]
push eax
call fcn.006013f3
mov ecx, dword [edi + 8]
test al, al
je 0x60deae
mov edx, dword [ebp - 0xc]
lea eax, [esi + esi*4]
add eax, eax
add eax, eax
test edx, edx
jns 0x60dec1
mov edx, dword [eax + ecx + 4]
mov ecx, dword [edi + 4]
mov ebx, dword [ebp - 0x10]
mov dword [ecx + ebx*4], edx
mov edx, dword [edi + 0x14]
mov ecx, dword [edi + 8]
mov dword [eax + ecx + 4], edx
mov edx, dword [edi + 8]
xor ecx, ecx
mov dword [eax + edx + 8], ecx
mov edx, dword [edi + 8]
mov dword [eax + edx + 0xc], ecx
mov edx, dword [edi + 8]
mov dword [eax + edx], 0xffffffff
mov edx, dword [edi + 8]
mov dword [eax + edx + 0x10], ecx
mov eax, 1
add dword [edi + 0x18], eax
add dword [edi + 0x10], eax
mov dword [edi + 0x14], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov dword [ebp - 0xc], esi
mov esi, dword [ebx + 4]
test esi, esi
jns 0x6016f1
jmp 0x688f6b
mov ebx, dword [eax + ecx + 4]
lea edx, [edx + edx*4]
mov dword [ecx + edx*4 + 4], ebx
jmp 0x60174a
Function at 0x621e1f
Capabilities:
Access peb ldr_data
Get ntdll base address
Get number of processors

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1019a6f0
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x101a2a60]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
push esi
mov dword [esi], 0x10001d18
mov dword [esi + 4], 0x100063f0
mov dword [esi + 8], 0x1000c37c
mov dword [esi + 0xc], 0x1002ae78
mov dword [esi + 0x10], 0x1002af24
mov dword [esi + 0x14], 0x1002af44
mov dword [esi + 0x18], 0x1002af5c
mov dword [esi + 0x1c], 0x1002ae88
mov dword [esi + 0x20], 0x1002af70
mov dword [esi + 0x24], 0x1000c4d8
mov dword [esi + 0x28], 0x1002af84
mov dword [esi + 0x2c], 0x1000655c
mov dword [esi + 0x30], 0x1000c4c8
mov dword [esi + 0x34], 0x1002af9c
mov dword [esi + 0x38], 0x1000c4ac
mov dword [esi + 0x3c], 0x1002afb0
mov dword [esi + 0x40], 0x10006594
call fcn.00620999
mov ebx, dword [0x1000135c]
lea eax, [esi + 0x124]
push eax
call ebx
mov eax, dword [esi + 0x140]
mov edi, dword [0x10001184]
test eax, eax
jne 0x68720d
mov eax, dword [esi + 0x144]
test eax, eax
jne 0x687215
mov eax, dword [esi + 0x148]
test eax, eax
jne 0x68721d
xor eax, eax
mov dword [esi + 0x13c], eax
mov dword [esi + 0x140], eax
mov dword [esi + 0x144], eax
mov dword [esi + 0x148], eax
mov dword [esi + 0x14c], eax
mov dword [esi + 0x150], eax
mov dword [esi + 0x154], eax
push 0x101a2a04
mov dword [esi + 0x158], eax
call dword [0x10001368]
cmp byte [esi + 0x1c9], 0
lea eax, [esi + 0x1b0]
je 0x621f53
push eax
call ebx
add esi, 0xa4
mov dword [ebp - 0x10], esi
push esi
mov dword [ebp - 4], 0
call fcn.00620941
cmp byte [esi + 0x7d], 0
lea eax, [esi + 0x64]
je 0x621f75
push eax
call ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x639e4a
Capabilities:
Encode data using xor

Disassembly:
mov esi, dword [edx + 8]
mov eax, dword [edx + 0xc]
cmp esi, dword [ebp + 0xc]
jne 0x639eb3
mov ecx, dword [ebp + 0x10]
test esi, esi
je 0x610147
mov bx, word [eax]
cmp bx, word [ecx]
jne 0x610137
add eax, 2
add ecx, 2
dec esi
jne 0x610124
jmp 0x610147
sbb ecx, ecx
and ecx, 0xfffffffe
inc ecx
je 0x610147
mov ebx, dword [ebp - 0xc]
jmp 0x639eb3
call 0x6e7e6d
int3
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [edi + 4], 0
lea eax, [edi + 4]
push ebx
push esi
mov dword [ebp - 4], eax
je 0x639f9d
mov edx, dword [ebp + 0xc]
xor eax, eax
xor ecx, ecx
test edx, edx
je 0x639e82
lea ecx, [ecx]
mov esi, dword [ebp + 0x10]
movzx esi, word [esi + ecx*2]
rol eax, 7
inc ecx
xor eax, esi
cmp ecx, edx
jb 0x639e71
and eax, 0x7fffffff
mov ebx, eax
xor edx, edx
div dword [edi]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
mov dword [ebp - 0xc], ebx
mov eax, dword [ecx + edx*4]
mov dword [ebp - 8], edx
test eax, eax
js 0x639eba
mov edi, edi
mov edx, dword [edi + 8]
lea eax, [eax + eax*4]
cmp dword [edx + eax*4], ebx
lea edx, [edx + eax*4]
je 0x61010e
mov eax, dword [edx + 4]
test eax, eax
jns 0x639ea1
mov eax, dword [edi + 0x14]
test eax, eax
jg 0x69fb81
mov eax, dword [edi]
cmp dword [edi + 0xc], eax
je 0x668f4c
mov ecx, dword [edi + 0xc]
lea eax, [ecx + 1]
mov dword [edi + 0xc], eax
mov edx, dword [edi + 8]
lea eax, [ecx + ecx*4]
add eax, eax
add eax, eax
mov dword [edx + eax], ebx
mov esi, dword [edi + 8]
mov edx, dword [ebp - 4]
mov edx, dword [edx]
mov ebx, dword [ebp - 8]
mov edx, dword [edx + ebx*4]
mov dword [esi + eax + 4], edx
mov esi, dword [edi + 8]
mov edx, dword [ebp + 0xc]
mov dword [esi + eax + 8], edx
mov edx, dword [ebp + 0x10]
mov dword [esi + eax + 0xc], edx
mov edx, dword [edi + 8]
mov esi, dword [ebp + 8]
mov dword [edx + eax + 0x10], esi
mov eax, dword [ebp - 4]
mov edx, dword [eax]
mov eax, ebx
pop esi
mov dword [edx + eax*4], ecx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
lea ecx, [edi + 8]
push ecx
push edi
mov esi, 0x11
mov dword [edi], 0x11
call fcn.00639fc3
mov dword [edi + 0x10], 0xffffffff
jmp 0x639e64
Function at 0x402260
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x4022dd
lea eax, [ebp - 0x130]
push eax
push esi
mov dword [ebp - 0x130], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x4022d6
mov edi, dword [sym.imp.KERNEL32.dll_Process32Next]
jmp 0x4022b0
lea eax, [ebp - 0x10c]
push str.hbrocx
push eax
call fcn.004035a0
add esp, 8
test eax, eax
jne 0x4022ef
lea eax, [ebp - 0x130]
push eax
push esi
call edi
test eax, eax
jne 0x4022b0
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00402cae
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
mov eax, 1
pop esi
call fcn.00402cae
mov esp, ebp
pop ebp
ret
Function at 0x40cd6f
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [section..data]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
xor edi, edi
push edi
mov dword [ebp - 0x20], eax
call ebx
mov esi, eax
mov dword [ebp - 0x18], esi
call fcn.004056ed
mov dword [ebp - 0x14], eax
cmp dword [0x419d3c], edi
jne 0x40ce60
push 0x800
push edi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov esi, eax
test esi, esi
jne 0x40cded
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40cf40
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov esi, eax
test esi, esi
je 0x40cf40
push str.MessageBoxW
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40cf40
push eax
call ebx
push str.GetActiveWindow
push esi
mov dword [0x419d3c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push esi
mov dword [0x419d40], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push esi
mov dword [0x419d44], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x419d4c], eax
test eax, eax
je 0x40ce5d
push str.GetProcessWindowStation
push esi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x419d48], eax
mov esi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40ce85
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40ce78
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], edi
je 0x40ce9a
push 4
pop eax
jmp 0x40cf42
cmp dword [ebp - 0x14], edi
je 0x40ce9a
push dword [0x419d3c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40ce7f
mov eax, dword [0x419d48]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, esi
je 0x40cef8
cmp dword [0x419d4c], esi
je 0x40cef8
push eax
call ebx
push dword [0x419d4c]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40cef8
test eax, eax
je 0x40cef8
call ecx
test eax, eax
je 0x40ceed
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40ceed
test byte [ebp - 8], 1
jne 0x40cef8
mov esi, dword [ebp + 0x10]
or esi, 0x200000
jmp 0x40cf28
mov eax, dword [0x419d40]
cmp eax, esi
je 0x40cf25
push eax
call ebx
test eax, eax
je 0x40cf25
call eax
mov edi, eax
test edi, edi
je 0x40cf25
mov eax, dword [0x419d44]
cmp eax, esi
je 0x40cf25
push eax
call ebx
test eax, eax
je 0x40cf25
push edi
call eax
mov edi, eax
mov esi, dword [ebp + 0x10]
push dword [0x419d3c]
call ebx
test eax, eax
je 0x40cf40
push esi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push edi
call eax
jmp 0x40cf42
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00402cae
leave
ret
Function at 0x1008924
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov ebx, ecx
test esi, esi
jne 0x100893f
push 0x80004005
call fcn.01008527
xor edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
inc eax
lea ecx, [eax + eax]
add esi, ecx
add edi, ecx
cmp eax, 1
jne 0x1008941
push edi
push dword [ebp + 0xc]
push 7
push 0
push dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x10092f4
Capabilities:
Query or enumerate registry key

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x224
mov eax, dword [0x1027474]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov eax, ecx
mov ecx, dword [ebp + 8]
push 0x2001f
push ecx
push dword [eax]
xor esi, esi
mov dword [ebp - 0x21c], ecx
lea ecx, [ebp - 0x214]
mov dword [ebp - 0x218], eax
mov dword [ebp - 0x214], esi
mov dword [ebp - 0x210], esi
mov dword [ebp - 0x20c], esi
call fcn.01008882
mov edi, eax
cmp edi, esi
je 0x1009366
lea ecx, [ebp - 0x214]
call fcn.0100880f
mov eax, edi
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.01016fbd
leave
ret 4
mov edi, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x1009384
lea eax, [ebp - 0x204]
push eax
lea ecx, [ebp - 0x214]
call fcn.010092f4
cmp eax, esi
jne 0x10093cf
lea eax, [ebp - 0x224]
push eax
push esi
push esi
push esi
lea eax, [ebp - 0x208]
push eax
lea eax, [ebp - 0x204]
push eax
push esi
push dword [ebp - 0x214]
mov dword [ebp - 0x208], 0x100
call edi
test eax, eax
je 0x100936e
lea ecx, [ebp - 0x214]
call fcn.0100880f
push dword [ebp - 0x21c]
mov ecx, dword [ebp - 0x218]
call fcn.01008789
lea ecx, [ebp - 0x214]
mov esi, eax
call fcn.0100880f
mov eax, esi
jmp 0x1009356
Function at 0x100b6e0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x1027474]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 0xc]
push edi
xor edi, edi
push 2
push edi
push eax
mov dword [ebp - 0x410], edi
mov dword [ebp - 0x414], ecx
mov dword [ebp - 0x418], edi
mov dword [ebp - 0x408], edi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [ebp - 0x40c], eax
cmp eax, edi
jne 0x100b73b
call fcn.010086be
mov esi, eax
jmp 0x100b81c
push ebx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov esi, eax
cmp esi, edi
jne 0x100b754
call fcn.010086be
jmp 0x100b80e
push esi
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
cmp ebx, edi
je 0x100b74a
push esi
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov esi, eax
lea eax, [esi + 1]
cmp eax, esi
jae 0x100b7b9
lea eax, [ebp - 0x404]
cmp dword [ebp - 0x408], eax
je 0x100b796
lea ecx, [ebp - 0x408]
call fcn.01008f50
mov esi, 0x8007000e
lea ecx, [ebp - 0x410]
call fcn.01008e45
mov ecx, dword [ebp - 4]
pop edi
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.01016fbd
leave
ret 0x10
push eax
lea ecx, [ebp - 0x408]
call fcn.01009fc0
cmp dword [ebp - 0x408], edi
jne 0x100b7d4
mov esi, 0x8007000e
jmp 0x100b810
push esi
push dword [ebp - 0x408]
push esi
push ebx
push edi
push 3
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
cmp eax, edi
je 0x100b74a
mov edx, dword [ebp - 0x408]
push dword [ebp + 0x14]
xor ecx, ecx
mov word [edx + eax*2], cx
push dword [ebp - 0x408]
lea ecx, [ebp - 0x418]
call fcn.0100b501
mov esi, eax
push dword [ebp - 0x40c]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
lea eax, [ebp - 0x404]
cmp dword [ebp - 0x408], eax
je 0x100b79b
lea ecx, [ebp - 0x408]
call fcn.01008f50
jmp 0x100b79b

Function at 0x100c069
Capabilities:
Check mutex on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x1001f20
xor edi, edi
push edi
push edi
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateMutexW]
mov dword [esi + 0x40], eax
cmp eax, edi
je 0x100c09d
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
jne 0x100c099
mov dword [esi + 0x44], edi
xor ebx, ebx
jmp 0x100c0b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, edi
jle 0x100c0b1
and eax, 0xffff
or eax, 0x80070000
mov ebx, eax
cmp ebx, edi
jl 0x100c0e5
cmp dword [ebp + 8], edi
je 0x100c0e5
push edi
push 2
push dword [ebp + 8]
push 0xffffffffffffffff
push 0x1001f14
call dword [sym.imp.KERNEL32.dll_CompareStringOrdinal]
cmp eax, 2
jne 0x100c0e5
lea eax, [esi + 0x48]
push eax
push 0x1001e60
call dword [sym.imp.SHLWAPI.dll_SHStrDupW]
mov ebx, eax
cmp dword [esi + 0x44], edi
jne 0x100c0f5
xor eax, eax
cmp dword [esi + 0x48], edi
sete al
mov dword [esi + 0x44], eax
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4