joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000e8c0
Capabilities:
Create thread
Terminate process

Disassembly:
push ebp
mov ebp, esp
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10012bcd
push eax
mov dword fs:[0], esp
sub esp, 0x38
push esi
push 0
push 0
push 0
push 0x1000e880
push 0
push 0
mov esi, ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp esi, 1
jne 0x1000e92a
push 0
mov ecx, 0x10018cd8
call fcn.10004d10
push eax
mov ecx, 0x10018d20
call fcn.10004d10
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1000e9bb
cmp esi, 2
jne 0x1000e951
push 0
mov ecx, 0x10018cd8
call fcn.10004d10
push eax
mov ecx, 0x10018cf0
call fcn.10004d10
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
jmp 0x1000e9bb
cmp esi, 5
jne 0x1000e9bb
push 0
sub esp, 0x18
mov ecx, esp
push str.Obbyb
call fcn.10001770
lea ecx, [ebp - 0x40]
call fcn.10004be0
add esp, 0x18
mov ecx, eax
mov dword [ebp - 4], 1
call fcn.10004d10
push eax
sub esp, 0x18
mov ecx, esp
push str.Zvokco_Bosxcdkvv_Dro_mvsoxd_Kqksx
call fcn.10001770
lea ecx, [ebp - 0x28]
call fcn.10004be0
add esp, 0x18
mov ecx, eax
call fcn.10004d10
push eax
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea ecx, [ebp - 0x28]
call fcn.10001720
lea ecx, [ebp - 0x40]
call fcn.10001720
push 1
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1000e9d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp + 8]
push esi
push edi
push eax
mov esi, dword [ebx + 4]
mov edi, ecx
push 0x40
push 5
push edi
mov dword [ebp - 4], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 8]
push eax
push 0x40
push 5
push 0x10018744
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [ebp + 8]
push eax
push 0x40
push 5
push 0x1001873c
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [edi]
mov ecx, 0x10018744
cmp eax, dword [ecx]
jne 0x1000ea34
movzx eax, byte [edi + 4]
cmp al, byte [ecx + 4]
jne 0x1000ea34
mov esi, 0xb
jmp 0x1000ea4d
mov eax, dword [edi]
mov ecx, 0x1001873c
cmp eax, dword [ecx]
jne 0x1000ea4d
movzx eax, byte [edi + 4]
cmp al, byte [ecx + 4]
jne 0x1000ea4d
mov esi, 5
lea eax, [esi + 5]
mov dword [ebx + 4], esi
push eax
call fcn.1000ef9f
mov ecx, dword [ebx + 4]
add esp, 4
mov esi, eax
add ecx, 5
lea eax, [ebp - 0xc]
push eax
push 0x40
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push dword [ebx + 4]
push edi
push esi
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 4]
mov ecx, edi
sub ecx, esi
add esp, 0xc
sub ecx, 5
mov byte [esi + eax], 0xe9
mov eax, dword [ebx + 4]
mov dword [eax + esi + 1], ecx
mov eax, dword [ebp - 4]
sub eax, edi
mov byte [ebp - 0xc], 0xe9
sub eax, 5
mov dword [ebp - 0xb], eax
mov eax, dword [ebp - 0xc]
mov dword [edi], eax
mov al, byte [ebp - 8]
mov byte [edi + 4], al
pop edi
mov dword [ebx], esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000fa20
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.1000fbd0
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1000faed
mov edx, dword [ebp - 4]
cmp edx, dword [0x10018084]
jb 0x1000fa6a
mov eax, dword [ebp - 4]
cmp eax, dword [0x10018088]
ja 0x1000fa6a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1000fa3a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1000fa90
jmp 0x1000faed
cmp dword [ebp - 0x14], 0x10000
jne 0x1000fad3
cmp dword [ebp - 0x18], 0x10000
jb 0x1000fad3
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000fac6
mov eax, dword [ebp - 8]
jmp 0x1000faef
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1000fae8
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.1000fbd0
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1000fa3a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000fb00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.1000fc00
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x1000fbc5
mov edx, dword [ebp - 4]
cmp edx, dword [0x10018084]
jb 0x1000fb45
mov eax, dword [ebp - 4]
cmp eax, dword [0x10018088]
ja 0x1000fb45
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1000fb15
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x1000fb6b
jmp 0x1000fbc5
cmp dword [ebp - 0x14], 0x10000
jne 0x1000fbae
cmp dword [ebp - 0x18], 0x10000
jb 0x1000fbae
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000fba1
mov eax, dword [ebp - 8]
jmp 0x1000fbc7
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x1000fbc0
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.1000fc00
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1000fb15
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10010fd0
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
cmp dword [0x1001944c], eax
je 0x10010fee
mov eax, 0x10dd
jmp 0x100110cf
mov eax, dword [0x1001945c]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1001106c
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x14]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0x10]
movzx eax, byte [edx + 0x36]
push eax
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + 0xc]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, dword [ebp - 4]
cmp dword [eax + 4], 0
jne 0x1001104a
mov ecx, dword [ebp - 4]
cmp dword [ecx + 0x10], 0
je 0x1001104a
mov edx, dword [ebp - 4]
mov eax, dword [edx + 0x10]
push eax
call fcn.10010080
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], 0
mov edx, dword [ebp - 4]
mov eax, dword [edx]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
push edx
call fcn.1000ec1a
add esp, 4
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
jmp 0x10010ff6
mov dword [0x1001945c], 0
call fcn.10010960
mov ecx, dword [0x10019458]
mov dword [ebp - 8], ecx
cmp dword [ebp - 8], 0
je 0x100110b9
mov edx, dword [ebp - 8]
mov eax, dword [edx + 4]
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 8]
mov edx, dword [ecx]
mov dword [ebp - 0x18], edx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
push ecx
call fcn.1000ec1a
add esp, 4
mov edx, dword [ebp - 0x18]
mov dword [ebp - 8], edx
jmp 0x10011084
mov dword [0x10019458], 0
mov dword [0x1001944c], 0
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x100115b0
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [0x10019450], 0
je 0x100115c9
mov eax, dword [0x10019450]
jmp 0x10011669
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
cmp dword [ebp + 8], eax
jne 0x100115db
xor eax, eax
jmp 0x10011669
push 8
call fcn.1000ec1f
add esp, 4
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10011631
mov dword [ebp - 8], 8
cmp dword [ebp - 4], 0
je 0x1001161a
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ebp - 0x10]
push edx
call fcn.1000ec1a
add esp, 4
mov dword [ebp - 4], 0
mov eax, dword [ebp - 8]
mov dword [0x10019450], eax
mov dword [0x10019454], 0
mov eax, dword [ebp - 8]
jmp 0x10011669
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
jne 0x1001164b
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 8], eax
jmp 0x100115fb
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 8]
mov dword [edx + 4], eax
mov ecx, dword [ebp - 4]
mov edx, dword [0x10019458]
mov dword [ecx], edx
mov eax, dword [ebp - 4]
mov dword [0x10019458], eax
xor eax, eax
mov esp, ebp
pop ebp
ret 4
Function at 0x4348c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x20000]
push edi
jmp 0x4348da
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x4348e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x4348d0
mov eax, 1
add ebx, ebx
jne 0x4348f3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x4348e8
jne 0x434904
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x4348e8
xor ecx, ecx
sub eax, 3
jb 0x434918
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x43498a
mov ebp, eax
add ebx, ebx
jne 0x434923
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x434930
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x434954
inc ecx
add ebx, ebx
jne 0x434940
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x434935
jne 0x434951
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x434935
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x434974
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x434965
jmp 0x4348d6
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x434974
add edi, ecx
jmp 0x4348d6
pop esi
mov edi, esi
mov ecx, 0x7da
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x434992
cmp byte [edi], 0x11
jne 0x434992
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x434997
lea edi, [esi + 0x31000]
mov eax, dword [edi]
or eax, eax
je 0x434a0f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x341dc]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x34298]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x4349c4
mov ecx, edi
jns 0x4349f3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x342a0]
or eax, eax
je 0x434a09
mov dword [ebx], eax
add ebx, 4
jmp 0x4349e1
call dword [esi + 0x3429c]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x434a40
cmp al, 0xef
ja 0x434a33
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x434a15
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x434a22
mov ebp, dword [esi + 0x342a4]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x434a74
sub esp, 0xffffff80
jmp 0x407d15
Function at 0x4011b4
Capabilities:
Authenticate hmac

Disassembly:
pushal
shr ch, cl
or cl, 0xaf
shld edi, ebp, 0x41
mov eax, 0x889d822d
mov ch, al
test ecx, 0xbdf00d29
imul edi, edi, 0
lea edx, [0xeea7194e]
neg bh
shr edx, 0x1a
sub edi, 0xffff360d
bswap ecx
imul eax, ecx
sub edi, 0x535
xchg edx, ebp
movzx edx, bp
and al, al
sub esi, edi
test ch, 0xa3
sbb al, 0x9a
xor cl, bl
mov dh, ah
push 0x9e5a2
push 0x5e1cf9
test dl, dh
cmp ecx, 0xe5e9
jno 0x40121e
imul edi, ebp, 0x10f77567
sbb dl, ch
movsx eax, dh
dec esi
shrd edi, ebx, cl
imul ebp, ecx, 0x6a75ff09
call 0x40126f
mov esi, 0xbe5fb658
test dh, 0xeb
not ah
xadd bh, dh
test dl, 0xdc
mov esi, ebp
btc ebx, ebp
xor eax, 0x852b8f62
dec eax
push 0xd828
cmp edi, 0x92f4
jno 0x40125e
or eax, 0x94fc6c51
bt ebx, eax
pop ebp
imul ecx, edx, 0x384f3246
shrd edx, esi, 0x2c
sub ebp, 0x597
and ebx, 0
neg al
mov ah, 0xe7
lea eax, [0xa4157ee0]
neg al
xchg edx, esi
mov ecx, ebx
dec ebp
add ebx, 0xfff3b564
not ah
add ebx, 0xc4a9d
mov edi, eax
and esi, esi
imul eax, esi, 0x5419c990
sub eax, 0x2319db34
cmp ebx, 0xdb7d
jae 0x4012ae
inc eax
movzx ebp, ax
cmp ebx, 0x118
jbe 0x401272
pop ebx
add dl, 0x93
test cl, ch
mov cl, dh
dec esi
shld ebp, ecx, cl
bswap ebp
btr ebp, esi
xadd al, al
cmp edx, edi
xchg ah, ch
imul eax, edi
xadd ebp, eax
mov al, 0xb1
imul edi, eax
xadd dl, dh
mov al, 0xa4
sub al, 0xb1
sbb edx, esi
mov ebp, edi
dec dl
add ebx, 0x2b947
mov ch, 0x70
test eax, 0x9ffa1ce9
sub ebx, 0x17af4
shr dl, cl
movsx edi, bl
shrd ebp, edi, 0x5c
bsf ecx, esi
or ch, al
bsf edx, eax
rcr eax, cl
xadd ah, cl
cmp edi, 0xc679
je 0x401320
sbb edi, eax
cmp edx, esi
test al, cl
neg dl
lea eax, [0x6d805172]
inc ah
ror ecx, 1
shrd ecx, ecx, cl
push 0xfa9158
push esi
mov ah, al
push ebx
mov dl, al
cmp edx, 0x3dd
jb 0x40134c
shrd edx, eax, 0xb2
shl ebp, cl
adc edi, 0x83f3d166
imul esi, ebx
xor eax, edi
rol ebp, 1
test esi, 0x6f8e6352
bts edi, 0x36
ret
Function at 0x401077
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
push dword [ebp + 8]
mov edi, 0x44fb40
mov ecx, edi
call fcn.004017eb
mov esi, eax
test esi, esi
js 0x401139
push 0x43d420
push dword [ebp + 0xc]
call fcn.004214ca
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x401139
push 0
push dword [ebp + 8]
mov ecx, edi
call fcn.00401840
mov dword [ebp - 8], eax
test eax, eax
jne 0x4010c9
or eax, 0xffffffff
jmp 0x40113c
push 0x8000
call fcn.0041cf89
mov dword [ebp - 4], eax
pop ecx
test esi, esi
je 0x401117
jmp 0x4010e0
mov eax, dword [ebp - 4]
mov ecx, 0x8000
cmp esi, ecx
mov edi, ecx
mov ecx, 0x44fb40
cmovl edi, esi
push edi
push eax
push dword [ebp - 8]
call fcn.00401a05
push ebx
push edi
push 1
push dword [ebp - 4]
call fcn.00421719
add esp, 0x10
cmp eax, edi
jl 0x401112
sub esi, edi
jne 0x4010dd
mov edi, 0x44fb40
push dword [ebp - 8]
mov ecx, edi
call fcn.004017c2
push ebx
call fcn.00421389
push dword [ebp - 4]
call fcn.0041c93d
pop ecx
pop ecx
test esi, esi
jne 0x401139
xor eax, eax
jmp 0x40113c
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x406088
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
or ecx, 0xffffffff
cmp dword [ebp + 0xc], edx
jle 0x4060b3
push esi
mov esi, dword [ebp + 8]
movsx eax, byte [edx + esi]
xor eax, ecx
shr ecx, 8
movzx eax, al
xor ecx, dword [eax*4 + 0x43d4c0]
inc edx
cmp edx, dword [ebp + 0xc]
jl 0x406099
pop esi
not ecx
mov eax, ecx
pop ebp
ret 8

Function at 0x408d30
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push edi
push dword [ebp + 0x14]
push dword [ebp + 8]
call fcn.00408de5
mov edi, eax
pop ecx
pop ecx
test edi, edi
jne 0x408d4c
or eax, 0xffffffff
jmp 0x408d6e
push esi
push edi
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.00421719
push edi
mov esi, eax
call fcn.00421389
add esp, 0x14
call fcn.00425078
mov eax, esi
pop esi
pop edi
pop ebp
ret

Function at 0x408e2a
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 8], 0
je 0x408e58
cmp dword [ebp + 0xc], 0
je 0x408e58
cmp dword [ebp + 0x10], 0
jg 0x408e43
xor eax, eax
pop ebp
ret
push dword [ebp + 8]
push dword [ebp + 0x10]
push 1
push dword [ebp + 0xc]
call fcn.004252e4
add esp, 0x10
pop ebp
ret
or eax, 0xffffffff
pop ebp
ret
Function at 0x40e537
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.0041d420
push esi
push edi
call fcn.00404c40
mov edi, eax
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
push eax
call fcn.0041d087
lea ecx, [ebp - 4]
push ecx
push eax
call fcn.00408d18
push dword [ebp - 4]
lea eax, [edi + 0x368]
push eax
call fcn.0040a5fc
lea eax, [ebp - 4]
push eax
call fcn.00408d25
add esp, 0x18
lea eax, [ebp - 0x1004]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0x20
lea eax, [ebp - 0x2004]
push eax
lea eax, [ebp - 0x1004]
push eax
call fcn.0041cf10
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x2004]
push eax
call fcn.00408d18
push dword [ebp - 4]
lea esi, [edi + 0x338]
push esi
call fcn.0040a5fc
push 0x5c
push dword [esi]
call fcn.0041ca2a
push dword [esi]
lea eax, [edi + 0x384]
push eax
call fcn.0040a5fc
push str.hsptv_
push dword [esi]
call fcn.00421790
lea eax, [ebp - 4]
push eax
call fcn.00408d25
push dword [esi]
lea eax, [edi + 0x388]
push eax
call fcn.0040a5fc
add esp, 0x40
pop edi
pop esi
leave
ret

Function at 0x40f49e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
mov ecx, dword [ebp + 0x10]
mov eax, ecx
shl eax, 2
push ebx
push esi
mov esi, dword [ebp + 0xc]
not eax
xor ebx, ebx
and eax, 8
or eax, 2
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
cmp byte [esi], bl
je 0x40f530
push 0x3c
lea eax, [ebp - 0x44]
push ebx
push eax
call fcn.0041eaa0
lea eax, [ebp - 4]
mov dword [ebp - 0x44], 0x3c
push eax
push esi
mov dword [ebp - 0x40], 0xc
mov dword [ebp - 0x3c], ebx
call fcn.00408d18
mov dword [ebp - 0x38], eax
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
call fcn.00408d18
add esp, 0x1c
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x28], 1
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteExA]
test eax, eax
lea eax, [ebp - 4]
push eax
je 0x40f5a2
call fcn.00408d25
lea eax, [ebp - 8]
push eax
call fcn.00408d25
pop ecx
pop ecx
jmp 0x40f59e
push eax
test cl, 0x10
je 0x40f556
mov eax, 0x43d43e
push eax
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.00408d18
pop ecx
pop ecx
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
jmp 0x40f58d
test cl, 0x20
je 0x40f578
mov eax, 0x43d43e
push eax
push eax
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.00408d18
pop ecx
pop ecx
push eax
push str.print
jmp 0x40f54d
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call fcn.00408d18
pop ecx
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
lea eax, [ebp - 4]
push eax
call fcn.00408d25
pop ecx
cmp esi, 0x20
jl 0x40f5b2
pop esi
pop ebx
leave
ret
call fcn.00408d25
lea eax, [ebp - 8]
push eax
call fcn.00408d25
pop ecx
pop ecx
push 0x44c354
lea eax, [ebp + 0x10]
mov dword [ebp + 0x10], 0xe
push eax
call fcn.0041ec7c
int3
Function at 0x40f5c8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1004
call fcn.0041d420
mov ecx, dword [ebp + 8]
xor edx, edx
mov eax, ecx
mov byte [ebp - 0x1004], dl
push esi
sub eax, edx
je 0x40f68e
sub eax, 1
je 0x40f681
sub eax, 1
je 0x40f66d
sub eax, 1
je 0x40f659
sub eax, 1
je 0x40f649
sub eax, 1
je 0x40f63f
sub eax, 1
je 0x40f62e
test ecx, 0x10000
je 0x40f6e8
push edx
movzx eax, cx
push eax
lea eax, [ebp - 0x1004]
push eax
push edx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
jmp 0x40f6a1
mov esi, dword [0x450a18]
add esi, 0x390
jmp 0x40f6e3
mov esi, 0x43d43e
jmp 0x40f6e3
mov eax, dword [0x450a18]
mov esi, dword [eax + 0x368]
jmp 0x40f6e3
push 0x1000
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x40f6a1
push 0x1000
lea eax, [ebp - 0x1004]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x40f6a1
mov eax, dword [0x450a18]
mov esi, dword [eax + 0x384]
jmp 0x40f6e3
lea eax, [ebp - 0x1004]
push 0x1000
push eax
call fcn.00423824
pop ecx
pop ecx
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x1004]
push eax
call fcn.00408d18
mov eax, dword [0x450a18]
push dword [ebp + 8]
add eax, 0x338
push eax
call fcn.0040a5fc
lea eax, [ebp + 8]
push eax
call fcn.00408d25
mov eax, dword [0x450a18]
push 0x5c
mov esi, dword [eax + 0x338]
push esi
call fcn.0041ca2a
add esp, 0x1c
mov eax, esi
pop esi
leave
ret
push 0x44c354
lea eax, [ebp - 4]
mov dword [ebp - 4], 3
push eax
call fcn.0041ec7c
int3
Function at 0x40f6fe
Capabilities:
Get hostname
Get memory capacity
Get session user name
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc8
push ebx
mov ebx, dword [ebp + 8]
mov dword [ebp - 4], 0x104
push edi
push 4
pop edi
test bl, 0x10
je 0x40f725
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
test bl, 0x20
je 0x40f74a
lea eax, [ebp - 0x48]
push eax
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, dword [ebp + 0x10]
and ebx, 0xf
mov ecx, dword [ebp + ebx*4 - 0x48]
mov dword [eax], ecx
mov ecx, dword [ebp + 0xc]
mov dword [ecx], edi
jmp 0x40f85f
push esi
sub ebx, 0
je 0x40f7c4
sub ebx, 1
je 0x40f7b4
sub ebx, 1
je 0x40f78f
sub ebx, 1
je 0x40f77a
sub ebx, 0xd
je 0x40f775
sub ebx, 1
je 0x40f770
xor eax, eax
jmp 0x40f85e
mov eax, dword [ebp - 0x14]
jmp 0x40f785
mov eax, dword [ebp - 0x10]
jmp 0x40f785
mov eax, dword [0x450a18]
mov eax, dword [eax + 0x37c]
mov esi, dword [ebp + 0x10]
mov dword [esi], eax
jmp 0x40f857
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetComputerNameA]
lea eax, [ebp + 8]
push eax
push esi
call fcn.00408d18
push dword [ebp + 8]
call fcn.004231c0
add esp, 0xc
jmp 0x40f832
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x40f79d
mov esi, dword [ebp + 0x10]
push str.Windows
push esi
call fcn.00421780
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetVersion]
mov ebx, eax
mov ecx, 0x43db80
mov eax, 0x43db84
test ebx, ebx
cmovs ecx, eax
push ecx
push esi
call fcn.00421790
mov eax, ebx
shr eax, 8
movzx eax, al
push eax
movzx eax, bl
push eax
lea eax, [ebp - 0xc8]
push str._ver_d._d
push eax
call fcn.00401b4a
lea eax, [ebp - 0xc8]
push eax
push esi
call fcn.00421790
lea eax, [ebp + 8]
push eax
push esi
call fcn.00408d18
push dword [ebp + 8]
call fcn.004231c0
add esp, 0x2c
mov edi, eax
cmp esi, dword [ebp + 8]
je 0x40f84a
push edi
push dword [ebp + 8]
push esi
call fcn.0041e520
add esp, 0xc
mov byte [edi + esi], 0
lea eax, [ebp + 8]
push eax
call fcn.00408d25
pop ecx
push 2
pop edi
mov ecx, dword [ebp + 0xc]
mov eax, esi
mov dword [ecx], edi
pop esi
pop edi
pop ebx
leave
ret
Function at 0x4126b4
Capabilities:
Log keystrokes

Disassembly:
mov eax, 0x43c711
call fcn.0041d3f4
sub esp, 0x10
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov dword [ebp - 0x10], esp
push esi
call dword [sym.imp.USER32.dll_TranslateMessage]
push esi
call dword [sym.imp.USER32.dll_DispatchMessageA]
mov eax, dword [0x450acc]
test byte [eax + 0x30c], 2
je 0x412729
cmp dword [esi + 4], 0x200
jne 0x412778
cmp dword [0x450ae0], 0
movzx ecx, word [esi + 0xc]
movzx eax, word [esi + 0xe]
jne 0x41271e
cmp dword [0x450ae4], ecx
jne 0x4127a7
cmp dword [0x450ae8], eax
jne 0x4127a7
jmp 0x412729
mov dword [0x450ae4], ecx
mov dword [0x450ae8], eax
cmp dword [esi + 4], 0x100
jne 0x412769
cmp dword [esi + 8], 9
jne 0x41273d
call fcn.00412164
push 2
call fcn.00405608
pop ecx
test eax, eax
je 0x412769
push dword [esi + 0xc]
and dword [ebp - 4], 0
push dword [esi + 8]
push 2
push dword [esi + 8]
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
push 2
call fcn.004057d1
add esp, 0x10
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
leave
ret
cmp dword [esi + 4], 0x100
jne 0x412769
cmp dword [0x450ae0], 0
jne 0x412729
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push 0x44c354
jmp 0x4127b3
and dword [ebp - 0x14], 0
lea eax, [ebp - 0x14]
push 0x44c354
push eax
call fcn.0041ec7c
int3