joyce8/EMBER2024-capa huggingface dataset:
Function at 0x42f2a0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.0041e8e0
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x42f36b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x42f36b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x42f31e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x42f329
or bh, 8
and edi, 0x8000000
je 0x42f344
mov eax, dword [0x4585dc]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x42f36b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42f740
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, dword [esp + 8]
sub esp, 4
push ebx
push esi
mov esi, dword [esp + 0x10]
push edi
push ebp
push 2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x42f76b
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ebx, eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
jne 0x42f78f
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
push ebx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
mov ebp, eax
test ebp, ebp
jne 0x42f7aa
xor eax, eax
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
mov edi, ebp
mov ecx, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov eax, dword [esp + 0x20]
xor ecx, ecx
mov cl, ah
mov edx, eax
mov dword [esp + 0x10], 0
shl ecx, 8
shr edx, 0x10
mov byte [esp + 0x10], dl
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x28]
or ecx, edx
mov edx, eax
shr edx, 0x10
mov dword [ebp + 0x28], ecx
mov dword [esp + 0x10], 0
xor ecx, ecx
mov byte [esp + 0x10], dl
mov cl, ah
xor edx, edx
shl ecx, 8
mov dl, al
shl edx, 0x10
or ecx, dword [esp + 0x10]
or ecx, edx
mov eax, dword [esp + 0x24]
mov edx, eax
mov dword [ebp + 0x44], ecx
shr edx, 0x10
xor ecx, ecx
mov dword [esp + 0x10], 0
mov cl, ah
mov byte [esp + 0x10], dl
shl ecx, 8
xor edx, edx
or ecx, dword [esp + 0x10]
mov dl, al
shl edx, 0x10
mov eax, dword [esp + 0x2c]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x48], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x30]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x64], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
mov eax, dword [esp + 0x34]
or ecx, edx
xor edx, edx
mov dl, al
mov dword [ebp + 0x54], ecx
shl edx, 0x10
xor ecx, ecx
mov cl, ah
shl ecx, 8
push 0
shr eax, 0x10
or ecx, edx
xor edx, edx
mov dl, al
or ecx, edx
mov dword [ebp + 0x50], ecx
call dword [sym.imp.USER32.dll_GetDC]
mov edi, eax
push 0
push ebp
lea ecx, [ebp + 0x68]
push ecx
push 4
push ebp
push edi
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
mov esi, eax
push edi
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
push ebp
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, esi
pop ebp
pop edi
pop esi
pop ebx
add esp, 4
ret 0x20
Function at 0x433735
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x433777
call fcn.00439462
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x433777
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x43376e
xor eax, eax
jmp 0x43377f
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.00433785
pop edi
pop esi
pop ebx
ret 4

Function at 0x436254
Capabilities:
Check if file exists
Get file attributes
Set file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push edi
push dword [ebp + 8]
xor edi, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], edi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ebx, dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xffffffff
mov dword [ebp - 4], eax
jne 0x436284
push edi
call ebx
push eax
call fcn.00436381
push esi
mov esi, dword [ebp + 0xc]
movzx eax, byte [esi + 0x10]
cmp eax, dword [ebp - 4]
je 0x4362ae
test byte [ebp - 4], 1
je 0x4362ae
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x4362ae
push edi
call ebx
push eax
call fcn.00436381
cmp dword [esi + 4], edi
lea eax, [esi + 4]
je 0x436354
lea ecx, [ebp - 0x24]
push ecx
push eax
call fcn.004361a1
cmp dword [esi + 8], edi
lea eax, [esi + 8]
pop ecx
pop ecx
je 0x4362e0
lea ecx, [ebp - 0x14]
push ecx
push eax
call fcn.004361a1
pop ecx
lea eax, [ebp - 0x14]
pop ecx
mov dword [ebp - 8], eax
cmp dword [esi], edi
je 0x4362f6
lea eax, [ebp - 0x1c]
push eax
push esi
call fcn.004361a1
pop ecx
lea eax, [ebp - 0x1c]
pop ecx
mov dword [ebp - 0xc], eax
push edi
push 0x80
push 3
push edi
push 1
push 0xc0000000
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x436320
push 0
call ebx
push eax
call fcn.00436381
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
test eax, eax
jne 0x43633e
push eax
call ebx
push eax
call fcn.00436381
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x436352
push eax
call ebx
push eax
call fcn.00436381
xor edi, edi
movzx eax, byte [esi + 0x10]
cmp eax, dword [ebp - 4]
pop esi
je 0x43637b
test byte [ebp - 4], 1
jne 0x43637b
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SetFileAttributesA]
test eax, eax
jne 0x43637b
push edi
call ebx
push eax
call fcn.00436381
pop edi
pop ebx
leave
ret 8
Function at 0x43a1d0
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x43a1fe
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x43a21c
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.0043a136
jmp 0x43a21c
mov eax, dword [esi + 0x14]
test eax, eax
je 0x43a21c
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.0043a136
test edi, edi
mov eax, edi
jne 0x43a206
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8
Function at 0x10001df0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push edi
mov edi, dword [esi + 0x2c]
mov dword [ebp - 0xc], edi
jmp 0x10001e03
mov edi, dword [ebp - 0xc]
mov ebx, dword [esi + 0x3c]
sub ebx, dword [esi + 0x74]
mov eax, dword [esi + 0x6c]
mov ecx, dword [esi + 0x2c]
sub ebx, eax
lea edx, [edi + ecx - 0x106]
mov dword [ebp - 4], ebx
cmp eax, edx
jb 0x10001e7d
mov eax, dword [esi + 0x38]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call fcn.10102780
mov edx, dword [esi + 0x4c]
mov eax, dword [esi + 0x44]
sub dword [esi + 0x70], edi
sub dword [esi + 0x6c], edi
add esp, 0xc
sub dword [esi + 0x5c], edi
lea ecx, [eax + edx*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, edi
jb 0x10001e51
sub eax, edi
jmp 0x10001e53
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x10001e42
mov ecx, dword [esi + 0x40]
mov edx, edi
lea ecx, [ecx + edi*2]
movzx eax, word [ecx - 2]
sub ecx, 2
cmp eax, edi
jb 0x10001e70
sub eax, edi
jmp 0x10001e72
xor eax, eax
dec edx
mov word [ecx], ax
jne 0x10001e61
add ebx, edi
mov dword [ebp - 4], ebx
mov edi, dword [esi]
cmp dword [edi + 4], 0
je 0x10001fa9
mov edx, dword [esi + 0x74]
add edx, dword [esi + 0x6c]
mov eax, dword [edi + 4]
add edx, dword [esi + 0x38]
mov ecx, dword [ebp - 4]
mov ebx, eax
mov dword [ebp - 8], edx
cmp ebx, ecx
jbe 0x10001ea3
mov ebx, ecx
test ebx, ebx
je 0x10001ef6
sub eax, ebx
mov dword [edi + 4], eax
mov eax, dword [edi + 0x1c]
mov eax, dword [eax + 0x18]
cmp eax, 1
jne 0x10001ec5
mov edx, dword [edi]
mov ecx, dword [edi + 0x30]
mov eax, ebx
call fcn.10005d30
jmp 0x10001ede
cmp eax, 2
jne 0x10001ee4
mov ecx, dword [edi]
mov eax, dword [edi + 0x30]
test ecx, ecx
jne 0x10001ed7
xor eax, eax
jmp 0x10001ee1
mov edx, ebx
call fcn.10005fc0
mov edx, dword [ebp - 8]
mov dword [edi + 0x30], eax
mov ecx, dword [edi]
push ebx
push ecx
push edx
call fcn.10102780
add dword [edi], ebx
add esp, 0xc
add dword [edi + 8], ebx
add dword [esi + 0x74], ebx
mov ebx, dword [esi + 0x74]
cmp ebx, 3
jb 0x10001f1e
mov edx, dword [esi + 0x6c]
add edx, dword [esi + 0x38]
mov ecx, dword [esi + 0x58]
movzx eax, byte [edx]
mov dword [esi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x54]
mov dword [esi + 0x48], eax
cmp ebx, 0x106
jae 0x10001f32
mov edx, dword [esi]
cmp dword [edx + 4], 0
jne 0x10001e00
mov eax, dword [esi + 0x16c0]
mov ecx, dword [esi + 0x3c]
cmp eax, ecx
jae 0x10001fa9
mov edi, dword [esi + 0x6c]
add edi, ebx
cmp eax, edi
jae 0x10001f78
sub ecx, edi
mov ebx, ecx
cmp ebx, 0x102
jbe 0x10001f59
mov ebx, 0x102
mov eax, dword [esi + 0x38]
push ebx
add eax, edi
push 0
push eax
call fcn.10102140
add esp, 0xc
add ebx, edi
pop edi
mov dword [esi + 0x16c0], ebx
pop ebx
mov esp, ebp
pop ebp
ret
lea edx, [edi + 0x102]
cmp eax, edx
jae 0x10001fa9
sub edi, eax
add edi, 0x102
sub ecx, eax
cmp edi, ecx
jbe 0x10001f92
mov edi, ecx
mov ecx, dword [esi + 0x38]
push edi
add ecx, eax
push 0
push ecx
call fcn.10102140
add esp, 0xc
add dword [esi + 0x16c0], edi
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005fa0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
test ecx, ecx
jne 0x10005fab
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
pop ebp
jmp fcn.10005fc0
Function at 0x10006b81
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10179c00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
push edi
push 0
push 0x80
push 3
push 0
mov dword [ebp - 0x18], eax
mov eax, dword [esi + 4]
push 2
mov edi, ecx
mov dword [ebp - 0x14], eax
push 0x40000000
lea eax, [edi + 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
push 0
lea eax, [ebp - 0x18]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp + 0xc]
add eax, 0xfffffff8
push eax
add esi, 8
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0x14], eax
mov ecx, dword [0x1017c164]
push 4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0xf]
push eax
mov byte [ebp - 0x10], 0x95
call fcn.10010768
mov ecx, dword [0x1017c164]
push 4
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xb]
push eax
call fcn.10010768
push 0x1e
call dword [sym.imp.KERNEL32.dll_Sleep]
push 9
lea eax, [ebp - 0x10]
push eax
mov ecx, edi
call fcn.1000fe09
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1010259e
leave
ret 8

Function at 0x10006cd1
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x10179c00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push 0
push 0x80
push 3
push 0
push 0
mov esi, ecx
push SysReAllocString
lea eax, [esi + 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x10006d1b
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call fcn.10006c4e
jmp 0x10006d90
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x18]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push ebx
mov dword [ebp - 0x1c], eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [0x1017c164]
push 4
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x13]
push eax
mov byte [ebp - 0x14], 0x97
call fcn.10010768
mov ecx, dword [0x1017c164]
push 4
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0xf]
push eax
call fcn.10010768
mov ecx, dword [0x1017c164]
push 4
push 0x1017b1e4
lea eax, [ebp - 0xb]
push eax
call fcn.10010768
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xd
lea eax, [ebp - 0x14]
push eax
mov ecx, esi
call fcn.1000fe09
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1010259e
leave
ret 4
Function at 0x10006f45
Capabilities:
Encode data using xor
Get common file path
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x10179c00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, 0x104
push esi
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x107]
push ebx
push eax
mov byte [ebp - 0x108], bl
call fcn.10102140
add esp, 0xc
push esi
lea eax, [ebp - 0x108]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea eax, [ebp - 0x20c]
push str._._mnbvcxz_lkjhgfdsa__poiuytrewq
push eax
call fcn.101045e0
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x20c]
push eax
call fcn.101045e0
lea eax, [ebp - 0x20c]
push str..key
push eax
call fcn.101045e0
add esp, 0x18
push ebx
push 0x80
push 4
push ebx
push 2
push 0x40000000
push str.C:ProgramDatakey.key
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebx
push eax
mov dword [ebp - 0x214], eax
mov dword [ebp - 0x218], ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x3200000
jae 0x1000701b
push 2
push ebx
push ebx
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
call esi
push eax
mov dword [ebp - 0x210], eax
call fcn.10014168
pop ecx
mov dword [ebp - 0x21c], eax
cmp dword [ebp - 0x210], ebx
jle 0x10007060
mov edx, dword [ebp - 0x210]
mov ecx, edi
sub ecx, eax
mov dword [ebp - 0x210], edx
mov dl, byte [ecx + eax]
xor dl, 0x62
mov byte [eax], dl
inc eax
dec dword [ebp - 0x210]
jne 0x1000704f
push ebx
lea eax, [ebp - 0x218]
push eax
push edi
call esi
push eax
push dword [ebp - 0x21c]
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_WriteFile]
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1010259e
leave
ret
Function at 0x10007099
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x418
mov eax, dword [0x10179c00]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov edi, 0x400
push edi
xor ebx, ebx
push ebx
mov esi, 0x1017b5d0
push esi
call fcn.10102140
add esp, 0xc
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push edi
push esi
push eax
mov dword [0x1017b5cc], eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
push 0x3ff
lea eax, [ebp - 0x403]
push ebx
push eax
mov dword [ebp - 0x418], ebx
mov byte [ebp - 0x404], bl
call fcn.10102140
mov eax, dword [0x1017b5cc]
add esp, 0xc
cmp eax, dword [0x1017b5c8]
je 0x100071a0
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x10007196
lea eax, [ebp - 0x414]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x408]
push eax
movzx eax, word [ebp - 0x40a]
push eax
movzx eax, word [ebp - 0x40c]
push eax
movzx eax, word [ebp - 0x40e]
push eax
movzx eax, word [ebp - 0x412]
push eax
movzx eax, word [ebp - 0x414]
push eax
push esi
lea eax, [ebp - 0x404]
push 0x1012d2ac
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
lea eax, [ebp - 0x404]
push eax
call fcn.10006f45
push edi
lea eax, [ebp - 0x404]
push ebx
push eax
call fcn.10102140
push edi
push ebx
push esi
call fcn.10102140
add esp, 0x40
mov dword [ebp - 0x418], 1
mov eax, dword [0x1017b5cc]
mov dword [0x1017b5c8], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x418]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1010259e
leave
ret

Function at 0x10007274
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor ebx, ebx
push ebx
mov word [ebp - 4], 0x5c
call edi
push 0x104
push ebx
mov esi, 0x1017b9e0
push esi
call fcn.10102140
add esp, 0xc
push ebx
call edi
push ebx
push 0x1a
push esi
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
push ebx
call edi
mov ecx, dword [0x1017c164]
lea eax, [ebp - 4]
push eax
push esi
call fcn.1001078f
push dword [ebp + 8]
mov ecx, dword [0x1017c164]
push esi
call fcn.1001078f
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10007431
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x320
mov eax, dword [0x10179c00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
push ebx
mov ebx, dword [ebp + 0x1c]
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 8]
mov dword [ebp - 0x320], eax
mov dword [ebp - 0x31c], ecx
test eax, eax
jne 0x1000746d
xor eax, eax
jmp 0x100075f9
lea eax, [ebp - 0x314]
push eax
push 0x10156c38
push 1
push 0
push 0x10156cb8
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
js 0x10007466
mov eax, dword [ebp - 0x314]
mov ecx, dword [eax]
lea edx, [ebp - 0x318]
push edx
push 0x10156c68
push eax
call dword [ecx]
test eax, eax
jns 0x100074b5
mov eax, dword [ebp - 0x314]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x10007466
mov eax, dword [ebp - 0x314]
mov ecx, dword [eax]
test edi, edi
jne 0x100074c9
push dword [0x10182400]
jmp 0x100074ca
push edi
push eax
call dword [ecx + 0x50]
test esi, esi
je 0x100074df
mov eax, dword [ebp - 0x314]
mov ecx, dword [eax]
push esi
push eax
call dword [ecx + 0x50]
cmp word [ebp + 0x18], 0
je 0x100074f5
mov eax, dword [ebp - 0x314]
push dword [ebp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x34]
test ebx, ebx
je 0x10007506
mov eax, dword [ebp - 0x314]
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 0x314]
push dword [ebp + 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x3c]
xor ebx, ebx
cmp dword [ebp - 0x31c], ebx
je 0x10007543
push str..lnk
push dword [ebp - 0x31c]
lea eax, [ebp - 0x108]
push dword [ebp - 0x320]
push str._s_s_s
push eax
call fcn.101046c8
jmp 0x100075a3
push 0x5c
cmp edi, ebx
je 0x1000754c
push edi
jmp 0x10007552
push dword [0x10182400]
call fcn.101026c0
pop ecx
pop ecx
cmp eax, ebx
jne 0x1000756e
mov eax, dword [ebp - 0x318]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
jmp 0x100074a7
push eax
push dword [ebp - 0x320]
lea eax, [ebp - 0x108]
push 0x1012d338
push eax
call fcn.101046c8
lea eax, [ebp - 0x108]
push eax
call fcn.10104540
lea eax, [ebp + eax - 0x108]
mov word [eax - 3], 0x6e6c
mov byte [eax - 1], 0x6b
add esp, 0x14
push 0x104
lea eax, [ebp - 0x310]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x108]
push eax
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
mov eax, dword [ebp - 0x318]
mov ecx, dword [eax]
push 1
lea edx, [ebp - 0x310]
push edx
push eax
call dword [ecx + 0x18]
mov esi, eax
mov eax, dword [ebp - 0x318]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 0x314]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
xor eax, eax
cmp esi, ebx
setge al
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1010259e
leave
ret
Function at 0x10007817
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x10179c00]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 8]
test edi, edi
jne 0x10007839
xor eax, eax
jmp 0x100078ec
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x130], eax
cmp eax, 0xffffffff
je 0x10007832
push esi
lea ecx, [ebp - 0x12c]
push ecx
push eax
mov dword [ebp - 0x12c], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x100078dd
lea eax, [ebp - 0x108]
push edi
push eax
xor esi, esi
call fcn.10104a20
pop ecx
pop ecx
test eax, eax
je 0x100078b2
lea eax, [ebp - 0x12c]
push eax
push dword [ebp - 0x130]
call sub.KERNEL32.dll_Process32Next
test eax, eax
je 0x100078ae
lea eax, [ebp - 0x108]
push edi
push eax
call fcn.10104a20
pop ecx
pop ecx
test eax, eax
jne 0x100078aa
xor esi, esi
inc esi
test esi, esi
je 0x1000787e
test esi, esi
je 0x100078dd
push dword [ebp - 0x130]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x124]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
test eax, eax
je 0x100078e9
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x100078eb
push dword [ebp - 0x130]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.1010259e
leave
ret

Function at 0x10007a75
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x434
mov eax, dword [0x10179c00]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x434], eax
mov eax, dword [ebp + 0xc]
xor ebx, ebx
push 0x3ff
mov dword [ebp - 0x430], eax
lea eax, [ebp - 0x42b]
push ebx
push eax
mov byte [ebp - 0x42c], bl
call fcn.10102140
mov esi, dword [sym.imp.KERNEL32.dll_Sleep]
add esp, 0xc
push ebx
call esi
push 0x400
lea eax, [ebp - 0x42c]
push ebx
push eax
call fcn.10102140
add esp, 0xc
push ebx
call esi
push ebx
mov dword [ebp - 0x2c], 0x54535953
mov dword [ebp - 0x28], 0x435c4d45
mov dword [ebp - 0x24], 0x65727275
mov dword [ebp - 0x20], 0x6f43746e
mov dword [ebp - 0x1c], 0x6f72746e
mov dword [ebp - 0x18], 0x7465536c
mov dword [ebp - 0x14], 0x7265535c
mov dword [ebp - 0x10], 0x65636976
mov dword [ebp - 0xc], 0x73255c73
mov byte [ebp - 8], bl
call esi
push dword [ebp - 0x434]
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x42c]
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0xc
push ebx
call esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
push edi
push 1
push dword [ebp - 0x430]
lea eax, [ebp - 0x42c]
push eax
push reloc.OLEAUT32.dll_SysReAllocString
call fcn.1001185b
add esp, 0x1c
push ebx
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1010259e
leave
ret