joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10034edd
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
xor ebx, ebx
push esi
push edi
cmp dword [0x1006f284], ebx
je 0x10034ef8
cmp dword [0x1006f288], ebx
jne 0x10034f41
push str.Comctl32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
mov edi, eax
cmp edi, ebx
je 0x10034f29
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.CreatePropertySheetPageW
push edi
call esi
push str.DestroyPropertySheetPage
push edi
mov dword [0x1006f284], eax
call esi
mov dword [0x1006f288], eax
cmp dword [0x1006f284], ebx
je 0x10034f39
cmp dword [0x1006f288], ebx
jne 0x10034f41
xor eax, eax
inc eax
jmp 0x1003504a
call fcn.1001e7bd
mov edi, dword [ebp + 8]
lea esi, [edi + 0xc]
mov ecx, esi
call fcn.1001cfe0
cmp dword [0x1006f010], ebx
jne 0x10034f67
cmp dword [0x1006f014], ebx
je 0x10035042
cmp dword [ebp + 0x10], ebx
je 0x10035042
push 0x100571f0
call fcn.1001df7d
pop ecx
test eax, eax
je 0x10035042
call fcn.1001e7bd
push dword [ebp + 0x10]
lea eax, [ebp - 0x28]
push eax
call fcn.100387e0
pop ecx
pop ecx
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x10]
call fcn.10005d74
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 4], eax
jmp 0x10034ffd
lea ecx, [ebp - 8]
call fcn.100246b0
cmp dword [eax + 0x18], 8
jb 0x10034fc6
mov eax, dword [eax + 4]
jmp 0x10034fc9
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10034ff5
lea ecx, [ebp - 8]
call fcn.100246b0
cmp dword [eax + 0x18], 8
jb 0x10034fe7
mov eax, dword [eax + 4]
jmp 0x10034fea
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x1003501e
lea ecx, [ebp - 8]
call fcn.1001484a
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x18]
lea ecx, [ebp - 0x10]
call fcn.10005d74
lea eax, [ebp - 0x10]
push eax
lea ecx, [ebp - 8]
call fcn.100249c9
test al, al
je 0x10034fb3
jmp 0x10035031
lea ecx, [ebp - 8]
call fcn.100246b0
push 0xffffffffffffffff
push ebx
push eax
mov ecx, esi
call fcn.10005972
lea ecx, [ebp - 0x28]
call fcn.10005d25
push dword [ebp - 0x28]
call fcn.10039dc6
pop ecx
xor eax, eax
cmp dword [edi + 0x20], ebx
sete al
pop edi
pop esi
pop ebx
leave
ret 0x10

Function at 0x1003549c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrlenW]
push esi
call edi
cmp eax, 2
jle 0x100354cf
cmp word [esi + 2], 0x3a
jne 0x100354cf
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x100354c2
xor eax, eax
pop edi
ret
not al
movzx eax, al
shr eax, 4
and eax, 1
pop edi
ret
push esi
call dword [sym.imp.SHLWAPI.dll_PathFindExtensionW]
push eax
call edi
neg eax
sbb eax, eax
neg eax
pop edi
ret
Function at 0x100357f1
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
push esi
push edi
mov edi, str.Softwareprojonepodlp_volatileoverlayIcon_
mov esi, reloc.OLEAUT32.dll_SysReAllocString
jne 0x10035824
push dword [ebp + 8]
push edi
push esi
call fcn.10004757
add esp, 0xc
test al, al
je 0x10035864
push dword [ebp + 8]
push edi
push esi
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueW]
jmp 0x1003584a
push 0x64
push dword [ebp + 8]
push edi
push esi
call fcn.1000430c
cmp eax, dword [ebp + 0xc]
je 0x10035864
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push dword [ebp + 8]
push edi
push esi
call fcn.100046cc
add esp, 0x18
push 0
push dword [ebp + 8]
call fcn.100015e9
push eax
push 0x3e8
push 0x100355e2
call fcn.1001a991
pop edi
pop esi
pop ebp
ret

Function at 0x10036a99
Capabilities:
Create thread

Disassembly:
push ebx
push ebp
push esi
push edi
call fcn.1001e7bd
mov esi, dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push 0x1006f28c
call esi
push 0x1006f2bc
call esi
push 0x1006f2a4
call esi
mov esi, dword [sym.imp.KERNEL32.dll_CreateThread]
xor ebp, ebp
push ebp
push ebp
push ebp
push 0x100366b2
mov ebx, 0x10000
push ebx
push ebp
call esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
push eax
call edi
push ebp
push ebp
push ebp
push 0x10036882
push ebx
push ebp
call esi
push eax
call edi
push ebp
push ebp
push ebp
push 0x100369db
push ebx
push ebp
call esi
push eax
call edi
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x100378cc
Capabilities:
Create thread

Disassembly:
push 0x94
mov eax, 0x10050cf0
call fcn.1003a5fc
push str.gxdteCfg
lea ecx, [ebp - 0x84]
call fcn.10004ab2
lea eax, [ebp - 0x84]
push eax
lea eax, [ebp - 0x48]
xor edi, edi
push eax
mov dword [ebp - 4], edi
call fcn.1001c4cd
pop ecx
pop ecx
push edi
push 1
lea ecx, [ebp - 0x84]
mov byte [ebp - 4], 2
call fcn.1000588b
lea ecx, [ebp - 0x48]
call fcn.10010cd5
lea ecx, [ebp - 0x48]
test al, al
je 0x10037b04
push str.ctxMenuAuth
call fcn.1001093c
mov esi, eax
mov ecx, esi
mov dword [ebp - 0x30], esi
call fcn.10010cd5
test al, al
je 0x10037b01
push str.enable
lea ecx, [ebp - 0x2c]
call fcn.10004ab2
push edi
lea eax, [ebp - 0x2c]
push eax
push esi
mov byte [ebp - 4], 3
call fcn.10019eb4
add esp, 0xc
mov ebx, eax
neg ebx
push edi
sbb bl, bl
push 1
lea ecx, [ebp - 0x2c]
inc bl
mov byte [ebp - 4], 2
call fcn.1000588b
test bl, bl
jne 0x10037b01
cmp dword [ebp + 8], edi
je 0x10037aea
push str.expired
lea ecx, [ebp - 0x68]
call fcn.10004ab2
push 5
lea eax, [ebp - 0x68]
push eax
push esi
mov byte [ebp - 4], 4
call fcn.10019eb4
add esp, 0xc
xor ebx, ebx
push edi
mov esi, eax
inc ebx
imul esi, esi, 0x3e8
push ebx
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 2
call fcn.1000588b
push str.exts
lea ecx, [ebp - 0x68]
call fcn.10004ab2
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x4c], esp
push 0x1005c03b
mov byte [ebp - 4], 5
call fcn.10004ab2
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x30]
lea eax, [ebp - 0xa0]
push eax
call fcn.10018ea0
push eax
lea eax, [ebp - 0x2c]
push eax
mov byte [ebp - 4], 6
call fcn.100013c8
add esp, 0x30
push edi
push ebx
lea ecx, [ebp - 0xa0]
call fcn.1000588b
push edi
push ebx
lea ecx, [ebp - 0x68]
mov byte [ebp - 4], 9
call fcn.1000588b
cmp dword [ebp - 0x18], edi
je 0x10037ad3
cmp esi, edi
je 0x10037ad3
call fcn.1002540c
test eax, eax
je 0x10037acc
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x10037a51
lea eax, [ebp - 0x28]
push 2
push eax
push str.explorer.exe
call fcn.10025440
add esp, 0xc
call fcn.10002cf3
mov ecx, eax
mov eax, edx
mov dword [ebp - 0x30], eax
mov eax, esi
cdq
add ecx, eax
mov eax, dword [ebp - 0x30]
adc eax, edx
mov dword [0x1006f5a8], ecx
mov dword [0x1006f5ac], eax
cmp dword [0x1006f5a0], edi
jne 0x10037ab2
push edi
push edi
push edi
push 0x10036fa5
push edi
push edi
mov dword [0x1006f5a0], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push str._TempAuth_temp_auth_cleaner_created
call fcn.10021e91
pop ecx
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x10037abe
lea eax, [ebp - 0x28]
push eax
push str._TempAuth_temp_auth_for:__s
call fcn.10021e91
pop ecx
jmp 0x10037add
push str._TempAuth_dte_not_working
jmp 0x10037ad8
push str._TempAuth_parameter_error
call fcn.10021e91
pop ecx
push edi
push ebx
lea ecx, [ebp - 0x2c]
call fcn.10005a9d
jmp 0x10037b01
push str._TempAuth_remove_temp_auth
call fcn.10021e91
mov dword [esp], str.explorer.exe
call fcn.100258cb
pop ecx
lea ecx, [ebp - 0x48]
or dword [ebp - 4], 0xffffffff
call fcn.1000f883
call fcn.1003a67f
ret
Function at 0x1003801b
Capabilities:
Check os version

Disassembly:
push 0x130
mov eax, 0x10050d26
call fcn.1003a5fc
test byte [0x1006f5d0], 1
mov esi, 0x1006f5b0
jne 0x10038059
or dword [0x1006f5d0], 1
and dword [ebp - 4], 0
mov ecx, esi
call fcn.10037f12
push 0x10054ff2
call fcn.1003b112
or dword [ebp - 4], 0xffffffff
pop ecx
lea eax, [ebp + 8]
push eax
lea eax, [ebp - 0x134]
push eax
mov ecx, esi
call fcn.100373dc
push esi
push dword [0x1006f5c8]
lea ecx, [ebp - 0x13c]
call fcn.10037250
lea eax, [ebp - 0x13c]
push eax
lea ecx, [ebp - 0x134]
call fcn.1003550c
test al, al
jne 0x100380a3
lea ecx, [ebp - 0x134]
call fcn.10037021
mov eax, dword [eax + 4]
jmp 0x10038100
push 0x118
lea eax, [ebp - 0x128]
push 0
push eax
call fcn.1003af40
add esp, 0xc
lea eax, [ebp - 0x12c]
push eax
mov dword [ebp - 0x12c], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x128], 5
jbe 0x100380e3
push dword [ebp + 8]
call fcn.10036ef5
jmp 0x100380eb
mov eax, dword [ebp + 8]
call fcn.10036b02
mov edi, eax
test edi, edi
je 0x100380fe
lea eax, [ebp + 8]
push eax
mov ecx, esi
call fcn.10037e71
mov dword [eax], edi
mov eax, edi
call fcn.1003a67f
ret

Function at 0x100395a0
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x100395e8
mov eax, dword [esi + 8]
test eax, eax
je 0x100395e8
and dword [ebp - 4], 0
lea ecx, [ebp - 4]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x100395db
cmp dword [ebp - 4], 0x103
jne 0x100395db
push 0
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_TerminateThread]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
and dword [esi + 8], 0
pop esi
leave
ret
Function at 0x10039689
Capabilities:
Check if file exists
Get session user name

Disassembly:
push ebp
sub esp, 0x324
lea ebp, [esp - 4]
mov eax, dword [0x1006c144]
xor eax, ebp
mov dword [ebp + 0x324], eax
push 0xc
mov eax, 0x10050d9f
call fcn.1003a593
mov eax, dword [ebp + 0x330]
mov dword [ebp - 0x10], eax
xor eax, eax
push 0x206
mov word [ebp + 0x1c], ax
xor ebx, ebx
lea eax, [ebp + 0x1e]
push ebx
push eax
mov esi, ecx
call fcn.1003af40
add esp, 0xc
push 0x104
lea eax, [ebp + 0x1c]
push eax
push str.polocker.exe
push esi
call fcn.10002287
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x100396fc
push 3
pop eax
jmp 0x100397ef
push dword [ebp - 0x10]
lea eax, [ebp + 0x1c]
push edi
push eax
lea eax, [ebp]
push str.__s___s__s
push eax
call fcn.100041e7
xor eax, eax
push 0xfe
mov word [ebp + 0x224], ax
lea eax, [ebp + 0x226]
push ebx
push eax
mov dword [ebp - 4], ebx
call fcn.1003af40
add esp, 0x20
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp + 0x224]
push eax
mov dword [ebp - 0x18], 0x80
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
test eax, eax
jne 0x10039761
push ebx
push 1
lea ecx, [ebp]
call fcn.10005a9d
xor eax, eax
jmp 0x100397ef
call fcn.1001a8c6
test eax, eax
mov eax, dword [ebp + 4]
jne 0x100397ac
cmp dword [ebp + 0x18], 8
jae 0x10039776
lea eax, [ebp + 4]
xor esi, esi
inc esi
push esi
push ebx
push eax
call fcn.10002e75
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x10039790
mov dword [ebp - 0x10], esi
cmp eax, 0xffffffff
jne 0x10039793
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x14]
call fcn.10001319
push ebx
push esi
lea ecx, [ebp]
call fcn.10005a9d
xor eax, eax
cmp byte [ebp - 0x10], bl
jmp 0x100397e8
cmp dword [ebp + 0x18], 8
jae 0x100397b5
lea eax, [ebp + 4]
xor esi, esi
inc esi
push esi
push eax
call fcn.1000326b
mov dword [ebp - 0x14], eax
cmp eax, ebx
je 0x100397ce
mov dword [ebp - 0x10], esi
cmp eax, 0xffffffff
jne 0x100397d1
mov dword [ebp - 0x10], ebx
lea ecx, [ebp - 0x14]
call fcn.10001319
push ebx
push esi
lea ecx, [ebp]
call fcn.10005a9d
xor eax, eax
cmp byte [ebp - 0x10], bl
setne al
dec eax
and eax, 4
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x324]
xor ecx, ebp
call fcn.1003a584
add ebp, 0x328
leave
ret

Function at 0x10039abe
Capabilities:
Create thread

Disassembly:
push ebx
push esi
mov esi, ecx
xor ebx, ebx
cmp byte [esi + 4], bl
je 0x10039acd
xor al, al
jmp 0x10039b1a
push 0x100588d8
mov byte [esi + 4], 1
call fcn.1001df7d
pop ecx
test eax, eax
je 0x10039b18
cmp dword [0x1006f010], ebx
je 0x10039b18
push 0x10059968
call fcn.1001a458
pop ecx
push 0x43
call dword [sym.imp.USER32.dll_GetSystemMetrics]
cmp eax, 1
je 0x10039b05
cmp eax, 2
jne 0x10039b18
push ebx
push ebx
push ebx
push 0x10039a2b
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 8], eax
mov al, 1
pop esi
pop ebx
ret

Function at 0x1003a584
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1006c144]
jne 0x1003a58e
repz ret
jmp fcn.1003ed7c
Function at 0x100430ee
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1003d861
and dword [ebp - 4], 0
cmp dword [0x100705bc], 0
mov ebx, eax
jne 0x1004319f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10043250
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10043250
push eax
call fcn.1003d7ef
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x100705bc], eax
call esi
push eax
call fcn.1003d7ef
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x100705c0], eax
call esi
push eax
call fcn.1003d7ef
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x100705c4], eax
call esi
push eax
call fcn.1003d7ef
pop ecx
mov dword [0x100705cc], eax
test eax, eax
je 0x1004319f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1003d7ef
pop ecx
mov dword [0x100705c8], eax
mov eax, dword [0x100705c8]
cmp eax, ebx
je 0x100431f7
cmp dword [0x100705cc], ebx
je 0x100431f7
push eax
call fcn.1003d86a
push dword [0x100705cc]
mov esi, eax
call fcn.1003d86a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x100431f7
test edi, edi
je 0x100431f7
call esi
test eax, eax
je 0x100431ee
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x100431ee
test byte [ebp - 0xc], 1
jne 0x100431f7
or dword [ebp + 0x10], 0x200000
jmp 0x10043230
mov eax, dword [0x100705c0]
cmp eax, ebx
je 0x10043230
push eax
call fcn.1003d86a
pop ecx
test eax, eax
je 0x10043230
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10043230
mov eax, dword [0x100705c4]
cmp eax, ebx
je 0x10043230
push eax
call fcn.1003d86a
pop ecx
test eax, eax
je 0x10043230
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100705bc]
call fcn.1003d86a
pop ecx
test eax, eax
je 0x10043250
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10043252
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40110c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x81a030]
jne 0x401116
repz ret
jmp fcn.00401c81

Function at 0x40848e
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00406852
and dword [ebp - 4], 0
cmp dword [0x81c814], 0
mov ebx, eax
jne 0x40853f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4085f0
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4085f0
push eax
call fcn.004067e0
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x81c814], eax
call esi
push eax
call fcn.004067e0
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x81c818], eax
call esi
push eax
call fcn.004067e0
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x81c81c], eax
call esi
push eax
call fcn.004067e0
pop ecx
mov dword [0x81c824], eax
test eax, eax
je 0x40853f
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004067e0
pop ecx
mov dword [0x81c820], eax
mov eax, dword [0x81c820]
cmp eax, ebx
je 0x408597
cmp dword [0x81c824], ebx
je 0x408597
push eax
call fcn.0040685b
push dword [0x81c824]
mov esi, eax
call fcn.0040685b
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x408597
test edi, edi
je 0x408597
call esi
test eax, eax
je 0x40858e
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40858e
test byte [ebp - 0xc], 1
jne 0x408597
or dword [ebp + 0x10], 0x200000
jmp 0x4085d0
mov eax, dword [0x81c818]
cmp eax, ebx
je 0x4085d0
push eax
call fcn.0040685b
pop ecx
test eax, eax
je 0x4085d0
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4085d0
mov eax, dword [0x81c81c]
cmp eax, ebx
je 0x4085d0
push eax
call fcn.0040685b
pop ecx
test eax, eax
je 0x4085d0
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x81c814]
call fcn.0040685b
pop ecx
test eax, eax
je 0x4085f0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4085f2
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40cc50
Capabilities:
Set console window title

Disassembly:
sub esp, 0x428
mov eax, dword [0x81a030]
xor eax, esp
mov dword [esp + 0x424], eax
mov eax, dword [0x2ffa114]
push ebx
mov ebx, dword [0x2ff9f60]
push esi
mov esi, dword [0x81b050]
push edi
mov edi, eax
cmp eax, 0x930
jne 0x40cc91
push 0x818b58
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov eax, dword [0x2ffa114]
mov dword [0x81c9ec], esi
cmp eax, 0x114e
jne 0x40ccbb
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
lea eax, [esp + 0x14]
push eax
push str.yubodumejuwal
call dword [sym.imp.KERNEL32.dll_BuildCommDCBW]
mov eax, dword [0x2ffa114]
cmp eax, 0x2f
jne 0x40ccdd
lea ecx, [esp + 0x10]
push ecx
lea edx, [esp + 0x10]
push edx
push 0
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ReadEventLogW]
call fcn.0040cba0
mov ecx, dword [esp + 0x430]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.0040110c
add esp, 0x428
ret
Function at 0x412210
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x41223d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x41223d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x402da5
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [0x40553c], eax
push 0
push dword [ebp + 8]
push 0
push 0
push 0
push 0x80000000
push 0
push 0x80000000
push 0xcf0000
push str.Magnetick
push str.Charge_Window_App
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x402dec
xor eax, eax
jmp 0x402e03
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_UpdateWindow]
xor eax, eax
inc eax
leave
ret

Function at 0x403222
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x404488
push 0x403384
push eax
mov eax, dword [0x4055b8]
mov dword fs:[0], esp
mov ecx, dword [sym.imp.CRTDLL.dll__fmode_dll]
sub esp, 0x6c
mov dword [ecx], eax
mov edx, dword [0x4055b4]
mov eax, dword [sym.imp.CRTDLL.dll__commode_dll]
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [eax], edx
call fcn.0040337a
lea edx, [ebp - 0x28]
lea eax, [ebp - 0x2c]
push dword [0x4055b0]
push edx
push eax
lea ecx, [ebp - 0x30]
push ecx
call sub.CRTDLL.dll___GetMainArgs
add esp, 0x10
push 0x4040d0
push 0x4040cc
call sub.CRTDLL.dll__initterm
add esp, 8
mov dword [ebp - 4], 0
mov eax, dword [sym.imp.CRTDLL.dll__acmdln_dll]
mov esi, dword [eax]
mov al, byte [esi]
cmp al, 0x22
jne 0x4032bd
mov al, byte [ebp - 0x34]
inc esi
mov al, byte [esi]
test al, al
je 0x4032b5
cmp al, 0x22
jne 0x4032aa
cmp byte [esi], 0x22
jne 0x4032c7
inc esi
jmp 0x4032c7
cmp al, 0x20
jbe 0x4032c7
inc esi
cmp byte [esi], 0x20
ja 0x4032c1
cmp byte [esi], 0
je 0x4032d7
cmp byte [esi], 0x20
ja 0x4032d7
inc esi
cmp byte [esi], 0
jne 0x4032cc
mov dword [ebp - 0x50], 0
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x50], 1
mov eax, 0xa
je 0x4032f7
movzx eax, word [ebp - 0x4c]
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call sub.CRTDLL.dll_exit
jmp 0x403333
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003ebf
Capabilities:
Contain obfuscated stackstrings
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x10003ece
pop dword [ebp - 0x34]
mov eax, 0x10003ece
sub dword [ebp - 0x34], eax
mov dword [ebp - 0x44], 0x6a547434
sub dword [ebp - 0x44], 0x1c022ee9
mov dword [ebp - 0x40], 0xe7519cff
add dword [ebp - 0x40], 0x4ae1af46
mov dword [ebp - 0x3c], 0x6ce72fe
add dword [ebp - 0x3c], 0x457dd130
mov dword [ebp - 0x38], 0x9e1f332e
sub dword [ebp - 0x38], 0x9e1f332e
lea eax, [ebp - 0x44]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x34]
call dword [eax]
mov dword [ebp - 0x44], 0x77703051
sub dword [ebp - 0x44], 0x2fdc6fb
mov dword [ebp - 0x40], 0x18df3d23
add dword [ebp - 0x40], 0x288d2452
mov dword [ebp - 0x3c], 0x9bd130b
add dword [ebp - 0x3c], 0x59b25961
mov dword [ebp - 0x38], 0x2c327c5e
sub dword [ebp - 0x38], 0x2c327c5e
lea ebx, [ebp - 0x44]
push ebx
push eax
mov eax, 0xdc45f461
sub eax, 0xcc45a421
add eax, dword [ebp - 0x34]
call dword [eax]
push 0x40
push 0x1000
push 0x37a3a
push 0
call eax
mov ecx, 0xee02fc5c
sub ecx, 0xee02b056
mov ebx, eax
mov esi, 0x1000b600
add esi, dword [ebp - 0x34]
mov edi, 0xd620a6f2
add edi, 0x9f78de1d
xor dword [ebp - 0x1c], edx
mov edx, dword [esi]
add dword [ebp - 0x2c], 0x1cba02c1
sub edx, edi
sub dword [ebp - 0x24], 0xecf95cee
mov dword [ebx], edx
sub dword [ebp - 0x24], eax
add ebx, 0x5d69c7b7
add ebx, 0xa296384d
add esi, 0x71863ff9
sub esi, 0x71863ff5
loop 0x10003fe0
add eax, 0x122eb
xor ebx, ebx
add ebx, eax
add eax, 0x86f634a0
add eax, 0x7909cb65
mov ecx, 0x82030247
sub ecx, 0x72030247
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
mov ecx, 0x2567661c
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
nop
mov ecx, 0x43325327
test eax, eax
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e06c
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x10007c1f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x10007c2e
pop dword [ebp - 0x20]
mov eax, 0xd798b194
sub eax, 0xc7983566
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x87aea9e0
sub dword [ebp - 0x30], 0x395c6495
mov dword [ebp - 0x2c], 0x313e4f15
sub dword [ebp - 0x2c], 0xff0b02d0
mov dword [ebp - 0x28], 0x218bd9ad
add dword [ebp - 0x28], 0x2ac06a81
mov dword [ebp - 0x24], 0x872a538b
add dword [ebp - 0x24], 0x78d5ac75
lea eax, [ebp - 0x30]
push eax
mov eax, 0x55ea54d5
sub eax, 0x45e9d481
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x2a8b18ca
add dword [ebp - 0x30], 0x49e7508c
mov dword [ebp - 0x2c], 0xdfa2193b
sub dword [ebp - 0x2c], 0x9e35b7c6
mov dword [ebp - 0x28], 0x92d51767
sub dword [ebp - 0x28], 0x2f65aafb
mov dword [ebp - 0x24], 0xa69071c4
add dword [ebp - 0x24], 0x596f8e3c
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0x719b273d
add eax, 0x9e655913
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x3c922
push 0
call eax
mov ecx, 0x5f9d
xor esi, esi
add esi, eax
mov edx, 0x7d23ef3a
add edx, 0x92dd0ac6
add edx, dword [ebp - 0x20]
mov ebx, 0x64dc3ce2
add ebx, 0xaaa4eb8f
mov edi, dword [edx]
mov dword [ebp - 8], 0x55bde13
xor edi, ebx
mov dword [ebp - 0x14], 0x2505457f
mov dword [esi], edi
mov dword [ebp - 0x1c], 0xe073bdeb
add esi, 4
add edx, 0x2b409adc
sub edx, 0x2b409ad8
loop 0x10007d4c
add eax, 0x17147
mov ebx, eax
add eax, 5
mov ecx, 0x7d6ed6bf
sub ecx, 0x6d6ed6bf
add ecx, dword [ebp - 0x20]
call ebx
leave
ret