joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012df1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10012ef0
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10012ed8
mov dword [ebp - 0x18], 0x26f7
cmp dword [ebp - 0x18], 0x82f
jge 0x10012eac
lea eax, [ebp - 8]
push eax
push 0x100080bc
call fcn.1004cd7b
pop ecx
pop ecx
mov eax, dword [ebp - 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 0x1c], 0
je 0x10012eac
mov dword [ebp - 0x48], 0xbe
lea eax, [ebp - 0xc]
push eax
push 0x100080bc
call fcn.1004cd7b
pop ecx
pop ecx
mov eax, dword [ebp - 0xc]
cdq
mov ecx, 0xbe
idiv ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc]
cdq
mov ecx, 0xbe
idiv ecx
mov dword [ebp - 0x24], edx
mov eax, dword [ebp - 0x20]
cmp eax, dword [ebp - 0x24]
jl 0x10012e9a
mov dword [ebp - 0x10], 0x1000816c
jmp 0x10012ea1
mov dword [ebp - 0x10], 0x10008170
push dword [ebp - 0x10]
call fcn.1004d431
pop ecx
jmp 0x10012e43
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
movzx eax, word [eax]
and eax, 0xfff
mov ecx, dword [ebp - 0x3c]
mov dword [ecx], eax
jmp 0x10012eee
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10012eee
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x10012f16
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x44], eax
push dword [ebp - 0x40]
push 0x5d2b
push dword [ebp - 0x44]
push 0x659a
push 0
call fcn.1000a455
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x1001b716
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001b772
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001b752
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001b750
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToLocalFileTime]
jmp 0x1001b770
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1001b770
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x1001b793
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
push 0x197f
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push 0
call fcn.1000f8de
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x1001baa6
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001baca
push 0x1329
push 1
push 0x7ce3
call fcn.1001bb12
add esp, 0xc
jmp 0x1001bb0e
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1001baed
push 0xffc
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x1001bb0e
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1001bb0e
push 0x1b7f
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov esp, ebp
pop ebp
ret

Function at 0x1001be77
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1001bed6
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1001beb6
push 0
push 0
push 0
push 0
push 0
push 0
push 0x14bf
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
jmp 0x1001bed4
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1001bed4
push 0
call dword [sym.imp.USER32.dll_CharUpperW]
jmp 0x1001bef2
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0
call fcn.10012161
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1001cf18
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1001cf7e
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1001cf55
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001cf53
push 0xffc
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x1001cf79
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
push 0
mov ecx, dword [ebp - 0x24]
call fcn.10024a46
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
jmp 0x1001d07c
lea eax, [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1001cfaa
push 0
push 0
push 0x1683
push 0
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
jmp 0x1001d07c
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], 0x17e7
cmp dword [ebp - 0x30], 0x680
jge 0x1001d03f
and dword [ebp - 8], 0
and dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0x100081b0
call fcn.1004cd7b
add esp, 0xc
cmp dword [ebp - 8], 0
je 0x1001cfef
cmp dword [ebp - 0xc], 0
jne 0x1001cffc
cmp dword [ebp - 8], 1
jle 0x1001cffc
push 0x100081b8
call fcn.1004d431
pop ecx
jmp 0x1001d03f
mov eax, dword [ebp - 0xc]
add eax, 0x30
push eax
push 0x100081c4
call fcn.1004d1c8
pop ecx
pop ecx
mov dword [ebp - 0x10], 1
jmp 0x1001d01f
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, dword [ebp - 8]
jge 0x1001d034
push 0x1000818c
call fcn.1004d1c8
pop ecx
jmp 0x1001d018
push 0x10008168
call fcn.1004d1c8
pop ecx
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x1001d07c
push 0x1033
push 0x1a0a
push 0x11b
push 0x201a
push 0x14d6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
mov esp, ebp
pop ebp
ret
Function at 0x1001e7fe
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
push esi
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1001e8e3
mov dword [ebp - 0x1c], 0x1a03
cmp dword [ebp - 0x1c], 0xcbb
jge 0x1001e88b
lea eax, [ebp - 0x10]
push eax
mov ecx, 0x10655530
call fcn.10024266
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x20], 0
je 0x1001e88b
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x24]
push eax
mov ecx, 0x10655530
call fcn.10024266
mov ecx, eax
call fcn.10024266
push fcn.100287b2
mov eax, dword [ebp - 0x24]
cdq
push 3
pop ecx
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x28]
cdq
push 3
pop esi
idiv esi
imul ecx, eax
push ecx
mov ecx, 0x10655478
call fcn.10024597
mov ecx, eax
call fcn.1002456a
jmp 0x1001e82f
lea eax, [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1001e8c7
push 0x63f
push 0
push 0
push 0x10ce
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
jmp 0x1001e8de
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
jmp 0x1001e997
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x1001e947
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0xffffffe8
jmp 0x1001e927
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xfffffff3
jle 0x1001e945
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001e943
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x1001e91c
jmp 0x1001e997
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
jmp 0x1001e975
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0x1c
je 0x1001e997
mov dword [ebp - 0x18], 0xfffa
mov eax, dword [ebp - 0x54]
cmp dword [eax], 0
je 0x1001e98e
jmp 0x1001e997
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
jmp 0x1001e96a
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001ef8d
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001effb
mov eax, dword [ebp + 0x20]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1001efbe
push 0x1b7f
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x1001eff9
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1001eff9
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1303
push 0x4d7
push 0x2298
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x1001f046
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x14], eax
push 0x48e5
push 0
push 0x57c4
push 0x5f92
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 0xbe1
call fcn.1001dff2
add esp, 0x28
mov esp, ebp
pop ebp
ret

Function at 0x100206a9
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100206ff
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x100206e6
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x100206fd
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100206fd
push 0xffc
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x10020721
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
push 0x31ac
push 0x1a8d
push dword [ebp - 0x18]
push 0x4d3
push 0
call fcn.1000aa29
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x1003281c
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x6c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100328a4
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10032866
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
inc eax
inc eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
jmp 0x1003289f
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
cmp dword [eax + 0x18], 0
jbe 0x1003289f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push dword [eax + 0x18]
push 0
call fcn.10030ed6
pop ecx
pop ecx
mov ecx, dword [ebp - 0x48]
mov dword [ecx], eax
jmp 0x100329e6
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x54], eax
mov dword [ebp - 8], 8
mov dword [ebp - 0x4c], 0xffffffff
mov dword [ebp - 0x50], 0
mov dword [ebp - 8], 0xd
jmp 0x100328db
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0xffffffff
je 0x100329c9
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x6c], 0
mov dword [ebp - 0x68], 0
mov dword [ebp - 0x64], 0
mov dword [ebp - 0x60], 0
cmp dword [ebp - 8], 1
jb 0x10032917
mov dword [ebp - 0x18], 1
jmp 0x1003291b
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x4c]
imul eax, dword [ebp - 8]
cmp eax, 0x8e1b8814
ja 0x10032932
mov dword [ebp - 0x1c], 1
jmp 0x10032936
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x18]
cmp eax, dword [ebp - 0x1c]
jg 0x10032947
mov dword [ebp - 0x20], 1
jmp 0x1003294b
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0xc]
cmp dword [ebp - 0x20], eax
jl 0x1003295c
mov dword [ebp - 0x24], 1
jmp 0x10032960
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x24]
je 0x10032971
mov dword [ebp - 0x28], 1
jmp 0x10032975
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0xc], 0
jmp 0x1003298b
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 3
jg 0x100329c4
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100329ac
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x100329c2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x10032984
jmp 0x100328d4
push dword [ebp - 0x54]
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push 0x5cb2
push 0x7aa6
push 0
call fcn.10032220
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x1003fd43
Capabilities:
Start service

Disassembly:
mov eax, 0x1006585e
call fcn.100640f8
sub esp, 0x14
push ebx
push esi
mov dword [ebp - 0x20], 0x211c
cmp dword [ebp - 0x20], 0x2204
push edi
mov dword [ebp - 0x10], esp
jle 0x1003fdc6
xor esi, esi
mov dword [ebp - 0x1c], esi
mov ebx, esi
mov dword [ebp - 0x18], 0xf71
xor edi, edi
xor esi, esi
mov dword [ebp - 0x14], 0x3d60
mov ecx, esi
mov eax, ebx
shl eax, cl
mov ecx, 0x10655478
cdq
push edx
push eax
call fcn.100246a9
add esi, edi
dec dword [ebp - 0x14]
jne 0x1003fd7f
inc edi
cmp edi, 0x38e5
jl 0x1003fd76
dec ebx
dec dword [ebp - 0x18]
jne 0x1003fd74
mov esi, dword [ebp - 0x1c]
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x138
jl 0x1003fd6b
push 0
push 0x15eb
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x1e2d
jge 0x1003fde2
mov edx, 0x100084e4
mov ecx, 0x10655478
call fcn.100287e4
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100411a0
Capabilities:
Compare security identifiers

Disassembly:
cmp byte [ecx], 0
je 0x100411af
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
ret
Function at 0x10060225
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10069758]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.10051258
mov dword [ebp - 0x14], eax
cmp dword [0x106565a0], esi
jne 0x10060318
push 0x800
push esi
push 0x10007f50
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x100602a5
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x100603f8
push esi
push esi
push 0x10007f50
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x100603f8
push 0x10007f68
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x100603f8
push eax
call ebx
push 0x10007f74
push edi
mov dword [0x106565a0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007f84
push edi
mov dword [0x106565a4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007f98
push edi
mov dword [0x106565a8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x106565b0], eax
test eax, eax
je 0x10060315
push 0x10007fb4
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x106565ac], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x1006033d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10060330
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10060352
push 4
pop eax
jmp 0x100603fa
cmp dword [ebp - 0x14], esi
je 0x10060352
push dword [0x106565a0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10060337
mov eax, dword [0x106565ac]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x100603b0
cmp dword [0x106565b0], edi
je 0x100603b0
push eax
call ebx
push dword [0x106565b0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x100603b0
test eax, eax
je 0x100603b0
call ecx
test eax, eax
je 0x100603a5
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x100603a5
test byte [ebp - 8], 1
jne 0x100603b0
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x100603e0
mov eax, dword [0x106565a4]
cmp eax, edi
je 0x100603dd
push eax
call ebx
test eax, eax
je 0x100603dd
call eax
mov esi, eax
test esi, esi
je 0x100603dd
mov eax, dword [0x106565a8]
cmp eax, edi
je 0x100603dd
push eax
call ebx
test eax, eax
je 0x100603dd
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x106565a0]
call ebx
test eax, eax
je 0x100603f8
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x100603fa
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004e8e3
mov esp, ebp
pop ebp
ret
Function at 0x4045c6
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x404607
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x404602
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x4045ec
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x4045f4
cmp edx, ebx
jne 0x404742
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x4045c3
add eax, dword [eax + 4]
jmp 0x4045b0
mov dword [ebp + 0xc], ebx
jmp 0x404612
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x40462a
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x404648
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
invalid

Function at 0x404e11
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and byte [ebp - 0x230], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
invalid
invalid
inc dword [eax]

Function at 0x404e5e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
inc eax
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.00403f31
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
invalid
invalid
wait
cld
invalid
invalid

Function at 0x404ed1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [eax + 0x38fffffc], esp
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
cld
invalid
push dword [esi]
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]

Function at 0x406272
Capabilities:
Get file size
Read file via mapping

Disassembly:
push esi
push edi
mov esi, eax
call fcn.004062de
xor edi, edi
push edi
push edi
push 3
push edi
push 3
push SysReAllocString
push dword [esp + 0x24]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
cmp eax, 0xffffffff
mov dword [esi], eax
je 0x4062d2
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push edi
push edi
push edi
push 2
push edi
push dword [esi]
mov dword [esi + 0x10], eax
call dword [sym.imp.KERNEL32.dll_CreateFileMappingW]
cmp eax, edi
mov dword [esi + 4], eax
je 0x4062d2
push edi
push edi
push edi
push 4
push eax
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
cmp eax, edi
mov dword [esi + 0xc], eax
je 0x4062d2
xor eax, eax
inc eax
jmp 0x4062d9
call fcn.004062de
xor eax, eax
pop edi
pop esi
ret 4
Function at 0x406d06
Capabilities:
Read .ini file

Disassembly:
and word [esi], 0
push 0x41a388
push dword [esp + 0xc]
push esi
push 0x413548
push dword [esp + 0x14]
push 0x41a598
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov eax, esi
ret

Function at 0x406d2b
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.00412df0
and word [ebp - 0x2004], 0
push 0x2000
lea eax, [ebp - 0x2002]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
push 0x41a388
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push 0x413548
push dword [ebp + 8]
push 0x41a598
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x2004], 0
je 0x406d9a
lea eax, [ebp - 0x2004]
push eax
push dword [ebp + 0xc]
call sub.msvcrt.dll_wcscpy
pop ecx
xor eax, eax
pop ecx
inc eax
leave
ret
xor eax, eax
leave
ret

Function at 0x406d9e
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x2004
call fcn.00412df0
and word [ebp - 0x2004], 0
push esi
push edi
push 0x2000
lea eax, [ebp - 0x2002]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
mov edi, 0x41a388
push edi
push 0x1000
lea eax, [ebp - 0x2004]
push eax
push 0x413548
push dword [ebp + 8]
mov esi, 0x41a598
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
cmp word [ebp - 0x2004], 0
je 0x406e05
cmp dword [ebp + 0x10], 0
jne 0x406e05
xor eax, eax
jmp 0x406e13
push edi
push dword [ebp + 0xc]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WritePrivateProfileStringW]
pop edi
pop esi
leave
ret