joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1101dec8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x7c
mov eax, dword [0x1302572c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov esi, dword [eax]
mov dword [ebp - 0x24], eax
call fcn.1101de8b
push esi
call fcn.1101e1f0
mov esi, eax
push edi
mov dword [ebp - 0x14], esi
call fcn.1101e1f0
push 0x58
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x7c]
push ebx
push eax
call fcn.110215c0
lea eax, [ebp - 0x7c]
push eax
push 5
push esi
call fcn.1101dd75
mov edi, eax
add esp, 0x20
cmp edi, 5
jb 0x1101e066
push edi
push esi
call fcn.1101e2d4
push dword [ebp - 0x70]
push dword [ebp - 0x74]
push dword [ebp - 0x78]
push dword [ebp - 0x7c]
push esi
call fcn.1101e460
mov ebx, eax
add esp, 0x1c
test ebx, ebx
je 0x1101e061
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [ebp - 0xc], 0
lea ecx, [ebp - 0xc]
and dword [ebp - 8], 0
push ecx
push 0x40
push edi
push esi
push eax
mov dword [ebp - 0x10], eax
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1101e046
lea eax, [ebp - 8]
push eax
push 0x40
push 0x6c
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1101e029
xor edx, edx
lea ecx, [ebx + 0x2c]
test edi, edi
je 0x1101dfaf
sub esi, ecx
mov al, byte [esi + ecx]
mov byte [ecx], al
mov byte [ebx + edx + 0x4c], al
inc edx
inc ecx
cmp edx, edi
jb 0x1101df9a
mov esi, dword [ebp - 0x14]
lea ecx, [ebx + 0x2c]
lea eax, [edi + esi]
push eax
lea eax, [ecx + edi]
push eax
call fcn.1101de42
mov edx, dword [ebp - 0x18]
mov eax, edx
pop ecx
pop ecx
mov ecx, esi
sub eax, esi
sub ecx, edx
cmp edx, esi
push edx
cmovb eax, ecx
cmp eax, 0x7fff0000
jbe 0x1101dff5
lea esi, [ebx + 0xc]
push esi
call fcn.1101de42
pop ecx
pop ecx
sub eax, ebx
sub eax, 0xc
push eax
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
push esi
mov esi, dword [ebp - 0x14]
push esi
call fcn.1101de42
mov eax, dword [ebp - 0x18]
pop ecx
pop ecx
mov dword [ebx + 8], eax
lea eax, [ebx + 0x2c]
push edi
push eax
push dword [ebp - 0x10]
mov dword [ebx + 4], edi
mov dword [ebx], esi
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push 0x6c
push ebx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
push edi
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 0xc]
push edi
push esi
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
cmp dword [ebx], 0
je 0x1101e055
mov ecx, dword [ebp - 0x24]
lea eax, [ebx + 0x2c]
mov dword [ecx], eax
jmp 0x1101e061
push 1
push ebx
call fcn.1101e567
pop ecx
pop ecx
xor ebx, ebx
call fcn.1101e172
push 0x13027990
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
xor eax, eax
test ebx, ebx
pop edi
setne al
xor ecx, ebp
pop esi
pop ebx
call fcn.1101e5a4
mov esp, ebp
pop ebp
ret
Function at 0x1101e089
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x1302572c]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 0xc], ebx
xor edi, edi
call fcn.1101de8b
xor esi, esi
mov eax, dword [esi*4 + 0x130279a8]
test eax, eax
je 0x1101e0c1
add eax, 0x2c
cmp eax, dword [ebx]
je 0x1101e166
inc esi
cmp esi, 0x40
jb 0x1101e0ab
xor esi, esi
test esi, esi
je 0x1101e148
push dword [esi + 4]
push dword [esi]
call fcn.1101e2d4
pop ecx
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
and dword [ebp - 8], edi
mov ebx, eax
lea eax, [ebp - 8]
push eax
push 0x40
push dword [esi + 4]
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
test eax, eax
je 0x1101e143
mov edx, dword [esi]
xor ecx, ecx
cmp dword [esi + 4], ecx
jbe 0x1101e110
mov al, byte [esi + ecx + 0x4c]
mov byte [ecx + edx], al
inc ecx
cmp ecx, dword [esi + 4]
jb 0x1101e103
push dword [esi + 4]
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
lea eax, [ebp - 8]
push eax
push dword [ebp - 8]
push dword [esi + 4]
push dword [esi]
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
mov ecx, dword [ebp - 0xc]
xor edi, edi
mov eax, dword [esi]
inc edi
push 0
push esi
mov dword [ecx], eax
call fcn.1101e567
pop ecx
pop ecx
call fcn.1101e172
push 0x13027990
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1101e5a4
mov esp, ebp
pop ebp
ret
mov esi, dword [esi*4 + 0x130279a8]
jmp 0x1101e0c9

Function at 0x1101e172
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_GetCurrentThread]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
push 0xf
mov dword [ebp - 4], eax
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
xor esi, esi
cmp dword [0x13027ab0], esi
jbe 0x1101e1c4
mov eax, dword [0x13027aac]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [0x13027aac]
push dword [eax + esi*4]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
inc esi
cmp esi, dword [0x13027ab0]
jb 0x1101e19f
push dword [0x13027aac]
call fcn.110282d5
and dword [0x13027aac], 0
and dword [0x13027ab0], 0
pop ecx
push dword [ebp - 4]
call edi
push eax
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1101e228
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d0
mov eax, dword [0x1302572c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push eax
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
cmp esi, 0xffffffff
je 0x1101e2c2
test esi, esi
je 0x1101e2c2
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp eax, 0xffffffff
je 0x1101e2b9
mov dword [ebp - 0x2d0], 0x10001
xor ebx, ebx
jmp 0x1101e2a5
mov eax, dword [ebp + 0xc]
cmp dword [ebp - 0x218], eax
jb 0x1101e2c2
add eax, dword [ebp + 0x10]
cmp dword [ebp - 0x218], eax
jae 0x1101e2c2
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
cmp ebx, 3
jge 0x1101e2b9
push 0x64
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call dword [sym.imp.KERNEL32.dll_SuspendThread]
inc ebx
lea eax, [ebp - 0x2d0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
jne 0x1101e273
jmp 0x1101e2c2
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor esi, esi
mov ecx, dword [ebp - 4]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.1101e5a4
mov esp, ebp
pop ebp
ret

Function at 0x1101e460
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov eax, dword [0x1302572c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
push ebx
xor ebx, ebx
mov dword [ebp - 0x48], eax
cmp dword [0x13027aa8], 0x40
jae 0x1101e556
push esi
lea esi, [edx + ecx]
add ecx, dword [ebp + 0x14]
push edi
cmp ecx, 0x80000000
lea edi, [ebp - 0x44]
push 9
lea eax, [ecx + 0x7ff80000]
mov edx, 0xfff80000
cmovb edx, eax
xor eax, eax
pop ecx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x48], edx
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
xor eax, eax
lea edi, [esi - 0x7fff0000]
inc eax
cmp esi, 0x80000000
mov esi, dword [ebp - 0x48]
cmovb edi, eax
cmp edi, esi
jae 0x1101e554
push 0x1c
lea eax, [ebp - 0x20]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1101e52f
cmp dword [ebp - 0x10], 0x10000
jne 0x1101e523
mov eax, dword [ebp - 0x14]
cmp eax, 0x6c
jb 0x1101e526
mov ecx, dword [ebp - 0x28]
cmp eax, ecx
jb 0x1101e526
lea eax, [ecx - 1]
xor edx, edx
add eax, edi
div ecx
push 0x20
imul eax, ecx
push 0x3000
push 0x6c
push eax
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov ebx, eax
test ebx, ebx
jne 0x1101e533
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x20]
add edi, eax
cmp edi, esi
jb 0x1101e4d8
test ebx, ebx
je 0x1101e554
xor eax, eax
cmp dword [eax*4 + 0x130279a8], 0
je 0x1101e547
inc eax
cmp eax, 0x40
jb 0x1101e535
jmp 0x1101e554
inc dword [0x13027aa8]
mov dword [eax*4 + 0x130279a8], ebx
pop edi
pop esi
mov ecx, dword [ebp - 4]
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.1101e5a4
mov esp, ebp
pop ebp
ret

Function at 0x1102b6c5
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.1102b5ca
Function at 0x11036215
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
pop eax
nop
nop
nop
nop
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x433030
nop
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
popal
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff18
push ebx
push esi
push edi
call sub.kernel32.dll_GetTickCount
push eax
call fcn.00402876
lea esi, [ebp - 0x28]
lea edi, [ebp - 0x14]
call fcn.00402454
call fcn.00402646
call fcn.0040247c
or eax, eax
je 0x40101d
call fcn.004023ac
or eax, eax
je 0x4010e2
mov ebx, eax
call fcn.00402377
lea eax, [ebp - 0xb8]
push eax
call fcn.0040234f
lea eax, [ebp - 0xc8]
push eax
lea eax, [ebp - 0xb8]
push eax
call fcn.00402292
push eax
push esi
push str._CD_Kod:__s_r_n
call dword [sym.imp.msvcrt.dll_printf]
add esp, 8
pop eax
push eax
push 0x404520
call dword [sym.imp.msvcrt.dll_printf]
add esp, 8
lea edi, [ebp - 0xd8]
lea esi, [ebp - 0xc8]
call fcn.0040223e
push 5
push edi
lea eax, [ebp - 0xe0]
push eax
call fcn.00402217
push 5
push edi
lea eax, [ebp - 0xe8]
push eax
call fcn.004021dc
lea esi, [ebp - 0xe0]
lea edi, [ebp - 0xe8]
call fcn.004010e7
push eax
push 0x404534
call dword [sym.imp.msvcrt.dll_printf]
add esp, 8
push ebx
call sub.kernel32.dll_FreeLibrary
push 0x404111
call sub.kernel32.dll_DeleteFileA
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4023ac
Capabilities:
Extract resource via kernel32 functions
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
push esi
push edi
push 0xa
push 0x64
push 0
call sub.kernel32.dll_FindResourceA
or eax, eax
je 0x40244f
mov dword [ebp - 4], eax
push eax
push 0
call sub.kernel32.dll_SizeofResource
mov dword [ebp - 8], eax
push dword [ebp - 4]
push 0
call sub.kernel32.dll_LoadResource
or eax, eax
je 0x40244f
mov dword [ebp - 0xc], eax
push 0x404111
push 0x400
call sub.kernel32.dll_GetTempPathA
jmp 0x402400
push 0x4023f8
push 0x404111
call fcn.00402770
push 0
push 0x404111
call sub.kernel32.dll__lcreat
cmp eax, 0xffffffff
jne 0x402424
xor eax, eax
jmp 0x40244f
mov dword [ebp - 0x10], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call sub.kernel32.dll__hwrite
push dword [ebp - 0xc]
call sub.kernel32.dll_FreeResource
push dword [ebp - 0x10]
call sub.kernel32.dll__lclose
push 0x404111
call sub.kernel32.dll_LoadLibraryA
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4027c4
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push 0xfffffffffffffff5
call sub.kernel32.dll_GetStdHandle
mov dword [ebp - 4], eax
push dword [ebp + 8]
call fcn.004028e0
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp - 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
mov eax, dword [ebp - 8]
leave
ret 4
Function at 0x401cb2
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], esp
push 0x40
push 0x1000
push dword [ebp + 8]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x401cec
push 6
call fcn.00462d6c
add esp, 4
jmp 0x401cf1
mov esp, ebp
pop ebp
ret 4
Function at 0x402f7e
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
xor ecx, ecx
lea eax, [ebp - 4]
mov ebx, eax
inc ecx
push ecx
push ebx
mov dword [ebx], ecx
cmp ecx, 0xa
jg 0x40306f
fild dword [ebp - 4]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fadd qword [0x486bb5]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
call fcn.0040102c
push 0x80000101
push 0
push eax
push 1
mov ebx, 0x140
call fcn.00463af0
add esp, 0x10
mov dword [ebp - 0x1c], eax
push 0x486bbd
push dword [ebp - 0x1c]
mov ecx, 2
call fcn.00402f22
add esp, 8
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x403009
push ebx
call fcn.00462d66
add esp, 4
mov eax, dword [ebp - 0x20]
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x40301d
push ebx
call fcn.00462d66
add esp, 4
pop eax
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
call fcn.004031df
test eax, eax
je 0x403068
mov eax, dword [ebp - 8]
test eax, eax
je 0x40304e
push eax
mov ebx, eax
call fcn.004019b8
inc eax
push eax
call fcn.00462d60
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
push eax
mov ebx, dword [0x4ddbd3]
test ebx, ebx
je 0x403062
push ebx
call fcn.00462d66
add esp, 4
pop eax
mov dword [0x4ddbd3], eax
pop ebx
pop ecx
jmp 0x402f9c
add esp, 8
mov eax, 0x486bc9
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0xc]
push eax
call fcn.0040342d
mov dword [ebp - 0x10], eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x403096
push ebx
call fcn.00462d66
add esp, 4
push 0x486bdf
push dword [ebp - 0x10]
mov ecx, 2
call fcn.00402f22
add esp, 8
mov dword [ebp - 0x14], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4030be
push ebx
call fcn.00462d66
add esp, 4
push 1
push 1
mov dword [ebp - 0x18], 0
push 0
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0
push 0
push dword [ebp - 0x1c]
mov dword [ebp - 0x20], 0
push 0
lea eax, [ebp - 0x20]
push eax
push 1
push 0x280
push 1
push 0x35c
mov dword [ebp - 0x24], 0
push 0
push dword [ebp - 0x24]
mov dword [ebp - 0x28], 0
push 0
push dword [ebp - 0x28]
push 1
lea eax, [ebp - 0x14]
push eax
mov dword [ebp - 0x2c], 0
push 0
push dword [ebp - 0x2c]
call fcn.004035f0
mov dword [ebp - 0x30], eax
mov ebx, dword [ebp - 0x14]
test ebx, ebx
je 0x40313a
push ebx
call fcn.00462d66
add esp, 4
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x40314a
push ebx
call fcn.00462d66
add esp, 4
mov eax, dword [ebp - 0x30]
mov dword [0x4ddbd7], eax
call fcn.00403c7d
push OleUIBusyA
push 0
push 0x414870
push 1
mov ebx, 0x9dc
call fcn.00463b10
add esp, 0x10
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
mov eax, 0
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x14]
push eax
push 0
push 0
push dword [ebp - 0xc]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x4031ba
push 6
call fcn.00462d6c
add esp, 4
call fcn.004138dd
mov eax, 0
jmp 0x4031c9
push eax
mov ebx, dword [ebp - 8]
test ebx, ebx
je 0x4031da
push ebx
call fcn.00462d66
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret
Function at 0x413842
Capabilities:
Copy file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], esp
push 0
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
call dword [sym.imp.KERNEL32.dll_CopyFileA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x413879
push 6
call fcn.00462d6c
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x41388d
mov esp, ebp
pop ebp
ret 8

Function at 0x42b5ae
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
push 0x200
call fcn.00401cb2
mov dword [ebp - 4], eax
mov dword [ebp - 0xc], esp
push 0x200
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetWindowTextW]
nop
nop
nop
nop
cmp dword [ebp - 0xc], esp
je 0x42b5fc
push 6
call fcn.00462d6c
add esp, 4
mov dword [ebp - 8], eax
fild dword [ebp - 8]
fstp qword [ebp - 0x10]
fld qword [ebp - 0x10]
fmul qword [0x486b4c]
fstp qword [ebp - 0x18]
fld qword [ebp - 0x18]
call fcn.0040102c
push 0x80000301
push 0
push eax
push 0x80000301
push 0
push dword [ebp - 4]
push 2
mov ebx, 0x910
call fcn.00463440
add esp, 0x1c
mov dword [ebp - 0x1c], eax
push 0x4da4c4
push dword [ebp - 0x1c]
mov ecx, 2
call fcn.00402333
add esp, 8
mov dword [ebp - 0x20], eax
mov ebx, dword [ebp - 0x1c]
test ebx, ebx
je 0x42b668
push ebx
call fcn.00462d66
add esp, 4
mov dword [ebp - 0x24], 0
push 0
push dword [ebp - 0x24]
lea eax, [ebp - 0x20]
push eax
call fcn.004020ac
mov dword [ebp - 0x28], eax
mov ebx, dword [ebp - 0x20]
test ebx, ebx
je 0x42b690
push ebx
call fcn.00462d66
add esp, 4
mov eax, dword [ebp - 0x28]
jmp 0x42b698
mov esp, ebp
pop ebp
ret 4
Function at 0x44233a
Capabilities:
Log keystrokes via input method manager

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esp
push dword [ebp + 8]
call dword [sym.imp.IMM32.dll_ImmGetContext]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x44237a
push 6
call fcn.00462d6c
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x4424ab
push 0x80000101
push 0
push 0
push 1
mov ebx, 0x140
call fcn.00463af0
add esp, 0x10
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], esp
push 0
push dword [ebp - 0x10]
push 0x800
push dword [ebp - 4]
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringA]
nop
nop
nop
nop
cmp dword [ebp - 0x14], esp
je 0x4423d7
push 6
call fcn.00462d6c
add esp, 4
mov dword [ebp - 0x18], eax
mov ebx, dword [ebp - 0x10]
test ebx, ebx
je 0x4423ea
push ebx
call fcn.00462d66
add esp, 4
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
push 0x80000301
push 0
push dword [ebp - 8]
push 1
mov ebx, 0x184
call fcn.00463800
add esp, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x442423
push ebx
call fcn.00462d66
add esp, 4
pop eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], esp
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0x800
push dword [ebp - 4]
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x442454
push 6
call fcn.00462d6c
add esp, 4
mov dword [ebp - 0x10], esp
push dword [ebp - 4]
push dword [ebp + 8]
call dword [sym.imp.IMM32.dll_ImmReleaseContext]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x442479
push 6
call fcn.00462d6c
add esp, 4
lea eax, [ebp - 0xc]
push eax
call fcn.004424cd
test eax, eax
je 0x4424ab
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x4424a6
push eax
mov ebx, eax
call fcn.004019b8
inc eax
push eax
call fcn.00462d60
pop ecx
pop esi
mov edi, eax
rep movsb byte es:[edi], byte [esi]
jmp 0x4424b5
mov eax, 0x486b77
jmp 0x4424b5
push eax
mov ebx, dword [ebp - 0xc]
test ebx, ebx
je 0x4424c6
push ebx
call fcn.00462d66
add esp, 4
pop eax
mov esp, ebp
pop ebp
ret 4

Function at 0x44f881
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0x20], 0
jne 0x44f89b
mov dword [ebp + 0x1c], 1
cmp dword [ebp + 0x18], 0
jne 0x44f8c3
mov eax, 0x4dc8e0
push eax
mov ebx, dword [ebp + 0x14]
mov ebx, dword [ebx]
test ebx, ebx
je 0x44f8bd
push ebx
call fcn.00462d66
add esp, 4
pop eax
mov ebx, dword [ebp + 0x14]
mov dword [ebx], eax
mov dword [ebp - 4], esp
push dword [ebp + 0x1c]
push 0x486b77
mov ebx, dword [ebp + 0xc]
push dword [ebx]
mov ebx, dword [ebp + 8]
push dword [ebx]
mov ebx, dword [ebp + 0x14]
push dword [ebx]
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
nop
nop
nop
nop
cmp dword [ebp - 4], esp
je 0x44f8fe
push 6
call fcn.00462d6c
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x20
mov eax, 0
setg al
jmp 0x44f912
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x463d60
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
push esi
mov esi, dword [esp + 0x14]
test esi, esi
jne 0x463d73
xor eax, eax
pop esi
add esp, 8
ret
push esi
call fcn.00466fa0
add esp, 4
test eax, eax
jne 0x463d85
pop esi
add esp, 8
ret
mov eax, dword [esi]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push edi
mov dword [esp + 0x10], 0
jne 0x463dfc
mov eax, dword [esp + 0x1c]
mov edi, dword [esi + 4]
cmp eax, ebx
mov dword [esp + 0x10], ebx
jle 0x463e2e
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x463de8
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x463db8
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret
pop edi
mov dword [esp + 0xc], 0
mov eax, dword [esp + 0xc]
pop ebp
pop ebx
pop esi
add esp, 8
ret
cmp eax, 2
jne 0x463e2e
mov eax, dword [esp + 0x1c]
mov esi, dword [esi + 4]
cmp eax, ebx
mov dword [esp + 0x10], ebx
jle 0x463e2e
lea edi, [esp + 0x2c]
lea ebx, [eax - 1]
mov eax, dword [edi]
mov edx, dword [esi]
mov ecx, dword [eax + 4]
add eax, 8
push ecx
push eax
mov ecx, esi
call dword [edx + 0x24]
add edi, 0xc
dec ebx
jne 0x463e17
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 8
ret

Function at 0x463e70
Capabilities:
Encode data using xor

Disassembly:
mov edx, dword [esp + 4]
mov eax, dword [esp + 8]
cmp edx, 1
jle 0x463e8e
push esi
lea ecx, [esp + 0x18]
dec edx
mov esi, dword [ecx]
add ecx, 0xc
xor eax, esi
dec edx
jne 0x463e83
pop esi
ret
Function at 0x463f50
Capabilities:
Enumerate files on windows

Disassembly:
sub esp, 0x144
push ebx
mov ebx, dword [esp + 0x14c]
push ebp
mov ebp, dword [esp + 0x15c]
push esi
push edi
mov esi, dword [ebp]
mov dword [esp + 0x10], 0
test ebx, ebx
je 0x463fdb
mov edi, ebx
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x463fdb
test esi, esi
je 0x463f95
cmp esi, 0xffffffff
je 0x463f95
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
lea eax, [esp + 0x14]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov esi, eax
cmp esi, 0xffffffff
mov dword [ebp], esi
je 0x464021
mov eax, dword [esp + 0x160]
test eax, eax
je 0x463fc4
mov ecx, dword [esp + 0x14]
and ecx, 0x10
cmp cl, 0x10
je 0x463fdb
jmp 0x463fd3
mov edx, dword [esp + 0x15c]
mov eax, dword [esp + 0x14]
test edx, eax
je 0x463fdb
mov dword [esp + 0x10], 1
test esi, esi
je 0x464021
cmp esi, 0xffffffff
je 0x464021
mov eax, dword [esp + 0x10]
test eax, eax
jne 0x464058
mov eax, dword [esp + 0x160]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
lea eax, [esp + 0x14]
push eax
push esi
je 0x46402e
call edi
test eax, eax
je 0x464021
mov ecx, dword [esp + 0x14]
and ecx, 0x10
cmp cl, 0x10
jne 0x464058
lea edx, [esp + 0x14]
push edx
push esi
call edi
test eax, eax
jne 0x464009
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x144
ret
call edi
test eax, eax
je 0x464021
mov ebx, dword [esp + 0x15c]
test dword [esp + 0x14], ebx
jne 0x464058
lea ecx, [esp + 0x14]
push ecx
push esi
call edi
test eax, eax
jne 0x46403b
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x144
ret
lea edi, [esp + 0x40]
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
push ecx
call fcn.00463260
mov edx, eax
lea edi, [esp + 0x44]
or ecx, 0xffffffff
xor eax, eax
add esp, 4
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
mov eax, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x144
ret