joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10042e82
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov ebx, eax
and eax, 0x3f
sar ebx, 6
push edi
imul edi, eax, 0x38
push 0xa
mov eax, dword [ebx*4 + 0x1006efa0]
pop edx
mov dword [ebp - 0x14], edx
mov ecx, dword [edi + eax + 0x18]
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10042ec5
cmp word [esi], dx
jne 0x10042ec5
or byte [edi + eax + 0x28], 4
jmp 0x10042eca
and byte [edi + eax + 0x28], 0xfb
lea edx, [esi + ecx*2]
mov eax, esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
cmp eax, edx
jae 0x1004301d
mov dword [ebp - 0xc], 0xd
movzx ecx, word [eax]
mov edx, ecx
mov dword [ebp - 0x10], edx
push 0x1a
pop edx
cmp cx, dx
mov edx, dword [ebp - 8]
je 0x10042ffd
add eax, 2
cmp cx, word [ebp - 0xc]
je 0x10042f0c
mov dword [ebp - 4], eax
mov word [esi], cx
jmp 0x10042f42
cmp eax, edx
jae 0x10042f4e
movzx eax, word [eax]
xor ecx, ecx
cmp ax, word [ebp - 0x14]
mov edx, eax
push 0xa
sete cl
xor eax, eax
lea ecx, [ecx*2 + 2]
add dword [ebp - 4], ecx
pop ecx
cmp dx, cx
mov edx, dword [ebp - 8]
sete al
dec eax
and eax, 3
add eax, ecx
mov word [esi], ax
mov eax, dword [ebp - 4]
add esi, 2
cmp eax, edx
jb 0x10042ee4
jmp 0x1004301d
push 0
lea eax, [ebp - 0x14]
push eax
push 2
lea eax, [ebp - 4]
push eax
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x10042ff9
cmp dword [ebp - 0x14], 0
je 0x10042ff9
mov eax, dword [ebx*4 + 0x1006efa0]
push 0xa
test byte [edi + eax + 0x28], 0x48
je 0x10042fd1
mov dx, word [ebp - 4]
lea eax, [esi + 2]
pop ecx
mov dword [ebp - 0x18], eax
cmp dx, cx
jne 0x10042f9a
mov word [esi], cx
jmp 0x10042fcd
push 0xd
pop eax
mov word [esi], ax
mov eax, dword [ebx*4 + 0x1006efa0]
movzx ecx, dx
shr ecx, 8
push 0xa
mov byte [edi + eax + 0x2a], dl
mov eax, dword [ebx*4 + 0x1006efa0]
mov byte [edi + eax + 0x2b], cl
mov eax, dword [ebx*4 + 0x1006efa0]
pop ecx
mov byte [edi + eax + 0x2c], cl
mov eax, dword [ebp - 0x18]
mov esi, eax
jmp 0x1004301d
pop ebx
cmp word [ebp - 4], bx
jne 0x10042fe2
cmp esi, dword [ebp + 0xc]
jne 0x10042fe2
mov word [esi], bx
jmp 0x1004301a
push 1
push 0xffffffffffffffff
push 0xfffffffffffffffe
push dword [ebp + 8]
call fcn.10043948
add esp, 0x10
cmp word [ebp - 4], bx
je 0x1004301d
push 0xd
jmp 0x10043016
mov ecx, dword [ebx*4 + 0x1006efa0]
mov al, byte [ecx + edi + 0x28]
test al, 0x40
jne 0x10043014
or al, 2
mov byte [ecx + edi + 0x28], al
jmp 0x1004301d
push 0x1a
pop eax
mov word [esi], ax
add esi, 2
sub esi, dword [ebp + 0xc]
and esi, 0xfffffffe
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret
Function at 0x10046e93
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
je 0x10046f30
push ebx
push esi
call fcn.10046e5c
xor ebx, ebx
sub eax, esi
push ebx
push ebx
push ebx
push ebx
sar eax, 1
push eax
push esi
push ebx
push ebx
mov dword [ebp - 8], eax
call fcn.10041865
add esp, 0x24
mov dword [ebp - 4], eax
test eax, eax
jne 0x10046edd
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10046f2f
push edi
push eax
call fcn.1003b20a
mov edi, eax
pop ecx
push ebx
test edi, edi
jne 0x10046efd
call fcn.1003b1d0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
xor eax, eax
jmp 0x10046f2e
push ebx
push dword [ebp - 4]
push edi
push dword [ebp - 8]
push esi
push ebx
push ebx
call fcn.10041865
add esp, 0x20
test eax, eax
jne 0x10046f1c
push edi
call fcn.1003b1d0
jmp 0x10046f24
push ebx
call fcn.1003b1d0
mov ebx, edi
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, ebx
pop edi
pop ebx
pop esi
leave
ret

Function at 0x10046f33
Capabilities:
Query environment variable

Disassembly:
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x10046f44
pop esi
ret
push ebx
push edi
push esi
call fcn.10046e5c
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.1003b20a
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x10046f6c
push ebx
push esi
push edi
call fcn.10020470
add esp, 0xc
push 0
call fcn.1003b1d0
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret

Function at 0x10047330
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.10046f81
Function at 0x1004ded1
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1004de4d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x1004e049
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x1004e049
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x1004dff8
jg 0x1004df2a
test eax, eax
je 0x1004dfee
push 1
push 0x1000
call fcn.1003b173
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x1004df50
mov eax, dword [ebp + 0x14]
push 0xc
pop edi
mov byte [eax + 0x1c], 1
mov dword [eax + 0x18], edi
jmp 0x1004dfe5
push 0x8000
push ebx
call fcn.1004dd7e
mov edi, dword [ebp + 0x14]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x1004df7c
jg 0x1004df77
cmp ecx, 0x1000
jb 0x1004df7c
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.100410e5
add esp, 0x10
cmp eax, 0xffffffff
je 0x1004dfc1
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x1004df77
jl 0x1004dfa8
test ecx, ecx
jne 0x1004df69
push dword [ebp - 0xc]
push ebx
call fcn.1004dd7e
push esi
call fcn.1003b1d0
add esp, 0xc
xor edi, edi
jmp 0x1004e05a
cmp byte [edi + 0x24], 0
je 0x1004dfd8
cmp dword [edi + 0x20], 5
jne 0x1004dfd8
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x1004dfe3
mov edi, dword [edi + 0x18]
jmp 0x1004dfe5
xor edi, edi
push esi
call fcn.1003b1d0
pop ecx
jmp 0x1004e05a
test ecx, ecx
jg 0x1004dfba
jl 0x1004dff8
test eax, eax
jae 0x1004dfba
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.10043948
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x1004e01b
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x1004dfba
jmp 0x1004e052
push ebx
call fcn.1004b451
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x1004dfba
mov esi, dword [ebp + 0x14]
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [esi + 0x24], 1
mov dword [esi + 0x20], eax
pop edi
mov byte [esi + 0x1c], 1
mov dword [esi + 0x18], edi
jmp 0x1004e05a
mov edi, dword [ebp + 0x14]
cmp byte [edi + 0x1c], 0
je 0x1004e057
mov edi, dword [edi + 0x18]
jmp 0x1004e05a
push 0x16
pop edi
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.10043948
add esp, 0x10
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1004ec90
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x1004ecbd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1004ecbd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x4010c0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
mov eax, dword [0x420008]
xor eax, ebp
mov dword [ebp - 4], eax
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push 0x208
push 0
push eax
call fcn.004073a0
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
push str..._birdwp.exe
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x20c]
push eax
call fcn.004036a0
add esp, 4
test eax, eax
jne 0x40113a
or eax, 0xffffffff
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040417c
mov esp, ebp
pop ebp
ret 0x10
push esi
push 0xfffe
call fcn.00404192
mov esi, eax
add esp, 4
test esi, esi
jne 0x401163
lea eax, [esi - 2]
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040417c
mov esp, ebp
pop ebp
ret 0x10
push edi
lea eax, [ebp - 0x20c]
push eax
push str.__s___s
push 0x7fff
push esi
call fcn.00401030
push 0x40
lea eax, [ebp - 0x24c]
mov dword [ebp - 0x250], 0x44
push 0
push eax
call fcn.004073a0
add esp, 0x20
lea eax, [ebp - 0x260]
xorps xmm0, xmm0
movups xmmword [ebp - 0x260], xmm0
push eax
lea eax, [ebp - 0x250]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push esi
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
jne 0x4011e9
push esi
call fcn.0040418d
add esp, 4
mov eax, 0xfffffffd
pop esi
pop edi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040417c
mov esp, ebp
pop ebp
ret 0x10
push dword [ebp - 0x25c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x260]
call esi
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
xor ecx, ebp
pop edi
call fcn.0040417c
mov esp, ebp
pop ebp
ret 0x10

Function at 0x402240
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x420008]
xor eax, ebp
mov dword [ebp - 4], eax
xor eax, eax
mov dword [ebp - 0x60], 0x690051
push ebx
push esi
mov word [ebp - 8], ax
lea esi, [ebp - 0x60]
mov eax, 0x420af8
mov dword [ebp - 0x5c], 0x6f0068
push edi
mov dword [ebp - 0x58], 0x20006f
mov edx, 0x2d
mov dword [ebp - 0x54], 0x360033
sub esi, eax
mov dword [ebp - 0x50], 0x200030
mov dword [ebp - 0x4c], 0x6f0053
mov dword [ebp - 0x48], 0x740066
mov dword [ebp - 0x44], 0x610077
mov dword [ebp - 0x40], 0x650072
mov dword [ebp - 0x3c], 0x280020
mov dword [ebp - 0x38], 0x650042
mov dword [ebp - 0x34], 0x6a0069
mov dword [ebp - 0x30], 0x6e0069
mov dword [ebp - 0x2c], 0x290067
mov dword [ebp - 0x28], 0x430020
mov dword [ebp - 0x24], 0x6d006f
mov dword [ebp - 0x20], 0x610070
mov dword [ebp - 0x1c], 0x79006e
mov dword [ebp - 0x18], 0x4c0020
mov dword [ebp - 0x14], 0x6d0069
mov dword [ebp - 0x10], 0x740069
mov dword [ebp - 0xc], 0x640065
lea ecx, [edx + 0x7fffffd1]
test ecx, ecx
je 0x402320
movzx ecx, word [esi + eax]
test cx, cx
je 0x402320
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x402302
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040417c
mov esp, ebp
pop ebp
ret
Function at 0x402b20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
mov eax, dword [0x420008]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov eax, 0x420d88
mov dword [ebp - 0x5c], 0x680043
lea esi, [ebp - 0x5c]
mov dword [ebp - 0x58], 0x6e0065
push edi
mov dword [ebp - 0x54], 0x640067
mov edx, 0x2c
mov dword [ebp - 0x50], 0x200075
sub esi, eax
mov dword [ebp - 0x4c], 0x690041
mov dword [ebp - 0x48], 0x680073
mov dword [ebp - 0x44], 0x6e0061
mov dword [ebp - 0x40], 0x200067
mov dword [ebp - 0x3c], 0x66004f
mov dword [ebp - 0x38], 0x690066
mov dword [ebp - 0x34], 0x650063
mov dword [ebp - 0x30], 0x540020
mov dword [ebp - 0x2c], 0x630065
mov dword [ebp - 0x28], 0x6e0068
mov dword [ebp - 0x24], 0x6c006f
mov dword [ebp - 0x20], 0x67006f
mov dword [ebp - 0x1c], 0x200079
mov dword [ebp - 0x18], 0x6f0043
mov dword [ebp - 0x14], 0x2c002e
mov dword [ebp - 0x10], 0x4c0020
mov dword [ebp - 0xc], 0x640074
mov dword [ebp - 8], 0x2e
nop dword [eax]
lea ecx, [edx + 0x7fffffd2]
test ecx, ecx
je 0x402bfe
movzx ecx, word [esi + eax]
test cx, cx
je 0x402bfe
mov word [eax], cx
add eax, 2
sub edx, 1
jne 0x402be0
test edx, edx
lea ecx, [eax - 2]
pop edi
cmovne ecx, eax
xor eax, eax
pop esi
pop ebx
mov word [ecx], ax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.0040417c
mov esp, ebp
pop ebp
ret
Function at 0x1002a8d
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0x14]
push edi
mov edi, dword [ebp + 0x10]
lea eax, [ebp + 0x14]
push eax
push edi
lea eax, [ebp + 0x10]
push eax
push 0
push dword [ebp + 0xc]
mov dword [ebp + 0x14], esi
push dword [ebp + 8]
call dword [sym.imp.API_MS_Win_Core_LocalRegistry_L1_1_0.dll_RegQueryValueExW]
test eax, eax
jne 0x1002ae8
mov eax, dword [ebp + 0x14]
cmp eax, 2
jb 0x1002ae3
shr eax, 1
xor ecx, ecx
cmp cx, word [edi + eax*2 - 2]
jne 0x1002ae3
mov eax, dword [ebp + 0x10]
dec eax
je 0x1002adf
dec eax
jne 0x1002ae3
push esi
push edi
call fcn.01002996
test eax, eax
jne 0x1002ae8
xor eax, eax
jmp 0x1002ae8
mov eax, 0x3f7
pop edi
pop esi
pop ebp
ret 0x10

Function at 0x1002d87
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x1003220
call 0x1165000
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x10043c8
push ebx
push esi
push edi
call dword [sym.imp.API_MS_Win_Core_Interlocked_L1_1_0.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x1002b9c
cmp eax, esi
jne 0x1002b8f
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x1002b9f
push 0x3e8
call dword [sym.imp.API_MS_Win_Core_Misc_L1_1_0.dll_Sleep]
jmp 0x1002b76
xor esi, esi
inc esi
mov eax, dword [0x10043c4]
cmp eax, esi
jne 0x1002bb2
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x1002bed
mov eax, dword [0x10043c4]
test eax, eax
jne 0x1002be7
mov dword [0x10043c4], esi
push 0x1001188
push 0x100117c
call fcn.01002af3
pop ecx
pop ecx
test eax, eax
je 0x1002bed
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x1002cb7
mov dword [0x1004078], esi
mov eax, dword [0x10043c4]
cmp eax, esi
jne 0x1002c11
push 0x1001178
push 0x1001170
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x10043c4], 2
cmp dword [ebp - 0x1c], ebx
jne 0x1002c1e
push ebx
push edi
call dword [sym.imp.API_MS_Win_Core_Interlocked_L1_1_0.dll_InterlockedExchange]
cmp dword [0x10043cc], ebx
je 0x1002c3f
push 0x10043cc
call fcn.01002eb9
pop ecx
test eax, eax
je 0x1002c3f
push ebx
push 2
push ebx
call dword [0x10043cc]
push dword [0x1004060]
push dword [0x1004064]
push dword [0x100405c]
call fcn.010018dc
add esp, 0xc
mov dword [0x1004074], eax
cmp dword [0x1004068], ebx
jne 0x1002c9d
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x1004078], ebx
jne 0x1002cab
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x1004074]
call fcn.01002f89
ret
call fcn.01003091
jmp 0x1002b54
Function at 0x4022d0
Capabilities:
Get thread local storage value

Disassembly:
push esi
push ebx
sub esp, 0x14
mov dword [esp], 0x408044
call sym._EnterCriticalSection_4
mov ebx, dword [0x40803c]
sub esp, 4
test ebx, ebx
je 0x40231b
nop
mov eax, dword [ebx]
mov dword [esp], eax
call sym._TlsGetValue_4
sub esp, 4
mov esi, eax
call sym._GetLastError_0
test eax, eax
jne 0x402314
test esi, esi
je 0x402314
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x4022f0
mov dword [esp], 0x408044
call sym._LeaveCriticalSection_4
sub esp, 4
add esp, 0x14
pop ebx
pop esi
ret

Function at 0x402500
Capabilities:
Write file on windows

Disassembly:
push esi
push ebx
sub esp, 0x14
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0x17
mov dword [esp + 4], 1
lea esi, [esp + 0x24]
mov dword [esp], str.Mingw_runtime_failure:_n
lea ebx, [eax + 0x40]
mov dword [esp + 0xc], ebx
call sym._fwrite
mov eax, dword [esp + 0x20]
mov dword [esp + 8], esi
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._vfprintf
call sym._abort
lea esi, [esi]

Function at 0x402550
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push edi
mov edi, ecx
push esi
push ebx
mov ebx, eax
mov esi, edx
sub esp, 0x4c
lea eax, [esp + 0x24]
mov dword [esp + 8], 0x1c
mov dword [esp], ebx
mov dword [esp + 4], eax
call sym._VirtualQuery_12
sub esp, 0xc
test eax, eax
je 0x402628
mov eax, dword [esp + 0x38]
cmp eax, 0x40
je 0x40258e
cmp eax, 4
jne 0x4025b0
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
call sym._memcpy
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov eax, dword [esp + 0x30]
lea ebp, [esp + 0x20]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], ebp
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
mov edx, dword [esp + 0x38]
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], ebx
mov dword [esp + 0x1c], edx
call sym._memcpy
mov edx, dword [esp + 0x1c]
cmp edx, 0x40
je 0x40259e
cmp edx, 4
je 0x40259e
mov eax, dword [esp + 0x20]
mov dword [esp + 0xc], ebp
mov dword [esp + 8], eax
mov eax, dword [esp + 0x30]
mov dword [esp + 4], eax
mov eax, dword [esp + 0x24]
mov dword [esp], eax
call sym._VirtualProtect_16
sub esp, 0x10
add esp, 0x4c
pop ebx
pop esi
pop edi
pop ebp
ret
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1c
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
call fcn.00402500
Function at 0x4010c0
Capabilities:
Get common file path

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x318
mov eax, dword [0x4b22d4]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x105
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x4010f9
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401317
mov esp, ebp
pop ebp
ret
mov ecx, dword [section..data]
push ecx
lea edx, [ebp - 0x10c]
push edx
push 0x491e18
lea eax, [ebp - 0x318]
push 0x20a
push eax
call fcn.00401060
add esp, 0x14
lea ecx, [ebp - 0x318]
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.00401317
mov esp, ebp
pop ebp
ret

Function at 0x401317
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4b22d4]
jne 0x401321
repz ret
jmp fcn.00406741

Function at 0x4117ca
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x4b22d4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00407377
and dword [ebp - 0x14], 0
cmp dword [0x4c13f4], 0
mov dword [ebp - 0x18], eax
jne 0x41187d
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x411925
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x411925
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x4c13f4], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x4c13f8], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x4c13fc], eax
call edi
push eax
call esi
mov dword [0x4c1404], eax
test eax, eax
je 0x41187d
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x4c1400], eax
mov eax, dword [0x4c1400]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x4118d6
cmp dword [0x4c1404], ecx
je 0x4118d6
push eax
call esi
push dword [0x4c1404]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x4118d6
test ebx, ebx
je 0x4118d6
call edi
test eax, eax
je 0x4118cd
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x4118cd
test byte [ebp - 8], 1
jne 0x4118d6
or dword [ebp + 0x10], 0x200000
jmp 0x411909
mov eax, dword [0x4c13f8]
cmp eax, dword [ebp - 0x18]
je 0x411909
push eax
call esi
test eax, eax
je 0x411909
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x411909
mov eax, dword [0x4c13fc]
cmp eax, dword [ebp - 0x18]
je 0x411909
push eax
call esi
test eax, eax
je 0x411909
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x4c13f4]
call esi
test eax, eax
je 0x411925
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x411927
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401317
leave
ret
Function at 0x417d76
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x4b22d4]
xor eax, ebp
mov dword [ebp - 4], eax
and dword [ebp - 0x1c], 0
push edi
xor eax, eax
and dword [ebp - 0x14], eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov eax, dword [ebp + 8]
mov dword [0x5bc1c0], eax
pop edi
test eax, eax
je 0x417db3
call fcn.00419a8b
mov dword [0x5bc1c4], eax
jmp 0x417deb
call fcn.00419a8b
sub eax, dword [0x5bc1c4]
cmp eax, 0xde
jb 0x417df4
jmp 0x417deb
push 1
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
mov ecx, 0x8000
test cx, ax
je 0x417de3
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_GetCursorPos]
push 0x16
call dword [sym.imp.KERNEL32.dll_Sleep]
cmp dword [0x5bc1c0], 0
je 0x417dc7
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, eax
call fcn.00401317
leave
ret 4
Function at 0x41ad99
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x27c
mov eax, dword [0x4b22d4]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x103
xor esi, esi
lea eax, [ebp - 0x10f]
push esi
push eax
mov byte [ebp - 0x110], 0
call fcn.00401f80
add esp, 0xc
push 0x13c
lea eax, [ebp - 0x26c]
push esi
push eax
mov dword [ebp - 0x270], esi
call fcn.00401f80
xor eax, eax
mov word [ebp - 0x130], ax
lea edi, [ebp - 0x12e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
xor eax, eax
mov word [ebp - 0x120], ax
lea edi, [ebp - 0x11e]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
add esp, 0xc
stosw word es:[edi], ax
call fcn.00419a8b
sub eax, dword [0x5bc140]
cmp eax, 0x493e0
jae 0x41ae29
xor eax, eax
jmp 0x41af5e
call fcn.00419a8b
mov dword [0x5bc140], eax
call fcn.0041a71b
test eax, eax
je 0x41ae22
push 0x5bb910
mov ecx, 0x104
lea eax, [ebp - 0x110]
call fcn.00435b27
pop ecx
call fcn.00435996
push str.PAULATempTimeDetectionFile
push 0x496334
push eax
call fcn.00436376
add esp, 0xc
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov dword [ebp - 0x278], eax
cmp eax, 0xffffffff
je 0x41ae22
mov ebx, dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp + 8]
push eax
call ebx
mov dword [ebp - 0x274], esi
lea eax, [ebp - 0x25c]
push eax
lea eax, [ebp - 0x26c]
push eax
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
test eax, eax
lea eax, [ebp - 0x120]
push eax
lea eax, [ebp - 0x26c]
jg 0x41aecd
lea eax, [ebp - 0x25c]
push eax
call ebx
sub esp, 0x10
mov edi, esp
lea esi, [ebp - 0x120]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
sub esp, 0x10
lea esi, [ebp - 0x130]
mov edi, esp
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
call fcn.0041acdf
add esp, 0x20
cmp eax, 0xdbba0
jle 0x41af31
lea eax, [ebp - 0x110]
call fcn.00435996
lea eax, [ebp - 0x244]
push eax
mov eax, 0x104
lea esi, [ebp - 0x110]
call fcn.00436c1c
pop ecx
mov eax, esi
call fcn.00474fee
test eax, eax
je 0x41af31
inc dword [ebp - 0x274]
lea eax, [ebp - 0x270]
push eax
push dword [ebp - 0x278]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x41aea2
push dword [ebp - 0x278]
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x274]
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00401317
leave
ret