joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100261b0
Capabilities:
Check mutex on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10071a82
mov eax, dword fs:[0]
push eax
sub esp, 0x44
mov eax, dword [0x100d9008]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x50], edx
mov ecx, 0x100e11d2
call fcn.10063695
push ecx
xorps xmm0, xmm0
lea ecx, [ebp - 0x48]
push 1
push str.29A83C8C_8395_47F1_9F05_9F112227DBE8
xor esi, esi
movups xmmword [ebp - 0x48], xmm0
movups xmmword [ebp - 0x38], xmm0
call fcn.100483b0
mov dword [ebp - 4], esi
mov edi, dword [sym.imp.KERNEL32.dll_CloseHandle]
nop dword [eax]
mov eax, dword [ebp - 0x50]
cmp byte [eax], 0
jne 0x10026261
push str.90A3941A_7445_4D9A_8FA5_A55EB9290053
push 0
push 0x100000
call dword [sym.imp.KERNEL32.dll_OpenMutexW]
test eax, eax
je 0x10026233
push eax
call edi
jmp 0x10026238
call fcn.10026050
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x10026253
push 0x7d0
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
test eax, eax
je 0x10026374
add esi, 0x7d0
cmp esi, 0xea60
jb 0x10026210
cmp dword [0x100dcba8], 0
je 0x1002631a
push 0
mov ecx, 0x100dcba4
call fcn.1001d620
mov eax, dword [0x100dcba8]
cmp byte [eax + 0x54], 0
je 0x1002631a
cmp dword [eax + 0x58], 1
jb 0x1002631a
mov al, byte [eax + 0x5c]
mov byte [ebp - 0x49], al
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 0
mov byte [ebp - 4], 4
xor eax, eax
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x14], 7
mov word [ebp - 0x28], ax
mov byte [ebp - 4], 5
lea ecx, [ebp - 0x28]
push 0x1b
push str.LeakFix.exe_Start_up_Failed
call fcn.1000f150
push 0x45
push str.RC::RCLeakProcessStarter::MakeSureLeakProcessRunning
push str.d:jenkinsworkspacepc_2345mpcsafe_build_rhino_safe_srcleakfixleakfixlib_src_rcleakprocessstarter.cpp
lea eax, [ebp - 0x28]
mov ecx, 0x100dcba4
push eax
push 1
call fcn.1001e720
cmp byte [ebp - 0x49], 0
je 0x10026306
lea eax, [ebp - 0x28]
mov ecx, 0x100dcba4
push eax
call fcn.1001ea90
mov byte [ebp - 4], 6
lea ecx, [ebp - 0x28]
call fcn.1000f080
mov byte [ebp - 4], 0
mov byte [ebp - 4], 0
mov byte [ebp - 0x49], 0
mov dword [ebp - 4], 0xb
mov eax, dword [ebp - 0x48]
test eax, eax
je 0x10026336
push eax
call edi
mov dword [ebp - 0x48], 0
mov byte [ebp - 4], 0xa
lea eax, [ebp - 0x40]
mov dword [ebp - 0x50], eax
mov byte [ebp - 4], 0xc
mov ecx, eax
call fcn.1000f080
mov byte [ebp - 4], 0xa
mov dword [ebp - 4], 0xffffffff
mov al, byte [ebp - 0x49]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1006161e
mov esp, ebp
pop ebp
ret
mov byte [ebp - 0x49], 1
jmp 0x1002631e
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x431072
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x20d01cca
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x431060
nop
nop
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4310d2
nop
nop
nop
nop
mov ebx, 0x42f3f8
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
nop
mov esi, 0x1237096d
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4310c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x401219
Function at 0x4027b6
Capabilities:
Get common file path

Disassembly:
sub esp, 0x400
push esi
push edi
xor esi, esi
xor edi, edi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
cmp edi, 0x9f60fc3
jg 0x4027dc
inc edi
cmp edi, 0x1e70dee2
jl 0x4027c2
cmp dword [0x4540fc], 0x400
jne 0x40280d
push esi
call fcn.00402a59
push esi
push esi
call fcn.00402a93
pop ecx
mov eax, esp
mov dword [eax], esi
mov dword [eax + 4], esi
call fcn.00402930
fstp st(0)
push esi
call fcn.00402c23
add esp, 0xc
xor edi, edi
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp edi, 0x58bc6e
jg 0x40282c
inc edi
cmp edi, 0xe52f
jl 0x40280f
mov eax, dword [0x44c0c4]
mov dword [0x4540fc], eax
call fcn.0040252b
mov edi, 0x3078f
cmp dword [0x4540fc], 0x51f
jne 0x402858
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
dec edi
jne 0x402840
pop edi
xor eax, eax
pop esi
add esp, 0x400
ret 0x10

Function at 0x406631
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x44b340]
jne 0x40663b
repz ret
jmp fcn.0040887c
Function at 0x407123
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x44b340]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00404013
and dword [ebp - 0x14], 0
cmp dword [0x44dd0c], 0
mov dword [ebp - 0x18], eax
jne 0x4071d6
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40727e
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40727e
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x44dd0c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x44dd10], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x44dd14], eax
call edi
push eax
call esi
mov dword [0x44dd1c], eax
test eax, eax
je 0x4071d6
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x44dd18], eax
mov eax, dword [0x44dd18]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40722f
cmp dword [0x44dd1c], ecx
je 0x40722f
push eax
call esi
push dword [0x44dd1c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40722f
test ebx, ebx
je 0x40722f
call edi
test eax, eax
je 0x407226
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x407226
test byte [ebp - 8], 1
jne 0x40722f
or dword [ebp + 0x10], 0x200000
jmp 0x407262
mov eax, dword [0x44dd10]
cmp eax, dword [ebp - 0x18]
je 0x407262
push eax
call esi
test eax, eax
je 0x407262
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x407262
mov eax, dword [0x44dd14]
cmp eax, dword [ebp - 0x18]
je 0x407262
push eax
call esi
test eax, eax
je 0x407262
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x44dd0c]
call esi
test eax, eax
je 0x40727e
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x407280
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00406631
leave
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x103ae7f0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x103ae7fa
pushal
call 0x103ae800
pop ebp
sub ebp, 0x10
sub ebp, 0x3ae7f0
mov al, byte [esp + 0x28]
cmp al, 1
je 0x103ae824
popal
xor eax, eax
inc eax
ret 0xc
jmp 0x103ae82d
mov eax, 0x3ae7f0
add eax, ebp
add eax, 0x63
mov ecx, 0x5e4
mov edx, 0xaee7f8d0
xor byte [eax], dl
inc eax
dec ecx
jne 0x103ae844
jmp 0x103ae857
pop ebx
sbb eax, 0xd0ec595b
rcl al, 1
push ecx
adc dword [eax], ebp
rcl al, 1
rcl bl, 1
sbb eax, 0xd0d0d768
shr byte [edx - 8], 1
rcl al, 1
shl byte [edi], 1
xor dl, bl
sbb byte [ebx + 0x51], bl
invalid
Function at 0x43666f
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x449a48
cmp edx, dword [eax]
je 0x436691
add eax, 8
inc ecx
cmp eax, 0x449ad8
jl 0x436682
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x449a48]
jne 0x4367bf
mov eax, dword [0x44a498]
cmp eax, 1
je 0x436799
test eax, eax
jne 0x4366c2
cmp dword [0x447144], 1
je 0x436799
cmp edx, 0xfc
je 0x4367bf
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4366f9
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004380f0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.00433cf0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x43673c
lea eax, [ebp - 0x1a4]
push eax
call fcn.00433cf0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x43d56c
push edi
call fcn.00430a40
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004380f0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00438100
lea eax, [ebp - 0xa0]
push 0x43d54c
push eax
call fcn.00438100
push dword [esi + 0x449a4c]
lea eax, [ebp - 0xa0]
push eax
call fcn.00438100
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00438c04
add esp, 0x2c
pop edi
jmp 0x4367bf
lea eax, [ebp + 8]
lea esi, [esi + 0x449a4c]
push 0
push eax
push dword [esi]
call fcn.00433cf0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret

Function at 0x43950b
Capabilities:
Hash data using murmur3

Disassembly:
inc esp
add byte [ecx], cl
adc eax, 0x44bd98
xor ebx, eax
dec eax
sub dword [0x44bd33], ecx
xor ecx, dword [0x44be54]
call fcn.00403ccc
xor edx, 0x15d969f5
xor edx, 0x15d969f5
call fcn.0040600a
add dword [0x44bb84], ebx
inc eax
xor ebx, eax
ror esi, 0x15
sub esi, eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call fcn.00403ccc
neg esi
call fcn.00403ccc
sub esi, 0x65f57b8
inc edi
xor dword [0x44bce0], ecx
xor esi, eax
xor edi, esi
or dword [0x44bce4], 0x2a96f540
or eax, 0x44bce4
inc eax
cmc
xchg esi, eax
sub al, byte [ebx]
cli
rol ebx, 0x11
not eax
not eax
ror ebx, 0x11
sub edi, edx
xor edi, esi
xor esi, eax
mov dword [0x44bbec], ebx
dec edi
Function at 0x43958c
Capabilities:
Hash data using murmur3

Disassembly:
add esi, 0x65f57b8
neg esi
call fcn.00404725
add esp, 0x10
ror ebx, 0xc
inc eax
ror eax, 0x11
xor esi, ebp
call fcn.00404342
xor eax, 0x16251504
mov dword [0x44bcc8], 0x2a4d10a
ror eax, 9
mov dword [0x44bd50], 0x7a538e7
xchg esi, eax
add edi, eax
rol eax, 0x14
sub esi, dword [0x44be8b]
call fcn.00407996
xor esi, eax
rol eax, 1
sub ecx, dword [0x44bda4]
dec eax
neg esi
call fcn.004041d9
not esi
inc esi
dec esi
not esi
call fcn.004051af
neg esi
inc eax
ror eax, 1
xor esi, eax
ror eax, 0x14
sub edi, eax
xchg esi, eax
xor dword [0x44bbb4], 0x836a370
rol eax, 9
sub dword [0x44bce8], 0x128f4690
xor eax, 0x16251504
call fcn.0040436b
xor esi, ebp
rol eax, 0x11
dec eax
rol ebx, 0xc
push 0x40
rol esi, 1
xor eax, 0x22fe0c6
not esi
xor edi, ecx
sub ebx, dword [0x44bf02]
inc eax
sub edi, eax
dec eax
mov dword [0x44bc48], 0x1574dec
inc eax
xor ebx, edi
ror esi, 0xd
add eax, 0xafa5bca
ror esi, 8
sub dword [0x44bb66], 0xe19152a
ror eax, 2
sub edx, dword [0x44be78]
rol eax, 2
xor dword [0x44bc02], 0x1af8124
rol esi, 8
sub eax, 0xafa5bca
rol esi, 0xd
xor ebx, edi
dec eax
inc eax
add edi, eax
dec eax
xor edi, ecx
not esi
xor eax, 0x22fe0c6
ror esi, 1
push 0x3000
xchg eax, eax
mov dword [0x44bb67], ecx
rol eax, 0xf
sub esi, eax
add dword [0x44bc17], 0xc4c23c6
sub ecx, dword [0x44be8b]
add esi, eax
sub edi, dword [0x44bf00]
call fcn.00405e41
xor eax, esi
mov dword [0x44bb66], 0xf28a62c
rol ebx, 0xc
xor ecx, eax
sub dword [0x44bc88], edx
neg edx
xor eax, esp
mov dword [0x44bc83], esi
xor eax, esp
neg edx
xor ecx, eax
ror ebx, 0xc
xor eax, esi
call fcn.00408012
sub esi, eax
add esi, eax
ror eax, 0xf
mov dword [0x44bbd4], esi
xchg eax, eax
push 0x855
sub esi, dword [0x44be69]
or dword [0x44bc1e], ecx
mov dword [0x44bb6e], 0xcbbc00
sub esi, eax
xor dword [0x44bc70], edx
xor edi, eax
and dword [0x44bd93], edx
xor esi, eax
xor edx, dword [0x44be38]
xor edi, eax
neg esi
call fcn.004029bc
xchg ebx, esi
xor edx, 0xd22af40
xor ecx, dword [0x44be2b]
ror ebx, 0x1f
and dword [0x44bc68], ebx
xor esi, eax
xor esi, eax
mov dword [0x44bd48], esi
rol ebx, 0x1f
xor edx, 0xd22af40
xchg ebx, esi
call fcn.004053b6
neg esi
xor edi, eax
xor esi, eax
mov dword [0x44bcb9], esi
xor edi, eax
sub dword [0x44bc57], ecx
add esi, eax
push 0
inc esi
add eax, edx
or dword [0x44bc7e], ecx
sub edx, dword [0x44be3c]
xor edi, edx
call fcn.00401eeb
dec esi
call fcn.00404df9
xor dword [0x44bba4], 0x18abc6b4
dec esi
inc esi
mov dword [0x44bd03], 0x21547c8
inc esi
Function at 0x9300f4
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x9300fa
pop ebp
sub ebp, 6
sub ebp, 0x5300f4
jmp 0x930158
jmp 0x930161
mov eax, 0x5300f4
add eax, ebp
add eax, 0x93
mov ecx, 0x62a
mov edx, 0x925d14ab
xor byte [eax], dl
inc eax
dec ecx
jne 0x930178
jmp 0x93018b
shr ebx, 0xc3
stosd dword es:[edi], eax
mov ebx, 0xabc3abab
xchg dword [bp + di + 0x5b2a], ebp
outsd dx, dword [esi]
ret 0x7404
Function at 0x10001000
Capabilities:
Create process on windows

Disassembly:
sub esp, 0x54
push edi
mov ecx, 0x10
xor eax, eax
lea edi, [esp + 0x18]
mov dword [esp + 0x14], 0x44
lea edx, [esp + 0x14]
rep stosd dword es:[edi], eax
mov eax, dword [esp + 0x60]
lea ecx, [esp + 4]
push ecx
push edx
push 0
push 0
push 0x10
mov dword [esp + 0x54], eax
mov eax, dword [esp + 0x70]
push 0
push 0
push 0
push eax
push 0
mov word [esp + 0x6c], 1
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
pop edi
add esp, 0x54
ret

Function at 0x10001050
Capabilities:
Get common file path
Get file size
Write file on windows

Disassembly:
sub esp, 0x11c
mov eax, dword [str._system32inno.jbg]
mov ecx, dword [0x10007748]
mov edx, dword [0x1000774c]
mov dword [esp + 4], eax
mov eax, dword [0x10007750]
push ebx
push esi
mov dword [esp + 0x18], eax
push edi
mov dword [esp + 0x14], ecx
mov cx, word [0x10007754]
mov dword [esp + 0x18], edx
mov dl, byte [0x10007756]
lea eax, [esp + 0x24]
push 0x104
push eax
mov word [esp + 0x28], cx
mov byte [esp + 0x2a], dl
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
lea ecx, [esp + 0x10]
lea edx, [esp + 0x24]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x80
push 4
push 0
push 2
lea eax, [esp + 0x38]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
push 0
push esi
mov dword [esp + 0x14], 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp eax, 0x3200000
jae 0x100010f9
push 2
push 0
push 0
push esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, dword [esp + 0x12c]
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push edi
call ebx
push eax
call fcn.10001530
add esp, 4
lea ecx, [esp + 0xc]
push 0
push ecx
push edi
call ebx
push eax
push edi
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
add esp, 0x11c
ret
Function at 0x10001140
Capabilities:
Get graphical window text

Disassembly:
sub esp, 0x410
push ebx
push esi
push edi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, eax
mov ecx, 0xff
xor eax, eax
lea edi, [esp + 0x1d]
mov byte [esp + 0x1c], 0
xor esi, esi
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
cmp ebx, dword [0x1000a1ac]
je 0x10001229
push 0x1000a1b0
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jle 0x10001212
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
mov ecx, dword [esp + 0x18]
mov edx, dword [esp + 0x16]
mov eax, dword [esp + 0x14]
and ecx, 0xffff
and edx, 0xffff
push ecx
mov ecx, dword [esp + 0x16]
and eax, 0xffff
push edx
mov edx, dword [esp + 0x16]
push eax
mov eax, dword [esp + 0x18]
and ecx, 0xffff
and edx, 0xffff
push ecx
and eax, 0xffff
push edx
push eax
push 0x1000a1b0
lea ecx, [esp + 0x38]
push 0x10007758
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
lea edx, [esp + 0x40]
push edx
call fcn.10001050
add esp, 0x28
mov ecx, 0x100
xor eax, eax
lea edi, [esp + 0x1c]
rep stosd dword es:[edi], eax
mov ecx, 0x100
mov edi, 0x1000a1b0
rep stosd dword es:[edi], eax
mov esi, 1
push 0x400
push 0x1000a1b0
push ebx
mov dword [0x1000a1ac], ebx
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, esi
pop edi
pop esi
pop ebx
add esp, 0x410
ret

Function at 0x100014d0
Capabilities:
Log keystrokes via application hook

Disassembly:
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x10001480
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x1000a1a8], eax
ret

Function at 0x100014f0
Capabilities:
Log keystrokes via application hook

Disassembly:
push 0
push str.information.exe
call fcn.10001000
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x10001480
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [0x1000a1a8], eax
mov eax, 1
ret 0xc
Function at 0x10003277
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x260
push ebx
push esi
mov ebx, ecx
push edi
mov edi, edx
test ebx, ebx
je 0x1000332e
test edi, edi
je 0x1000332e
lea eax, [ebp - 0x260]
push eax
push 0x1f4
call dword [sym.imp.KERNEL32.dll_GetLogicalDriveStringsA]
test eax, eax
je 0x10003326
cmp byte [ebp - 0x260], 0
je 0x10003326
lea esi, [ebp - 0x260]
push 0x101ac0d0
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1000331e
push 0x101ac0d4
push esi
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
je 0x1000331e
mov al, byte [esi]
mov byte [ebp - 4], al
mov al, byte [esi + 1]
mov byte [ebp - 3], al
lea eax, [ebp - 0x6c]
push 0x64
push eax
lea eax, [ebp - 4]
mov byte [ebp - 2], 0
push eax
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceA]
test eax, eax
je 0x1000332e
lea eax, [ebp - 0x6c]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov dword [ebp - 8], eax
lea eax, [ebp - 0x6c]
push eax
push ebx
call fcn.1014403a
add esp, 0xc
test eax, eax
je 0x10003335
add esi, 4
cmp byte [esi], 0
jne 0x100032bc
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 8]
add eax, ebx
push eax
push edi
call dword [sym.imp.KERNEL32.dll_lstrcatA]
xor eax, eax
inc eax
jmp 0x10003330

Function at 0x10003352
Capabilities:
Create restart manager session

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x254
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x4c]
push ebx
push esi
push edi
push 0x42
xor ebx, ebx
mov edi, ecx
push ebx
push eax
call fcn.10143750
add esp, 0xc
lea eax, [ebp - 0x4c]
push eax
push ebx
lea eax, [ebp - 4]
push eax
call dword [sym.imp.RstrtMgr.DLL_RmStartSession]
mov esi, eax
push esi
push 0x101ac0d8
call fcn.10001ca6
pop ecx
pop ecx
test esi, esi
jne 0x100033e9
mov ecx, edi
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1000339c
sub ecx, edx
lea eax, [ecx + 1]
push eax
lea ecx, [ebp - 0x254]
push ecx
push eax
push edi
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
test eax, eax
je 0x100033f4
push ebx
push ebx
push ebx
lea eax, [ebp - 0x254]
push ebx
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 1
push dword [ebp - 4]
call dword [sym.imp.RstrtMgr.DLL_RmRegisterResources]
test eax, eax
jne 0x100033e9
push ebx
push ebx
push dword [ebp - 4]
call dword [sym.imp.RstrtMgr.DLL_RmShutdown]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push dword [ebp - 4]
call dword [sym.imp.RstrtMgr.DLL_RmEndSession]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10003402
Capabilities:
Enumerate processes
Get process image filename

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x52c
lea eax, [ebp - 0x124]
push ebx
push esi
push edi
push 0x124
push 0
xor edi, edi
mov ebx, ecx
push eax
inc edi
call fcn.10143750
add esp, 0xc
push 0
push 2
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x100034d1
lea eax, [ebp - 0x128]
mov dword [ebp - 0x128], 0x128
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
je 0x100034d1
test edi, edi
je 0x100034d1
push dword [ebp - 0x120]
push 0
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
lea eax, [ebp - 0x104]
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcmpiA]
test eax, eax
jne 0x100034bf
test edi, edi
je 0x100034bf
push 0x200
lea eax, [ebp - 0x328]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_K32GetProcessImageFileNameA]
lea edx, [ebp - 0x528]
lea ecx, [ebp - 0x328]
call fcn.10003277
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x528]
call fcn.10003352
lea eax, [ebp - 0x128]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_Process32Next]
mov edi, eax
jmp 0x1000345a
pop edi
pop esi
pop ebx
leave
ret