joyce8/EMBER2024-capa huggingface dataset:
Function at 0x430517
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x10], 0
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
call fcn.004302c1
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp + 8]
mov dword [eax + 4], edx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0xb4]
mov dword [esp], eax
call fcn.00430152
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax + 0x20]
and eax, 0x30
test al, al
jne 0x430572
mov eax, dword [ebp - 0x14]
add eax, 0x70
mov dword [esp + 4], 1
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll_longjmp]
call eax
mov eax, dword [0xe39510]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x43069c
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
test eax, eax
jne 0x430604
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x4305c1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0042f024
mov dword [ebp - 0x10], 0
mov eax, dword [0xe39510]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
jmp 0x43069c
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 4]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x68], 1
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
test eax, eax
je 0x430634
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x18]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x18], 0
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x24]
and eax, 4
test eax, eax
je 0x43069c
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xdeadbeef
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0x14]
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_CloseHandle]
call eax
sub esp, 4
mov eax, dword [ebp - 0x10]
mov dword [eax + 0x14], 0
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call fcn.0042f024
mov dword [ebp - 0x10], 0
mov eax, dword [0xe39510]
mov edx, dword [ebp - 0x10]
mov dword [esp + 4], edx
mov dword [esp], eax
mov eax, dword [sym.imp.KERNEL32.dll_TlsSetValue]
call eax
sub esp, 8
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.msvcrt.dll__endthreadex]
call eax
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408ecc
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x21913f73
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..rdata
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4300d2
nop
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x177b4228
nop
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x9ba058
Capabilities:
Decompress data using aplib

Disassembly:
call fcn.009ba1a8
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, 0x80
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0x9ba07e
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9ba06a
add dl, dl
jne 0x9ba089
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9ba0dc
xor eax, eax
add dl, dl
jne 0x9ba096
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x9ba17d
add dl, dl
jne 0x9ba0a5
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9ba0b0
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9ba0bb
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9ba0c6
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x9ba0d2
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x9ba075
mov eax, 1
add dl, dl
jne 0x9ba0ea
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x9ba0f5
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9ba0e1
sub eax, ebx
mov ebx, 1
jne 0x9ba128
mov ecx, 1
add dl, dl
jne 0x9ba10e
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9ba119
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9ba105
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9ba075
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x9ba13f
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x9ba14a
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x9ba136
cmp eax, 0x7d00
jae 0x9ba16d
cmp eax, 0x500
jb 0x9ba168
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9ba075
cmp eax, 0x7f
ja 0x9ba170
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x9ba075
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x9ba19e
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x9ba075
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x431000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
je 0x431072
nop
nop
nop
nop
mov ebx, 0x40915c
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x42dd4bdf
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
loop 0x431060
nop
nop
nop
nop
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4310d2
nop
nop
mov ebx, 0x42f3f8
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0x2c175a45
nop
nop
nop
nop
nop
xor dword [eax], esi
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x4310c0
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x10004033
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
push ebx
push esi
mov esi, edx
push edi
test cl, cl
je 0x1000417c
mov dword [esp + 0x14], 0xa3a
cmp dword [esp + 0x14], 0xae6
push 0
pop ebx
jle 0x100040bb
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
sar eax, cl
lea ecx, [esp + 0x18]
cdq
push edx
push eax
call fcn.10001a31
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000407e
mov eax, dword [eax]
push eax
call fcn.100490c6
pop ecx
push ebx
push 1
lea ecx, [esp + 0x20]
call fcn.1000209f
inc edi
cmp edi, 0x2f29
jl 0x10004062
inc esi
cmp esi, 0x1215
jl 0x10004060
push 0xe5c
push ebx
push 0xc2d
push 0x245b
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [esp + 0x14], 0x917
jge 0x100040d0
push str.wvygtc_buevyhsj_ishtaz_mky_xpvccfasq_meakc_qkqyjktz_vihka_woegirdqz_scwlcvy_myqqkri
call fcn.100490c6
pop ecx
cmp byte [ebp + 0x18], 0
je 0x10004154
mov byte [esp + 0x13], bl
lea edx, [esp + 0x13]
push 0x782
xor cl, cl
call fcn.100048e8
mov dword [esp + 0x18], 0x92
cmp dword [esp + 0x18], 0x232
pop ecx
jle 0x10004140
mov esi, ebx
mov edi, ebx
mov eax, edi
lea ecx, [esp + 0x30]
xor eax, esi
cdq
push edx
push eax
call fcn.10001a31
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000411b
mov eax, dword [eax]
push eax
call fcn.100490c6
pop ecx
push ebx
push 1
lea ecx, [esp + 0x38]
call fcn.1000209f
inc edi
cmp edi, 0x27dd
jl 0x10004101
inc esi
cmp esi, 0x4b72
jl 0x100040ff
cmp dword [esp + 0x14], 0x33
jge 0x100041ab
push str.gytsu_zcfasa_ilmsrya_scotvfab_xqewg_zqjlp_ydapszbpr
call fcn.100490c6
pop ecx
jmp 0x100041ab
mov edx, dword [ebp + 0x2c]
xor ebx, ebx
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov dword [edx], eax
mov eax, dword [ebp + 0x28]
mov ecx, dword [eax]
mov eax, dword [edx]
cmp eax, ecx
mov edx, dword [ebp + 0x20]
mov eax, dword [ebp + 0x14]
setg bl
mov ecx, dword [edx]
add ecx, ebx
mov dword [eax], ecx
dec dword [edx]
jmp 0x100041ab
cmp byte [ebp + 8], 0
je 0x100041a1
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
jmp 0x1000419a
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [edx]
cmp dword [edx], 3
jl 0x1000418d
jmp 0x100041ab
mov eax, dword [ebp + 0x1c]
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000454f
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
cmp byte [ebp + 0x14], 0
push ebx
push esi
mov ebx, ecx
push edi
mov dword [esp + 0x1c], ebx
je 0x1000465d
mov dword [esp + 0x14], 0x11ac
cmp dword [esp + 0x14], 0x135d
jle 0x10004607
xor ebx, ebx
xor esi, esi
mov dword [esp + 0x10], esi
xor edi, edi
mov dword [esp + 0xc], edi
and dword [esp + 0x18], 0
mov eax, esi
cdq
idiv edi
mov esi, dword [esp + 0x18]
mov edi, edx
mov eax, edi
lea ecx, [esp + 0x20]
xor eax, esi
or eax, ebx
cdq
push edx
push eax
call fcn.10001a31
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100045bb
mov eax, dword [eax]
push eax
call fcn.100490c6
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.1000209f
inc esi
cmp esi, 0x181e
jl 0x1000459f
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
inc edi
mov dword [esp + 0xc], edi
cmp edi, 0x2201
jl 0x1000458f
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0x50f0
jl 0x10004589
inc ebx
cmp ebx, 0x65d
jl 0x10004583
mov ebx, dword [esp + 0x1c]
cmp dword [esp + 0x14], 0x1105
jge 0x1000461c
push str.wbgl_enp_lvfegao_pgom_ywbw_srv_ffrm_cpkzncpg
call fcn.100490c6
pop ecx
cmp byte [ebp + 0x1c], 0
je 0x1000463e
cmp byte [ebx], 0
je 0x1000468e
push 0x7dbf
push 1
push ecx
push 0x7b28
call fcn.10003caa
add esp, 0x10
jmp 0x1000468e
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1000468e
push 0
push 0x1a9
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x1000468e
cmp byte [ebp + 0x18], 0
je 0x10004685
mov dword [edx], 0
cmp dword [edx], 3
jge 0x1000468e
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x3592
inc dword [edx]
cmp dword [edx], 3
jl 0x10004671
jmp 0x1000468e
mov eax, dword [ebp + 0xc]
mov dword [eax], 0xfffffffe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000475b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
cmp byte [ebp + 0xc], 0
push ebx
push esi
mov esi, edx
mov byte [esp + 0x10], cl
push edi
mov dword [esp + 0x2c], esi
je 0x100047ce
xor ebx, ebx
cmp byte [ebp + 0x10], bl
je 0x100047b3
push 0x49be
push ecx
push 0x325e
push ebx
push 1
push 0x2714
push 1
push 0x6cf8
push ecx
mov edx, 0x4df7
mov byte [esp + 0x36], bl
lea ecx, [esp + 0x36]
call fcn.10003e3f
add esp, 0x24
jmp 0x100048e1
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x100048e1
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x100048e1
test cl, cl
je 0x100047f0
push 0x1fd0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
jmp 0x100048e1
mov dword [esp + 0x28], 0x7ce2
cmp dword [esp + 0x28], 0x7e73
push 0
pop ebx
jle 0x100048b3
mov esi, ebx
mov dword [esp + 0x24], ebx
mov edi, ebx
mov dword [esp + 0x20], ebx
mov eax, esi
mov ecx, ebx
cdq
idiv edi
mov dword [esp + 0x18], ecx
mov dword [esp + 0x1c], edx
mov esi, ecx
mov edi, 0x6164
mov eax, esi
lea ecx, [esp + 0x30]
and eax, edx
cdq
push edx
push eax
call fcn.10001a31
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10004845
mov eax, dword [eax]
push eax
call fcn.100490c6
pop ecx
push ebx
push 1
lea ecx, [esp + 0x38]
call fcn.1000209f
mov edx, dword [esp + 0x1c]
dec esi
dec edi
jne 0x1000482b
mov ecx, dword [esp + 0x18]
inc ecx
mov dword [esp + 0x18], ecx
cmp ecx, 0x4650
jl 0x10004824
mov edi, dword [esp + 0x20]
mov esi, dword [esp + 0x24]
inc edi
mov dword [esp + 0x20], edi
cmp edi, 0x1669
jl 0x10004815
inc esi
mov dword [esp + 0x24], esi
cmp esi, 0x7472
jl 0x1000480f
push ebx
push 0x1f56
push 0xe90
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollPos]
mov esi, dword [esp + 0x2c]
cmp dword [esp + 0x28], 0x7be8
jge 0x100048c8
push str.nfg_xven_nrrq_uxx_xebtdv_zkauzkju_qnqkdhboq_tegk_lyfk_hsmcu_jzj_mwghch
call fcn.100490c6
pop ecx
mov edx, dword [ebp + 8]
mov dword [edx], ebx
jmp 0x100048dc
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x6bc3ec3d
inc dword [edx]
cmp dword [edx], 3
jl 0x100048cf
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009679
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
xor eax, eax
mov dword [ebp - 8], edx
cmp byte [ebp + 8], al
mov byte [ebp - 1], al
je 0x100096a8
cmp byte [ebp - 1], al
je 0x100096d1
push 0x19d0
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x100096d1
cmp byte [ebp - 1], al
je 0x100096d1
push 0x96e
push eax
push 0x20a9
push 0x1933
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
mov esp, ebp
pop ebp
ret

Function at 0x1000a1b1
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x1000a1c8
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x1000a1ea
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x1008bd74
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x1008c100
jl 0x1000a1f8
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x1008c3a4
jl 0x1000a238
mov ecx, dword [0x1008d0f0]
xor ecx, dword [0x1008bd74]
and ecx, edi
xor ecx, dword [0x1008d0f0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x1008bd70], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x1008c3a4]
mov dword [0x1008c730], eax
pop esi
ret
Function at 0x1000cee6
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1000cfab
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1000cf32
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x1000cfa9
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x40]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x44]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jle 0x1000cf8d
mov dword [ebp - 0x10], 1
jmp 0x1000cf91
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
add eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x48]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x1000d005
lea eax, [ebp + 0x14]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x1000cfe5
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1000cfe3
push 0x149a
push 0
push 0
push 0x82d
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
jmp 0x1000d005
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
test eax, eax
je 0x1000d005
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov esp, ebp
pop ebp
ret
Function at 0x1000d7a6
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1000d831
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1000d81a
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1000d7fe
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 4
jge 0x1000d818
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.10001e41
or dword [eax], 0xffffffff
jmp 0x1000d7f3
jmp 0x1000d82f
push 0
push 0x1a9
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x1000d84d
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 0
call fcn.1000d877
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1002740d
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10027439
push 0x4a19
push 0x2548
push 1
push 0x4d4d
call fcn.100274c5
add esp, 0x10
jmp 0x100274c1
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1002746d
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002746b
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x100274c1
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1002749b
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 3
jge 0x100274c1
push 0
push 0
push dword [ebp - 8]
push 0x5a13
push dword [ebp - 0x20]
push 0x2443
call fcn.1002a2f9
add esp, 0x18
jmp 0x10027490
mov esp, ebp
pop ebp
ret

Function at 0x1002a239
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002a2d8
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1002a2ad
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1002a283
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jg 0x1002a2ab
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002a2a9
push 1
push 0x1fa4
push 0x2114
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x1002a278
jmp 0x1002a2d6
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x1002a2d6
push 1
push 0x1f05
push 0x245
push 0
push 0x2afb
push 0
call fcn.10027ece
add esp, 0x18
jmp 0x1002a2f5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
push 0
push dword [ebp - 0x18]
push 0x3806
push 0x218e
call fcn.10022340
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1002a2f9
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1002a32f
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 0x7481
push dword [ebp - 0xc]
push 0
push 0x1364
call fcn.1002b030
add esp, 0x14
jmp 0x1002a38e
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1002a363
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002a361
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x1002a38e
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
push dword [eax]
mov ecx, dword [ebp - 0x28]
call fcn.10001e41
mov dword [eax], 1
mov esp, ebp
pop ebp
ret