joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001cde
Capabilities:
Initialize winsock library
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
push ebx
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
push edi
push dword [ebp + 8]
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x14], esi
call fcn.01003359
mov eax, dword [edi]
mov dword [0x1004964], eax
lea eax, [ebp - 0x1a4]
push eax
push 0x101
call dword [sym.imp.WS2_32.dll_WSAStartup]
cmp eax, 0xffffffff
jne 0x1001d46
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push dword [0x1004964]
push 0x2719
push 2
call fcn.01002102
add esp, 0x10
jmp 0x1001e13
cmp dword [ebp + 8], 2
jge 0x1001d51
call fcn.0100156b
xor ebx, ebx
inc ebx
cmp dword [ebp + 8], ebx
jle 0x1001dfa
mov eax, dword [edi + ebx*4]
mov cl, byte [eax]
cmp cl, 0x2d
je 0x1001d91
cmp cl, 0x2f
je 0x1001d91
cmp dword [ebp - 4], esi
jne 0x1001d76
mov dword [ebp - 4], eax
jmp 0x1001df0
cmp dword [ebp - 8], esi
jne 0x1001d80
mov dword [ebp - 8], eax
jmp 0x1001df0
cmp dword [ebp - 0x14], esi
jne 0x1001d8a
mov dword [ebp - 0x14], eax
jmp 0x1001df0
call fcn.0100156b
jmp 0x1001df0
lea esi, [eax + 1]
jmp 0x1001de8
movsx eax, al
push eax
call dword [sym.imp.msvcrt.dll_toupper]
cmp eax, 0x41
pop ecx
je 0x1001de0
cmp eax, 0x44
je 0x1001dd7
cmp eax, 0x47
je 0x1001de0
cmp eax, 0x4e
je 0x1001dc3
cmp eax, 0x53
jne 0x1001e1b
mov dword [ebp - 0xc], 2
jmp 0x1001de7
cmp dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 1
jne 0x1001de7
call fcn.0100156b
jmp 0x1001de7
mov dword [ebp - 0xc], 3
jmp 0x1001de7
mov dword [ebp - 0xc], 1
inc esi
mov al, byte [esi]
test al, al
jne 0x1001d96
xor esi, esi
inc ebx
cmp ebx, dword [ebp + 8]
jl 0x1001d5d
call fcn.010021c1
cmp eax, esi
je 0x1001e22
push eax
push 0x271e
push 2
call fcn.01002102
add esp, 0xc
push 1
call dword [sym.imp.msvcrt.dll_exit]
call fcn.0100156b
jmp 0x1001e9f
mov eax, dword [ebp - 0xc]
dec eax
je 0x1001e6e
dec eax
je 0x1001e45
dec eax
jne 0x1001e9f
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.01001782
cmp eax, esi
je 0x1001e9f
push eax
push 0x2721
jmp 0x1001e95
cmp dword [ebp - 4], esi
je 0x1001e4f
cmp dword [ebp - 8], esi
jne 0x1001e54
call fcn.0100156b
push dword [ebp - 0x14]
push dword [ebp - 8]
push dword [ebp - 4]
call fcn.01001920
cmp eax, esi
je 0x1001e9f
push eax
push 0x2720
jmp 0x1001e95
cmp dword [ebp - 0x10], esi
je 0x1001e7d
cmp dword [ebp - 4], esi
jne 0x1001e7d
call fcn.0100156b
push dword [ebp - 8]
push dword [ebp - 0x10]
push dword [ebp - 4]
call fcn.010015ee
cmp eax, esi
je 0x1001e9f
push eax
push 0x271f
push 2
call fcn.01002102
add esp, 0xc
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x1001ea6
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x1001150
call fcn.01002044
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1001ee1
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1001ee1
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1001ef9
cmp eax, 0x20b
je 0x1001ee6
mov dword [ebp - 0x1c], edi
jmp 0x1001f0d
cmp dword [ecx + 0x84], 0xe
jbe 0x1001ee1
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x1001f07
cmp dword [ecx + 0x74], 0xe
jbe 0x1001ee1
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1004968], 0xffffffff
or dword [0x100496c], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1004958]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x1004954]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1004970], eax
call fcn.0100203e
cmp dword [section..data], edi
jne 0x1001f68
push fcn.0100203e
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.0100202c
push 0x10010dc
push 0x10010d8
call sub.msvcrt.dll__initterm
mov eax, dword [0x1004950]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push eax
push dword [0x100494c]
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x30], eax
push 0x10010d4
push 0x10010d0
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x24]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.01001cde
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x34], esi
cmp dword [ebp - 0x1c], edi
jne 0x1001fdf
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1002014
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.0100207d
ret

Function at 0x10020a6
Capabilities:
Resolve dns

Disassembly:
push dword [esp + 4]
call dword [sym.imp.WS2_32.dll_inet_addr]
cmp eax, 0xffffffff
jne 0x10020cf
push dword [esp + 4]
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x10020cc
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov eax, dword [eax]
jmp 0x10020cf
or eax, 0xffffffff
ret 4
Function at 0x10021c1
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
push 0
call dword [sym.imp.msvcrt.dll_time]
mov dword [ebp - 8], eax
lea eax, [ebp - 0x128]
mov dword [esp], 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
jne 0x10021f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
leave
ret
lea eax, [ebp - 0x128]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10021fe
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
sub eax, edx
cmp dword [0x100495c], 0
push esi
lea eax, [ebp + eax - 0x128]
push edi
mov dword [ebp - 4], eax
je 0x100224c
mov edi, eax
mov esi, 0x10011a8
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x128]
push eax
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x100224c
push 0x1001198
push eax
call ebx
mov dword [0x100497c], eax
mov edi, dword [ebp - 4]
mov esi, 0x1001188
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x128]
push eax
movsw word es:[edi], word [esi]
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov esi, eax
test esi, esi
jne 0x1002271
push 2
pop eax
jmp 0x10022a6
push 0x1001174
push esi
call ebx
test eax, eax
mov dword [0x1004974], eax
je 0x100226c
push 0x1001160
push esi
call ebx
test eax, eax
mov dword [0x1004978], eax
je 0x100226c
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0xc]
push eax
push dword [ebp - 8]
call dword [0x1004974]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x403024
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 0
je 0x403062
call fcn.00403064
mov edx, dword [ebp + 0x10]
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
mov eax, dword [edx]
jbe 0x403060
push esi
push edi
mov esi, dword [ebp + 8]
movzx edi, al
movzx esi, byte [esi + ecx]
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x413cb0]
xor eax, esi
inc ecx
cmp ecx, dword [ebp + 0xc]
jb 0x403040
pop edi
pop esi
mov dword [edx], eax
pop ebp
ret

Function at 0x403064
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
cmp word [0x4140b0], si
jne 0x4030a8
push edi
mov ecx, 0x413cb0
push 8
mov eax, esi
pop edi
mov dl, al
and edx, 1
shr eax, 1
cmp dx, 1
jne 0x40308d
xor eax, 0xedb88320
dec edi
jne 0x40307b
mov dword [ecx], eax
add ecx, 4
inc esi
cmp ecx, 0x4140b0
jb 0x403076
mov word [0x4140b0], 1
pop edi
pop esi
ret
Function at 0x4030c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, eax
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ebx
shr esi, 6
and eax, 0x3f
mov dword [ebp - 8], ebx
mov dword [ebp + 0x14], eax
jbe 0x403103
and dword [ebp + 0x14], 7
mov edi, eax
shr edi, 3
cmp edi, ebx
jbe 0x403103
cmp esi, ebx
jbe 0x403103
mov dword [ebp - 8], 1
dec esi
push 8
lea eax, [ebp - 0x18]
push 0x41333c
push eax
call fcn.00407750
push ebx
push dword [ebp + 8]
call fcn.0040326f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x18]
push eax
call fcn.0040349c
add esp, 0x1c
cmp esi, ebx
jbe 0x40317e
mov ebx, dword [ebp + 0xc]
mov dword [ebp + 8], esi
push 8
lea eax, [ebp - 0x10]
pop esi
push esi
push ebx
push eax
call fcn.00407750
add esp, 0xc
xor eax, eax
mov cl, byte [eax + ebp - 0x18]
xor byte [eax + ebp - 0x10], cl
inc eax
cmp eax, esi
jb 0x403149
push dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push eax
call fcn.0040349c
push esi
lea eax, [ebp - 0x18]
push dword [ebp + 0x10]
push eax
call fcn.00407750
add dword [ebp + 0x10], esi
add esp, 0x14
add ebx, esi
dec dword [ebp + 8]
jne 0x403136
jmp 0x403184
mov ebx, dword [ebp + 0xc]
push 8
pop esi
cmp word [ebp - 8], 0
je 0x403210
push esi
lea eax, [ebp - 0x10]
push ebx
push eax
call fcn.00407750
add esp, 0xc
xor eax, eax
mov cl, byte [eax + ebp - 0x18]
xor byte [eax + ebp - 0x10], cl
inc eax
cmp eax, esi
jb 0x40319f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040349c
add ebx, 8
push edi
lea eax, [ebp - 0x10]
push ebx
push eax
call fcn.00407750
mov eax, esi
sub eax, edi
push eax
lea eax, [edi + ebp - 0x10]
push 0
push eax
call fcn.00402916
add esp, 0x20
xor eax, eax
mov cl, byte [eax + ebp - 0x18]
xor byte [eax + ebp - 0x10], cl
inc eax
cmp eax, esi
jb 0x4031dd
mov esi, dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push esi
push eax
call fcn.0040349c
lea eax, [ebp - 0x18]
add esi, 8
push edi
push eax
push esi
call fcn.00407750
add esp, 0x14
mov dword [ebp - 4], edi
xor edi, edi
mov dword [ebp + 0x10], esi
test edi, edi
jbe 0x403242
xor esi, esi
test edi, edi
jbe 0x40323f
mov ecx, dword [ebp + 0x10]
mov dword [ebp + 0xc], ebx
lea eax, [ebp - 0x18]
sub dword [ebp + 0xc], eax
lea eax, [ebp - 0x18]
sub ecx, eax
mov edx, dword [ebp + 0xc]
lea eax, [esi + ebp - 0x18]
mov dl, byte [eax + edx]
xor dl, byte [eax]
inc esi
cmp esi, edi
mov byte [eax + ecx], dl
jb 0x40322b
mov dword [ebp - 4], edi
cmp dword [ebp + 0x14], 0
jbe 0x403268
mov eax, dword [ebp - 4]
lea esi, [eax + ebp - 0x18]
push esi
push dword [ebp + 0x14]
call fcn.00403786
mov eax, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
pop ecx
pop ecx
mov cl, byte [ebx + eax]
xor cl, byte [esi]
mov byte [edx + eax], cl
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x4032ab
Capabilities:
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xf4
push ebx
push esi
push edi
xor ecx, ecx
movzx eax, byte [ecx + str.80_]
mov esi, dword [ebp + 8]
mov edx, eax
sar edx, 3
and eax, 7
mov dl, byte [esi + edx]
test byte [eax*2 + 0x413bc4], dl
setne al
mov byte [ecx + ebp - 0x74], al
inc ecx
cmp ecx, 0x38
jl 0x4032b9
and dword [ebp + 8], 0
mov dword [ebp - 4], 0x1e
cmp word [ebp + 0xc], 1
jne 0x4032f9
mov eax, dword [ebp - 4]
jmp 0x4032fe
mov eax, dword [ebp + 8]
add eax, eax
and dword [ebp + eax*4 - 0xf0], 0
and dword [ebp + eax*4 - 0xf4], 0
lea ecx, [ebp + eax*4 - 0xf0]
lea esi, [ebp + eax*4 - 0xf4]
mov eax, dword [ebp + 8]
xor edx, edx
movzx eax, byte [eax + 0x413c0c]
mov edi, eax
cmp edi, 0x1c
jge 0x403335
mov bl, byte [edi + ebp - 0x74]
jmp 0x40333c
mov bl, byte [edi + ebp - 0x90]
mov byte [edx + ebp - 0x3c], bl
inc edx
inc edi
cmp edx, 0x1c
jl 0x40332a
push 0x1c
pop edi
add eax, edi
cmp eax, 0x38
jge 0x403357
mov dl, byte [eax + ebp - 0x74]
jmp 0x40335e
mov dl, byte [eax + ebp - 0x90]
mov byte [edi + ebp - 0x3c], dl
inc edi
inc eax
cmp edi, 0x38
jl 0x40334c
xor edi, edi
mov edx, 0x413b64
movzx ebx, byte [edi + 0x413c1c]
lea eax, [edi + 0x413c34]
cmp byte [ebx + ebp - 0x3c], 0
je 0x403388
mov ebx, dword [edx]
or dword [esi], ebx
movzx eax, byte [eax]
cmp byte [eax + ebp - 0x3c], 0
je 0x403396
mov eax, dword [edx]
or dword [ecx], eax
add edx, 4
inc edi
cmp edx, 0x413bc4
jl 0x403370
sub dword [ebp - 4], 2
inc dword [ebp + 8]
cmp dword [ebp - 4], 0xfffffffe
jg 0x4032ed
lea eax, [ebp - 0xf4]
push eax
call fcn.004033c5
pop ecx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4038c2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 0x14]
push ebx
push esi
push edi
mov edi, eax
xor ebx, ebx
xor esi, esi
mov dword [ebp - 4], ebx
shr edi, 6
and eax, 0x3f
mov dword [ebp - 8], ebx
mov dword [ebp + 0x14], eax
jbe 0x4038fe
and dword [ebp + 0x14], 7
mov esi, eax
shr esi, 3
cmp esi, ebx
jbe 0x4038fe
cmp edi, ebx
jbe 0x4038fe
mov dword [ebp - 8], 1
dec edi
push 8
lea eax, [ebp - 0x10]
push 0x41333c
push eax
call fcn.00407750
push ebx
push dword [ebp + 8]
call fcn.0040326f
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.0040349c
push 1
push dword [ebp + 8]
call fcn.0040326f
add esp, 0x24
cmp edi, ebx
jbe 0x40398b
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 0x10]
sub eax, ebx
mov dword [ebp + 0x10], edi
mov edi, dword [ebp + 0xc]
mov dword [ebp + 8], eax
push 8
lea eax, [ebp - 0x28]
push edi
push eax
call fcn.00407750
push ebx
push edi
call fcn.0040349c
add esp, 0x14
push 8
pop eax
mov ecx, dword [ebp + 8]
mov cl, byte [ebx + ecx]
xor byte [ebx], cl
inc ebx
dec eax
jne 0x40395f
lea eax, [ebp - 0x28]
push 8
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00407750
sub dword [ebp + 8], 8
add esp, 0xc
add edi, 8
dec dword [ebp + 0x10]
jne 0x403946
jmp 0x403991
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0xc]
cmp word [ebp - 8], 0
je 0x403a39
lea eax, [ebp - 0x18]
push eax
push edi
call fcn.0040349c
add edi, 8
push esi
lea eax, [ebp - 0x20]
push edi
push eax
mov dword [ebp + 0x10], edi
call fcn.00407750
mov dword [ebp + 8], 8
lea edi, [esi + ebp - 0x20]
sub dword [ebp + 8], esi
push dword [ebp + 8]
push 0
push edi
call fcn.00402916
add esp, 0x20
xor eax, eax
mov cl, byte [eax + ebp - 0x20]
xor byte [eax + ebp - 0x18], cl
inc eax
cmp eax, 8
jb 0x4039d5
push dword [ebp + 8]
lea eax, [esi + ebp - 0x18]
push eax
push edi
call fcn.00407750
lea eax, [ebp - 0x20]
push ebx
push eax
call fcn.0040349c
add esp, 0x14
lea eax, [ebp - 0x10]
mov edi, ebx
sub eax, ebx
push 8
pop ecx
mov dl, byte [eax + edi]
xor byte [edi], dl
inc edi
dec ecx
jne 0x403a08
lea eax, [ebp - 0x18]
add ebx, 8
push esi
push eax
push ebx
call fcn.00407750
lea eax, [ebp - 0x20]
push 8
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.00407750
mov edi, dword [ebp + 0x10]
add esp, 0x18
mov dword [ebp - 4], esi
xor esi, esi
test esi, esi
jbe 0x403a72
and dword [ebp + 8], 0
test esi, esi
jbe 0x403a6f
mov dword [ebp + 0x10], edi
lea eax, [ebp - 0x10]
sub dword [ebp + 0x10], eax
mov ecx, ebx
lea eax, [ebp - 0x10]
sub ecx, eax
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x10]
lea eax, [eax + ebp - 0x10]
mov dl, byte [eax + edx]
xor dl, byte [eax]
inc dword [ebp + 8]
cmp dword [ebp + 8], esi
mov byte [eax + ecx], dl
jb 0x403a55
mov dword [ebp - 4], esi
cmp dword [ebp + 0x14], 0
jbe 0x403a95
mov eax, dword [ebp - 4]
lea esi, [eax + ebp - 0x10]
push esi
push dword [ebp + 0x14]
call fcn.00403786
mov eax, dword [ebp - 4]
pop ecx
pop ecx
mov cl, byte [edi + eax]
xor cl, byte [esi]
mov byte [ebx + eax], cl
pop edi
pop esi
xor eax, eax
pop ebx
leave
ret
Function at 0x4073db
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4142c4]
jne 0x4073e5
repz ret
jmp fcn.00408f32

Function at 0x40d5b0
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.0040b07e
xor ebx, ebx
cmp dword [0x415e14], ebx
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov dword [ebp - 0xc], ebx
jne 0x40d685
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
jne 0x40d5f0
xor eax, eax
jmp 0x40d749
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4118f8
push edi
call esi
cmp eax, ebx
je 0x40d5e9
push eax
call fcn.0040b01b
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x415e14], eax
call esi
push eax
call fcn.0040b01b
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x415e18], eax
call esi
push eax
call fcn.0040b01b
mov dword [0x415e1c], eax
lea eax, [ebp - 8]
push eax
call fcn.0040a02f
test eax, eax
pop ecx
pop ecx
je 0x40d653
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004080b7
add esp, 0x14
cmp dword [ebp - 8], 2
jne 0x40d685
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.0040b01b
cmp eax, ebx
pop ecx
mov dword [0x415e24], eax
je 0x40d685
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.0040b01b
pop ecx
mov dword [0x415e20], eax
mov eax, dword [0x415e20]
mov esi, dword [ebp - 0x10]
cmp eax, esi
je 0x40d6fe
cmp dword [0x415e24], esi
je 0x40d6fe
push eax
call fcn.0040b087
pop ecx
call eax
cmp eax, ebx
je 0x40d6cb
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
push dword [0x415e24]
call fcn.0040b087
pop ecx
call eax
test eax, eax
je 0x40d6cb
test byte [ebp - 0x18], 1
jne 0x40d6fe
lea eax, [ebp - 0xc]
push eax
call fcn.0040a066
test eax, eax
pop ecx
je 0x40d6e6
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.004080b7
add esp, 0x14
cmp dword [ebp - 0xc], 4
jb 0x40d6f5
or dword [ebp + 0x10], 0x200000
jmp 0x40d72f
or dword [ebp + 0x10], 0x40000
jmp 0x40d72f
mov eax, dword [0x415e18]
cmp eax, esi
je 0x40d72f
push eax
call fcn.0040b087
pop ecx
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x40d72f
mov eax, dword [0x415e1c]
cmp eax, esi
je 0x40d72f
push dword [ebp - 4]
push eax
call fcn.0040b087
pop ecx
call eax
mov dword [ebp - 4], eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
push dword [0x415e14]
call fcn.0040b087
pop ecx
call eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4011b3
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
mov al, byte [0x44c027]
movzx ax, al
push ax
push 0x44c028
push dword [ebp + 8]
push dword [0x44cb48]
call sub.kernel32.dll_ReadProcessMemory
push dword [0x44ce24]
push 0
mov al, byte [0x44c027]
movzx ax, al
push ax
push 0x44c023
push dword [ebp + 8]
push dword [0x44cb48]
call sub.kernel32.dll_WriteProcessMemory
push dword [0x44cb4c]
call sub.kernel32.dll_ResumeThread
mov dword [0x44cb58], 0x10007
push 0xa
call sub.kernel32.dll_Sleep
push 0x44cb58
push dword [0x44cb4c]
call sub.kernel32.dll_GetThreadContext
mov eax, dword [ebp + 8]
cmp dword [0x44cc10], eax
jne 0x401237
jmp 0x401239
jmp 0x401213
push dword [0x44cb4c]
call sub.kernel32.dll_SuspendThread
push dword [0x44ce24]
push 0
mov al, byte [0x44c027]
movzx ax, al
push ax
push 0x44c028
push dword [ebp + 8]
push dword [0x44cb48]
call sub.kernel32.dll_WriteProcessMemory
leave
ret 4

Function at 0x40126e
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
mov al, byte [0x44c027]
movzx ax, al
push ax
push 0x44c028
push dword [ebp + 8]
push dword [0x44cb48]
call sub.kernel32.dll_ReadProcessMemory
push 0
push 0
mov al, byte [0x44c027]
movzx ax, al
push ax
push 0x44c038
push dword [0x44c178]
push dword [0x44cb48]
call sub.kernel32.dll_ReadProcessMemory
push dword [0x44ce24]
push 0
mov al, byte [0x44c027]
movzx ax, al
push ax
push 0x44c023
push dword [ebp + 8]
push dword [0x44cb48]
call sub.kernel32.dll_WriteProcessMemory
push dword [0x44ce24]
push 0
mov al, byte [0x44c027]
movzx ax, al
push ax
push 0x44c023
push dword [0x44c178]
push dword [0x44cb48]
call sub.kernel32.dll_WriteProcessMemory
push dword [0x44cb4c]
call sub.kernel32.dll_ResumeThread
push 0xa
call sub.kernel32.dll_Sleep
mov dword [0x44cb58], 0x10007
push 0x44cb58
push dword [0x44cb4c]
call sub.kernel32.dll_GetThreadContext
mov eax, dword [ebp + 8]
cmp dword [0x44cc10], eax
jne 0x401340
jmp 0x401351
mov eax, dword [0x44c178]
mov ebx, dword [0x44cc10]
cmp eax, ebx
je 0x4013b4
jmp 0x401323
push dword [0x44cb4c]
call sub.kernel32.dll_SuspendThread
push dword [0x44ce24]
push 0
mov al, byte [0x44c027]
movzx ax, al
push ax
push 0x44c028
push dword [ebp + 8]
push dword [0x44cb48]
call sub.kernel32.dll_WriteProcessMemory
push dword [0x44ce24]
push 0
mov al, byte [0x44c027]
movzx ax, al
push ax
push 0x44c038
push dword [0x44c178]
push dword [0x44cb48]
call sub.kernel32.dll_WriteProcessMemory
mov eax, 0
leave
ret 4
push dword [0x44cb4c]
call sub.kernel32.dll_SuspendThread
push dword [0x44ce24]
push 0
mov al, byte [0x44c027]
movzx ax, al
push ax
push 0x44c028
push dword [ebp + 8]
push dword [0x44cb48]
call sub.kernel32.dll_WriteProcessMemory
push dword [0x44ce24]
push 0
mov al, byte [0x44c027]
movzx ax, al
push ax
push 0x44c038
push dword [0x44c178]
push dword [0x44cb48]
call sub.kernel32.dll_WriteProcessMemory
mov eax, 1
leave
ret 4
Function at 0x401ef0
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push 0
push 0
push 3
push 0
push 1
push 0x80000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0xffffffff
jne 0x401f1c
xor eax, eax
leave
ret 0xc
push 0
push dword [ebp - 4]
call sub.kernel32.dll_GetFileSize
mov dword [ebp - 8], eax
add dword [ebp - 8], 0x20
push dword [ebp - 8]
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov dword [ebp - 0xc], eax
push 0
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_ReadFile
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp - 0x10]
mov dword [eax], ecx
mov eax, 1
leave
ret 0xc

Function at 0x401ff0
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebx
push esi
push edi
push 0
call sub.user32.dll_OpenClipboard
push 1
call sub.user32.dll_IsClipboardFormatAvailable
or eax, eax
je 0x402032
push 1
call sub.user32.dll_GetClipboardData
mov ebx, eax
push eax
call fcn.00402250
mov esi, eax
push esi
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov edi, eax
push edi
push ebx
call fcn.004022d0
call sub.user32.dll_CloseClipboard
mov eax, edi
jmp 0x40203b
xor eax, eax
call sub.user32.dll_CloseClipboard
jmp 0x40203b
pop edi
pop esi
pop ebx
ret

Function at 0x40206c
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0
push pe_nt_image_headers32
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x402097
xor eax, eax
leave
ret 0xc
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_FlushFileBuffers
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 8]
leave
ret 0xc

Function at 0x40258a
Capabilities:
Hash data using crc32b

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [0x44d790]
push edi
test esi, esi
jne 0x4025e7
push 0x400
call dword [sym.imp.msvcrt.dll_malloc]
mov esi, eax
pop ecx
mov dword [0x44d790], esi
xor edi, edi
push edi
push 8
pop ecx
call fcn.0040256b
pop ecx
push 8
shl eax, 0x18
pop ecx
test eax, eax
jns 0x4025cc
add eax, eax
xor eax, 0x4c11db7
jmp 0x4025ce
add eax, eax
dec ecx
jne 0x4025bf
push eax
push 0x20
pop ecx
call fcn.0040256b
mov dword [esi + edi*4], eax
inc edi
cmp edi, 0x100
pop ecx
jl 0x4025af
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
add ecx, eax
jmp 0x40260a
movsx edx, byte [eax]
xor edx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x10]
and edx, 0xff
shr edi, 8
xor edi, dword [esi + edx*4]
inc eax
mov dword [ebp + 0x10], edi
cmp eax, ecx
jb 0x4025f1
mov eax, dword [ebp + 0x10]
pop edi
pop esi
pop ebp
ret