joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003defc
Capabilities:
Get disk information

Disassembly:
mov eax, 0x10062c98
call fcn.100612c8
sub esp, 0x48
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edi
mov byte [ebp - 0x14], cl
je 0x1003dfe3
test cl, cl
je 0x1003dfd8
mov dword [ebp - 0x20], 0x2bc3
cmp dword [ebp - 0x20], 0x2de1
jle 0x1003dfab
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x18], edi
mov ebx, esi
mov dword [ebp + 0x18], 0x2d3f
mov esi, ebx
mov edi, 0x2231
mov eax, esi
lea ecx, [ebp - 0x3c]
cdq
push edx
push eax
call fcn.10001a31
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003df6a
mov eax, dword [eax]
push eax
call fcn.100490c6
pop ecx
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.1000209f
inc esi
dec edi
jne 0x1003df53
mov edi, dword [ebp - 0x18]
add ebx, edi
dec dword [ebp + 0x18]
jne 0x1003df4c
mov esi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x3a1c
jl 0x1003df43
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x87b
jl 0x1003df3e
call fcn.1001ddcd
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
mov eax, dword [ebp + 0xc]
sar ecx, 2
cmp dword [ebp - 0x20], 0x2a04
mov dword [eax], ecx
jge 0x1003e0d9
push str.envuznfs_nvza_lkhrjaco
call fcn.100490c6
pop ecx
jmp 0x1003e0d9
mov eax, dword [ebp + 0x1c]
and dword [eax], 0
jmp 0x1003e0d9
cmp byte [ebp + 0x10], 0
je 0x1003e018
mov esi, dword [ebp + 8]
mov dword [esi], 2
jmp 0x1003e00e
push 0x3082
push 0
mov edx, 0x230f
mov ecx, 0x5e8e
call fcn.1003e1df
dec dword [esi]
pop ecx
pop ecx
cmp dword [esi], 0
jge 0x1003dff4
jmp 0x1003e0d9
mov dword [ebp + 0x18], 0x47e3
cmp dword [ebp + 0x18], 0x4a29
jle 0x1003e06f
push 0xb5b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
xor esi, esi
xor ebx, ebx
mov ecx, ebx
mov eax, esi
shl eax, cl
mov ecx, 0x1007cab8
cdq
push edx
push eax
call fcn.10001cb3
inc ebx
cmp ebx, 0x7166
jl 0x1003e03b
inc esi
cmp esi, 0x2c48
jl 0x1003e039
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_FlashWindow]
mov dword [ebp - 4], 2
cmp dword [ebp + 0x18], 0x453d
jge 0x1003e0ad
mov edx, str.wwu_qhsjt_uubvr_ctqd_qkw
mov ecx, 0x1007cab8
call fcn.100036f5
jmp 0x1003e0ad
mov eax, dword [ebp + 0x20]
mov ecx, edi
or dword [ebp - 4], 0xffffffff
mov eax, dword [eax]
inc eax
push eax
push 0
lea eax, [ebp - 0x54]
push eax
call fcn.100408bf
push eax
mov ecx, edi
call fcn.1001de2b
push 0
push 1
lea ecx, [ebp - 0x54]
call fcn.1000737d
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003ec99
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10062ce1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x30
cmp byte [ebp + 0x14], 0
push esi
mov byte [esp + 8], dl
je 0x1003ee22
test dl, dl
je 0x1003ee05
mov edx, ecx
xor esi, esi
lea ecx, [esp + 0x18]
mov dword [esp + 0x14], esi
call fcn.1003dbf0
mov edx, dword [ebp + 8]
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], esi
call fcn.1003dbf0
mov byte [esp + 0x3c], 1
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x18]
sub ecx, dword [esp + 0x24]
sar eax, 2
sar ecx, 2
cmp eax, ecx
mov dword [esp + 0x10], esi
lea eax, [esp + 0x18]
jbe 0x1003ed58
push 0x996
push 0x5f19
push 1
push eax
push 1
lea eax, [esp + 0x24]
mov edx, 0x5b95
push eax
push 0x29f8
mov cl, 1
call fcn.1003defc
add esp, 0x1c
lea eax, [esp + 0x24]
lea edx, [esp + 0xc]
push eax
lea eax, [esp + 0x14]
push eax
push ecx
push ecx
call fcn.1003f554
add esp, 0x10
jmp 0x1003ed73
push eax
lea eax, [esp + 0x14]
mov dword [esp + 0x14], ecx
push eax
lea eax, [esp + 0x14]
mov dl, 1
push eax
mov cl, dl
call fcn.1003e1f9
add esp, 0xc
cmp dword [esp + 0x10], 0
mov dword [esp + 0xc], esi
jle 0x1003ede8
mov ecx, dword [esp + 0x14]
test ecx, ecx
jne 0x1003edec
push 0x2bff
lea eax, [esp + 0x1c]
mov edx, 0x5bee
push eax
lea eax, [esp + 0x2c]
mov cl, 1
push eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x24]
push 1
push eax
call fcn.1003eb0c
add esp, 0x18
lea eax, [esp + 0xc]
push eax
push 0xd50
push 0x133b
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
push ecx
lea eax, [esp + 0x30]
mov cl, 1
push eax
call fcn.1003eb8d
mov eax, dword [esp + 0x28]
add esp, 0x1c
inc eax
mov dword [esp + 0xc], eax
cmp eax, dword [esp + 0x10]
jl 0x1003ed7e
mov ecx, dword [esp + 0x14]
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
lea ecx, [esp + 0x24]
call fcn.100410c0
lea ecx, [esp + 0x18]
call fcn.100410c0
jmp 0x1003ee7b
sub esp, 0x14
mov byte [esp + 0x1b], 0
lea edx, [esp + 0x1b]
xor cl, cl
push 0x32d7
call fcn.1003ea38
add esp, 0x18
jmp 0x1003ee7b
cmp byte [ebp + 0x18], 0
je 0x1003ee63
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1003ee7b
xor esi, esi
mov edx, 0x610c
push esi
push 0x5346
push 0x1c46
push 0x3e0f
push 1
push 0x1287
push esi
push 0x4dfd
mov ecx, 0x695f
call fcn.1003b941
add esp, 0x20
jmp 0x1003ee7b
push 0x19d0
xor esi, esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov ecx, dword [esp + 0x34]
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100400d5
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10062da8
call fcn.100612c8
sub esp, 0x28
push ebx
push esi
mov dword [ebp - 0x1c], 0x6e28
xor esi, esi
cmp dword [ebp - 0x1c], 0x6f6b
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], ecx
jle 0x1004015a
mov edi, esi
mov dword [ebp - 0x18], esi
mov ebx, esi
mov eax, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x20], esi
mov ecx, eax
mov esi, ebx
sar esi, cl
and esi, edi
mov edi, dword [ebp - 0x20]
mov eax, esi
mov ecx, 0x1007cab8
xor eax, edi
cdq
push edx
push eax
call fcn.10001cb3
inc edi
cmp edi, 0x3886
jl 0x10040117
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x14], eax
push 0
pop esi
cmp eax, 0x5b68
jl 0x10040109
inc ebx
cmp ebx, 0x44f9
jl 0x10040104
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x15b3
jl 0x10040102
mov dword [ebp - 4], esi
cmp dword [ebp - 0x1c], 0x6d62
jge 0x10040175
mov edx, str.ljobccc_tmks_yquxdkee_ablyzd_wgscaxkxw_ulwotfh_urewsoj_ssjhn
mov ecx, 0x1007cab8
call fcn.100036f5
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x10], 0
je 0x10040233
mov ecx, dword [ebp + 0x14]
push 0x18
pop ebx
mov eax, dword [ecx + 4]
sub eax, dword [ecx]
cdq
idiv ebx
mov dword [ebp - 0x20], eax
test eax, eax
jle 0x1004024e
mov ebx, dword [ebp - 0x24]
mov edi, esi
mov edx, dword [ecx]
mov ecx, ebx
add edx, edi
call fcn.1003f416
test al, al
je 0x100401f6
mov eax, dword [ebp + 0xc]
sub esp, 0x18
mov ecx, esp
mov eax, dword [eax]
add eax, edi
push eax
call fcn.10008281
lea ecx, [ebp - 0x30]
call fcn.1003dd4c
add esp, 0x18
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 2
call fcn.10040084
test eax, eax
je 0x10040229
cmp eax, 2
je 0x10040229
cmp eax, 3
je 0x10040229
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.100074ec
inc esi
add edi, 0x18
cmp esi, dword [ebp - 0x20]
jge 0x1004024e
mov ecx, dword [ebp + 0x14]
jmp 0x100401a1
lea ecx, [ebp - 0x30]
call fcn.100074ec
jmp 0x1004024e
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1004024e
push 0x149a
push esi
push esi
push 0x82d
push esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10040281
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x10062db2
call fcn.100612c8
sub esp, 0xc
push ebx
mov ebx, ecx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x1004030f
cmp byte [ebp + 0x18], 0
je 0x100402ec
mov esi, dword [ebp + 0x1c]
mov edi, dword [esi + 4]
cmp dword [esi], edi
je 0x100402db
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
push 0x18
cdq
pop ecx
idiv ecx
sub edi, dword [esi]
mov ecx, eax
mov eax, edi
push 0x18
cdq
pop edi
idiv edi
cmp eax, ecx
jne 0x100402db
push ecx
push ecx
mov ecx, dword [ebp + 8]
push esi
push 1
push ebx
push 0x4af0
call fcn.100400d5
add esp, 0x18
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x100402db
sub esp, 0xc
mov edx, 0x5db7
push 0
push ecx
push 0x163d
push ecx
call fcn.1003b1ea
add esp, 0x1c
jmp 0x100402db
mov dword [ebp - 0x18], 0x6fe4
cmp dword [ebp - 0x18], 0x70e1
jle 0x1004036d
xor esi, esi
mov edi, esi
mov dword [ebp - 0x14], 0x3a09
xor ebx, ebx
mov eax, edi
mov ecx, 0x1007cab8
and eax, ebx
cdq
push edx
push eax
call fcn.10001cb3
inc ebx
cmp ebx, 0x2f2f
jl 0x1004032c
dec edi
dec dword [ebp - 0x14]
jne 0x1004032a
inc esi
cmp esi, 0x2aa4
jl 0x10040321
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0x1dcb
push 0
call esi
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x10040373
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp byte [ebp + 0xc], 0
je 0x10040386
push 0
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x1004039e
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x1004039e
push 0x2440
push 0
call esi
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x6d4b
jge 0x100402db
mov edx, str.puatub_doitqbx_papuwe_fxumxv
mov ecx, 0x1007cab8
call fcn.100036f5
jmp 0x100402db
Function at 0x40a15c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [ebp + 0xc]
mov word [ebp + 0xc], ax
mov ebx, 0x19826993
mov eax, ebx
mul ebx
mov dword [ebp - 0x10], eax
mov ebx, eax
xor esi, esi
mov eax, ebx
mul ebx
mov dword [ebp - 0x14], eax
mov ebx, eax
mov word [ebp - 0xc], 0
jmp 0x40a272
mov eax, ebx
xor eax, ebx
mov ebx, eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.00405066
pop ecx
mov edx, eax
mov byte [ebp - 1], dl
cmp byte [ebp - 1], 0
jne 0x40a1b3
mov byte [ebp - 2], 0
jmp 0x40a1dd
call fcn.0040ddd8
mov dword [ebp - 0x18], eax
mov eax, 0x7fff
mov edi, 7
movzx edx, byte [ebp - 1]
mov ecx, edi
sub ecx, edx
cdq
idiv ecx
mov ecx, eax
mov eax, dword [ebp - 0x18]
cdq
idiv ecx
mov edx, eax
mov byte [ebp - 2], dl
mov eax, dword [ebp + 8]
mov al, byte [esi + eax]
cmp al, 0x70
jb 0x40a1fc
cmp al, 0x7f
ja 0x40a1fc
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, dword [ebp + 8]
movzx eax, byte [esi + eax]
cmp eax, 0xe2
jne 0x40a21b
mov eax, dword [ebp + 8]
add eax, esi
inc eax
movzx edx, byte [eax]
movzx ecx, byte [ebp - 2]
sub edx, ecx
mov byte [eax], dl
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 8
push 0x90
lea eax, [ebp - 0xa]
push eax
call fcn.0040ddc0
movzx eax, byte [ebp - 1]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
lea eax, [ebp - 0xa]
movzx edx, byte [ebp - 2]
add eax, edx
push eax
call fcn.0040ddb4
mov eax, ebx
sub eax, ebx
mov ebx, eax
push 6
lea eax, [ebp - 0xa]
push eax
mov eax, dword [ebp + 8]
add eax, esi
push eax
call fcn.0040ddb4
add esp, 0x24
mov eax, ebx
add eax, ebx
mov ebx, eax
add esi, 6
inc word [ebp - 0xc]
movzx eax, word [ebp + 0xc]
dec eax
cmp esi, eax
jb 0x40a190
pop edi
pop esi
pop ebx
leave
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x408ecc
nop
nop
mov ecx, 0x3eed309b
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x43004e
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x430024
nop
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x2b97c7a
nop
nop
nop
nop
test eax, eax
je 0x430084
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43006c
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219
Function at 0x10022b40
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10022d50
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x10022c0d
mov edx, dword [ebp - 4]
cmp edx, dword [0x10036004]
jb 0x10022b8a
mov eax, dword [ebp - 4]
cmp eax, dword [0x10036008]
ja 0x10022b8a
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10022b5a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10011492
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10022bb0
jmp 0x10022c0d
cmp dword [ebp - 0x14], 0x10000
jne 0x10022bf3
cmp dword [ebp - 0x18], 0x10000
jb 0x10022bf3
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10022be6
mov eax, dword [ebp - 8]
jmp 0x10022c0f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10022c08
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10022d50
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10022b5a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10022c50
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10022d80
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10022d15
mov edx, dword [ebp - 4]
cmp edx, dword [0x10036004]
jb 0x10022c95
mov eax, dword [ebp - 4]
cmp eax, dword [0x10036008]
ja 0x10022c95
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10022c65
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call fcn.10011492
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x10022cbb
jmp 0x10022d15
cmp dword [ebp - 0x14], 0x10000
jne 0x10022cfe
cmp dword [ebp - 0x18], 0x10000
jb 0x10022cfe
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10022cf1
mov eax, dword [ebp - 8]
jmp 0x10022d17
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10022d10
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10022d80
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10022c65
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x10026380
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x10036890], 0
je 0x10026396
xor eax, eax
jmp 0x100265b5
cmp dword [0x1003688c], 0
je 0x100263a9
mov eax, dword [0x1003688c]
jmp 0x100265b5
push 0x24
push 0
push 0x10036860
call fcn.10011492
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [0x10036860], eax
push 0
push 0
push str.dbghelp.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov dword [0x10036864], eax
cmp dword [0x10036864], 0
jne 0x1002644f
mov dword [0x10036890], 1
cmp dword [0x10036864], 0
je 0x10026402
mov eax, dword [0x10036864]
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
nop
mov dword [0x10036868], 0
mov dword [0x1003686c], 0
mov dword [0x10036870], 0
mov dword [0x10036874], 0
mov dword [0x10036878], 0
mov dword [0x1003687c], 0
mov dword [0x10036880], 0
xor eax, eax
jmp 0x100265b5
push str.ImagehlpApiVersionEx
mov ecx, dword [0x10036864]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10036868], eax
push str.SymInitialize
mov edx, dword [0x10036864]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1003686c], eax
push str.SymSetOptions
mov eax, dword [0x10036864]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10036870], eax
push str.SymGetOptions
mov ecx, dword [0x10036864]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10036874], eax
push str.SymLoadModule64
mov edx, dword [0x10036864]
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10036878], eax
push str.SymGetModuleInfo64
mov eax, dword [0x10036864]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1003687c], eax
push str.SymFromName
mov ecx, dword [0x10036864]
push ecx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10036880], eax
push 8
push 0
lea edx, [ebp - 0xc]
push edx
call fcn.10011492
add esp, 0xc
mov eax, 0xc
mov word [ebp - 0xc], ax
cmp dword [0x10036868], 0
je 0x10026534
cmp dword [0x1003686c], 0
je 0x10026534
cmp dword [0x10036878], 0
je 0x10026534
cmp dword [0x1003687c], 0
je 0x10026534
cmp dword [0x10036880], 0
jne 0x10026539
jmp 0x100263e2
lea ecx, [ebp - 0xc]
push ecx
call dword [0x10036868]
nop
movzx edx, word [ebp - 0xc]
cmp edx, 0xc
jge 0x10026552
jmp 0x100263e2
push 0
push 0
mov eax, dword [0x10036860]
push eax
call dword [0x1003686c]
test eax, eax
jne 0x1002656b
jmp 0x100263e2
cmp dword [0x10036874], 0
je 0x100265a6
cmp dword [0x10036870], 0
je 0x100265a6
call dword [0x10036874]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
and ecx, 0xfffffff8
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 4]
or edx, 0x2704
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
push eax
call dword [0x10036870]
nop
mov dword [0x1003688c], 0x10036860
mov eax, dword [0x1003688c]
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x401012
mov eax, dword [0x4e553b]
shl eax, 2
mov dword [0x4e553f], eax
push edx
push 0
call fcn.004e3d14
mov edx, eax
call fcn.004d90a4
pop edx
call fcn.004d8440
call fcn.004d90a8
push 0
call fcn.004da02c
pop ecx
push 0x4e54e4
push 0
call fcn.004e3d14
mov dword [0x4e5543], eax
push 0
jmp fcn.004e1804
Function at 0x41ed82
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push 0
cmp dword [ebp + 0xc], 0
je 0x41ed98
mov eax, 2
jmp 0x41ed9a
xor eax, eax
push eax
push 0
xor edx, edx
mov dl, bl
push edx
call fcn.004e4630
push eax
push ebx
call fcn.004e479e
pop ebx
pop ebp
ret
Function at 0x4243af
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x48]
push eax
push ebx
call fcn.004e4372
mov esi, eax
push ebx
call fcn.004e4594
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
inc eax
push eax
call sym.SISCOM.EXE__hb_xgrab
pop ecx
mov edi, eax
push 0
push 0
push 0x31
push ebx
call fcn.004e454c
push eax
call fcn.004e454c
push eax
call fcn.004e46b4
push eax
push esi
call fcn.004e4298
mov dword [ebp - 8], eax
lea eax, [ebp - 0x58]
push eax
push ebx
call fcn.004e44da
push 1
push esi
call fcn.004e42aa
mov edx, dword [ebp - 4]
inc edx
push edx
push edi
push ebx
call fcn.004e458e
push 0
lea ecx, [ebp - 0x58]
push ecx
push 0xffffffffffffffff
push edi
push esi
call fcn.004e4468
push edi
call sym.SISCOM.EXE__hb_xfree
pop ecx
push dword [ebp - 8]
push esi
call fcn.004e4298
lea eax, [ebp - 0x48]
push eax
push ebx
call fcn.004e448c
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42444f
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff90
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x60]
push eax
push ebx
call fcn.004e4372
mov esi, eax
push ebx
call fcn.004e454c
push eax
call fcn.004e44ec
mov dword [ebp - 8], eax
call fcn.00423c68
lea eax, [ebp - 0x70]
push eax
push ebx
call fcn.004e44da
push 0x6f228a
push ebx
call dword [0x6f2154]
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x70]
mov dword [ebp - 0xc], edx
mov ecx, dword [ebp - 0x68]
mov dword [ebp - 0x10], ecx
lea eax, [ebp - 0x10]
push eax
push ebx
call fcn.004e43a8
lea edx, [ebp - 0x10]
push edx
push ebx
call fcn.004e454c
push eax
call fcn.004e46a2
push 0xcc0020
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 8]
mov ecx, dword [ebp - 0x64]
sub ecx, dword [ebp - 0x6c]
push ecx
mov eax, dword [ebp - 0x68]
sub eax, dword [ebp - 0x70]
push eax
push 0
push 0
push esi
call fcn.004e40fa
mov edx, dword [ebp - 0x68]
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x68], 0x10
push 0
push 0
push 0xf0
push ebx
call fcn.004e46b4
dec eax
jne 0x424515
push 0
lea ecx, [ebp - 0x70]
push ecx
push 5
push 2
push esi
push dword [ebp - 4]
call dword [0x6f2158]
jmp 0x424529
push 0
lea eax, [ebp - 0x70]
push eax
push 1
push 2
push esi
push dword [ebp - 4]
call dword [0x6f2158]
mov edx, dword [ebp - 0xc]
mov dword [ebp - 0x68], edx
mov dword [ebp - 0x70], 0xf
push ebx
call fcn.004e4594
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x14]
inc ecx
push ecx
call sym.SISCOM.EXE__hb_xgrab
pop ecx
mov edi, eax
mov eax, dword [ebp - 0x14]
inc eax
push eax
push edi
push ebx
call fcn.004e458e
push 0
push 0
push 0xffffffffffffffff
push edi
push 1
push 1
call fcn.004e3e46
mov dword [ebp - 0x18], eax
mov edx, dword [ebp - 0x18]
add edx, edx
push edx
call sym.SISCOM.EXE__hb_xgrab
pop ecx
mov dword [ebp - 0x1c], eax
push 0
push 0
push 0x31
push ebx
call fcn.004e454c
push eax
call fcn.004e454c
push eax
call fcn.004e46b4
push eax
push esi
call fcn.004e4298
mov dword [ebp - 0x20], eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x14]
push edi
push 1
push 1
call fcn.004e3e46
add dword [ebp - 0x70], 2
add dword [ebp - 0x6c], 5
add dword [ebp - 0x64], 5
lea ecx, [ebp - 0x70]
push ecx
push 0
push 0
mov eax, dword [ebp - 0x18]
dec eax
push eax
push dword [ebp - 0x1c]
push 0
push 2
push esi
push dword [ebp - 4]
call dword [0x6f2164]
push dword [ebp - 0x20]
push esi
call fcn.004e4298
push dword [ebp - 0x1c]
call sym.SISCOM.EXE__hb_xfree
pop ecx
push edi
call sym.SISCOM.EXE__hb_xfree
pop ecx
push dword [ebp - 4]
call dword [0x6f2160]
push dword [ebp - 8]
push ebx
call fcn.004e454c
push eax
call fcn.004e4696
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x43392b
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
push esi
call fcn.004e3e4c
test ebx, ebx
jne 0x433949
push esi
call fcn.004d9368
pop ecx
mov ebx, eax
cmp dword [0x6f37f4], 0
je 0x433957
call fcn.0043a8f1
test ebx, ebx
jbe 0x433965
push ebx
push esi
call fcn.0043b0bf
add esp, 8
cmp dword [0x6f37f4], 0
je 0x433973
call fcn.0043a915
pop esi
pop ebx
pop ebp
ret

Function at 0x436dd0
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov esi, dword [ebp + 8]
xor edi, edi
xor eax, eax
mov dword [ebp - 4], eax
lea edx, [ebp - 4]
push edx
push esi
call fcn.00439414
add esp, 8
mov esi, eax
push esi
call fcn.004d9368
pop ecx
mov ebx, eax
jmp 0x436dfc
dec ebx
test ebx, ebx
je 0x436e17
movsx eax, byte [esi + ebx - 1]
push eax
push 0x6f3a5c
call fcn.004d9298
add esp, 8
test eax, eax
jne 0x436dfb
test ebx, ebx
je 0x436e37
cmp ebx, 0x107
jg 0x436e37
push esi
call fcn.004e3ce4
cmp eax, 0xffffffff
jne 0x436e32
xor edi, edi
jmp 0x436e37
mov edi, eax
and edi, 0x10
push 0
call fcn.0043974b
pop ecx
cmp dword [ebp - 4], 0
je 0x436e4e
push dword [ebp - 4]
call sym.SISCOM.EXE__hb_xfree
pop ecx
mov eax, edi
pop edi
pop esi
pop ebx
pop ecx
pop ebp
ret