joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4aa710
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x526060]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
mov dword [ebp - 0x210], 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esi, dword [ebp + 0xc]
push eax
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
add esi, 0xffffffdf
mov edi, eax
cmp esi, 0xd
ja case.0x4aa759.41
movzx eax, byte [esi + 0x4aa7d0]
jmp dword [eax*4 + 0x4aa7c8]
or edi, 0x100
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004c4090
add esp, 0xc
lea eax, [ebp - 0x20c]
mov ecx, edi
or ecx, 0x1000000
cmp dword [ebp + 0x10], 0
push 0x104
cmove ecx, edi
push eax
shl ecx, 0x10
push ecx
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call fcn.00458050
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00412b06
mov esp, ebp
pop ebp
ret 0xc

Function at 0x4aa760
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x526060]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
mov dword [ebp - 0x210], 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esi, dword [ebp + 0xc]
push eax
push 0
push esi
call dword [sym.imp.USER32.dll_MapVirtualKeyExW]
add esi, 0xffffffdf
mov edi, eax
cmp esi, 0xd
ja case.0x4aa759.41
movzx eax, byte [esi + 0x4aa7d0]
jmp dword [eax*4 + 0x4aa7c8]
or edi, 0x100
push 0x208
lea eax, [ebp - 0x20c]
push 0
push eax
call fcn.004c4090
add esp, 0xc
lea eax, [ebp - 0x20c]
mov ecx, edi
or ecx, 0x1000000
cmp dword [ebp + 0x10], 0
push 0x104
cmove ecx, edi
push eax
shl ecx, 0x10
push ecx
call dword [sym.imp.USER32.dll_GetKeyNameTextW]
push 0xffffffffffffffff
lea eax, [ebp - 0x20c]
mov ecx, ebx
push eax
call fcn.00458050
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00412b06
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4aaab0
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4e9f7b
mov eax, dword fs:[0]
push eax
sub esp, 0x98
mov eax, dword [0x526060]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov eax, dword [ebp + 8]
mov dword [edi + 0x10], eax
test eax, eax
je 0x4aabe7
lea eax, [ebp - 0xa4]
push eax
call fcn.004aa020
mov ecx, dword [edi + 0x10]
movups xmm0, xmmword [ebp - 0xa4]
push 0
sub esp, 0x10
mov eax, esp
push 0
movups xmmword [eax], xmm0
mov eax, dword [ecx]
push 0x40000080
push 0
call dword [eax + 0x1c]
mov ecx, eax
call fcn.00451790
push eax
mov ecx, edi
call fcn.00457830
push eax
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x4aabe7
mov esi, dword [edi + 0x10]
mov ecx, esi
call fcn.00494040
push eax
mov eax, dword [esi]
mov ecx, esi
call dword [eax + 0x1c]
mov ecx, eax
call fcn.004511c0
push 1
push dword [eax]
push 0x30
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SendMessageW]
mov ecx, dword [edi + 0x10]
movzx eax, word [ecx + 0x726]
push eax
movzx eax, word [ecx + 0x724]
mov ecx, edi
push eax
call fcn.004ab1d0
lea eax, [ebp - 0x94]
mov ecx, edi
push eax
call fcn.004aa4e0
mov ecx, dword [edi + 0x10]
push eax
add ecx, 0x1c8
mov dword [ebp - 4], 0
call fcn.00458250
lea ecx, [ebp - 0x94]
mov dword [ebp - 4], 0xffffffff
call fcn.004581b0
mov ecx, dword [edi + 0x10]
mov eax, dword [ecx]
mov eax, dword [eax + 0x100]
call eax
xor ecx, ecx
cmp al, 1
sete cl
push ecx
push dword [edi + 4]
call dword [sym.imp.USER32.dll_EnableWindow]
push 4
push dword [edi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
push dword [edi + 4]
call dword [sym.imp.USER32.dll_SetFocus]
mov byte [edi + 0x18], 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.00412b06
mov esp, ebp
pop ebp
ret 4

Function at 0x4ae013
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x4d9d07
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004d99c7

Function at 0x4dba39
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004db8b8
Function at 0x1000aa00
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
mov edi, dword [ebp + 8]
test edi, edi
je 0x1000aa5d
push esi
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x1000aa23
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0xe
call fcn.10003680
add esp, 4
push edi
test eax, eax
je 0x1000aa36
call eax
jmp 0x1000aa3c
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
test esi, esi
je 0x1000aa49
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
cmp ebx, 0xffffffff
je 0x1000aa5d
test bl, 0x10
jne 0x1000aa5d
pop edi
mov eax, 1
pop ebx
pop ebp
ret
pop edi
xor eax, eax
pop ebx
pop ebp
ret

Function at 0x10013030
Capabilities:
Contain obfuscated stackstrings

Disassembly:
jmp 0x101c8b00
sub esp, 0x14
lea edx, [esp]
mov dword [esp], 0x526c6c44
mov dword [esp + 4], 0x73696765
add al, 0x65
imul esi, dword [bp + di - 0x39], 0x74082444
jb 0x101c8b70
mov dword [esp + 0xc], 0x65767265
mov word [esp + 0x10], 0x72
call fcn.101c9030
call eax
xor eax, eax
add esp, 0x14
ret
Function at 0x100de170
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
cmp dword [ebp - 0x114], 6
je 0x100de1b5
ja 0x100de1b5
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret

Function at 0x100de1d0
Capabilities:
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x118
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x118]
mov dword [ebp - 0x118], 0x114
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
mov ecx, dword [ebp - 4]
xor eax, eax
cmp dword [ebp - 0x114], 5
sete al
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret

Function at 0x100de220
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push edi
lea eax, [ebp - 8]
xor edi, edi
push eax
lea eax, [ebp - 4]
mov dword [ebp - 0x10], edi
push eax
push 1
push edi
push edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call fcn.101c9146
test eax, eax
je 0x100de2d5
push ebx
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], edi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
xor ebx, ebx
cmp dword [ebp - 8], ebx
jbe 0x100de2cc
push esi
xor esi, esi
lea ebx, [ebx]
mov ecx, dword [ebp - 4]
mov eax, dword [ecx + esi]
cmp eax, dword [ebp - 0xc]
jne 0x100de2c2
push dword [ebp + 8]
push dword [ecx + esi + 8]
call sub.msvcrt.dll__wcsicmp
add esp, 8
test eax, eax
jne 0x100de2c2
mov eax, dword [ebp - 4]
push dword [esi + eax + 4]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x100de2bf
push 1
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, 1
mov dword [ebp - 0x10], edi
jmp 0x100de2c2
mov edi, dword [ebp - 0x10]
inc ebx
add esi, 0x10
cmp ebx, dword [ebp - 8]
jb 0x100de270
pop esi
push dword [ebp - 4]
call fcn.101c914c
pop ebx
mov eax, edi
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x100f2fc0
Capabilities:
Check if file exists

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov esi, ecx
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
mov dword [ebp - 0x404], 0
mov dword [ebp - 0x408], eax
mov ecx, esi
lea eax, [ebp - 0x408]
mov dword [ebp - 0x400], 0
push eax
lea eax, [ebp - 0x400]
push eax
lea eax, [ebp - 0x404]
push eax
call fcn.100f6220
or edi, 0xffffffff
test eax, eax
je 0x100f302c
lea esi, [edi + 2]
jmp 0x100f3139
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
add eax, 0x10
lea ecx, [ebp - 0x3fc]
mov dword [ebp - 0x400], eax
call fcn.100f2d80
lea eax, [ebp - 0x3fc]
mov ecx, esi
push eax
push dword [esi + 0xd0]
call fcn.100f3d90
test eax, eax
je 0x100f3117
cmp dword [ebp - 0x3fc], 0x55484951
jne 0x100f3117
mov eax, dword [ebp - 0x3f8]
mov ebx, dword [ebp - 0x3f4]
mov dword [ebp - 0x404], eax
test eax, eax
jne 0x100f3092
test ebx, ebx
je 0x100f30aa
push dword [ebp - 0x3f0]
lea eax, [ebp - 0x3ec]
push eax
lea ecx, [ebp - 0x400]
call fcn.10003740
cmp dword [esi + 0xfc], 0
je 0x100f3117
push dword [esi + 0xd0]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x100f3117
push ecx
lea eax, [ebp - 0x400]
mov ecx, esp
push eax
call fcn.1001b810
mov ecx, esi
call fcn.100f3170
test eax, eax
jne 0x100f30ef
push 0xb
push str.about:blank
lea ecx, [ebp - 0x400]
call fcn.10003740
push 0xb
push str.sysr_atad_5
push ebx
push dword [ebp - 0x404]
lea eax, [ebp - 0x400]
push ecx
mov ecx, esp
push eax
call fcn.1001b810
mov ecx, esi
call fcn.100f63e0
xor esi, esi
jmp 0x100f311c
mov esi, 1
mov edx, dword [ebp - 0x400]
mov eax, edi
add edx, 0xfffffff0
lock xadd dword [edx + 0xc], eax
dec eax
test eax, eax
jg 0x100f3139
mov ecx, dword [edx]
push edx
mov eax, dword [ecx]
call dword [eax + 4]
mov eax, dword [ebp - 0x408]
add eax, 0xfffffff0
lock xadd dword [eax + 0xc], edi
dec edi
test edi, edi
jg 0x100f3154
mov ecx, dword [eax]
push eax
mov edx, dword [ecx]
call dword [edx + 4]
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
Function at 0x10124920
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 8], edi
call fcn.10002d70
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0xc]
mov ebx, dword [ebp + 8]
add eax, 0x10
mov dword [ebx], eax
mov esi, dword [edi]
cmp esi, dword [edi + 4]
je 0x101249d0
lea edi, [esi + 0x18]
cmp dword [edi + 0x18], 0x70000
jne 0x10124983
cmp dword [edi - 4], 8
mov eax, esi
jb 0x10124963
mov eax, dword [esi]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [edi + 0x14], 8
mov ebx, edi
mov dword [ebp - 4], eax
jb 0x10124977
mov ebx, dword [edi]
cmp dword [edi - 4], 8
mov edx, esi
jb 0x1012499d
mov edx, dword [esi]
jmp 0x1012499d
cmp dword [edi + 0x14], 8
mov ebx, edi
jb 0x1012498d
mov ebx, dword [edi]
cmp dword [edi - 4], 8
mov edx, esi
jb 0x10124997
mov edx, dword [esi]
mov eax, dword [edi + 0x20]
mov dword [ebp - 4], eax
mov eax, dword [edi + 0x28]
mov ecx, dword [edi + 0x24]
push eax
mov eax, dword [edi + 0x1c]
push ecx
push dword [ebp - 4]
push eax
push dword [edi + 0x18]
push ebx
mov ebx, dword [ebp + 8]
push edx
push str._s__s__u__u__u__u__u_
push ebx
call fcn.10123b20
mov eax, dword [ebp - 8]
add esi, 0x44
add esp, 0x24
add edi, 0x44
cmp esi, dword [eax + 4]
jne 0x10124950
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10124d70
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20c
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [0x10247120], 0
je 0x10124e78
push 0x208
lea eax, [ebp - 0x20c]
mov dword [0x10247120], 0
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0xc
lea eax, [ebp - 0x20c]
push 0x104
push eax
push dword [0x10257d10]
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
test eax, eax
jne 0x10124ddf
mov eax, 1
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
push ebx
push esi
push str...SoftMgrSpeedupQuarant.dll
lea eax, [ebp - 0x20c]
push eax
push eax
call dword [sym.imp.SHLWAPI.dll_PathCombineW]
call fcn.10003180
mov esi, dword [eax + 0x154]
test esi, esi
je 0x10124e0a
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
push 0xe
call fcn.10003680
add esp, 4
test eax, eax
je 0x10124e23
lea ecx, [ebp - 0x20c]
push ecx
call eax
jmp 0x10124e30
lea eax, [ebp - 0x20c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, eax
test esi, esi
je 0x10124e3d
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
cmp ebx, 0xffffffff
je 0x10124e61
test bl, 0x10
jne 0x10124e61
mov eax, 1
pop esi
mov dword [0x10247124], eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
xor eax, eax
pop esi
mov dword [0x10247124], eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, dword [0x10247124]
xor ecx, ebp
call fcn.101f99c6
mov esp, ebp
pop ebp
ret
Function at 0x1014cc50
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
mov esi, ecx
mov eax, dword [esi + 0x38]
test eax, eax
je 0x1014cc6a
push eax
call ebx
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x1014cc74
push eax
call ebx
mov eax, dword [esi + 0x40]
test eax, eax
je 0x1014cc7e
push eax
call ebx
cmp dword [esi + 0x44], 0
mov dword [esi + 0x38], 0
mov dword [esi + 0x3c], 0
mov dword [esi + 0x40], 0
je 0x1014cca6
mov ecx, esi
call fcn.1014cdf0
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [esi + 0x48], 0
je 0x1014cccc
cmp dword [esi + 0x18], 0
je 0x1014cccc
cmp dword [esi + 0x30], 0
je 0x1014cccc
lea eax, [esi + 0x20]
push eax
lea eax, [esi + 8]
push eax
call fcn.1002d9f0
add esp, 8
test al, al
je 0x1014cc99
push edi
lea eax, [ebp - 0xc]
mov byte [ebp - 1], 0
push eax
lea eax, [ebp - 8]
mov dword [ebp - 8], 0
push eax
push 1
push 0
push 0
mov dword [ebp - 0xc], 0
call fcn.101c9146
test eax, eax
je 0x1014cd72
cmp dword [ebp - 0xc], 0
mov dword [ebp - 0x10], 0
jbe 0x1014cd60
xor edi, edi
mov ecx, dword [ebp - 8]
mov eax, dword [ecx + edi]
cmp eax, dword [esi]
jne 0x1014cd51
push str.explorer.exe
push dword [ecx + edi + 8]
call sub.msvcrt.dll__wcsicmp
add esp, 8
test eax, eax
jne 0x1014cd51
mov eax, dword [ebp - 8]
push dword [edi + eax + 4]
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ebx, eax
test ebx, ebx
je 0x1014cd51
push 1
push ebx
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
call ebx
mov byte [ebp - 1], 1
mov eax, dword [ebp - 0x10]
add edi, 0x10
inc eax
mov dword [ebp - 0x10], eax
cmp eax, dword [ebp - 0xc]
jb 0x1014cd05
push dword [ebp - 8]
call fcn.101c914c
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, 4
jmp 0x1014cd80
push str.Program_Manager
push str.Progman
push 0
push 0
call dword [sym.imp.USER32.dll_FindWindowExW]
test eax, eax
je 0x1014cde3
lea ecx, [ebp - 0x10]
mov dword [ebp - 0x10], 0
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
cmp dword [ebp - 0x10], 0
jbe 0x1014cdde
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, dword [ebp - 0x10]
cmp eax, ecx
je 0x1014cdde
push ecx
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1014cdde
push 1
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call ebx
mov byte [ebp - 1], 1
sub edi, 1
jne 0x1014cd80
mov al, byte [ebp - 1]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1014d3f0
Capabilities:
Create process on windows
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x670
mov eax, dword [0x102519c8]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
mov ebx, ecx
jmp 0x1014d410
push dword [ebx + 0x40]
mov byte [ebp - 0x615], 0
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
je 0x1014d60f
push 0
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
mov dword [ebp - 0x66c], 0
push 0x1e0
push eax
mov word [ebp - 0x62e], ax
lea edi, [ebp - 0x204]
mov dword [ebp - 0x62c], eax
mov ecx, 8
mov dword [ebp - 0x628], eax
mov esi, str.WinSta0Default
mov dword [ebp - 0x624], eax
mov dword [ebp - 0x620], eax
lea eax, [ebp - 0x1e4]
rep movsd dword es:[edi], dword [esi]
push eax
mov dword [ebp - 0x664], 0
mov dword [ebp - 0x660], 0
mov dword [ebp - 0x65c], 0
mov dword [ebp - 0x658], 0
mov dword [ebp - 0x654], 0
mov dword [ebp - 0x650], 0
mov dword [ebp - 0x64c], 0
mov dword [ebp - 0x648], 0
mov dword [ebp - 0x63e], 0
mov dword [ebp - 0x63a], 0
mov dword [ebp - 0x636], 0
mov dword [ebp - 0x632], 0
mov dword [ebp - 0x670], 0x44
call sub.msvcrt.dll_memset
add esp, 0xc
mov dword [ebp - 0x644], 1
lea eax, [ebp - 0x204]
mov dword [ebp - 0x61c], 0
mov dword [ebp - 0x668], eax
mov eax, 5
mov word [ebp - 0x640], ax
lea eax, [ebp - 0x61c]
push 0
push dword [ebx + 0x40]
push eax
call fcn.101c9158
push 0x208
lea eax, [ebp - 0x614]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x208
lea eax, [ebp - 0x40c]
push 0
push eax
call sub.msvcrt.dll_memset
add esp, 0x18
lea eax, [ebp - 0x40c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
lea eax, [ebp - 0x40c]
push eax
push str.__sexplorer.exe_
lea eax, [ebp - 0x614]
push 0x103
push eax
call fcn.101fa3aa
add esp, 0x10
lea eax, [ebp - 0x62c]
push eax
lea eax, [ebp - 0x670]
push eax
push 0
push dword [ebp - 0x61c]
lea eax, [ebp - 0x614]
push 0x410
push 0
push 0
push 0
push eax
push 0
push dword [ebx + 0x40]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x1014d5f0
push dword [ebp - 0x62c]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x615], 1
call esi
push dword [ebp - 0x628]
call esi
call dword [sym.imp.ADVAPI32.dll_RevertToSelf]
mov eax, dword [ebp - 0x61c]
test eax, eax
je 0x1014d606
push eax
call fcn.101c915e
cmp byte [ebp - 0x615], 0
jne 0x1014d634
cmp byte [ebp + 8], 0
jne 0x1014d634
mov ecx, ebx
call fcn.1014d060
test al, al
jne 0x1014d634
mov ecx, ebx
call fcn.1014d6a0
test al, al
je 0x1014d634
mov byte [ebp + 8], 1
jmp 0x1014d410
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.101f99c6
mov esp, ebp
pop ebp
ret 4
Function at 0x101c679b
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, ecx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebx]
add ecx, 8
mov dword [ebp - 4], eax
mov eax, dword [ecx + 0x5a8]
mov dword [ecx + 0x5b0], eax
call fcn.101c693e
mov edi, eax
test edi, edi
je 0x101c6826
mov eax, dword [ebp - 4]
cmp eax, dword [edi]
jne 0x101c67d6
mov esi, edi
jmp 0x101c6812
push dword [edi]
push 1
push 0x40
call dword [sym.imp.KERNEL32.dll_OpenThread]
test eax, eax
jne 0x101c680b
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x101c67fe
mov ecx, dword [ebx]
push edi
add ecx, 8
call fcn.101c68d9
jmp 0x101c6812
push str.
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
jmp 0x101c6812
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebx]
add ecx, 8
call fcn.101c693e
mov edi, eax
test edi, edi
jne 0x101c67cb
test esi, esi
jne 0x101c683b
mov ecx, dword [ebx]
add ecx, 8
call fcn.101c6ad2
mov esi, eax
test esi, esi
je 0x101c683b
mov eax, dword [ebp - 4]
mov dword [esi], eax
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret

Function at 0x101c7d40
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
add eax, 0x18
add eax, ecx
movzx ecx, word [ecx + 6]
lea ecx, [ecx + ecx*4]
lea edi, [eax + ecx*8]
cmp eax, edi
je 0x101c7d7e
mov esi, dword [ebp + 0xc]
mov edx, dword [eax + 0xc]
cmp esi, edx
jb 0x101c7d77
mov ecx, dword [eax + 8]
add ecx, edx
cmp esi, ecx
jb 0x101c7d80
add eax, 0x28
cmp eax, edi
jne 0x101c7d67
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x101c86a0
Capabilities:
Get process heap force flags

Disassembly:
mov eax, dword fs:[0x18]
mov ecx, dword [eax + 0x30]
mov eax, dword [ecx + 0xa4]
shl eax, 0x10
or eax, dword [ecx + 0xa8]
ret

Function at 0x101c8b40
Capabilities:
Contain obfuscated stackstrings
Resolve function by parsing pe exports

Disassembly:
sub esp, 0xe4
xor eax, eax
mov dword [esp + 0x3c], ecx
mov dword [esp + 0x14], 0x53453c5e
mov ecx, 0x3d090c
mov dword [esp + 0x18], 0x6751375f
mov dword [esp + 0x1c], 0x506d7826
mov dword [esp + 0x20], 0x4c315363
mov dword [esp + 0x24], 0x5e70246a
mov word [esp + 0x28], 0x7023
mov byte [esp + 0x2a], 0
mov dword [esp + 0x40], 0x65006b
mov dword [esp + 0x44], 0x6e0072
mov dword [esp + 0x48], 0x6c0065
mov dword [esp + 0x4c], 0x320033
mov dword [esp + 0x50], 0x64002e
mov dword [esp + 0x54], 0x6c006c
mov word [esp + 0x58], ax
lea ebx, [ebx]
Function at 0x101c8bc0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
xor eax, eax
mov byte [esp + eax + 0x78], al
inc eax
cmp eax, 0x6a
jb 0x101c8bc2
dec ecx
jne fcn.101c8bc0
cmp byte [esp + 0xa8], 0x30
push ebx
push ebp
push esi
push edi
jne 0x101c8bea
lea ecx, [esp + 0x50]
call fcn.101c9100
mov esi, eax
jmp 0x101c8bee
mov esi, dword [esp + 0x4c]
mov edx, 0xe3142
mov ecx, esi
call fcn.101c91d0
mov ebx, eax
mov edx, 0xd5786
mov ecx, esi
mov dword [esp + 0x18], ebx
call fcn.101c91d0
mov edx, 0x348bfa
mov dword [esp + 0x78], eax
mov ecx, esi
call fcn.101c91d0
push 4
push 0x3000
push 0xcfc00
push 0
mov dword [esp + 0x80], eax
call ebx
mov ebp, eax
movsx edx, byte [esp + 0xe0]
mov eax, section.YX
movsx ecx, byte [esp + 0x88]
sub eax, ebp
imul edx, ecx
mov dword [esp + 0x10], eax
xor edi, edi
mov eax, 1
mov dword [esp + 0x48], ebp
sub eax, ebp