joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4819fa
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4c8ba0]
test eax, eax
je 0x481a0d
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
ret
push esi
push 0x94
call fcn.00444d68
pop ecx
test eax, eax
je 0x481a28
mov ecx, eax
call fcn.0048152b
mov esi, eax
jmp 0x481a2a
xor esi, esi
push 0
push 0x25
mov ecx, esi
call fcn.0044fa2a
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret

Function at 0x4844c6
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4c8ba4]
push esi
push edi
mov edi, ecx
test eax, eax
je 0x4844e4
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov esi, dword [0x4c8ba4]
jmp 0x484516
push 0x17c
call fcn.00444d68
pop ecx
test eax, eax
je 0x4844fe
mov ecx, eax
call fcn.00483f8f
mov esi, eax
jmp 0x484500
xor esi, esi
push 0
push 0x13
mov ecx, esi
call fcn.0044fa2a
push 5
push dword [esi + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
cmp edi, 0xffffffff
je 0x484523
push edi
mov ecx, esi
call fcn.0048200b
pop edi
pop esi
ret

Function at 0x484626
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
push ebx
push esi
mov esi, ecx
push edi
push esi
mov dword [ebp - 8], edx
mov dword [ebp - 4], esi
call dword [sym.imp.USER32.dll_GetParent]
mov ebx, eax
lea eax, [ebp - 0x18]
push eax
mov edx, esi
mov ecx, ebx
call fcn.0044ffa8
mov eax, dword [ebp - 8]
xor edi, edi
cmp eax, edi
jne 0x484672
push 0x1fd
lea eax, [ebp - 0x218]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp - 0x218]
mov ecx, dword [ebp - 0xc]
sub ecx, dword [ebp - 0x14]
push edi
push dword [0x4c61f8]
push edi
push ebx
push ecx
mov ecx, dword [ebp - 0x10]
sub ecx, dword [ebp - 0x18]
push ecx
push dword [ebp - 0x14]
mov ecx, dword [ebp + 0xc]
push dword [ebp - 0x18]
or ecx, 0x50010000
push ecx
push eax
push str.SysLink
push edi
call dword [sym.imp.USER32.dll_CreateWindowExW]
mov esi, dword [sym.imp.USER32.dll_SendMessageW]
mov ebx, eax
mov eax, dword [ebp + 8]
cmp eax, edi
jne 0x4846be
push edi
push edi
push 0x31
push dword [ebp - 4]
call esi
push edi
push eax
push 0x30
push ebx
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
leave
ret 8

Function at 0x484971
Capabilities:
Hide graphical window

Disassembly:
push ebx
push ebp
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetDlgItem]
push 0
movzx esi, dx
push 0
mov ebx, ecx
push esi
push ebx
call edi
xor edx, edx
mov ecx, eax
call fcn.00484626
push esi
push ebx
mov ebp, eax
call edi
test ebp, ebp
je 0x4849a6
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
mov eax, ebp
pop edi
pop esi
pop ebp
pop ebx
ret

Function at 0x4857f5
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [ecx + 0x24]
lea edx, [eax + 1]
cmp edx, 2
jne 0x485805
jmp fcn.00484bd2
test eax, eax
jne 0x48580a
inc eax
push 0
push 3
mov dword [ecx + 0x24], eax
pop edx
mov ecx, eax
call fcn.00485271
ret 4
Function at 0x485d80
Capabilities:
Hide graphical window

Disassembly:
mov eax, dword [0x4c8c10]
test eax, eax
je 0x485d93
push dword [eax + 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
ret
mov edx, 0x4a7124
mov ecx, 0x4c8bf0
call fcn.0041e474
push 0x268
call fcn.00444d68
pop ecx
test eax, eax
je 0x485dbc
mov ecx, eax
call fcn.004855eb
mov ecx, eax
jmp 0x485dbe
xor ecx, ecx
push esi
push 0
push 0xf8
mov dword [0x4c8c10], ecx
call fcn.0044fa2a
mov eax, dword [0x4c8c10]
push dword [0x4cf0c0]
mov esi, dword [eax + 4]
call fcn.0043c727
pop ecx
push eax
push esi
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov eax, dword [0x4c8c10]
push 5
push dword [eax + 4]
call dword [sym.imp.USER32.dll_ShowWindow]
pop esi
ret
Function at 0x48bb84
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x30]
cmp dword [ebx], 0
je 0x48bd60
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x48bd60
dec eax
push ebp
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov ebp, 0x100c
je 0x48bccd
sub eax, 3
je 0x48bcab
dec eax
je 0x48bc89
dec eax
je 0x48bc67
dec eax
jne 0x48bcee
mov eax, dword [esi + 0x28]
mov eax, dword [eax + 8]
push 2
push 0xffffffffffffffff
push ebp
xor ebx, ebx
push eax
jmp 0x48bc00
mov edx, dword [esi + 0x2c]
mov ecx, eax
imul ecx, ecx, 0x2c
cmp dword [ecx + edx + 8], 0
je 0x48bbf5
inc ebx
mov ecx, dword [esi + 0x28]
mov ecx, dword [ecx + 8]
push 2
push eax
push ebp
push ecx
call edi
cmp eax, 0xffffffff
jne 0x48bbe5
cmp byte [0x4c8208], 0
je 0x48bcee
cmp ebx, 1
mov dword [esp + 0x10], 9
mov dword [esp + 0x24], 0x4c8208
mov dword [esp + 0x14], 0x24
jle 0x48bc40
push ebx
push dword [0x4cf2e0]
call fcn.0043c727
pop ecx
jmp 0x48bc4b
push dword [0x4cf2e4]
call fcn.0043c727
pop ecx
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00450a20
pop ecx
pop ecx
cmp eax, 6
jne 0x48bd5e
jmp 0x48bcee
call fcn.00429592
mov ebx, dword [ebx]
mov al, byte [ebx + 0x46]
and al, 6
cmp al, 4
je 0x48bc80
or byte [ebx + 0x46], 4
jmp 0x48bd59
and byte [ebx + 0x46], 0xfb
jmp 0x48bd59
call fcn.00429592
mov ebx, dword [ebx]
mov al, byte [ebx + 0x46]
and al, 0xa
cmp al, 8
je 0x48bca2
or byte [ebx + 0x46], 8
jmp 0x48bd59
and byte [ebx + 0x46], 0xf7
jmp 0x48bd59
call fcn.00429592
mov ebx, dword [ebx]
mov al, byte [ebx + 0x46]
and al, 3
cmp al, 1
je 0x48bcc4
or byte [ebx + 0x46], 1
jmp 0x48bd59
and byte [ebx + 0x46], 0xfe
jmp 0x48bd59
push 0xa3
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor edx, edx
inc edx
mov ecx, ebx
test ax, ax
jge 0x48bce9
call fcn.00478464
jmp 0x48bcee
call fcn.0048ceb0
call fcn.00429592
push 2
push 0xffffffffffffffff
jmp 0x48bd48
mov ecx, dword [esi + 0x2c]
mov eax, ebx
imul eax, eax, 0x2c
mov eax, dword [eax + ecx + 8]
mov ecx, dword [esp + 0x34]
dec ecx
dec ecx
je 0x48bd2c
dec ecx
je 0x48bd24
sub ecx, 4
jne 0x48bd45
test eax, eax
je 0x48bd45
mov ecx, dword [esi + 0x30]
push eax
call fcn.00406e71
jmp 0x48bd45
test eax, eax
je 0x48bd30
and dword [eax + 0x20], 0
test eax, eax
jne 0x48bd3c
mov eax, dword [esi + 0x30]
and dword [eax + 0x118], 0
jmp 0x48bd45
mov ecx, dword [esi + 0x30]
push eax
call fcn.00407822
push 2
push ebx
mov eax, dword [esi + 0x28]
mov eax, dword [eax + 8]
push ebp
push eax
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x48bcf9
call fcn.004295a3
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x20
ret 4
Function at 0x48bb88
Capabilities:
Log keystrokes via polling

Disassembly:
sub esp, 0x20
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x30]
cmp dword [ebx], 0
je 0x48bd60
mov eax, dword [esp + 0x2c]
test eax, eax
je 0x48bd60
dec eax
push ebp
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageW]
mov ebp, 0x100c
je 0x48bccd
sub eax, 3
je 0x48bcab
dec eax
je 0x48bc89
dec eax
je 0x48bc67
dec eax
jne 0x48bcee
mov eax, dword [esi + 0x28]
mov eax, dword [eax + 8]
push 2
push 0xffffffffffffffff
push ebp
xor ebx, ebx
push eax
jmp 0x48bc00
mov edx, dword [esi + 0x2c]
mov ecx, eax
imul ecx, ecx, 0x2c
cmp dword [ecx + edx + 8], 0
je 0x48bbf5
inc ebx
mov ecx, dword [esi + 0x28]
mov ecx, dword [ecx + 8]
push 2
push eax
push ebp
push ecx
call edi
cmp eax, 0xffffffff
jne 0x48bbe5
cmp byte [0x4c8208], 0
je 0x48bcee
cmp ebx, 1
mov dword [esp + 0x10], 9
mov dword [esp + 0x24], 0x4c8208
mov dword [esp + 0x14], 0x24
jle 0x48bc40
push ebx
push dword [0x4cf2e0]
call fcn.0043c727
pop ecx
jmp 0x48bc4b
push dword [0x4cf2e4]
call fcn.0043c727
pop ecx
push eax
lea eax, [esp + 0x14]
push eax
call fcn.00450a20
pop ecx
pop ecx
cmp eax, 6
jne 0x48bd5e
jmp 0x48bcee
call fcn.00429592
mov ebx, dword [ebx]
mov al, byte [ebx + 0x46]
and al, 6
cmp al, 4
je 0x48bc80
or byte [ebx + 0x46], 4
jmp 0x48bd59
and byte [ebx + 0x46], 0xfb
jmp 0x48bd59
call fcn.00429592
mov ebx, dword [ebx]
mov al, byte [ebx + 0x46]
and al, 0xa
cmp al, 8
je 0x48bca2
or byte [ebx + 0x46], 8
jmp 0x48bd59
and byte [ebx + 0x46], 0xf7
jmp 0x48bd59
call fcn.00429592
mov ebx, dword [ebx]
mov al, byte [ebx + 0x46]
and al, 3
cmp al, 1
je 0x48bcc4
or byte [ebx + 0x46], 1
jmp 0x48bd59
and byte [ebx + 0x46], 0xfe
jmp 0x48bd59
push 0xa3
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
xor edx, edx
inc edx
mov ecx, ebx
test ax, ax
jge 0x48bce9
call fcn.00478464
jmp 0x48bcee
call fcn.0048ceb0
call fcn.00429592
push 2
push 0xffffffffffffffff
jmp 0x48bd48
mov ecx, dword [esi + 0x2c]
mov eax, ebx
imul eax, eax, 0x2c
mov eax, dword [eax + ecx + 8]
mov ecx, dword [esp + 0x34]
dec ecx
dec ecx
je 0x48bd2c
dec ecx
je 0x48bd24
sub ecx, 4
jne 0x48bd45
test eax, eax
je 0x48bd45
mov ecx, dword [esi + 0x30]
push eax
call fcn.00406e71
jmp 0x48bd45
test eax, eax
je 0x48bd30
and dword [eax + 0x20], 0
test eax, eax
jne 0x48bd3c
mov eax, dword [esi + 0x30]
and dword [eax + 0x118], 0
jmp 0x48bd45
mov ecx, dword [esi + 0x30]
push eax
call fcn.00407822
push 2
push ebx
mov eax, dword [esi + 0x28]
mov eax, dword [eax + 8]
push ebp
push eax
call edi
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x48bcf9
call fcn.004295a3
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x20
ret 4

Function at 0x432003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
add eax, 0x40729f
nop
nop
sub eax, 0x407245
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
jl 0x432030
nop
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x430006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..pdata
nop
nop
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x430072
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x6e7a1181
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x430060
nop
nop
mov eax, section..pdata_1
nop
cmp eax, 0
nop
nop
nop
nop
nop
nop
je 0x4300d2
mov ebx, 0x42e3d0
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
div edi
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
mov esi, 0x780f28bf
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x100012a8
Capabilities:
Resolve function by parsing pe exports

Disassembly:
jmp 0x10007c40
add byte gs:[eax], al
add byte [esi - 0x77], ah
lea ebx, [esi]
in eax, 0xff
invalid
Function at 0x1000f0b0
Capabilities:
Encode data using xor

Disassembly:
clc
or dword [edi], eax
pop es
xchg edx, eax
xchg esp, eax
xor edx, 6
push es
xchg edx, eax
pushfd
xor eax, dword [ebx]
push es
push es
or bl, byte [eax + 0x43]
nop
pushfd
jg 0x1000f0b9
push es
push es
jl 0x1000f0e3
xchg edx, eax
mov ebx, cs
std
push es
push es
nop
mov word [ebx + 2], ds
push es
push es
invalid
pop es
xchg edx, eax
invalid

Function at 0x1002d040
Capabilities:
Get common file path

Disassembly:
sub esp, 0x314
mov eax, dword [0x10153fdc]
xor eax, esp
mov dword [esp + 0x310], eax
mov eax, dword [0x10157b90]
push ebx
push esi
test eax, eax
je 0x1002d07c
push eax
push 0x1011aa9c
lea eax, [esp + 0x10]
push eax
push 0xe6
call fcn.1000eb10
add esp, 0x10
jmp 0x1002d10d
call fcn.1002c700
test eax, eax
je 0x1002d0c6
lea ecx, [esp + 0x110]
push ecx
push 0xe6
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
lea ebx, [esp + 0x110]
call fcn.1002c7c0
mov esi, eax
test esi, esi
jne 0x1002d0ef
pop esi
mov eax, 7
pop ebx
mov ecx, dword [esp + 0x310]
xor ecx, esp
call fcn.100a8c9b
add esp, 0x314
ret
lea eax, [esp + 0x110]
push eax
push 0xe6
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
lea ecx, [esp + 0x110]
push ecx
call fcn.1002c900
mov esi, eax
add esp, 4
test esi, esi
je 0x1002d0aa
push esi
push 0x1011aa9c
lea edx, [esp + 0x10]
push edx
push 0xe6
call fcn.1000eb10
push esi
call fcn.100ab2c8
add esp, 0x14
lea eax, [esp + 8]
push eax
call fcn.1001a160
add esp, 4
test eax, eax
jbe 0x1002d12e
lea ecx, [esp + 8]
dec ecx
cmp byte [ecx + eax], 0x5c
jne 0x1002d12e
sub eax, 1
jne 0x1002d123
mov edx, dword [esp + 0x320]
lea ecx, [esp + 8]
push ecx
push str._setilqs_
add edx, 0xffffffe2
push edi
push edx
mov byte [esp + eax + 0x18], 0
call fcn.1000eb10
push edi
call fcn.1001a160
mov esi, eax
lea eax, [edi + esi]
push eax
push 0x14
call fcn.10031ae0
add esp, 0x1c
mov ecx, 4
lea esp, [esp]
movzx eax, byte [edi + esi]
xor edx, edx
mov ebx, 0x3e
div ebx
movzx eax, byte [edi + esi + 1]
add esi, 5
movzx edx, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi - 5], dl
xor edx, edx
div ebx
movzx eax, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi - 4], al
movzx eax, byte [edi + esi - 3]
xor edx, edx
div ebx
movzx eax, byte [edi + esi - 2]
movzx edx, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi - 3], dl
xor edx, edx
div ebx
movzx eax, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi - 2], al
movzx eax, byte [edi + esi - 1]
xor edx, edx
div ebx
sub ecx, 1
movzx edx, byte [edx + str.abcdefghijklmnopqrstuvwxyzABCDEFGHIJKLMNOPQRSTUVWXYZ0123456789]
mov byte [edi + esi - 1], dl
jne 0x1002d170
mov byte [edi + esi], cl
mov ecx, dword [esp + 0x318]
pop esi
pop ebx
xor ecx, esp
xor eax, eax
call fcn.100a8c9b
add esp, 0x314
ret
Function at 0x1002d480
Capabilities:
Get disk size

Disassembly:
sub esp, 0x114
mov eax, dword [0x10153fdc]
xor eax, esp
mov dword [esp + 0x110], eax
mov eax, dword [esp + 0x118]
lea edx, [esp + 8]
push edx
push 0x104
push ecx
push eax
mov dword [esp + 0x14], 0x200
call fcn.1002d3a0
add esp, 0x10
test eax, eax
jne 0x1002d57d
push esi
lea eax, [esp + 0xc]
call fcn.1002d020
mov esi, eax
test esi, esi
je 0x1002d548
push edi
call fcn.1002c700
test eax, eax
mov eax, esi
je 0x1002d50e
cmp word [esi], 0
je 0x1002d4f7
cmp word [eax], 0x5c
je 0x1002d4f2
add eax, 2
cmp word [eax], 0
jne 0x1002d4e1
jmp 0x1002d4f7
xor ecx, ecx
mov word [eax], cx
lea edx, [esp + 8]
push edx
mov eax, edx
push eax
lea ecx, [esp + 0x14]
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x1002d538
cmp byte [esi], 0
je 0x1002d523
cmp byte [eax], 0x5c
je 0x1002d520
inc eax
cmp byte [eax], 0
jne 0x1002d513
jmp 0x1002d523
mov byte [eax], 0
lea eax, [esp + 8]
push eax
mov ecx, eax
push ecx
lea edx, [esp + 0x14]
push edx
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceA]
push esi
mov edi, eax
call fcn.100ab2c8
add esp, 4
test edi, edi
pop edi
jne 0x1002d563
mov eax, 0x200
pop esi
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.100a8c9b
add esp, 0x114
ret
mov eax, dword [esp + 8]
pop esi
mov ecx, dword [esp + 0x110]
xor ecx, esp
call fcn.100a8c9b
add esp, 0x114
ret
mov ecx, dword [esp + 0x110]
mov eax, dword [esp + 4]
xor ecx, esp
call fcn.100a8c9b
add esp, 0x114
ret

Function at 0x10030290
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test ecx, ecx
jle 0x100302bd
push esi
push edi
jmp 0x100302a0
movzx esi, byte [edx]
movzx esi, byte [esi + 0x1011c708]
lea edi, [eax*8]
xor esi, edi
dec ecx
xor eax, esi
inc edx
test ecx, ecx
jg 0x100302a0
pop edi
pop esi
ret
Function at 0x1004ffc0
Capabilities:
Access the windows event log

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x104
call fcn.100ab720
push ebx
push esi
push edi
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
test eax, eax
je 0x10050009
push eax
call dword [sym.imp.KERNEL32.dll_GetFileType]
test eax, eax
je 0x10050009
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
push 0x101540c0
call fcn.100abaa9
add esp, 0xc
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 8]
lea edx, [ebp + 0xc]
push edx
push eax
lea ecx, [ebp - 0x104]
push 0xff
push ecx
call fcn.100ab911
add esp, 0x10
mov byte [ebp - 5], 0
call dword [sym.imp.KERNEL32.dll_GetVersion]
cmp eax, 0x80000000
jae 0x1005010b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
call dword [sym.imp.USER32.dll_GetProcessWindowStation]
mov ebx, eax
test ebx, ebx
je 0x100500c6
lea edx, [ebp - 4]
push edx
push 0
push 0
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
jne 0x100500c6
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
jne 0x100500c6
mov eax, dword [ebp - 4]
cmp eax, 0x200
ja 0x100500c6
lea esi, [eax + 1]
and esi, 0xfffffffe
mov dword [ebp - 4], esi
lea eax, [esi + 2]
add eax, 3
and al, 0xfc
call fcn.100ab720
lea eax, [ebp - 4]
mov edi, esp
push eax
push esi
push edi
push 2
push ebx
call dword [sym.imp.USER32.dll_GetUserObjectInformationW]
test eax, eax
je 0x100500c6
mov ecx, dword [ebp - 4]
push str.Service_0x
push edi
lea eax, [ecx + 1]
and al, 0xfe
mov dword [ebp - 4], eax
shr eax, 1
mov word [edi + eax*2], 0
call fcn.100ab7fd
add esp, 8
test eax, eax
je 0x1005010b
push str.OPENSSL
push 0
call dword [sym.imp.ADVAPI32.dll_RegisterEventSourceA]
mov esi, eax
lea eax, [ebp - 4]
push 0
push eax
push 0
push 1
push 0
push 0
push 0
lea edx, [ebp - 0x104]
push 1
push esi
mov dword [ebp - 4], edx
call dword [sym.imp.ADVAPI32.dll_ReportEventA]
push esi
call dword [sym.imp.ADVAPI32.dll_DeregisterEventSource]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x10
lea ecx, [ebp - 0x104]
push str.OpenSSL:_FATAL
push ecx
push 0
call dword [sym.imp.USER32.dll_MessageBoxA]
lea esp, [ebp - 0x110]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1007af5e
Capabilities:
Query or enumerate registry value

Disassembly:
push 0
mov eax, 0x1011139b
call fcn.100ae183
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.10001776
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x1007afc0
call fcn.100791e6
cmp eax, 1
jne 0x1007afc0
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.1007a729
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.10077eab
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.1000147e
mov dword [ebp + 8], SysStringLen
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.1000147e
mov eax, esi
call fcn.100ae25b
ret 0x10

Function at 0x1007afe9
Capabilities:
Set registry value

Disassembly:
push 0
mov eax, 0x101113c6
call fcn.100ae183
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.10001776
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x1007b04b
call fcn.100791e6
cmp eax, 1
jne 0x1007b04b
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.1007a729
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.10077eab
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.1000147e
mov dword [ebp + 8], SysStringLen
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegSetValueW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.1000147e
mov eax, esi
call fcn.100ae25b
ret 0x14

Function at 0x1007b077
Capabilities:
Delete registry key

Disassembly:
push 0
mov eax, 0x101113f1
call fcn.100ae183
push dword [ebp + 0xc]
lea ecx, [ebp + 0xc]
call fcn.10001776
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x80000000
jne 0x1007b0d9
call fcn.100791e6
cmp eax, 1
jne 0x1007b0d9
lea eax, [ebp + 0xc]
push eax
lea eax, [ebp + 8]
push str.SoftwareClasses_
push eax
call fcn.1007a729
add esp, 0xc
push eax
lea ecx, [ebp + 0xc]
mov byte [ebp - 4], 1
call fcn.10077eab
mov ecx, dword [ebp + 8]
add ecx, 0xfffffff0
call fcn.1000147e
mov dword [ebp + 8], SysStringLen
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
mov ecx, dword [ebp + 0xc]
add ecx, 0xfffffff0
mov esi, eax
call fcn.1000147e
mov eax, esi
call fcn.100ae25b
ret 8
Function at 0x10084f1e
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x10111e7e
call fcn.100ae183
mov esi, ecx
cmp dword [esi + 0x50], 0
jne 0x10084f43
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x10084f89
lea ecx, [ebp - 0x10]
call fcn.100766bb
mov ecx, dword [esi + 0x50]
mov eax, dword [ecx]
and dword [ebp - 4], 0
lea edx, [ebp - 0x10]
push edx
call dword [eax + 0x8c]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10075966
add esp, 0x10
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
mov esi, eax
call fcn.1000147e
mov eax, esi
call fcn.100ae25b
ret 8

Function at 0x1008ca69
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 4], ecx
cmp dword [ebp + 8], ebx
je 0x1008cab0
call fcn.10079e13
mov esi, dword [eax + 0xc]
push 0xf0
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x1008cab0
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ebx, eax
test ebx, ebx
je 0x1008cacc
push ebx
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.1008c5e1
mov esi, eax
test edi, edi
je 0x1008caca
test ebx, ebx
je 0x1008caca
push ebx
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x1009507a
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, ecx
mov dword [edi + 0x58], ebx
test ebx, 0xffff0000
jne 0x1009509e
cmp dword [edi + 0x54], 0
jne 0x1009509e
movzx eax, bx
mov dword [edi + 0x54], eax
call fcn.10079e13
mov esi, dword [eax + 0xc]
push 5
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push esi
push dword [ebp + 0xc]
mov ebx, eax
push ebx
mov ecx, edi
call fcn.1009503b
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x10097b5e
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov edi, edi
push esi
mov esi, ecx
mov ecx, dword [esi + 8]
mov dword [esi], vtable.CRecentFileList.0
test ecx, ecx
je 0x10097b75
push 3
call fcn.10097b0b
mov ecx, dword [esi + 0x1c]
sub ecx, 0x10
call fcn.1000147e
mov ecx, dword [esi + 0x10]
sub ecx, 0x10
call fcn.1000147e
mov ecx, dword [esi + 0xc]
sub ecx, 0x10
pop esi
jmp fcn.1000147e

Function at 0x100a8c9b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10153fdc]
jne 0x100a8ca5
repz ret
jmp fcn.100b46ec