joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4684c6
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x60
push 0x49afa8
call fcn.004695bc
mov edi, 0x94
mov eax, edi
call fcn.00468450
mov dword [ebp - 0x18], esp
mov esi, esp
mov dword [esi], edi
push esi
call dword [0x497174]
mov ecx, dword [esi + 0x10]
mov dword [0x104e6f0], ecx
mov eax, dword [esi + 4]
mov dword [0x104e6fc], eax
mov edx, dword [esi + 8]
mov dword [0x104e700], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
mov dword [0x104e6f4], esi
cmp ecx, 2
je 0x468526
or esi, 0x8000
mov dword [0x104e6f4], esi
shl eax, 8
add eax, edx
mov dword [0x104e6f8], eax
xor esi, esi
push esi
mov edi, dword [0x497160]
call edi
cmp word [eax], 0x5a4d
jne 0x468561
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x468561
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x468579
cmp eax, 0x20b
je 0x468566
mov dword [ebp - 0x1c], esi
jmp 0x46858d
cmp dword [ecx + 0x84], 0xe
jbe 0x468561
xor eax, eax
cmp dword [ecx + 0xf8], esi
jmp 0x468587
cmp dword [ecx + 0x74], 0xe
jbe 0x468561
xor eax, eax
cmp dword [ecx + 0xe8], esi
setne al
mov dword [ebp - 0x1c], eax
push esi
call fcn.0046a2ba
pop ecx
test eax, eax
jne 0x4685b9
cmp dword [0x104e73c], 1
jne 0x4685a6
call fcn.00469aeb
push 0x1c
call fcn.00469974
push 0xff
call fcn.00468070
pop ecx
pop ecx
call fcn.00469608
mov dword [ebp - 4], esi
call fcn.0046a0f5
test eax, eax
jge 0x4685d2
push 0x1b
call fcn.004684a1
pop ecx
call dword [0x497170]
mov dword [0x104fd00], eax
call fcn.00469fd3
mov dword [0x104e734], eax
call fcn.00469f31
test eax, eax
jge 0x4685f8
push 8
call fcn.004684a1
pop ecx
call fcn.00469cfe
test eax, eax
jge 0x468609
push 9
call fcn.004684a1
pop ecx
call fcn.004680a0
mov dword [ebp - 0x20], eax
cmp eax, esi
je 0x46861c
push eax
call fcn.004684a1
pop ecx
mov dword [ebp - 0x38], esi
lea eax, [ebp - 0x64]
push eax
call dword [0x49716c]
call fcn.00469c95
mov dword [ebp - 0x68], eax
test byte [ebp - 0x38], 1
je 0x46863d
movzx eax, word [ebp - 0x34]
jmp 0x468640
push 0xa
pop eax
push eax
push dword [ebp - 0x68]
push esi
push esi
call edi
push eax
call fcn.00447940
mov edi, eax
mov dword [ebp - 0x6c], edi
cmp dword [ebp - 0x1c], esi
jne 0x46865e
push edi
call fcn.004681c7
call fcn.004681e9
jmp 0x468690
or dword [ebp - 4], 0xffffffff
mov eax, edi
lea esp, [ebp - 0x7c]
call fcn.004695f7
ret
Function at 0x47d3c0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
xor edx, edx
cmp ecx, edx
je 0x47d460
push ebx
push ebp
push esi
mov esi, dword [ecx]
push edi
xor eax, eax
mov byte [esi + 0x16], dl
mov esi, dword [ecx]
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov byte [esi + 0x18], dl
mov esi, dword [ecx]
mov byte [esi + 0x19], dl
mov edi, dword [ecx + 4]
xor esi, esi
cmp edi, edx
jle 0x47d412
mov ebp, dword [ecx]
xor edx, edx
mov ebx, eax
mov dl, byte [esi + ebp]
shr ebx, 0x18
xor edx, ebx
shl eax, 8
mov edx, dword [edx*4 + 0x4a6e14]
xor eax, edx
inc esi
cmp esi, edi
jl 0x47d3f3
xor edx, edx
mov edi, dword [ecx + 0xc]
xor esi, esi
cmp edi, edx
jle 0x47d43b
mov ebp, dword [ecx + 8]
xor edx, edx
mov ebx, eax
mov dl, byte [esi + ebp]
shr ebx, 0x18
xor edx, ebx
shl eax, 8
mov edx, dword [edx*4 + 0x4a6e14]
xor eax, edx
inc esi
cmp esi, edi
jl 0x47d41e
mov edx, dword [ecx]
pop edi
mov byte [edx + 0x16], al
mov esi, dword [ecx]
mov edx, eax
shr edx, 8
mov byte [esi + 0x17], dl
mov esi, dword [ecx]
mov edx, eax
shr edx, 0x10
mov byte [esi + 0x18], dl
mov ecx, dword [ecx]
shr eax, 0x18
pop esi
pop ebp
mov byte [ecx + 0x19], al
pop ebx
ret

Function at 0x47f4aa
Capabilities:
Terminate process

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, 0x120
cmp dword [esp + 0x10], esi
mov eax, dword [edi]
jae 0x47f4ce
push eax
call fcn.00481c06
push 2
call fcn.00481b95
pop ecx
mov dword [edi], eax
pop ecx
push esi
push 0
push eax
call fcn.00468010
add esp, 0xc
pop edi
pop esi
ret
Function at 0x47fea2
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
push ebx
push esi
push edi
push dword [ebp + 0x18]
push dword [ebp + 0x1c]
push 1
call fcn.00481ba6
mov esi, eax
xor ebx, ebx
add esp, 0xc
cmp esi, ebx
mov dword [ebp - 8], esi
je 0x47fefa
push esi
call fcn.0047f8fb
push ebx
push esi
call fcn.00490620
add esp, 0xc
test eax, eax
je 0x47ff01
mov edi, dword [ebp - 8]
push dword [edi + 0xac]
lea esi, [edi + 0xac]
push edi
call fcn.00481ccd
push edi
mov dword [esi], ebx
call fcn.00481c06
add esp, 0xc
xor eax, eax
jmp 0x480003
push dword [ebp + 0x20]
mov esi, dword [ebp - 8]
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push esi
call fcn.00481d3a
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
call fcn.00481fee
mov ecx, dword [ebp + 8]
mov edi, 0x49bd28
mov dword [ebp - 4], ecx
add esp, 0x20
sub dword [ebp - 4], edi
mov eax, edi
mov edx, dword [ebp - 4]
mov dl, byte [edx + eax]
cmp dl, byte [eax]
je 0x47ff43
or byte [esi + 0x6e], 2
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x47ff35
test byte [esi + 0x6e], 2
je 0x47ffc1
cmp ecx, ebx
je 0x47ff97
mov al, byte [ecx]
cmp al, byte [0x49bd28]
jne 0x47ff77
cmp al, 0x31
jne 0x47ff6d
mov dl, byte [ecx + 2]
cmp dl, byte [0x49bd2a]
jne 0x47ff77
cmp al, 0x30
jne 0x47ffc1
cmp byte [ecx + 2], 0x39
jge 0x47ffc1
cmp ecx, ebx
je 0x47ff97
push ecx
lea eax, [ebp - 0x58]
push str.Application_was_compiled_with_png.h_from_libpng__.20s
push eax
call fcn.004900f8
lea eax, [ebp - 0x58]
push eax
push esi
call fcn.00481de9
add esp, 0x14
push edi
lea eax, [ebp - 0x58]
push str.Application__is__running_with_png.c_from_libpng__.20s
push eax
call fcn.004900f8
lea eax, [ebp - 0x58]
push eax
push esi
call fcn.00481de9
push str.Incompatible_libpng_version_in_application_and_library
push esi
mov dword [esi + 0x6c], ebx
call fcn.00481d5d
add esp, 0x1c
mov eax, 0x2000
push eax
push esi
mov dword [esi + 0xb0], eax
call fcn.00481c4d
push ebx
push ebx
push ebx
push esi
mov dword [esi + 0xac], eax
call fcn.00481655
push ebx
push ebx
push 1
push ebx
push esi
call fcn.0048049e
push ebx
push esi
call fcn.00490620
add esp, 0x34
test eax, eax
je 0x480000
jmp 0x46b2bd
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4887af
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0xc]
test edx, edx
jne 0x4887bd
xor eax, eax
pop ebp
ret
mov eax, dword [ebp + 8]
cmp dword [ebp + 0x10], 8
push esi
push edi
not eax
mov ecx, 0xff
jb 0x48889e
mov edi, dword [ebp + 0x10]
push ebx
shr edi, 3
movzx ebx, byte [edx]
mov esi, eax
sub dword [ebp + 0x10], 8
and esi, ecx
xor esi, ebx
mov ebx, eax
shr ebx, 8
mov eax, dword [esi*4 + 0x49bf88]
xor eax, ebx
inc edx
mov esi, eax
movzx ebx, byte [edx]
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x49bf88]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x49bf88]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x49bf88]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x49bf88]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
movzx ebx, byte [edx + 1]
mov esi, dword [esi*4 + 0x49bf88]
shr eax, 8
xor esi, eax
inc edx
mov eax, esi
and eax, ecx
xor eax, ebx
movzx ebx, byte [edx + 1]
mov eax, dword [eax*4 + 0x49bf88]
shr esi, 8
xor eax, esi
inc edx
mov esi, eax
and esi, ecx
xor esi, ebx
shr eax, 8
mov esi, dword [esi*4 + 0x49bf88]
xor eax, esi
inc edx
dec edi
jne 0x4887da
pop ebx
cmp dword [ebp + 0x10], 0
je 0x4888bf
movzx edi, byte [edx]
mov esi, eax
and esi, ecx
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x49bf88]
xor eax, esi
inc edx
dec dword [ebp + 0x10]
jne 0x4888a4
pop edi
pop esi
not eax
pop ebp
ret
Function at 0x48be5e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [esi + 0x24]
mov ecx, dword [esi + 0x64]
mov eax, dword [esi + 0x34]
mov edx, dword [esi + 0x6c]
sub eax, ecx
sub eax, edx
mov dword [ebp + 8], eax
jne 0x48be88
test ecx, ecx
jne 0x48be92
test edx, edx
jne 0x48be92
mov eax, edi
jmp 0x48befe
cmp eax, 0xffffffff
jne 0x48be92
push 0xfffffffffffffffe
pop eax
jmp 0x48befe
mov edx, dword [esi + 0x24]
lea edx, [edi + edx - 0x106]
cmp ecx, edx
jb 0x48befe
mov eax, dword [esi + 0x30]
push edi
lea ecx, [eax + edi]
push ecx
push eax
call fcn.00467bc0
mov ecx, dword [esi + 0x44]
mov eax, dword [esi + 0x3c]
sub dword [esi + 0x68], edi
sub dword [esi + 0x64], edi
add esp, 0xc
sub dword [esi + 0x54], edi
lea eax, [eax + ecx*2]
dec eax
dec eax
movzx edx, word [eax]
mov ebx, edx
sub ebx, edi
cmp edx, edi
sbb edx, edx
not edx
and edx, ebx
dec ecx
mov word [eax], dx
jne 0x48bec3
mov eax, dword [esi + 0x38]
mov edx, edi
lea eax, [eax + edi*2]
dec eax
dec eax
movzx ecx, word [eax]
mov ebx, ecx
sub ebx, edi
cmp ecx, edi
sbb ecx, ecx
not ecx
and ecx, ebx
dec edx
mov word [eax], cx
jne 0x48bee2
mov eax, dword [ebp + 8]
add eax, edi
mov ecx, dword [esi]
cmp dword [ecx + 4], 0
je 0x48bf59
push eax
mov eax, dword [esi + 0x6c]
add eax, dword [esi + 0x64]
add eax, dword [esi + 0x30]
push eax
push ecx
call fcn.0048bf5e
add dword [esi + 0x6c], eax
mov ebx, dword [esi + 0x6c]
add esp, 0xc
cmp ebx, 3
jb 0x48bf45
mov eax, dword [esi + 0x64]
mov ecx, dword [esi + 0x30]
lea edx, [eax + ecx]
mov ecx, dword [esi + 0x50]
movzx eax, byte [edx]
mov dword [esi + 0x40], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [esi + 0x4c]
mov dword [esi + 0x40], eax
cmp ebx, 0x106
jae 0x48bf59
mov eax, dword [esi]
cmp dword [eax + 4], 0
jne 0x48be6a
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x40407d
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
cmp dword [0x40f6b8], 2
push esi
push edi
jne 0x40416e
push str.advapi32.dll
xor edi, edi
xor esi, esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
cmp eax, edi
je 0x4040b6
push str.GetUserNameW
push eax
call fcn.007b18b4
nop
mov esi, eax
cmp esi, edi
mov dword [ebp - 4], 0x208
je 0x40416e
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x21c]
push eax
call esi
test eax, eax
je 0x40416e
cmp word [ebp - 0x21c], di
lea eax, [ebp - 0x21c]
je 0x404163
push ebx
jmp 0x4040ef
mov eax, dword [ebp - 8]
movzx ebx, word [eax]
inc eax
inc eax
cmp ebx, 0x20
mov dword [ebp - 8], eax
jne 0x404102
push 0x5f
pop ebx
cmp ebx, 0x20
jl 0x404126
cmp ebx, 0x7e
jg 0x404126
push ebx
push str._:___
call dword [sym.imp.MSVCRT.dll_strchr]
pop ecx
test eax, eax
pop ecx
jne 0x404126
and byte [ebp - 0x13], al
push 1
mov byte [ebp - 0x14], bl
pop eax
jmp 0x404139
push ebx
lea eax, [ebp - 0x14]
push str.__x_
push eax
call dword [sym.imp.MSVCRT.dll_sprintf]
add esp, 0xc
lea esi, [eax + edi]
lea ecx, [esi + 1]
cmp ecx, dword [ebp + 0xc]
jae 0x404159
push eax
lea eax, [ebp - 0x14]
push eax
mov eax, dword [ebp + 8]
add edi, eax
push edi
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov edi, esi
mov eax, dword [ebp - 8]
cmp word [eax], 0
jne 0x4040ec
pop ebx
mov eax, dword [ebp + 8]
and byte [edi + eax], 0
mov eax, edi
jmp 0x40418f
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
test eax, eax
jne 0x404188
and byte [esi], al
push esi
call sub.MSVCRT.dll_strlen
pop ecx
pop edi
pop esi
leave
ret
Function at 0x7b4088
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x14]
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, dword [esi]
mov ecx, dword [esi + 4]
test eax, eax
jle 0x7b40e3
push edi
mov edi, dword [ebp + 0x10]
sub dword [ebp + 0xc], edi
mov dword [ebp + 8], eax
mov edi, edi
inc bl
lea edi, [edi + 1]
movzx ebx, bl
mov dl, byte [esi + ebx + 8]
add cl, dl
movzx ecx, cl
mov al, byte [esi + ecx + 8]
mov byte [esi + ebx + 8], al
add al, dl
movzx eax, al
mov byte [esi + ecx + 8], dl
movzx edx, byte [eax + esi + 8]
mov eax, dword [ebp + 0xc]
xor dl, byte [eax + edi - 1]
sub dword [ebp + 8], 1
mov byte [edi - 1], dl
jne 0x7b40a8
mov eax, dword [ebp + 0x14]
pop edi
mov dword [esi], ebx
mov dword [esi + 4], ecx
pop esi
pop ebx
pop ebp
ret

Function at 0x7b939c
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push eax
mov eax, dword [esp + 4]
lea eax, [eax + 0x40]
xchg dword [esp + 4], eax
mov dword [esp + 4], eax
mov eax, dword [esp]
lea esp, [esp + 4]
add dword [esp], 0xffffff5f
xchg dword [esp], eax
push edi
mov edi, dword [esp + 4]
lea edi, [edi + 1]
xchg dword [esp + 4], edi
mov dword [esp + 4], edi
mov edi, dword [esp]
lea esp, [esp + 4]
xchg dword [esp + 4], eax
push ebp
mov ebp, esp
leave
xchg dword [esp], eax
push ebp
mov ebp, esp
leave
popfd
push ecx
mov ecx, dword [esp + 4]
lea ecx, [ecx + 0x4e]
xchg dword [esp + 4], ecx
mov dword [esp + 4], ecx
mov ecx, dword [esp]
lea esp, [esp + 4]
jmp fcn.007b4088
Function at 0x1000431f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x1000433e
xor eax, eax
jmp 0x100043b9
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x10004354
xor eax, eax
jmp 0x100043b9
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x1000439c
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jae 0x1000439c
mov eax, dword [ebp - 4]
movzx eax, word [eax]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax*2 + 2]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
jmp 0x10004375
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jb 0x100043a8
xor eax, eax
jmp 0x100043b9
mov eax, dword [ebp - 4]
movzx eax, word [eax]
test eax, eax
jne 0x100043b6
xor eax, eax
jmp 0x100043b9
mov eax, dword [ebp - 4]
leave
ret

Function at 0x10009dcf
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x10009dd8
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
shl eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
and dword [eax], 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
mov eax, dword [ebp - 0x10]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10009e15
mov eax, dword [ebp - 0xc]
jmp 0x10009e6b
cmp dword [ebp - 4], 1
je 0x10009e26
cmp dword [ebp - 4], 2
je 0x10009e26
push 0xd
pop eax
jmp 0x10009e6b
cmp dword [ebp + 0xc], 0
je 0x10009e5f
cmp dword [ebp - 8], 0
je 0x10009e58
mov eax, dword [ebp - 8]
xor edx, edx
push 2
pop ecx
div ecx
test edx, edx
jne 0x10009e51
mov eax, dword [ebp - 8]
shr eax, 1
mov ecx, dword [ebp + 0xc]
movzx eax, word [ecx + eax*2 - 2]
test eax, eax
je 0x10009e56
push 0xd
pop eax
jmp 0x10009e6b
jmp 0x10009e5f
mov eax, dword [ebp + 0xc]
and word [eax], 0
mov eax, dword [ebp - 8]
shr eax, 1
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
leave
ret 0xc
Function at 0x10009e96
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x100ee3e0]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x228], ecx
lea ecx, [ebp - 0x10]
call fcn.1001dc86
push 0x2001f
push dword [ebp + 8]
mov eax, dword [ebp - 0x228]
push dword [eax]
lea ecx, [ebp - 0x10]
call fcn.10009c10
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10009ef4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x21c], eax
lea ecx, [ebp - 0x10]
call fcn.10009c82
mov eax, dword [ebp - 0x21c]
jmp 0x10009f83
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x10009f59
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x10]
call fcn.10009e96
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10009f50
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x220], eax
lea ecx, [ebp - 0x10]
call fcn.10009c82
mov eax, dword [ebp - 0x220]
jmp 0x10009f83
mov dword [ebp - 4], 0x100
jmp 0x10009efb
lea ecx, [ebp - 0x10]
call fcn.10009c55
push dword [ebp + 8]
mov ecx, dword [ebp - 0x228]
call fcn.10009d35
mov dword [ebp - 0x224], eax
lea ecx, [ebp - 0x10]
call fcn.10009c82
mov eax, dword [ebp - 0x224]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.10071fa1
leave
ret 4
Function at 0x1000f864
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x100ee3e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], ecx
mov eax, dword [ebp - 0x218]
and dword [eax], 0
mov eax, dword [ebp - 0x218]
and dword [eax + 4], 0
mov eax, dword [ebp - 0x218]
and dword [eax + 8], 0
mov eax, dword [ebp - 0x218]
and dword [eax + 0xc], 0
mov eax, dword [ebp - 0x218]
and dword [eax + 0x10], 0
and word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.10074c40
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push 0x100d7f78
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x1000f91b
jmp 0x1000f98f
mov eax, dword [ebp - 0x218]
mov dword [eax], 1
push str.OpenThemeData
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x218]
mov dword [ecx + 4], eax
push str.CloseThemeData
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x218]
mov dword [ecx + 8], eax
push str.DrawThemeBackground
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x218]
mov dword [ecx + 0xc], eax
push str.SetWindowTheme
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x218]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10071fa1
leave
ret

Function at 0x100138ad
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.100206a7
test eax, eax
je 0x10013912
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jl 0x10013908
cmp dword [ebp + 8], 0x1b
jne 0x100138ee
push 0
push 2
push 0x111
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.100207c0
jmp 0x10013908
cmp dword [ebp + 8], 0xd
jne 0x10013908
push 0
push 1
push 0x111
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.100207c0
push 0
mov ecx, dword [ebp - 4]
call fcn.100139bc
leave
ret 0xc
Function at 0x100293ab
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
call fcn.1000fa40
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x100293dc
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x100293dc
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ShowWindow]
leave
ret

Function at 0x10032787
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
and dword [ebp - 0xc], 0
and dword [ebp - 4], 0
and dword [ebp - 8], 0
mov eax, dword [ebp - 0x34]
cmp dword [eax + 0x334], 0
je 0x100327b8
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [ebp - 0x34]
and dword [eax + 0x334], 0
mov eax, dword [ebp - 0x34]
cmp dword [eax + 0x324], 0
je 0x10032896
mov eax, dword [ebp - 0x34]
push dword [eax + 0x324]
call fcn.1000f731
pop ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1003288c
push 2
push 0
push dword [ebp - 8]
mov ecx, dword [ebp - 0x34]
call fcn.10031b8a
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
mov eax, dword [eax + 0x324]
cmp eax, dword [ecx + 0x320]
jne 0x1003288c
mov eax, dword [ebp + 0xc]
and eax, 0xffff
movzx eax, ax
mov ecx, dword [ebp + 0x10]
and ecx, 0xffff
movzx ecx, cx
shl ecx, 0x10
or eax, ecx
push eax
push dword [ebp + 8]
push 0x202
mov ecx, dword [ebp - 8]
call fcn.1000f7b7
mov ecx, dword [ebp - 8]
call fcn.100253c0
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1003286e
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
test eax, eax
je 0x1003286e
push 1
push 0
push 0
push dword [ebp - 0x10]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x14], eax
jmp 0x1003288c
mov ecx, dword [ebp - 8]
call fcn.100095ec
test eax, eax
je 0x1003288c
mov dword [ebp - 0xc], 1
mov ecx, dword [ebp - 8]
call fcn.100095ec
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x34]
and dword [eax + 0x324], 0
cmp dword [ebp - 0xc], 0
je 0x100328f7
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x34]
add ecx, 4
call fcn.1003481f
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
call dword [eax + 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x24]
push 0x4e
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x34]
add ecx, 4
call fcn.1003487e
mov ecx, eax
call fcn.100348a0
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x2c], eax
leave
ret 0xc
Function at 0x10034d33
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push edi
mov dword [ebp - 0x30], ecx
mov byte [ebp - 1], 0
cmp dword [ebp + 8], 0
je 0x10034dff
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x30]
cmp dword [eax + 4], 0
je 0x10034dfd
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0xc], 0
je 0x10034dfd
push 0x4ff
push 0x64
push 0
mov eax, dword [ebp - 0x30]
add eax, 0xc
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x10034d9b
mov byte [ebp - 1], 1
jmp 0x10034dfd
cmp dword [ebp - 0x10], 0xffffffff
jne 0x10034da5
jmp 0x10034dfd
and dword [ebp - 0x2c], 0
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x28]
rep stosd dword es:[edi], eax
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x10034de0
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 0x28], 0x12
jne 0x10034de0
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0
je 0x10034df8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
cmp eax, 0x2710
jbe 0x10034df8
jmp 0x10034dfd
jmp 0x10034d58
jmp 0x10034e21
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0xc], 0
je 0x10034e21
push 0xbb8
mov eax, dword [ebp - 0x30]
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
neg eax
sbb eax, eax
inc eax
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
pop edi
leave
ret 4