joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4c30f4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov byte [ebp - 1], dl
mov ebx, eax
xor eax, eax
push ebp
push 0x4c3256
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 0xc]
xor eax, eax
call fcn.00403010
lea eax, [ebp - 0xc]
call fcn.004ba360
cmp bl, 1
jne 0x4c3139
lea eax, [ebp - 0x10]
mov edx, 0x4c326c
call fcn.00404914
jmp 0x4c3146
lea eax, [ebp - 0x10]
mov edx, 0x4c327c
call fcn.00404914
lea eax, [ebp - 0x10]
call fcn.004ba360
cmp byte [ebp - 1], 1
jne 0x4c3163
lea eax, [ebp - 0x14]
mov edx, 0x4c326c
call fcn.00404914
jmp 0x4c3170
lea eax, [ebp - 0x14]
mov edx, 0x4c327c
call fcn.00404914
lea eax, [ebp - 0x14]
call fcn.004ba360
lea edx, [ebp - 8]
xor eax, eax
call fcn.00403010
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 8]
call fcn.004c0fbc
mov edx, dword [ebp - 0x18]
lea eax, [ebp - 8]
call fcn.00404914
lea eax, [ebp - 8]
call fcn.004ba360
push 0x4c328c
push 0xa
mov ecx, dword [0x4cb668]
mov dl, 1
mov eax, dword [0x41c310]
call fcn.00421108
mov ebx, eax
lea eax, [ebp - 0xc]
mov ecx, 0x4c329c
mov edx, dword [0x4cc2bc]
call fcn.00404b88
mov edx, dword [ebp - 0xc]
mov eax, ebx
call fcn.00420dd4
mov eax, ebx
call fcn.0040398c
mov eax, dword [0x4ca638]
mov eax, dword [eax]
call fcn.00467d54
push dword [ebp - 0xc]
push 0x4c32b4
push dword [ebp - 8]
push 0x4c32b4
push dword [ebp - 0x10]
push 0x4c32b4
push dword [ebp - 0x14]
lea eax, [ebp - 0xc]
mov edx, 7
call fcn.00404bfc
mov eax, dword [0x4ca638]
mov eax, dword [eax]
call fcn.00467d54
push 0
mov eax, dword [ebp - 0xc]
call fcn.00404d3c
push eax
call sub.kernel32.dll_WinExec
mov eax, dword [0x4ca638]
mov eax, dword [eax]
call fcn.00467ffc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4c325d
lea eax, [ebp - 0x18]
mov edx, 5
call fcn.004048a0
ret
Function at 0x401020
Capabilities:
Hide graphical window

Disassembly:
sub esp, 0x128
push esi
push edi
push 0
push str.ODBCAdmClass
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x401070
push eax
call dword [sym.imp.USER32.dll_GetLastActivePopup]
push eax
mov esi, eax
call dword [sym.imp.USER32.dll_IsIconic]
push esi
test eax, eax
je 0x401056
call dword [sym.imp.USER32.dll_OpenIcon]
jmp 0x40105c
call dword [sym.imp.USER32.dll_BringWindowToTop]
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
xor eax, eax
pop edi
pop esi
add esp, 0x128
ret 0x10
push str.odbcint.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [section..bss], eax
test eax, eax
je 0x40109a
lea ecx, [esp + 0x30]
push 0x100
push ecx
push 0x650
push eax
call dword [sym.imp.USER32.dll_LoadStringA]
xor edi, edi
mov esi, dword [esp + 0x134]
mov dword [esp + 8], edi
mov dword [esp + 0x10], edi
mov dword [esp + 0x14], edi
push 0x580
mov dword [esp + 0x1c], esi
push esi
mov dword [esp + 0x14], 0x401000
call dword [sym.imp.USER32.dll_LoadIconA]
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], edi
lea eax, [esp + 8]
mov dword [esp + 0x28], edi
mov dword [esp + 0x24], 2
mov dword [esp + 0x2c], str.ODBCAdmClass
push eax
call dword [sym.imp.USER32.dll_RegisterClassA]
test ax, ax
jne 0x401100
xor eax, eax
pop edi
pop esi
add esp, 0x128
ret 0x10
push 0
push esi
push 0
push 0
lea eax, [esp + 0x40]
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push 0x80000000
push eax
push str.ODBCAdmClass
push 0
call dword [sym.imp.USER32.dll_CreateWindowExA]
mov esi, eax
test esi, esi
jne 0x401145
xor eax, eax
pop edi
pop esi
add esp, 0x128
ret 0x10
mov eax, dword [esp + 0x140]
push eax
push esi
call dword [sym.imp.USER32.dll_ShowWindow]
push esi
call dword [sym.imp.USER32.dll_UpdateWindow]
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x38]
mov ecx, dword [esp + 0x3c]
sub eax, dword [esp + 0x30]
sub ecx, dword [esp + 0x34]
sar eax, 1
push 0
sar ecx, 1
push 0
push 0
push ecx
push eax
push esi
call dword [sym.imp.USER32.dll_MoveWindow]
push esi
call sub.odbccp32.dll_Ordinal_11
mov eax, dword [section..bss]
test eax, eax
je 0x4011a8
push eax
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
push esi
call dword [sym.imp.USER32.dll_DestroyWindow]
xor eax, eax
pop edi
pop esi
add esp, 0x128
ret 0x10
Function at 0x4011c2
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x403010
push 0x401348
push eax
mov dword fs:[0], esp
sub esp, 0x74
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov dword [0x402004], 0xffffffff
mov eax, dword [0x402004]
mov dword [0x402008], eax
call dword [sym.imp.MSVCRT20.dll___p__fmode]
mov ecx, dword [0x404018]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT20.dll___p__commode]
mov ecx, dword [0x404014]
mov dword [eax], ecx
call fcn.00401347
call fcn.00401334
push 0x404030
push 0x40402c
call sub.MSVCRT20.dll__initterm
add esp, 8
mov eax, dword [0x404010]
push eax
mov eax, dword [0x40400c]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
call dword [sym.imp.MSVCRT20.dll___getmainargs]
add esp, 0x14
push 0x404028
push 0x404024
call sub.MSVCRT20.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT20.dll___p__acmdln]
mov esi, dword [eax]
mov al, byte [esi]
cmp al, 0x22
jne 0x401292
mov al, byte [ebp - 0x3c]
inc esi
mov al, byte [esi]
test al, al
je 0x40128a
cmp al, 0x22
jne 0x40127f
cmp byte [esi], 0x22
jne 0x40129c
inc esi
jmp 0x40129c
cmp al, 0x20
jbe 0x40129c
inc esi
cmp byte [esi], 0x20
ja 0x401296
cmp byte [esi], 0
je 0x4012ac
cmp byte [esi], 0x20
ja 0x4012ac
inc esi
cmp byte [esi], 0
jne 0x4012a1
mov dword [ebp - 0x58], 0
lea eax, [ebp - 0x84]
push eax
call dword [sym.imp.KERNEL32.dll_GetStartupInfoA]
test byte [ebp - 0x58], 1
mov eax, 0xa
je 0x4012cf
movzx eax, word [ebp - 0x54]
push eax
push esi
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call main
push eax
call dword [sym.imp.MSVCRT20.dll_exit]
jmp 0x40130d
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov eax, dword [ebp - 0x10]
pop edi
mov dword fs:[0], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xe56d42
Capabilities:
Execute anti-debugging instructions

Disassembly:
push 0
jmp 0xe56f19
jmp 0xe56d9d
pop dword [esp]
push dword [esp + 1]
mov dword [esp + 8], ebp
call fcn.00e56de7
imul ecx, dword [eax - reloc.MSVCRT.dll___dllonexit], 0x4246489
mov dword [esp + 4], esp
push edx
mov word [esp + 1], dx
push dword [esp + 2]
jb 0xe56d87
jae 0xe56e4a
pop ebp
jecxz 0xe56e29
push ss
in eax, 0xd
cmpsb byte [esi], byte es:[edi]
rcl dword [eax - 0x2d]
dec edx
in eax, 0x66
mov ebx, dword [esp]
xlatb
mov dword [esp + 4], edi
lea esp, [esp + 4]
pushfd
jmp 0xe5511f
pop dword [esp]
push dword [esp + 1]
mov dword [esp + 8], ebp
jmp 0xe56d92
neg bx
jmp 0xe56e9e
lea edx, [ebx*4]
mov ebx, dword [esp]
neg cx
jb 0xe56e5a
neg bx
rdtsc
not al
sub esp, 0x11
xor bh, bl
jmp 0xe56eda
rdtsc
not al
sub esp, 0x11
jmp 0xe56ed8
xor bh, bl
neg si
call fcn.00e56ebd
xchg bh, bl
mov di, 0x602e
clc
or cx, 0x8d03
and ecx, esi
call fcn.00e56f1e
test eax, 0xdef66bc8
jmp 0xe56ee2
jmp 0xe56e70
Function at 0xf728fe
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop word [esp]
mov cl, byte [esp + 1]
cmp ah, al
jmp 0xf7293f
lea ebp, reloc.MSVCRT.dll___dllonexit
mov ch, 0xeb
pushal
xchg byte [esp + 0xd], ch
mov byte [esp + 9], bl
rdtsc
jmp 0xf7291f

Function at 0xf72b29
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ecx, esi
mov si, word [esp + 9]
btr di, ax
mov ax, 0x3345
jmp 0xf72c31
rdtsc
add esp, 0
std
push word [esp + 1]
mov si, word [esp + 1]
jmp 0xf72b9f
lea ecx, reloc.MSVCRT.dll___dllonexit
mov si, bp
mov si, word [esp]
mov di, word [esp + 1]
lea edi, [esi - 0xdf]
xchg byte [esp], ah
jmp 0xf72b6c
mov dword [esp], ecx
xchg byte [esp + 1], dl
mov word [esp + 1], sp
mov byte [esp], cl
dec esi
mov edx, ecx
jmp 0xf72bd1
inc dl
mov ebx, dword [esp]
cmc
mov byte [esp], bh
lea eax, reloc.MSVCRT.dll___dllonexit
mov word [esp], cx
jmp 0xf72b82
std
xchg word [esp + 1], ax
pop word [esp]
mov dx, cx
pop cx
rcl di, cl
jmp 0xf72c07
xchg ebp, eax
mov ecx, dword [esp]
mov ax, 0xbcb8
xchg ecx, edx
mov ax, 0x199b
mov ch, 0x32
jmp 0xf72bbc
lea ebp, [edi - 0x69]
xchg bp, bx
lea ebx, [esp + ecx]
bswap edx
mov ah, bl
mov bp, 0x9089
jmp 0xf72ced
push dword [esp + 0x11]
add esp, 0x15
mov cl, al
mov dx, word [esp]
mov dh, 0xf0
mov si, 0x894c
jmp 0xf72bf5
lea edx, [esi*4]
mov ah, 0x11
push word [esp + 5]
jmp 0xf72c6f
neg di
mov edi, 0xedb3be03
mov bh, cl
bswap eax
rdtsc
sub esp, 6
jmp 0xf72c46
mov ax, di
mov ebp, edi
inc dx
bts cx, bp
dec bp
mov dword [esp + 1], edi
jmp 0xf72cba
lea edx, [edi + ebp]
xchg cl, dl
setl dh
mov ah, byte [esp + 7]
popal
rol dh, cl
jmp 0xf72c5c
mov edi, esp
mov esi, ebx
mov byte [esp + 0x24], bl
mov bh, 0xb7
xchg byte [esp + 0x2e], bh
cpuid
jmp 0xf72ccd
sub esp, 0xd
push dword [esp]
not eax
sub esp, 0x1b
not bl
mov bx, 0xd0f6
jmp 0xf72c9b
pop dword [esp + 0x24]
and al, 0x24
mov byte [esp + 0x25], bl
neg ch
xchg word [esp + 0x19], ax
bts edx, edi
not si
jmp 0xf72cff
dec eax
xchg cx, ax
adc byte [esi - 0x75], ah
add al, 0x24
mov ax, word [esp]
mov al, dh
cld
pushal
and cl, 0x69
xchg word [esp + 2], bp
jmp 0xf72c8a
std
xchg word [esp + 0x26], dx
pop dword [esp + 0x22]
sub esp, 0xe
sub esp, 0x1c
lea esp, [esp + 0x56]
jmp 0xf72eab
xchg ecx, ebx
cld
mov bp, bx
call fcn.00f72d63
in eax, dx
insb byte es:[edi], dx
loop 0xf72ccf
je 0xf72ce9
stc
fdivr dword [ebx]
adc cl, byte [ebp - 0xd791079]
xchg edi, ebp
xchg dl, dh
mov ah, dh
xchg cx, dx
mov bx, word [esp]
setns ch
jmp 0xf72d3b
mov cl, byte [esp]
lea ebx, [ebp*4]
lea edx, [edx*4]
bt bx, ax
mov edx, 0x7f82f57a
std
jmp 0xf72d51
bts eax, ebx
bswap ebx
bt edx, edx
std
std
mov di, word [esp]
jmp 0xf72d7e
bswap ebp
or di, 0x6333
mov bx, word [esp]
stc
stc
mov cl, 0xf
jmp 0xf72dbb
mov ax, cx
ror bx, 0xd
xchg ecx, ebx
mov cx, bp
lea eax, [esi + edi]
lea esi, [edx*4]
jmp 0xf72deb

Function at 0xf72dfc
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0x13], ecx
lea esi, [ebp*4]
jmp 0xf72e22
Function at 0xf72f44
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov ax, bp
stc
add esp, 0
bsr ax, bp
mov ebp, dword [esp]
dec bh
jmp 0xf72eef
ror ebp, 0xe
pop edx
mov dl, ah
shr si, 0xe
mov ah, byte [esp]
mov bx, word [esp]
jmp 0xf72ec6
xchg bx, cx
mov dl, 0x1b
clc
mov bp, word [esp]
push eax
mov ah, 0x1a
jmp 0xf72f2e
mov ecx, 0x5af7ce0a
stc
mov cx, word [esp + 1]
bswap edx
jmp 0xf72f5c
xchg word [esp + 2], di
mov word [esp + 6], bp
bsf ax, cx
not eax
pop ebp
mov ecx, 0x61cc3b4f
jmp 0xf72edc
mov ebp, 0x1825f9a7
pop word [esp]
add esp, 1
jmp 0xf72efe
jmp 0xf72f16
setnp bh
not esi
mov edi, esp
bt eax, ecx
add esp, 1
jmp 0xf72fb7
mov ecx, 0xe4c907fd
mov bx, word [esp]
xchg edi, eax
mov dx, word [esp]
lea esi, [eax - 0xee]
mov dl, byte [esp + 1]
jmp 0xf72f46
mov edx, 0xd72f94c
mov ch, 0xb4
not cx
lea esp, [esp]
clc
sbb ax, 0x5d79
jmp 0xf72f99

Function at 0xf73223
Capabilities:
Execute anti-debugging instructions

Disassembly:
bsr ecx, esi
mov byte [esp + 2], bh
mov byte [esp + 0x23], dh
jmp 0xf7320d

Function at 0xf73240
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov cx, bp
mov bh, byte [esp + 4]
neg bh
sub esp, 0x1b
bswap ebx
lea esp, [esp + 0x18]
jmp 0xf7315e
bts di, cx
pop esi
bswap ebx
jmp 0xf73177

Function at 0xf73894
Capabilities:
Execute anti-debugging instructions

Disassembly:
push word [esp]
mov word [esp], si
mov byte [esp + 1], cl
jmp 0xf73887
lea esp, [esp + 2]
mov dword [esp], ebp
call 0xf73894
or dword [ebp + reloc.MSVCRT.dll___dllonexit], 0x24
call fcn.00f738dd
cmp byte [eax + 0x56b8492e], bh
push ss
xchg ebp, eax
add eax, 0x84749f6c
aaa
push ds
imul ecx, dword [eax + reloc.MSVCRT.dll___dllonexit], 0x243489fe

Function at 0xf738dd
Capabilities:
Parse pe header

Disassembly:
mov eax, dword fs:[0x30]
jmp 0xf73a00
mov dword [esp], edi
jmp 0xf738c7
mov eax, dword [eax + 8]
push eax
jmp 0xf730d1
lea ebx, [ebx + 0x1c]
mov eax, dword [ebx]
pop ebx
mov eax, dword [eax]
jmp 0xf73931
mov eax, dword [eax + 0xc]
push ebx
mov ebx, eax
jmp 0xf739a4
Function at 0x401800
Capabilities:
Encode data using xor

Disassembly:
push 0x402444
call sub.MSVBVM60.DLL_ThunRTMain
add byte [eax], al
add byte [eax], al
add byte [eax], al
xor byte [eax], al
add byte [eax], al
cmp byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
mov byte [edi], dh
mov dh, 0x7d
mov dl, 0x34
xchg ebx, eax
dec edi
cmpsb byte [esi], byte es:[edi]
mov eax, dword gs:[0x7a709eb5]
mov cl, 0
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [0x30303043], ch
sub eax, 0x30300052
xor byte [eax], dh
xor byte [eax], dh
add byte [eax], al
add byte [eax], al
dec esp
xor dword [eax], eax
push es
jnp 0x40188a
cmp esi, dword [eax + 0x17821d03]
inc esp
xchg ebp, eax
mov al, 3
sbb eax, 0x95441782
imul ecx, dword [eax], 6
call 0xf3f69583
push ds
cmc
lodsd eax, dword [esi]
insb byte es:[di], dx
mov byte [edx + esi*4 - 6], cl
inc ebp
xor edi, 0x4c
jge 0x40184e
cmp cl, byte [edi - 0x53]
xor ebx, dword [ecx - 0x48ee309a]
or al, 0
stosb byte es:[edi], al
add byte [eax - 0x2d], ah
xchg ebx, eax
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
and al, 0xb
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ebx + ecx], ah
add byte [eax], al
cmp dword [ecx], ecx
add byte [eax], al
add byte [0x726f4600], al
insd dword es:[edi], dx
xor dword [eax], eax
or eax, 0x46000501
outsd dx, dword [esi]
jb 0x401927
xor dword [eax], eax
sbb dword [ecx], eax
add byte [edx], al
and edi, ebx
or byte [eax], al
add byte [esp + esi*2], ch
add bl, dh
or byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [ecx], al
add byte [eax], ah
and byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + 0x16000008], ch
add byte [eax], al
add byte [eax], ch
add byte [eax], al
add byte [eax], ah
add byte [eax], al
add byte [eax], al
add byte [eax], al
add dword [eax], eax
or byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax + eax], 0
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], 0
add byte [eax], 0
add byte [eax + 0x800080], al
add byte [eax], al
add byte [eax], 0x80
add byte [eax - 0x3fffff80], al
add al, al
rol al, 0
rcr ah, 0xc0
add al, dh
retf 0xa6
Function at 0x10009a70
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x1007aabb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.1006faf5
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x10009af2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.1006da07
mov eax, dword [eax]
push 0x10095c48
push eax
call fcn.10060754
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.1006fd80
test bl, bl
je 0x10009af2
push 0x10095c48
lea ecx, [esp + 0xc]
call fcn.10070110
push 0x10095c54
lea ecx, [esp + 0xc]
call fcn.10070110
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x10009b2e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.1006fd80
jmp 0x10009bf9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x10009bb2
lea edx, [esp + 0x7c]
push 0x10095c50
push edx
call fcn.10060754
add esp, 8
test eax, eax
je 0x10009bb2
lea eax, [esp + 0x7c]
push 0x10095c4c
push eax
call fcn.10060754
add esp, 8
test eax, eax
je 0x10009bb2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10009b42
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.1006fd80
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x1000a3f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x1000a452
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x1000a460
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x1007ab3b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x1009f4fc]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x1000a598
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x1000a4c6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.1006fd80
xor eax, eax
jmp 0x1000a60f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.1006febd
push esi
lea ecx, [esp + 0xc]
call fcn.1007014c
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x1000a5ed
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.1000a3f0
test eax, eax
jne 0x1000a5ed
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.1000a3f0
test eax, eax
jne 0x1000a5ed
lea eax, [esp + 0x14]
push 0x10095c64
push eax
call fcn.100617d0
mov esi, eax
add esp, 8
test esi, esi
jne 0x1000a5cc
lea ecx, [esp + 0x14]
push 0x10095c60
push ecx
call fcn.10061750
mov esi, eax
add esp, 8
test esi, esi
jne 0x1000a5cc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x1000a5cf
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.1006fe6d
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x1000a4de
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.1006fd80
xor eax, eax
jmp 0x1000a60f
mov byte [esi], 0
push 0x10095c5c
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.1006fd80
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x100198d0
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x1001993e
cmp si, 0x69
ja 0x1001993e
add esi, 0xffd0
cmp si, 0x11
je 0x1001990e
push 0x11
call edi
test ax, ax
jge 0x1001990e
or esi, 0x2000
cmp si, 0x10
je 0x10019923
push 0x10
call edi
test ax, ax
jge 0x10019923
or esi, 0x4000
cmp si, 0x12
je 0x10019938
push 0x12
call edi
test ax, ax
jge 0x10019938
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x1001994b
mov esi, 0xbd
jmp 0x100198ff
cmp si, 0x6e
jne 0x10019958
mov esi, 0xbe
jmp 0x100198ff
cmp si, 0x6f
jne 0x100198f9
mov esi, 0xbf
jmp 0x100198ff

Function at 0x1001b090
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x100afc30]
xor edx, edx
cmp eax, edx
jne 0x1001b0b6
xor eax, eax
mov byte [eax + 0x100afb30], al
inc eax
cmp eax, 0x100
jl 0x1001b09e
mov dword [0x100afc30], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x100afb30
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x1001b147
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x1001b11a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x1001b0e8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x1001b1c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x1001b213
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x1001b1fa
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret