joyce8/EMBER2024-capa huggingface dataset:
Function at 0x30026435
Capabilities:
Log keystrokes via polling

Disassembly:
push ecx
cmp dword [0x301792f4], 1
je 0x30046bce
push edi
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push ebp
push ebx
push 0x10
call esi
xor edi, edi
test ax, ax
mov dword [esp + 0x10], 4
jl 0x30026464
mov dword [esp + 0x10], edi
push 0x11
call esi
test ax, ax
jl 0x30046bd5
xor ebx, ebx
push 0x12
call esi
test ax, ax
jl 0x30046bdd
push 0x90
call esi
mov bp, ax
push 0x14
and ebp, 1
call esi
and eax, 1
shl eax, 1
or ebp, eax
shl ebp, 2
push 0x91
call esi
and eax, 1
or ebp, eax
shl ebp, 8
or ebp, edi
or ebp, ebx
or ebp, dword [esp + 0x10]
pop ebx
mov eax, ebp
pop ebp
pop esi
pop edi
pop ecx
ret
mov eax, dword [0x3017930c]
pop ecx
ret
push 8
pop ebx
jmp 0x30026473
push 0x20
pop edi
jmp 0x30026480

Function at 0x300281ba
Capabilities:
Terminate process

Disassembly:
mov dword [0x3017aa18], 1
cmp dword [esp + 8], 0
push ebx
push esi
mov ebx, dword [esp + 0x14]
mov byte [0x3017aa14], bl
jne 0x300281f6
cmp dword [0x30180d7c], 0
jne 0x30047b53
push 0x3017901c
push 0x30179014
call fcn.300282f5
add esp, 8
push 0x30179024
push 0x30179020
call fcn.300282f5
add esp, 8
test ebx, ebx
jne 0x30047b81
mov eax, dword [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_ExitProcess]
mov esi, dword [0x30180d74]
sub esi, 4
cmp esi, dword [0x30180d7c]
jb 0x300281e4
mov eax, dword [esi]
test eax, eax
je 0x30047b70
call eax
sub esi, 4
cmp esi, dword [0x30180d7c]
jb 0x300281e4
jmp 0x30047b68
pop esi
pop ebx
ret

Function at 0x3004bf5d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 0x1010
push 0x10
call fcn.30028bef
mov ebx, dword [ebp + 0x10]
mov esi, eax
xor eax, eax
cmp ebx, dword [0x3017f8d8]
sete al
mov dword [ebp - 4], eax
test eax, eax
mov eax, dword [0x3017f97c]
jne 0x3004bf91
mov eax, dword [0x3017f7c4]
mov eax, dword [eax + 4]
dec eax
push eax
push dword [ebp + 0xc]
call fcn.30028c90
mov dword [esi + 8], ebx
mov ebx, dword [ebp + 8]
mov edi, eax
cmp edi, ebx
jl 0x3004c010
test edi, edi
jl 0x3004c010
push dword [ebp + 0x14]
sub eax, ebx
push 0x1010
inc eax
push eax
push 1
mov dword [esi], ebx
mov dword [esi + 4], edi
push 4
call fcn.300148f6
push 0
mov dword [esi + 0xc], eax
push eax
call fcn.30015a72
cmp ebx, edi
mov dword [ebp + 0x10], ebx
jg 0x3004c007
push dword [ebp - 4]
push dword [ebp + 0x10]
call fcn.300082ae
mov ecx, dword [0x3017f958]
mov edx, dword [ecx]
mov ebx, edx
xor ebx, eax
and ebx, 1
xor ebx, edx
mov dword [ecx], ebx
add dword [0x3017f958], 4
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], edi
jle 0x3004bfda
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x10
xor eax, eax
mov dword [esi + 4], eax
mov dword [esi], eax
mov dword [esi + 0xc], eax
jmp 0x3004c007
Function at 0x3005c7a7
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x408
push ebx
push esi
mov ebx, dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push edi
mov esi, 0xff
push esi
xor edi, edi
cmp dword [0x3017dbf4], edi
lea eax, [ebp - 0x204]
push eax
jne 0x3005c92a
call fcn.30168fb5
cmp word [ebp + eax*2 - 0x206], 0x5c
lea ecx, [ebp + eax*2 - 0x204]
jne 0x3005c931
mov word [ecx - 2], di
lea eax, [ebp - 0x204]
push eax
push 0x3017e240
call dword [0x3017be38]
mov edi, 0x3017e520
push edi
lea eax, [ebp - 0x204]
push eax
call dword [0x3017bedc]
lea eax, [ebp - 0x204]
push eax
call fcn.300147a2
cmp dword [ebp + 8], 0
lea eax, [ebp - 0x204]
push eax
je 0x3005c965
call fcn.30003a19
test eax, eax
jne 0x3005c972
cmp dword [0x3017dbf4], eax
push esi
lea eax, [ebp - 0x408]
push eax
jne 0x3005c943
call fcn.30168fb5
cmp word [ebp + eax*2 - 0x40a], 0x5c
lea ecx, [ebp + eax*2 - 0x408]
jne 0x3005c94a
and word [ecx - 2], 0
lea eax, [ebp - 0x204]
push eax
lea eax, [ebp - 0x408]
push eax
call dword [0x3017bedc]
lea eax, [ebp - 0x408]
push eax
push 0x3017e090
call dword [0x3017be38]
push edi
lea eax, [ebp - 0x408]
push eax
call dword [0x3017bedc]
lea eax, [ebp - 0x408]
push eax
call fcn.300147a2
lea eax, [ebp - 0x408]
push eax
call fcn.30003a19
test eax, eax
jne 0x3005c972
cmp dword [0x3017dbf4], eax
push esi
lea eax, [ebp - 0x204]
push eax
push dword [0x3017dd10]
jne 0x3005c95d
call fcn.30019d3e
lea eax, [ebp - 0x204]
push eax
call fcn.3001629a
push eax
push 0x3017e240
call dword [0x3017bedc]
push edi
lea eax, [ebp - 0x204]
push eax
call dword [0x3017bedc]
lea eax, [ebp - 0x204]
push eax
call fcn.300147a2
lea eax, [ebp - 0x204]
push eax
call fcn.30003a19
pop edi
pop esi
pop ebx
leave
ret 4
call ebx
jmp 0x3005c7d9
mov word [ecx], 0x5c
mov word [ebp + eax*2 - 0x202], di
jmp 0x3005c7f3
call ebx
jmp 0x3005c85b
mov word [ecx], 0x5c
and word [ebp + eax*2 - 0x406], 0
jmp 0x3005c876
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
jmp 0x3005c8e5
call fcn.30003a19
test eax, eax
je 0x3005c972
xor eax, eax
jmp 0x3005c923
push 1
pop eax
jmp 0x3005c923
Function at 0x30087136
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp dword [0x3017dbf4], 0
push edi
mov edi, dword [ebp + 0xc]
lea eax, [ebp + 0xc]
push eax
mov dword [ebp + 0xc], edi
push esi
jne 0x300871a3
call fcn.30168ee4
test eax, eax
je 0x300871b2
cmp dword [ebp + 0xc], 1
jbe 0x300871b2
cmp dword [ebp + 0x10], 0
je 0x30087174
mov eax, dword [ebp + 0xc]
mov word [esi + eax*2 - 2], 0x38
inc dword [ebp + 0xc]
mov eax, dword [ebp + 0xc]
cmp dword [ebp + 0x10], 0
mov word [esi + eax*2 - 2], 0x2e
push 4
jne 0x300871ab
push 0x102c3
mov eax, dword [ebp + 0xc]
lea eax, [esi + eax*2]
push eax
call fcn.30028b60
add dword [ebp + 0xc], eax
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebp
ret 0xc
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x30087157
push 0x102c4
jmp 0x3008718b
cmp dword [ebp + 0x10], 0
push edi
jne 0x300871c6
push 0x102c1
push esi
call fcn.30028b60
jmp 0x3008719d
push 0x102c2
jmp 0x300871be

Function at 0x300871cd
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x204
push esi
push edi
mov eax, 0x100
push eax
push 0x102c5
mov dword [ebp - 4], eax
lea eax, [ebp - 0x204]
push eax
call fcn.30028b60
mov edi, dword [ebp + 0xc]
push 5
mov esi, dword [ebp + 8]
push edi
push esi
push 0x301793ec
lea eax, [ebp - 0x204]
push eax
push 0x3017a01c
call fcn.30028ffc
cmp word [esi], 0
je 0x3008726b
cmp dword [0x3017dbf4], 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x204]
push eax
jne 0x30087263
call fcn.30168ee4
test eax, eax
je 0x3008726b
cmp dword [ebp - 4], 1
jbe 0x3008726b
push esi
call fcn.300147a2
mov ax, word [esi]
movzx ecx, ax
push 1
sub edi, ecx
dec edi
movzx eax, ax
push edi
lea eax, [esi + eax*2 + 2]
push eax
call fcn.30087136
add word [esi], ax
pop edi
pop esi
leave
ret 8
call dword [sym.imp.ADVAPI32.dll_GetUserNameW]
jmp 0x30087231
push esi
call fcn.30158864
jmp 0x30087241
Function at 0x3008aff5
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x450
mov eax, dword [0x3017f120]
push ebx
push esi
and word [0x3017d6d0], 0xffdf
push edi
xor ebx, ebx
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x50]
push ebx
mov dword [0x3017f120], eax
lea eax, [ebp - 0x50]
push eax
call fcn.30001d18
pop ecx
test eax, eax
pop ecx
jne 0x3008b15d
mov edi, 0x3017d6c0
stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
push 0x20019
push ebx
cmp dword [0x3017dbf4], ebx
push 0x3016f2ac
push reloc.GRINTL32.dll_Ordinal_2
jne 0x3008b0dc
call fcn.301690c5
push 0xff
xor ecx, ecx
cmp eax, ebx
sete cl
push 0x102e1
lea eax, [ebp - 0x450]
mov dword [ebp - 0xc], ecx
push eax
call fcn.30028b60
cmp dword [ebp - 0xc], ebx
mov edi, eax
mov dword [ebp - 8], 0x1fe
je 0x3008b0ef
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x250]
push eax
push ebx
push ebx
cmp dword [0x3017dbf4], ebx
lea eax, [ebp - 0x450]
push eax
push dword [ebp - 4]
jne 0x3008b0e7
call fcn.30169101
cmp eax, ebx
jne 0x3008b0ef
mov eax, dword [ebp - 8]
cdq
sub eax, edx
mov esi, eax
sar esi, 1
dec esi
cmp word [ebp + esi*2 - 0x252], 0x5c
je 0x3008b101
mov word [ebp + esi*2 - 0x250], 0x5c
inc esi
mov word [ebp + esi*2 - 0x250], bx
jmp 0x3008b101
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
jmp 0x3008b05b
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x3008b0ad
lea eax, [ebp - 0x250]
push eax
call fcn.3001f824
mov esi, eax
cmp esi, ebx
jne 0x3008b0d2
push 0x2080
lea eax, [esi + edi]
lea eax, [eax + eax + 4]
push eax
call fcn.30028bef
lea ecx, [esi + edi]
mov dword [0x3017d6c0], eax
cmp esi, ebx
mov word [eax], cx
je 0x3008b138
mov eax, dword [0x3017d6c0]
add eax, 2
push eax
lea eax, [ebp - 0x250]
push eax
call dword [0x3017bedc]
mov eax, dword [0x3017d6c0]
lea eax, [eax + esi*2 + 2]
push eax
lea eax, [ebp - 0x450]
push eax
call dword [0x3017bedc]
cmp dword [ebp - 0xc], ebx
je 0x3008b15d
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
mov dword [0x3017f120], eax
pop ebx
leave
ret

Function at 0x3008b1de
Capabilities:
Resolve function by parsing pe exports

Disassembly:
movsx eax, word [esp + 4]
add eax, 0xffffffa0
cmp eax, 0x22
ja case.0x3008b1ef.97
jmp dword [eax*4 + 0x301779a4]
mov eax, 0x2bc
ret 4
mov eax, 0x1bb
jmp 0x3008b1fb
mov eax, 0x181
jmp 0x3008b1fb
mov eax, 0x183
jmp 0x3008b1fb
mov eax, 0x17f
jmp 0x3008b1fb
mov eax, 0xf1
jmp 0x3008b1fb
mov eax, 0x27f
jmp 0x3008b1fb
push 0x79
pop eax
jmp 0x3008b1fb
mov eax, 0x3bf
jmp 0x3008b1fb
push 0x7d
jmp 0x3008b22a
push 0x7e
jmp 0x3008b22a
mov eax, 0x23e
jmp 0x3008b1fb
mov eax, 0x201
jmp 0x3008b1fb
mov eax, 0x202
jmp 0x3008b1fb
mov eax, 0x3bc
jmp 0x3008b1fb
mov eax, 0x300
jmp 0x3008b1fb
mov eax, 0xbd
jmp 0x3008b1fb
mov eax, 0x85
jmp 0x3008b1fb
mov eax, 0xbe
jmp 0x3008b1fb
mov eax, 0xbf
jmp 0x3008b1fb
mov eax, 0x81
jmp 0x3008b1fb
mov eax, 0x82
jmp 0x3008b1fb
mov eax, 0x83
jmp 0x3008b1fb
mov eax, 0x84
jmp 0x3008b1fb
mov eax, 0x87
jmp 0x3008b1fb
xor eax, eax
jmp 0x3008b1fb
push 2
jmp 0x3008b22a
push 1
jmp 0x3008b22a
push 3
jmp 0x3008b22a
push 4
jmp 0x3008b22a
or eax, 0xffffffff
jmp 0x3008b1fb
Function at 0x300947fa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44c
mov eax, dword [0x3017f120]
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 0xc], eax
lea eax, [ebp - 0x4c]
push edi
mov dword [0x3017f120], eax
lea eax, [ebp - 0x4c]
push eax
call fcn.30001d18
pop ecx
test eax, eax
pop ecx
jne 0x30094938
push 0xff
push dword [ebp + 8]
lea eax, [ebp - 0x44c]
push eax
call fcn.30028b60
mov ebx, eax
lea eax, [ebp - 4]
push eax
push 0x20019
push edi
cmp dword [0x3017dbf4], edi
push 0x30170454
push reloc.GRINTL32.dll_Ordinal_2
jne 0x300948c5
call fcn.301690c5
cmp eax, edi
jne 0x30094947
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x24c]
push eax
push edi
push edi
cmp dword [0x3017dbf4], edi
lea eax, [ebp - 0x44c]
push eax
push dword [ebp - 4]
mov dword [ebp - 8], 0x1fe
jne 0x300948cd
call fcn.30169101
cmp eax, edi
jne 0x300948d5
mov eax, dword [ebp - 8]
cdq
sub eax, edx
mov esi, eax
sar esi, 1
dec esi
cmp word [ebp + esi*2 - 0x24e], 0x5c
je 0x300948e7
mov word [ebp + esi*2 - 0x24c], 0x5c
inc esi
mov word [ebp + esi*2 - 0x24c], di
jmp 0x300948e7
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
jmp 0x30094863
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x30094896
lea eax, [ebp - 0x24c]
push eax
call fcn.3001f824
mov esi, eax
cmp esi, edi
jne 0x300948bb
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
cmp dword [ebp + 8], 0x10107
jne 0x30094938
push 0x2080
lea eax, [esi + ebx]
lea eax, [eax + eax + 2]
push eax
call fcn.30028bef
cmp esi, edi
mov dword [0x30179b1c], eax
je 0x30094927
push eax
lea eax, [ebp - 0x24c]
push eax
call dword [0x3017bedc]
mov eax, dword [0x30179b1c]
lea eax, [eax + esi*2]
push eax
lea eax, [ebp - 0x44c]
push eax
call dword [0x3017bedc]
mov eax, dword [ebp - 0xc]
pop edi
pop esi
mov dword [0x3017f120], eax
pop ebx
leave
ret 4
lea eax, [ebp - 0x24c]
push eax
call fcn.3001f824
mov esi, eax
cmp esi, edi
je 0x300948f0
mov word [ebp + esi*2 - 0x24c], di
jmp 0x300948f0
Function at 0x300a3324
Capabilities:
Enumerate pe sections

Disassembly:
mov eax, dword [0x30179c1c]
mov ecx, 0x87
cmp eax, ecx
jg 0x300a3354
cmp eax, ecx
je 0x300a3349
test eax, eax
jne case.0x300a3374.139
mov dword [0x30179bc4], 0x4000
ret
mov dword [0x30179bc4], 0x16
ret
cmp eax, 0x1002
jg 0x300a33e9
cmp eax, 0x1001
jge 0x300a33de
add eax, 0xffffff76
cmp eax, 0xe
ja case.0x300a3374.139
jmp dword [eax*4 + 0x30177b82]
mov dword [0x30179bc4], 1
ret
mov dword [0x30179bc4], 0x406
ret
mov dword [0x30179bc4], 0x209
ret
mov dword [0x30179bc4], 0x609
ret
mov dword [0x30179bc4], 0x709
ret
mov dword [0x30179bc4], 0x109
ret
mov dword [0x30179bc4], 0x309
ret
mov dword [0x30179bc4], 0x101
ret
mov dword [0x30179bc4], 0x1f
ret
mov dword [0x30179bc4], 2
ret
sub eax, 0x1003
je 0x300a340b
sub eax, 0x10
je 0x300a3400
mov dword [0x30179bc4], 0x1e
ret
mov dword [0x30179bc4], 4
ret
mov dword [0x30179bc4], 3
ret
Function at 0x300bf424
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebx
push ebp
xor ebp, ebp
cmp dword [esp + 0xc], ebp
push esi
push edi
je 0x300bf4c7
cmp dword [0x3017da20], ebp
je 0x300bf496
cmp dword [0x3017e518], ebp
jne 0x300bf496
cmp dword [0x3017dbf4], ebp
mov edi, dword [sym.imp.USER32.dll_SetWindowsHookExW]
mov ebx, dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
jne 0x300bf49d
call esi
push eax
push dword [0x3017dd10]
push dword [0x3017e494]
push 2
call ebx
cmp dword [0x3017dbf4], ebp
mov dword [0x3017e518], eax
jne 0x300bf4b2
call esi
push eax
push dword [0x3017dd10]
push dword [0x3017e4e4]
push 0xffffffffffffffff
call ebx
mov dword [0x3017e75c], eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
call esi
push eax
push dword [0x3017dd10]
push dword [0x3017e494]
push 2
call edi
jmp 0x300bf471
call esi
push eax
push dword [0x3017dd10]
push dword [0x3017e4e4]
push 0xffffffffffffffff
call edi
jmp 0x300bf491
mov eax, dword [0x3017e518]
cmp eax, ebp
je 0x300bf496
mov esi, dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
push eax
call esi
push dword [0x3017e75c]
call esi
mov dword [0x3017e518], ebp
mov dword [0x3017e75c], ebp
jmp 0x300bf496
Function at 0x3011efc6
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x17
push esi
call fcn.3000365f
push 1
call fcn.30003638
mov edi, eax
mov ebx, 0xff00
mov ax, word [edi + 0x28]
and ax, bx
xor ecx, ecx
cmp ax, bx
setne cl
lea eax, [esi + 0xc0]
push ecx
push eax
call fcn.3009684f
mov ax, word [edi + 0x2c]
and ax, bx
xor ecx, ecx
cmp ax, bx
setne cl
push ecx
push esi
call fcn.3009684f
push edi
call fcn.300e6f3c
push eax
lea eax, [esi + 0x90]
push eax
call fcn.3009684f
mov eax, dword [edi + 0x14]
neg eax
push eax
lea eax, [esi + 0xc]
push eax
call fcn.30003684
push dword [edi + 0x18]
lea eax, [esi + 0x48]
push eax
call fcn.30003684
mov ax, word [edi + 0x30]
and ax, bx
xor ecx, ecx
cmp ax, bx
setne cl
lea eax, [esi + 0xcc]
push ecx
push eax
call fcn.3009684f
mov al, byte [edi]
shr eax, 3
and eax, 1
push eax
lea eax, [esi + 0xe4]
push eax
call fcn.3009684f
push dword [edi + 0x20]
lea eax, [esi + 0x18]
push eax
call fcn.30003684
push dword [edi + 0x1c]
lea eax, [esi + 0x54]
push eax
call fcn.30003684
mov eax, dword [edi + 0x24]
mov ax, word [eax + 0x188]
shr eax, 8
and eax, 1
push eax
lea eax, [esi + 0x60]
push eax
call fcn.3009684f
movzx eax, word [edi]
shr eax, 0xf
push eax
lea eax, [esi + 0xd8]
push eax
call fcn.3009684f
push dword [edi + 0x4f4]
lea eax, [esi + 0x24]
push eax
call fcn.30003684
push dword [edi + 0x4f0]
lea eax, [esi + 0x9c]
push eax
call fcn.30003684
push dword [edi + 0x4e8]
lea eax, [esi + 0xa8]
push eax
call fcn.30003684
push dword [edi + 0x4ec]
lea eax, [esi + 0x30]
push eax
call fcn.30003684
mov ax, word [edi]
shr eax, 9
and eax, 1
push eax
lea eax, [esi + 0xfc]
push eax
call fcn.3009684f
push dword [edi + 0x50c]
lea eax, [esi + 0xb4]
push eax
call fcn.30003684
mov ax, word [edi + 4]
and ax, 0x3fff
cmp ax, 3
jne 0x3011f196
push dword [edi + 0x18]
lea eax, [esi + 0xf0]
push eax
call fcn.30003684
mov eax, dword [edi + 0x4f8]
inc eax
push eax
lea eax, [esi + 0x3c]
push eax
call fcn.30003684
push edi
call fcn.300df325
push eax
lea eax, [esi + 0x6c]
push eax
call fcn.30003684
lea eax, [ebp - 8]
push eax
push edi
call fcn.300df36e
lea eax, [ebp - 8]
push eax
lea eax, [esi + 0x78]
push eax
call fcn.30096863
push edi
call fcn.300df353
push eax
add esi, 0x84
push esi
call fcn.30003684
pop edi
pop esi
pop ebx
leave
ret 4
push 0
jmp 0x3011f138
Function at 0x3014df26
Capabilities:
Encode data using xor

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
test edi, edi
je 0x3014dfa7
mov eax, dword [esp + 0x14]
test eax, eax
je 0x3014df68
mov ecx, dword [0x3017d054]
mov edx, ecx
and edx, 0x2000
test dx, dx
je 0x3014df68
and ecx, 0x1000
test cx, cx
jne 0x3014df68
push 1
mov eax, dword [esp + 0x10]
push edi
push eax
call fcn.3014de59
pop edi
pop esi
ret 0xc
mov ecx, dword [0x3017c814]
test eax, eax
je 0x3014df81
mov ecx, dword [0x3017c748]
sub ecx, dword [0x3017dfec]
and ecx, 0xf
mov esi, dword [esp + 0xc]
mov al, byte [ecx + 0x3017df70]
xor al, byte [esi]
mov dl, al
shl dl, 3
shr al, 5
or dl, al
mov byte [esi], dl
inc esi
inc ecx
and ecx, 0xf
dec edi
jne 0x3014df85
mov dword [0x3017c814], ecx
pop edi
pop esi
ret 0xc
Function at 0x30157f3b
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
mov esi, dword [sym.imp.USER32.dll_GetKeyState]
push 1
call esi
test ax, ax
jl 0x30157f61
push 2
call esi
test ax, ax
jl 0x30157f61
push 4
call esi
test ax, ax
jl 0x30157f61
xor eax, eax
pop esi
ret
push 1
pop eax
pop esi
ret

Function at 0x301585ce
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
push esi
push edi
push 2
mov edi, dword [ebp + 8]
pop esi
push 0x5c
lea edx, [edi + 2]
mov eax, edx
pop ecx
cmp word [eax], cx
je 0x301585f0
add eax, esi
jmp 0x301585e7
cmp eax, edx
jne 0x30158607
add eax, 4
cmp word [eax], cx
je 0x30158600
add eax, esi
jmp 0x301585f7
add eax, esi
cmp word [eax], cx
jne 0x30158600
sub eax, edi
mov esi, eax
sar esi, 1
push esi
lea eax, [ebp - 0x208]
push eax
push edx
call fcn.30028c12
xor edi, edi
push edi
push edi
lea eax, [ebp - 4]
push eax
lea eax, [ebp + 8]
push eax
push edi
push edi
cmp dword [0x3017dbf4], edi
push edi
lea eax, [ebp - 0x208]
mov word [ebp + esi*2 - 0x208], di
push eax
jne 0x30158659
call fcn.30168f28
cmp eax, edi
je 0x30158661
cmp dword [ebp + 8], 0xf
jb 0x30158661
push 1
pop eax
pop edi
pop esi
leave
ret 4
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationW]
jmp 0x30158646
xor eax, eax
jmp 0x30158653

Function at 0x30158734
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x200
push esi
mov esi, dword [ebp + 8]
movzx eax, word [esi]
push eax
lea eax, [ebp - 0x200]
push eax
lea eax, [esi + 2]
push eax
call fcn.30028c12
movzx eax, word [esi]
and word [ebp + eax*2 - 0x200], 0
cmp dword [0x3017dbf4], 0
lea eax, [ebp - 0x200]
push eax
jne 0x3015877b
call fcn.301689f9
pop esi
leave
ret 4
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x30158776

Function at 0x30158864
Capabilities:
Get common file path

Disassembly:
cmp dword [0x3017dbf4], 0
push esi
mov esi, dword [esp + 8]
push 0xff
lea eax, [esi + 2]
push eax
jne 0x3015889e
call fcn.30168fb5
movzx ecx, ax
mov word [esi], ax
cmp word [esi + ecx*2], 0x5c
je 0x3015889a
inc eax
mov word [esi], ax
movzx eax, ax
mov word [esi + eax*2], 0x5c
pop esi
ret 4
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x30158880
Function at 0x301588a6
Capabilities:
Get common file path
Set current directory
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x214
push esi
push dword [ebp + 8]
xor esi, esi
cmp dword [0x3017dbf4], esi
jne 0x30158936
call fcn.301692cb
cmp eax, esi
je 0x30158956
cmp dword [0x3017dbf4], esi
lea eax, [ebp - 0x214]
push eax
push 0x105
jne 0x3015893e
call fcn.30168d4a
cmp eax, esi
je 0x30158956
cmp dword [0x30179338], esi
mov eax, dword [ebp - 0x214]
mov word [ebp - 8], 0x3d
jne 0x30158946
cmp ax, 0x80
jae 0x30158946
and ax, 0xdf
cmp dword [0x3017dbf4], esi
mov word [ebp - 6], ax
lea eax, [ebp - 0x214]
push eax
lea eax, [ebp - 8]
mov word [ebp - 4], 0x3a
mov word [ebp - 2], si
push eax
jne 0x3015894e
call fcn.3016932e
cmp eax, esi
je 0x30158956
xor eax, eax
pop esi
leave
ret 4
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
jmp 0x301588c2
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
jmp 0x301588e3
push eax
call fcn.301683a5
jmp 0x30158905
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x3015892b
or eax, 0xffffffff
jmp 0x30158931

Function at 0x30161c0d
Capabilities:
Read clipboard data

Disassembly:
cmp dword [0x3017c750], 0
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x14]
je 0x30161c28
push edi
call fcn.30162bdf
test eax, eax
je 0x30161c5e
cmp edi, 2
jne 0x30161c34
call fcn.30162c06
mov edi, eax
mov esi, dword [edi*4 + 0x30179e60]
cmp edi, 9
jne 0x30161c4f
push 8
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x30161c4f
push 8
pop esi
mov ebp, dword [sym.imp.USER32.dll_GetClipboardData]
push esi
call ebp
mov ebx, eax
test ebx, ebx
jne 0x30161c67
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
ret 4
cmp esi, 8
jne 0x30161c79
cmp edi, 0x2f
je 0x30161c79
push ebx
call fcn.301623a1
jmp 0x30161c60
cmp esi, 2
jne 0x30161cb6
cmp dword [0x3017dae8], 0
je 0x30161cb6
push 9
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x30161cb6
push 9
call ebp
test eax, eax
je 0x30161cb6
cmp edi, 0x2f
jne 0x30161cab
push 0
push eax
push ebx
call fcn.30162207
jmp 0x30161c60
push eax
push ebx
call fcn.301621d9
test eax, eax
jne 0x30161c60
push edi
push ebx
call fcn.30161e6f
cmp edi, 0x26
jne 0x30161c60
test eax, eax
je 0x30161c60
push 1
push eax
call fcn.301539d1
jmp 0x30161c60

Function at 0x30161e5b
Capabilities:
Read clipboard data

Disassembly:
mov eax, dword [esp + 4]
push dword [eax*4 + 0x30179e60]
call dword [sym.imp.USER32.dll_GetClipboardData]
ret 4