joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100515f
Capabilities:
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb0
mov eax, dword [0x10091b8]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], eax
call dword [sym.imp.USER32.dll_CountClipboardFormats]
test eax, eax
je 0x100528a
push edi
xor edi, edi
cmp dword [0x1009bac], edi
je 0x1005289
push dword [0x1009448]
call fcn.01002a5f
test eax, eax
jne 0x10051b2
push 0x10020a8
call fcn.01004c8a
pop ecx
jmp 0x1005289
call dword [sym.imp.USER32.dll_EmptyClipboard]
push edi
push 0x80
push 3
push edi
push 1
push 0x80000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1005279
push ebx
push esi
call fcn.01004c90
mov ebx, eax
cmp ebx, edi
jne 0x10051f2
push 0x1002024
call fcn.01004c8a
pop ecx
test ebx, ebx
jbe 0x100526f
push edi
lea eax, [ebp - 0xb0]
push eax
push esi
call fcn.01004d1d
lea eax, [ebp - 0xa4]
push eax
push 0x1002010
call fcn.01004c8a
cmp dword [ebp - 0xb0], 0xc000
pop ecx
pop ecx
jb 0x1005236
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov dword [ebp - 0xb0], eax
push esi
lea eax, [ebp - 0xb0]
push eax
call fcn.01006424
test eax, eax
je 0x100525f
push eax
push dword [ebp - 0xb0]
call dword [sym.imp.USER32.dll_SetClipboardData]
test eax, eax
jne 0x100526a
push 0x1002090
jmp 0x1005264
push 0x1002078
call fcn.01004c8a
pop ecx
inc edi
cmp edi, ebx
jb 0x10051f6
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop ebx
jmp 0x1005284
push 0x1002038
call fcn.01004c8a
pop ecx
call fcn.01002aa5
pop edi
mov ecx, dword [ebp - 4]
xor eax, eax
pop esi
call fcn.01007021
leave
ret 4
Function at 0x100531e
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xb8
mov eax, dword [0x10091b8]
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor esi, esi
push esi
push esi
push dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x1c]
push ebx
mov dword [ebp - 0xb8], eax
mov dword [ebp - 0xb4], esi
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
xor eax, eax
cmp dword [0x1009a8c], esi
je 0x10053ac
push 0x2b
pop ecx
push dword [ebp - 0xb8]
lea edi, [ebp - 0xb0]
rep stosd dword es:[edi], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xb0], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xac], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xa8], eax
lea eax, [ebp - 0xa4]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
push esi
lea eax, [ebp - 0xb4]
push eax
push 0xac
lea eax, [ebp - 0xb0]
jmp 0x10053ee
push 0x16
pop ecx
lea edi, [ebp - 0x60]
rep stosd dword es:[edi], eax
stosb byte es:[edi], al
mov ax, word [ebp + 0x18]
push esi
mov word [ebp - 0x60], ax
mov eax, dword [ebp + 0x14]
push esi
mov dword [ebp - 0x5e], eax
mov eax, dword [ebp + 0x10]
push 0x4f
mov dword [ebp - 0x5a], eax
lea eax, [ebp - 0x56]
push eax
push 0xffffffffffffffff
push dword [ebp - 0xb8]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
push esi
lea eax, [ebp - 0xb4]
push eax
push 0x59
lea eax, [ebp - 0x60]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0xb4]
pop edi
pop esi
pop ebx
call fcn.01007021
leave
ret 0x18
Function at 0x1005fe2
Capabilities:
Read clipboard data
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push edi
push dword [ebp + 8]
xor edi, edi
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x10060a4
push dword [0x1009448]
call fcn.01002a5f
test eax, eax
je 0x10060a4
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
mov dword [ebp - 8], esi
je 0x100609a
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_GlobalSize]
push esi
call ebx
push eax
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
test eax, eax
mov dword [ebp - 4], eax
je 0x1006099
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GlobalLock]
call esi
test eax, eax
mov dword [ebp + 8], eax
je 0x1006099
push dword [ebp - 4]
call esi
mov esi, eax
test esi, esi
je 0x1006090
push dword [ebp - 8]
call ebx
test eax, eax
je 0x1006073
mov ecx, dword [ebp + 8]
mov cl, byte [ecx]
mov byte [esi], cl
inc esi
inc dword [ebp + 8]
dec eax
jne 0x1006065
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp - 4]
push dword [ebp + 0xc]
call dword [sym.imp.USER32.dll_SetClipboardData]
mov edi, eax
neg edi
sbb edi, edi
neg edi
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop ebx
call fcn.01002aa5
test edi, edi
pop esi
jne 0x10060be
push 0x1002314
call fcn.01004c8a
cmp dword [ebp - 4], 0
pop ecx
je 0x10060be
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, edi
pop edi
leave
ret 8
Function at 0x10066e0
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
cmp dword [esi], 0xc000
jb 0x1006700
lea eax, [esi + 0xc]
push eax
call dword [sym.imp.USER32.dll_RegisterClipboardFormatW]
mov dword [esi], eax
push dword [esi + 4]
push 0x42
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
xor ebx, ebx
cmp eax, ebx
mov dword [ebp + 8], eax
jne 0x1006721
push 0x100248c
call fcn.01004c8a
pop ecx
jmp 0x10067a0
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
cmp eax, ebx
mov dword [ebp - 8], eax
jne 0x100673c
push 0x1002464
call fcn.01004c8a
pop ecx
jmp 0x10067b7
push edi
mov edi, dword [esi + 8]
push edi
lea eax, [esi + 0xc]
push eax
push 0x100243c
call fcn.01004c8a
add esp, 0xc
push ebx
push ebx
push edi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push ebx
lea eax, [ebp - 4]
push eax
push dword [esi + 4]
push dword [ebp - 8]
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov eax, dword [esi + 4]
cmp eax, dword [ebp - 4]
pop edi
push dword [ebp + 8]
je 0x10067a4
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
push dword [ebp - 4]
push dword [esi + 4]
push 0x1002408
call fcn.01004c8a
add esp, 0xc
xor eax, eax
jmp 0x10067c2
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.01006a26
mov ebx, eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, ebx
pop esi
pop ebx
leave
ret 0xc
Function at 0x1006d2b
Capabilities:
Parse pe header
Terminate process

Disassembly:
push 0x28
push 0x10025a8
call fcn.01006ee0
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
cmp word [eax], 0x5a4d
jne 0x1006d66
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x1006d66
movzx eax, word [ecx + 0x18]
cmp eax, 0x10b
je 0x1006d7e
cmp eax, 0x20b
je 0x1006d6b
mov dword [ebp - 0x1c], edi
jmp 0x1006d92
cmp dword [ecx + 0x84], 0xe
jbe 0x1006d66
xor eax, eax
cmp dword [ecx + 0xf8], edi
jmp 0x1006d8c
cmp dword [ecx + 0x74], 0xe
jbe 0x1006d66
xor eax, eax
cmp dword [ecx + 0xe8], edi
setne al
mov dword [ebp - 0x1c], eax
mov dword [ebp - 4], edi
push 1
call dword [sym.imp.msvcrt.dll___set_app_type]
pop ecx
or dword [0x1009bb0], 0xffffffff
or dword [0x1009bb4], 0xffffffff
call dword [sym.imp.msvcrt.dll___p__fmode]
mov ecx, dword [0x1009440]
mov dword [eax], ecx
call dword [sym.imp.msvcrt.dll___p__commode]
mov ecx, dword [0x100943c]
mov dword [eax], ecx
mov eax, dword [sym.imp.msvcrt.dll__adjust_fdiv]
mov eax, dword [eax]
mov dword [0x1009bb8], eax
call fcn.01006ed8
cmp dword [0x10091bc], edi
jne 0x1006ded
push fcn.01006ed8
call dword [sym.imp.msvcrt.dll___setusermatherr]
pop ecx
call fcn.01006ec1
push 0x10012d8
push 0x10012d4
call sub.msvcrt.dll__initterm
mov eax, dword [0x1009438]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
push dword [0x1009434]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.msvcrt.dll___getmainargs]
mov dword [ebp - 0x34], eax
push 0x10012d0
push 0x10012c8
call sub.msvcrt.dll__initterm
mov eax, dword [ebp - 0x20]
mov ecx, dword [sym.imp.msvcrt.dll___initenv]
mov dword [ecx], eax
push dword [ebp - 0x20]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.01002d6a
add esp, 0x30
mov esi, eax
mov dword [ebp - 0x38], esi
cmp dword [ebp - 0x1c], edi
jne 0x1006e64
push esi
call dword [sym.imp.msvcrt.dll_exit]
call dword [sym.imp.msvcrt.dll__cexit]
jmp 0x1006e99
or dword [ebp - 4], 0xffffffff
mov eax, esi
call fcn.01006f1b
ret
Function at 0x1000c196
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 4], 0
mov dword [ebp - 8], esp
push 2
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x1000c1cd
push 6
call fcn.1000ea96
add esp, 4
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x41
jl 0x1000c1eb
cmp dword [ebp - 4], 0x5a
jg 0x1000c1eb
mov eax, 1
jmp 0x1000c1f0
mov eax, 0
test eax, eax
je 0x1000c1fc
add dword [ebp - 4], 0x20
mov eax, dword [ebp - 4]
jmp 0x1000c204
mov esp, ebp
pop ebp
ret 4

Function at 0x1000dbf3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x10], esp
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x1000dc35
push 6
call fcn.1000ea96
add esp, 4
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], esp
push str.CallWindowProcA
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
nop
nop
nop
nop
cmp dword [ebp - 0x18], esp
je 0x1000dc5f
push 6
call fcn.1000ea96
add esp, 4
mov dword [ebp - 4], eax
push dword [ebp + 8]
call fcn.1000dd01
mov dword [ebp - 8], eax
mov dword [ebp - 0x10], esp
push 0
push 0
push dword [ebp - 8]
push dword [ebp - 4]
push 0
push 0
push dword [0x10032f16]
call dword [sym.imp.KERNEL32.dll_CreateRemoteThread]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x1000dcac
push 6
call fcn.1000ea96
add esp, 4
mov dword [ebp - 0xc], eax
cmp dword [ebp + 0xc], 0
je 0x1000dce5
mov dword [ebp - 0x10], esp
push 0xffffffff
push dword [ebp - 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
nop
nop
nop
nop
cmp dword [ebp - 0x10], esp
je 0x1000dce0
push 6
call fcn.1000ea96
add esp, 4
call fcn.1000de39
call fcn.1000de39
cmp dword [ebp - 0xc], 0
mov eax, 0
setne al
jmp 0x1000dcfb
mov esp, ebp
pop ebp
ret 0xc

Function at 0x1000ddc8
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov dword [ebp - 4], 0
cmp dword [ebp + 8], 0
jne 0x1000dde9
mov dword [ebp + 8], 0x400
mov eax, dword [ebp + 8]
mov dword [0x10032f1e], eax
mov dword [ebp - 8], esp
push 0x40
push 0x1000
push dword [ebp + 8]
push 0
push dword [0x10032f16]
call dword [sym.imp.KERNEL32.dll_VirtualAllocEx]
nop
nop
nop
nop
cmp dword [ebp - 8], esp
je 0x1000de28
push 6
call fcn.1000ea96
add esp, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
jmp 0x1000de33
mov esp, ebp
pop ebp
ret 8
Function at 0x1000f230
Capabilities:
Read .ini file

Disassembly:
push ebx
push ebp
push esi
push edi
push 0x400
call fcn.10024075
mov ebx, dword [esp + 0x1c]
mov ebp, dword [esp + 0x40]
mov ecx, dword [esp + 0x28]
add esp, 4
mov esi, eax
mov eax, dword [esp + 0x30]
push ebx
push 0x400
push esi
push ebp
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
cmp eax, 0x3ff
jl 0x1000f29a
push esi
lea edi, [eax + 0x400]
call fcn.1002409e
push edi
call fcn.10024075
mov edx, dword [esp + 0x38]
add esp, 8
mov esi, eax
mov eax, dword [esp + 0x24]
push ebx
push edi
push esi
push ebp
push edx
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringA]
dec edi
cmp eax, edi
jge 0x1000f26a
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
xor ebx, ebx
repne scasb al, byte es:[edi]
not ecx
dec ecx
je 0x1000f2b6
push ecx
push esi
call fcn.10011570
add esp, 8
mov ebx, eax
push esi
call fcn.1002409e
add esp, 4
mov eax, ebx
pop edi
pop esi
pop ebp
pop ebx
ret
Function at 0x100100b0
Capabilities:
Write file on windows

Disassembly:
sub esp, 8
mov eax, dword [esp + 0x10]
push edi
push 0
push 0x20
push 2
push 0
push 0
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
xor eax, eax
cmp edi, 0xffffffff
je 0x10010142
mov eax, dword [esp + 0x10]
push ebx
mov ebx, 1
push ebp
cmp eax, ebx
push esi
mov dword [esp + 0x10], ebx
jle 0x10010134
mov ebp, dword [sym.imp.KERNEL32.dll_WriteFile]
lea esi, [esp + 0x2c]
mov eax, dword [esi]
lea edx, [esp + 0x14]
push 0
push edx
lea ecx, [eax + 8]
mov eax, dword [eax + 4]
push eax
push ecx
push edi
call ebp
test eax, eax
je 0x1001012c
mov eax, dword [esp + 0x1c]
inc ebx
add esi, 0xc
cmp ebx, eax
jl 0x100100f5
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
mov dword [esp + 0x10], 0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0x10]
pop esi
pop ebp
pop ebx
pop edi
add esp, 8
ret
Function at 0x100106d0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x10
push esi
mov esi, dword [esp + 0x1c]
test esi, esi
jne 0x100106e3
xor eax, eax
pop esi
add esp, 0x10
ret
push esi
call fcn.10012430
add esp, 4
test eax, eax
jne 0x100106f5
pop esi
add esp, 0x10
ret
mov eax, dword [esi]
mov ecx, 1
push ebx
push ebp
cmp eax, ecx
push edi
mov dword [esp + 0x10], 0
jne 0x100107b6
mov eax, dword [esi + 4]
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x24]
cmp eax, ecx
mov dword [esp + 0x14], ecx
jle 0x10010833
lea ebx, [esp + 0x34]
mov eax, dword [ebx + 8]
xor ebp, ebp
cmp eax, 0x80000004
jne 0x1001073e
mov esi, dword [ebx]
jmp 0x10010752
push ebx
call fcn.10012290
mov esi, eax
add esp, 4
test esi, esi
je 0x10010796
mov ebp, 1
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x1001077d
lea edx, [esp + 0x1c]
push eax
mov eax, dword [esp + 0x1c]
push edx
push ecx
push esi
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x1001077d
mov dword [esp + 0x10], eax
test ebp, ebp
je 0x1001078a
push esi
call fcn.10017edb
add esp, 4
mov eax, dword [esp + 0x10]
test eax, eax
je 0x10010833
mov eax, dword [esp + 0x14]
mov ecx, dword [esp + 0x24]
inc eax
add ebx, 0xc
cmp eax, ecx
mov dword [esp + 0x14], eax
jl 0x1001072e
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10
ret
cmp eax, 2
jne 0x10010833
mov eax, dword [esp + 0x24]
mov edx, dword [esi + 4]
cmp eax, ecx
mov dword [esp + 0x18], edx
mov dword [esp + 0x10], ecx
jle 0x10010833
dec eax
lea ebx, [esp + 0x34]
mov dword [esp + 0x24], eax
mov eax, dword [ebx + 8]
xor ebp, ebp
cmp eax, 0x80000004
jne 0x100107e7
mov esi, dword [ebx]
jmp 0x100107fb
push ebx
call fcn.10012290
mov esi, eax
add esp, 4
test esi, esi
je 0x10010825
mov ebp, 1
mov edi, esi
or ecx, 0xffffffff
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
dec ecx
test ecx, ecx
jle 0x10010818
mov eax, dword [esp + 0x18]
push ecx
push esi
mov ecx, eax
mov edx, dword [eax]
call dword [edx + 0x24]
test ebp, ebp
je 0x10010825
push esi
call fcn.10017edb
add esp, 4
mov eax, dword [esp + 0x24]
add ebx, 0xc
dec eax
mov dword [esp + 0x24], eax
jne 0x100107d7
mov eax, dword [esp + 0x10]
pop edi
pop ebp
pop ebx
pop esi
add esp, 0x10
ret
Function at 0x100108a0
Capabilities:
Get file size
Read file on windows

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x14]
push ebp
push esi
test ebx, ebx
push edi
jne 0x100108b9
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
push ebx
call fcn.10012430
add esp, 4
test eax, eax
jne 0x100108ce
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edi, dword [esp + 0x34]
test edi, edi
je 0x100108e8
mov eax, dword [esp + 0x2c]
test eax, eax
jg 0x100108e8
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [ebx]
xor esi, esi
cmp eax, 1
jne 0x100109d0
mov ebp, dword [ebx + 4]
mov edi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push eax
push esi
push esi
push ebp
call edi
mov ebx, eax
cmp ebx, 0xffffffff
mov dword [esp + 0x14], ebx
jne 0x10010920
push 2
push esi
push esi
push ebp
call edi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x10010937
push 0
push ebp
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
sub esi, ebx
jmp 0x1001093b
mov esi, dword [esp + 0x2c]
push esi
call fcn.10024075
add esp, 4
mov ebx, eax
lea eax, [esp + 0x10]
push 0
push eax
push esi
push ebx
push ebp
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x10010974
push 2
push eax
push eax
push ebp
call edi
push ebx
call fcn.1002409e
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov edx, dword [esp + 0x10]
xor edi, edi
test edx, edx
mov ecx, ebx
jbe 0x10010990
mov al, byte [ecx]
test al, al
je 0x10010990
cmp al, 0x1a
je 0x10010990
inc edi
inc ecx
cmp edi, edx
jb 0x10010980
lea ecx, [edi + 1]
push ecx
call fcn.1000ec60
mov edx, dword [esp + 0x18]
add esp, 4
mov esi, eax
push 0
lea eax, [edi + edx]
push 0
push eax
push ebp
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
push ebx
push esi
call fcn.10017b60
push ebx
mov byte [edi + esi], 0
call fcn.1002409e
add esp, 0x10
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
cmp eax, 2
jne 0x10010a4b
mov ebx, dword [ebx + 4]
mov ecx, ebx
mov edx, dword [ebx]
call dword [edx + 0x14]
test edi, edi
mov ebp, eax
jne 0x100109ea
or eax, 0xffffffff
jmp 0x100109ee
mov eax, dword [esp + 0x2c]
mov edx, dword [ebx]
lea ecx, [esp + 0x14]
push ecx
lea ecx, [esp + 0x14]
push ecx
push eax
push 0
mov ecx, ebx
call dword [edx + 0x30]
mov edx, dword [esp + 0x10]
xor edi, edi
test eax, eax
jbe 0x10010a1d
mov cl, byte [edx]
test cl, cl
je 0x10010a1d
cmp cl, 0x1a
je 0x10010a1d
inc edi
inc edx
cmp edi, eax
jb 0x10010a0c
lea edx, [edi + 1]
push edx
call fcn.1000ec60
add esp, 4
lea ecx, [edi + ebp]
mov esi, eax
mov eax, dword [ebx]
push 0
push ecx
mov ecx, ebx
call dword [eax + 0x18]
mov edx, dword [esp + 0x10]
push edi
push edx
push esi
call fcn.10017b60
add esp, 0xc
mov byte [edi + esi], 0
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
Function at 0x10012c50
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
sub esp, 8
xor ecx, ecx
xor eax, eax
push ebp
mov ebp, dword [esp + 0x18]
mov byte [eax + ebp], al
inc eax
cmp eax, 0x100
jl 0x10012c5c
mov eax, dword [esp + 0x14]
mov byte [ebp + 0x100], cl
cmp eax, ecx
mov byte [ebp + 0x101], cl
jle 0x10012cef
push ebx
push esi
push edi
mov byte [esp + 0x24], cl
xor esi, esi
mov ebx, ebp
mov dword [esp + 0x10], 0x100
mov edi, dword [esp + 0x24]
mov ecx, dword [esp + 0x1c]
and edi, 0xff
xor eax, eax
xor edx, edx
mov al, byte [edi + ecx]
mov dl, byte [ebx]
add esi, eax
add edx, esi
and edx, 0x800000ff
jns 0x10012cb9
dec edx
or edx, 0xffffff00
inc edx
mov byte [esp + 0x14], dl
mov esi, dword [esp + 0x14]
and esi, 0xff
lea eax, [esi + ebp]
push eax
push ebx
call fcn.10012d00
lea eax, [edi + 1]
add esp, 8
cdq
idiv dword [esp + 0x20]
mov eax, dword [esp + 0x10]
inc ebx
dec eax
mov dword [esp + 0x10], eax
mov byte [esp + 0x24], dl
jne 0x10012c8e
pop edi
pop esi
pop ebx
pop ebp
add esp, 8
ret

Function at 0x10012d20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0xc
mov edx, dword [esp + 0x14]
push ebx
push esi
mov esi, dword [esp + 0x20]
xor ebx, ebx
mov al, byte [esi + 0x100]
mov cl, byte [esi + 0x101]
test edx, edx
mov byte [esp + 0x20], al
mov byte [esp + 8], cl
jle 0x10012e1d
push ebp
mov ebp, dword [esp + 0xc]
push edi
mov edi, dword [esp + 0x28]
and edi, 0xff
and ebp, 0xff
lea eax, [edi + 1]
and eax, 0x800000ff
jns 0x10012d72
dec eax
or eax, 0xffffff00
inc eax
mov byte [esp + 0x28], al
xor ecx, ecx
mov edi, dword [esp + 0x28]
and edi, 0xff
mov cl, byte [edi + esi]
lea eax, [edi + esi]
add ecx, ebp
mov dword [esp + 0x18], eax
and ecx, 0x800000ff
jns 0x10012d9e
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ebp, dword [esp + 0x10]
and ebp, 0xff
lea ecx, [esi + ebp]
push ecx
push eax
mov dword [esp + 0x1c], ecx
call fcn.10012d00
mov eax, dword [esp + 0x1c]
xor edx, edx
xor ecx, ecx
add esp, 8
mov dl, byte [eax]
mov eax, dword [esp + 0x18]
mov cl, byte [eax]
add edx, ecx
and edx, 0x800000ff
jns 0x10012ddf
dec edx
or edx, 0xffffff00
inc edx
mov eax, dword [esp + 0x20]
and edx, 0xff
mov cl, byte [edx + esi]
mov dl, byte [ebx + eax]
xor dl, cl
mov byte [ebx + eax], dl
mov eax, dword [esp + 0x24]
inc ebx
cmp ebx, eax
jl 0x10012d61
mov dl, byte [esp + 0x28]
mov al, byte [esp + 0x10]
pop edi
mov byte [esi + 0x100], dl
mov byte [esi + 0x101], al
pop ebp
pop esi
pop ebx
add esp, 0xc
ret
mov byte [esi + 0x100], al
mov byte [esi + 0x101], cl
pop esi
pop ebx
add esp, 0xc
ret
Function at 0x10013de0
Capabilities:
Encrypt data using des

Disassembly:
sub esp, 0xf4
xor ecx, ecx
push ebx
push ebp
push esi
mov esi, dword [esp + 0x104]
push edi
xor eax, eax
mov al, byte [ecx + str.80_]
mov edx, eax
and eax, 7
sar edx, 3
mov bl, byte [eax*2 + 0x1003342c]
mov dl, byte [edx + esi]
test bl, dl
setne al
mov byte [esp + ecx + 0x4c], al
inc ecx
cmp ecx, 0x38
jl 0x10013df3
mov eax, 0x1e
xor edx, edx
mov dword [esp + 0x10], eax
cmp dword [esp + 0x10c], 1
je 0x10013e34
lea eax, [edx + edx]
lea edi, [esp + eax*4 + 0x88]
lea ebp, [esp + eax*4 + 0x84]
xor eax, eax
xor ecx, ecx
mov cl, byte [edx + 0x100334d4]
mov dword [edi], 0
mov dword [ebp], 0
mov esi, ecx
cmp ecx, 0x1c
jge 0x10013e66
mov bl, byte [esp + ecx + 0x4c]
jmp 0x10013e6a
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x1c
jl 0x10013e5b
mov eax, 0x1c
lea ecx, [esi + 0x1c]
cmp ecx, 0x38
jge 0x10013e88
mov bl, byte [esp + ecx + 0x4c]
jmp 0x10013e8c
mov bl, byte [esp + ecx + 0x30]
mov byte [esp + eax + 0x14], bl
inc eax
inc ecx
cmp eax, 0x38
jl 0x10013e7d
xor ecx, ecx
mov eax, 0x1003343c
xor ebx, ebx
mov bl, byte [ecx + 0x100334e4]
cmp byte [esp + ebx + 0x14], 0
je 0x10013eb7
mov esi, dword [eax]
mov ebx, dword [ebp]
or ebx, esi
mov dword [ebp], ebx
xor ebx, ebx
mov bl, byte [ecx + 0x100334fc]
cmp byte [esp + ebx + 0x14], 0
je 0x10013ece
mov esi, dword [eax]
mov ebx, dword [edi]
or ebx, esi
mov dword [edi], ebx
add eax, 4
inc ecx
cmp eax, str.80_
jl 0x10013e9e
mov eax, dword [esp + 0x10]
inc edx
sub eax, 2
cmp eax, 0xfffffffe
mov dword [esp + 0x10], eax
jg 0x10013e27
lea edx, [esp + 0x84]
push edx
call fcn.10013f10
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xf4
ret
Function at 0x100160a0
Capabilities:
Enumerate processes
Terminate process

Disassembly:
push 0xffffffffffffffff
push 0x10029fcb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x130
push esi
mov esi, dword [esp + 0x144]
push esi
lea ecx, [esp + 8]
mov dword [esp + 0xc], 0
call fcn.10024340
mov eax, dword [esp + 0x148]
test eax, eax
jne 0x10016172
mov eax, dword [esp + 4]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x1001610a
lea ecx, [esp + 4]
mov dword [esp + 0x13c], 0xffffffff
call fcn.10024316
xor eax, eax
jmp 0x100161c2
push esi
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
test eax, eax
je 0x10016125
lea ecx, [esp + 8]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
jmp 0x10016176
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
lea edx, [esp + 0xc]
mov esi, eax
push edx
push esi
mov dword [esp + 0x14], pe_nt_image_headers32
call sub.KERNEL32.dll_Process32First
test eax, eax
je 0x10016176
mov ecx, dword [esp + 4]
lea eax, [esp + 0x30]
push eax
push ecx
call fcn.100192b4
add esp, 8
test eax, eax
je 0x1001616e
lea edx, [esp + 0xc]
push edx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10016147
jmp 0x10016176
mov eax, dword [esp + 0x14]
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
test eax, eax
jne 0x10016196
lea ecx, [esp + 4]
mov dword [esp + 0x13c], 0xffffffff
call fcn.10024316
xor eax, eax
jmp 0x100161c2
push eax
push 0
push 1
call dword [sym.imp.KERNEL32.dll_OpenProcess]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
lea ecx, [esp + 4]
mov esi, eax
mov dword [esp + 0x13c], 0xffffffff
call fcn.10024316
mov eax, esi
mov ecx, dword [esp + 0x134]
pop esi
mov dword fs:[0], ecx
add esp, 0x13c
ret 8