joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000e970
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x58
mov eax, dword [0x1003b040]
xor eax, esp
mov dword [esp + 0x54], eax
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, edi
mov dword [0x10063e64], 0
xorps xmm0, xmm0
lea edx, [esp + 0x20]
mov ecx, esi
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x30], xmm0
movq qword [esp + 0x40], xmm0
call fcn.10002560
mov eax, dword [esp + 0x26]
cmp eax, 0xffffffff
je 0x1000e9d4
test eax, 0x68000
jne 0x1000e9d4
mov eax, dword [esp + 0x22]
test eax, eax
je 0x1000ea60
cmp eax, 5
je 0x1000ea24
xorps xmm0, xmm0
lea edx, [esp + 0x20]
mov ecx, esi
movaps xmmword [esp + 0x20], xmm0
movaps xmmword [esp + 0x30], xmm0
movq qword [esp + 0x40], xmm0
call fcn.10002560
mov eax, dword [esp + 0x26]
cmp eax, 0xffffffff
je 0x1000ea08
test eax, 0x68000
jne 0x1000ea08
mov ecx, dword [esp + 0x22]
jmp 0x1000ea0b
or ecx, 0xffffffff
mov eax, dword [0x10063e64]
add eax, ecx
add esi, eax
mov dword [0x10063e64], eax
cmp eax, 5
jl 0x1000e995
jmp 0x1000ea31
mov eax, dword [0x10063e64]
add eax, 4
mov dword [0x10063e64], eax
push eax
call fcn.1002e65c
add esp, 4
mov dword [0x10063e6c], eax
mov dword [0x10063e68], edi
push 0x40
push 0x3000
push dword [0x10063e64]
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x1000ea75
xor eax, eax
pop edi
pop esi
mov ecx, dword [esp + 0x54]
xor ecx, esp
call fcn.1002e1ee
mov esp, ebp
pop ebp
ret 8
push dword [0x10063e64]
push edi
push dword [0x10063e6c]
call sub.VCRUNTIME140.dll_memcpy
add esp, 0xc
push dword [0x10063e64]
push dword [0x10063e6c]
push esi
call sub.VCRUNTIME140.dll_memcpy
mov ecx, dword [0x10063e64]
mov eax, edi
sub eax, esi
mov byte [esp + 0x20], 0xe9
sub eax, 5
add esp, 0xc
mov dword [esp + 0x15], eax
mov eax, dword [esp + 0x14]
mov dword [ecx + esi], eax
mov al, byte [esp + 0x18]
mov byte [ecx + esi + 4], al
lea eax, [esp + 0x1c]
push eax
push 0x40
push dword [0x10063e64]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
cmp dword [0x10063e64], 5
mov cl, 5
jle 0x1000eb01
mov eax, 5
nop dword [eax + eax]
inc cl
mov byte [eax + edi], 0x90
movzx eax, cl
cmp eax, dword [0x10063e64]
jl 0x1000eaf0
mov eax, dword [ebp + 0xc]
sub eax, edi
sub eax, 5
mov dword [esp + 0x15], eax
mov eax, dword [esp + 0x14]
mov dword [edi], eax
mov al, byte [esp + 0x18]
mov byte [edi + 4], al
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x20]
push dword [0x10063e64]
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [esp + 0x5c]
mov eax, esi
pop edi
pop esi
xor ecx, esp
call fcn.1002e1ee
mov esp, ebp
pop ebp
ret 8
Function at 0x1001af60
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
call fcn.1001ad00
mov ecx, dword [0x10064b38]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1001afa6
cmp byte [0x100758b0], 0
je 0x1001afa6
push dword [0x1007555c]
push dword [0x10075558]
push dword [0x10075554]
push dword [0x10075550]
call fcn.1001a6a0
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x2d
call esi
test al, 1
je 0x1001afc5
cmp byte [0x10063e72], 0
sete al
mov byte [0x10063e72], al
jmp 0x1001afca
mov al, byte [0x10063e72]
test al, al
je 0x1001b14d
push 1
call esi
test al, 1
je 0x1001afe3
mov byte [0x10063e7e], 1
jmp 0x1001aff2
push 1
call esi
test al, 1
jne 0x1001aff2
mov byte [0x10063e7e], 0
push 2
call esi
test al, 1
je 0x1001b003
mov byte [0x10063e7c], 1
jmp 0x1001b012
push 2
call esi
test al, 1
jne 0x1001b012
mov byte [0x10063e7c], 0
push 1
call esi
test ax, ax
je 0x1001b024
mov byte [0x10064b4c], 1
jmp 0x1001b032
push 1
call esi
test ax, ax
jne 0x1001b032
mov byte [0x10064b4c], al
push 2
call esi
test ax, ax
je 0x1001b044
mov byte [0x10063e7d], 1
jmp 0x1001b052
push 2
call esi
test ax, ax
jne 0x1001b052
mov byte [0x10063e7d], al
cmp byte [0x100758e6], 0
je 0x1001b06c
mov ecx, 0x10063e60
call fcn.10007700
mov byte [0x100758e6], 0
cmp byte [0x100758e5], 0
je 0x1001b086
mov ecx, 0x10063e60
call fcn.10009cf0
mov byte [0x100758e5], 0
push dword [0x1007554c]
mov ecx, 0x10064980
push dword [0x10075548]
push dword [0x10075544]
push dword [0x10075540]
call fcn.100155b0
push dword [0x10075efc]
push dword [0x10075ef4]
call fcn.10029930
mov ecx, dword [0x10075550]
test ecx, ecx
jns 0x1001b0cb
xor ecx, ecx
mov dword [0x10075550], ecx
mov eax, dword [0x10075554]
test eax, eax
jns 0x1001b0db
xor eax, eax
mov dword [0x10075554], eax
mov edi, dword [0x10064ce4]
mov ebx, edi
mov edx, dword [0x10064ce0]
mov esi, edx
sub ebx, dword [0x1007555c]
sub esi, dword [0x10075558]
cmp ecx, ebx
jle 0x1001b101
mov dword [0x10075550], ebx
cmp eax, esi
jle 0x1001b10b
mov dword [0x10075554], esi
mov ecx, dword [0x10075540]
test ecx, ecx
jns 0x1001b11d
xor ecx, ecx
mov dword [0x10075540], ecx
mov eax, dword [0x10075544]
test eax, eax
jns 0x1001b12d
xor eax, eax
mov dword [0x10075544], eax
sub edi, dword [0x10075548]
sub edx, dword [0x1007554c]
cmp ecx, edi
jle 0x1001b143
mov dword [0x10075540], edi
cmp eax, edx
jle 0x1001b14d
mov dword [0x10075544], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001b530
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov edx, 0x1c
xor eax, eax
nop
mov cl, byte [eax + edi + 0x6346f401]
xor cl, dl
inc edx
mov byte [esi + eax], cl
and edx, 0x800000ff
jns 0x1001b55d
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0xe
jl 0x1001b540
pop edi
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
ret 4
Function at 0x1001b6e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov edx, 0x15
xor eax, eax
nop
mov cl, byte [eax + edi - 0xff1925]
xor cl, dl
inc edx
mov byte [esi + eax], cl
and edx, 0x800000ff
jns 0x1001b70d
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0x11
jl 0x1001b6f0
pop edi
mov byte [esi + 0x11], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001b7a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov edx, 0x8c
xor eax, eax
nop
mov cl, byte [eax + edi - 0x2c90a980]
xor cl, dl
inc edx
mov byte [esi + eax], cl
and edx, 0x800000ff
jns 0x1001b7cd
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0xd
jl 0x1001b7b0
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001bff0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov edx, 0xb7
xor eax, eax
nop
mov cl, byte [eax + edi - 0x16426759]
xor cl, dl
inc edx
mov byte [esi + eax], cl
and edx, 0x800000ff
jns 0x1001c01d
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0xb
jl 0x1001c000
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001c1c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov edx, 0xdc
xor eax, eax
nop
mov cl, byte [eax + edi - 0x4b36b2cc]
xor cl, dl
inc edx
mov byte [esi + eax], cl
and edx, 0x800000ff
jns 0x1001c1ed
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0xb
jl 0x1001c1d0
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001c2c0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov edx, 0xa3
xor eax, eax
nop
mov cl, byte [eax + edi + 0x3fd6497b]
xor cl, dl
inc edx
mov byte [esi + eax], cl
and edx, 0x800000ff
jns 0x1001c2ed
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0xc
jl 0x1001c2d0
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001c360
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov edx, 0xab
xor eax, eax
nop
mov cl, byte [eax + edi + 0x39ca4980]
xor cl, dl
inc edx
mov byte [esi + eax], cl
and edx, 0x800000ff
jns 0x1001c38d
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0xb
jl 0x1001c370
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001c640
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov edx, 0x31
xor eax, eax
nop
mov cl, byte [eax + edi - 0x30357a82]
xor cl, dl
inc edx
mov byte [esi + eax], cl
and edx, 0x800000ff
jns 0x1001c66d
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0x14
jl 0x1001c650
pop edi
mov byte [esi + 0x14], 0
mov eax, esi
pop esi
ret 4
Function at 0x1001c830
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov edx, 0xab
xor eax, eax
nop
mov cl, byte [eax + edi - 0x78ca5e5b]
xor cl, dl
inc edx
mov byte [esi + eax], cl
and edx, 0x800000ff
jns 0x1001c85d
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0xb
jl 0x1001c840
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001cfa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov edx, 0x38
xor eax, eax
nop
mov cl, byte [eax + edi - 0x20b64c60]
xor cl, dl
inc edx
mov byte [esi + eax], cl
and edx, 0x800000ff
jns 0x1001cfcd
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0xd
jl 0x1001cfb0
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001d240
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov edx, 0x3c
xor eax, eax
nop
mov cl, byte [eax + edi + 0x508dd01d]
xor cl, dl
inc edx
mov byte [esi + eax], cl
and edx, 0x800000ff
jns 0x1001d26d
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0x10
jl 0x1001d250
pop edi
mov byte [esi + 0x10], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001d4e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov edx, 0xe
xor eax, eax
nop
mov cl, byte [eax + edi - 0xaeef186]
xor cl, dl
inc edx
mov byte [esi + eax], cl
and edx, 0x800000ff
jns 0x1001d50d
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0xe
jl 0x1001d4f0
pop edi
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001d520
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov edx, 0x35
xor eax, eax
nop
mov cl, byte [eax + edi - 0x6282fd3f]
xor cl, dl
inc edx
mov byte [esi + eax], cl
and edx, 0x800000ff
jns 0x1001d54d
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0x12
jl 0x1001d530
pop edi
mov byte [esi + 0x12], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001d7f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov edx, 0x2b
xor eax, eax
nop
mov cl, byte [eax + edi - 0x7125becb]
xor cl, dl
inc edx
mov byte [esi + eax], cl
and edx, 0x800000ff
jns 0x1001d81d
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0xb
jl 0x1001d800
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001daf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov edx, 0xe5
xor eax, eax
nop
mov cl, byte [eax + edi + 0x6acb51ce]
xor cl, dl
inc edx
mov byte [esi + eax], cl
and edx, 0x800000ff
jns 0x1001db1d
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0xe
jl 0x1001db00
pop edi
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
ret 4
Function at 0x1001dfa0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov edx, 0x67
xor eax, eax
nop
mov cl, byte [eax + edi + 0x6b32a658]
xor cl, dl
inc edx
mov byte [esi + eax], cl
and edx, 0x800000ff
jns 0x1001dfcd
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0xf
jl 0x1001dfb0
pop edi
mov byte [esi + 0xf], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001e0b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov edx, 0xd2
xor eax, eax
nop
mov cl, byte [eax + edi - 0x57d4a2c6]
xor cl, dl
inc edx
mov byte [esi + eax], cl
and edx, 0x800000ff
jns 0x1001e0dd
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0xb
jl 0x1001e0c0
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001e0f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov edx, 1
xor eax, eax
nop
mov cl, byte [eax + edi - 0x239182a4]
xor cl, dl
inc edx
mov byte [esi + eax], cl
and edx, 0x800000ff
jns 0x1001e11d
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0xb
jl 0x1001e100
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001e2b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov edx, 0xc6
xor eax, eax
nop
mov cl, byte [eax + edi + 0x6575ec95]
xor cl, dl
inc edx
mov byte [esi + eax], cl
and edx, 0x800000ff
jns 0x1001e2dd
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0xd
jl 0x1001e2c0
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001e400
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov edx, 0x68
xor eax, eax
nop
mov cl, byte [eax + edi - 0x7632c59d]
xor cl, dl
inc edx
mov byte [esi + eax], cl
and edx, 0x800000ff
jns 0x1001e42d
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0xe
jl 0x1001e410
pop edi
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001e440
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov edx, 7
xor eax, eax
nop
mov cl, byte [eax + edi - 0x631a8993]
xor cl, dl
inc edx
mov byte [esi + eax], cl
and edx, 0x800000ff
jns 0x1001e46d
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0xe
jl 0x1001e450
pop edi
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001e5f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov edx, 0x1b
xor eax, eax
nop
mov cl, byte [eax + edi - 0x22048303]
xor cl, dl
inc edx
mov byte [esi + eax], cl
and edx, 0x800000ff
jns 0x1001e61d
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0xd
jl 0x1001e600
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret 4
Function at 0x1001e630
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov edx, 0xaa
xor eax, eax
nop
mov cl, byte [eax + edi - 0x5cb0fbbd]
xor cl, dl
inc edx
mov byte [esi + eax], cl
and edx, 0x800000ff
jns 0x1001e65d
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0xb
jl 0x1001e640
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001e670
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov edx, 0xd
xor eax, eax
nop
mov cl, byte [eax + edi + 0x758d2da1]
xor cl, dl
inc edx
mov byte [esi + eax], cl
and edx, 0x800000ff
jns 0x1001e69d
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0xb
jl 0x1001e680
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001ebf0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov edx, 0x42
xor eax, eax
nop
mov cl, byte [eax + edi + 0x3ec9ae8c]
xor cl, dl
inc edx
mov byte [esi + eax], cl
and edx, 0x800000ff
jns 0x1001ec1d
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0xb
jl 0x1001ec00
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001ec30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov edx, 0x52
xor eax, eax
nop
mov cl, byte [eax + edi - 0x5b1bf00c]
xor cl, dl
inc edx
mov byte [esi + eax], cl
and edx, 0x800000ff
jns 0x1001ec5d
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0x16
jl 0x1001ec40
pop edi
mov byte [esi + 0x16], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001ec70
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov edx, 0x3d
xor eax, eax
nop
mov cl, byte [eax + edi - 0x760f49be]
xor cl, dl
inc edx
mov byte [esi + eax], cl
and edx, 0x800000ff
jns 0x1001ec9d
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0x13
jl 0x1001ec80
pop edi
mov byte [esi + 0x13], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001edc0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov edx, 0xb2
xor eax, eax
nop
mov cl, byte [eax + edi - 0x6a3aa13e]
xor cl, dl
inc edx
mov byte [esi + eax], cl
and edx, 0x800000ff
jns 0x1001eded
dec edx
or edx, 0xffffff00
inc edx
inc eax
cmp eax, 0x10
jl 0x1001edd0
pop edi
mov byte [esi + 0x10], 0
mov eax, esi
pop esi
ret 4
Function at 0x100209d0
Capabilities:
Allocate or change rwx memory
Contain obfuscated stackstrings
Create thread
Spawn thread to rwx shellcode

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
mov eax, dword [0x1003b040]
xor eax, esp
mov dword [esp + 0x24], eax
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, dword [ebp + 8]
push edi
cmp eax, 1
jne 0x10020b57
push str.vaudio_speex.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
lea edi, [eax + 0x2490]
lea eax, [esp + 0xc]
push eax
push 0x40
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea eax, [esp + 0xc]
mov byte [edi], 0xc3
push eax
push dword [esp + 0x10]
push 1
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
push ebx
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov ecx, 0xa4
xor edx, edx
nop dword [eax]
mov al, byte [edx + 0x10036f24]
xor al, cl
inc ecx
mov byte [esp + edx + 0x1c], al
and ecx, 0x800000ff
jns 0x10020a5d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xc
jl 0x10020a40
push 0x100208a0
lea eax, [esp + 0x20]
mov byte [esp + 0x2c], 0
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x72657375
push eax
mov dword [esp + 0x20], 0x642e3233
mov word [esp + 0x24], 0x6c6c
mov byte [esp + 0x26], 0
call fcn.10001750
push eax
call fcn.100010f0
mov dword [0x10065018], eax
mov ecx, 0x10
xor edx, edx
nop word [eax + eax]
mov al, byte [edx + str.WtfPagexjIuh]
xor al, cl
inc ecx
mov byte [esp + edx + 0x1c], al
and ecx, 0x800000ff
jns 0x10020acd
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xc
jl 0x10020ab0
push 0x100208f0
lea eax, [esp + 0x20]
mov byte [esp + 0x2c], 0
push eax
lea eax, [esp + 0x18]
mov dword [esp + 0x18], 0x72657375
push eax
mov dword [esp + 0x20], 0x642e3233
mov word [esp + 0x24], 0x6c6c
mov byte [esp + 0x26], 0
call fcn.10001750
push eax
call fcn.100010f0
push 0x104
push 0x10065020
push ebx
mov dword [0x10065014], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push ebx
push 0x1001f860
push 0
push 0
mov dword [0x10063e60], ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
neg eax
sbb eax, eax
neg eax
pop edi
pop ebx
mov ecx, dword [esp + 0x24]
xor ecx, esp
call fcn.1002e1ee
mov esp, ebp
pop ebp
ret 0xc
test eax, eax
jne 0x10020b8f
mov eax, dword [0x10064c50]
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 4]
mov dword [ecx], eax
mov eax, dword [0x10064e54]
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 4]
mov dword [ecx], eax
mov eax, dword [0x10064e7c]
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 4]
mov dword [ecx], eax
mov eax, dword [0x10064e84]
mov ecx, dword [eax + 0xc]
mov eax, dword [eax + 4]
mov dword [ecx], eax
mov ecx, dword [esp + 0x2c]
mov eax, 1
pop edi
pop ebx
xor ecx, esp
call fcn.1002e1ee
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10026fa0
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
mov dword [edi + 0xd60], 0
mov dword [0x2438ff74], 0xffffffff
mov dword [0x243b2ef8], 0
cmp byte [0x100758dc], 0
je 0x10026fe5
push 0x45
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x10026fe5
cmp byte [0x100758dc], 0
jne 0x10027015
mov ecx, dword [esi + 8]
cmp ecx, dword [esi]
jne 0x10027008
mov eax, dword [esi + 4]
inc eax
add ecx, eax
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [edi + 0xe08], ecx
mov eax, dword [esi + 8]
pop edi
mov dword [esi], eax
pop esi
ret 8
mov dword [esi + 4], 0
mov dword [edi + 0xe08], ecx
mov eax, dword [esi + 8]
pop edi
mov dword [esi], eax
pop esi
ret 8
Function at 0x10029540
Capabilities:
Hash data with md5

Disassembly:
sub esp, 0x68
mov eax, dword [0x1003b040]
xor eax, esp
mov dword [esp + 0x60], eax
push esi
push 0x40
lea eax, [esp + 0x24]
mov esi, ecx
push 0
push eax
call sub.VCRUNTIME140.dll_memset
mov eax, 0x20
mov dword [esp + 0x14], 0x67452301
mov dword [esp + 0x24], eax
lea ecx, [esp + 0x2c]
shr eax, 3
mov edx, 0x3f
and eax, 0x3f
mov dword [esp + 0x18], 0xefcdab89
add ecx, eax
mov dword [esp + 0x1c], 0x98badcfe
mov dword [esp + 0x20], 0x10325476
sub edx, eax
mov dword [esp + 0x28], 0
add esp, 0xc
mov dword [esp + 0x20], esi
mov byte [ecx], 0x80
inc ecx
cmp edx, 8
jae 0x100295dc
push edx
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
lea edx, [esp + 0x2c]
lea ecx, [esp + 0x14]
call fcn.10028ea0
push 0x38
lea eax, [esp + 0x30]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0x18
jmp 0x100295eb
lea eax, [edx - 8]
push eax
push 0
push ecx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
mov eax, dword [esp + 0x18]
lea edx, [esp + 0x20]
mov dword [esp + 0x58], eax
lea ecx, [esp + 8]
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x5c], eax
call fcn.10028ea0
mov ecx, dword [esp + 0x64]
mov eax, dword [esp + 0xe]
pop esi
xor ecx, esp
call fcn.1002e1ee
add esp, 0x68
ret
Function at 0x408b40
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov ecx, dword [ebp + 0xc]
add dword [ebx + 0x331075], ecx
lea edx, [ebp - 8]
push 0
mov eax, dword [esi]
push edx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x10], eax
jg 0x408ba4
cld
mov dword [ebp - 0xc], ecx
cmp al, 0xe3
push es
invalid
add byte [eax], al
mov dword [ebp - 8], 0x6e
call dword [sym.imp.WS2_32.dll_WSARecv]
adc eax, sym.imp.WS2_32.dll_WSARecv
sbb edi, eax
push dword [ebp + 0x2c]
push edi
hlt
add byte [eax], al
pop edi
add eax, 0xa8780
pop esi
mov esp, ebp
jle 0x408b73
jmp 0x408b7d
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
pop eax
nop
nop
nop
add eax, 0x403d6f
nop
nop
sub eax, 0x403d15
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
xor dword [ebx], edx
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
jne 0x43001e
nop
popal
nop
nop
nop
nop
nop
jmp fcn.00401219
Function at 0x10003180
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov dword [ebp - 4], 0x3000
mov eax, dword [0x100065d8]
mov dword [0x10006640], eax
push str.VirtualAlloc
push str.kernel32
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10006644], eax
mov dword [ebp - 0x24], 1
mov dword [ebp - 0x2c], 1
mov dword [ebp - 0x3c], 1
mov dword [ebp - 0x14], 1
mov dword [ebp - 0x20], 1
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x10], 1
mov dword [ebp - 0x1c], 1
mov dword [ebp - 0x30], 1
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x34], 1
mov dword [ebp - 8], 1
mov dword [ebp - 0xc], 1
push str.LOcfSJpdtk
call dword [sym.imp.GDI32.dll_AddFontResourceW]
push 0x40
mov ecx, dword [ebp - 4]
push ecx
push dword [0x10006640]
push dword [0x10006624]
push dword [0x10006644]
pop ecx
mov ecx, dword [0x10006644]
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
mov eax, eax
push 0x10003268
push ecx
ret