joyce8/EMBER2024-capa huggingface dataset:
Function at 0x78cb04
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdfc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x204], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x78cc5f
push dword fs:[eax]
mov dword fs:[eax], esp
test ebx, ebx
je 0x78cc42
mov eax, ebx
test eax, eax
je 0x78cb3d
sub eax, 4
mov eax, dword [eax]
jmp 0x78cb3f
xor eax, eax
mov edi, eax
test ebx, ebx
je 0x78cb4f
mov eax, ebx
sub eax, 0xa
movzx eax, word [eax]
jmp 0x78cb53
mov ax, 2
cmp ax, 1
jne 0x78cbd4
test ebx, ebx
je 0x78cb67
mov eax, ebx
sub eax, 0xc
movzx eax, word [eax]
jmp 0x78cb6f
mov eax, dword [0x8dd680]
movzx eax, word [eax]
push edi
push 0
push 0
movzx eax, ax
mov ecx, ebx
xor edx, edx
call fcn.00412438
mov edi, eax
cmp edi, 0x100
jle 0x78cb97
mov eax, edi
add eax, eax
call fcn.00407160
mov esi, eax
jmp 0x78cb9d
lea esi, [ebp - 0x200]
test ebx, ebx
je 0x78cbab
mov eax, ebx
sub eax, 0xc
movzx edx, word [eax]
jmp 0x78cbb4
mov edx, dword [0x8dd680]
movzx edx, word [edx]
mov eax, ebx
test eax, eax
je 0x78cbc1
sub eax, 4
mov eax, dword [eax]
jmp 0x78cbc3
xor eax, eax
push eax
push esi
push edi
movzx eax, dx
mov ecx, ebx
xor edx, edx
call fcn.00412438
jmp 0x78cc0d
cmp edi, 0x100
jle 0x78cbe9
mov eax, edi
add eax, eax
call fcn.00407160
mov esi, eax
jmp 0x78cbef
lea esi, [ebp - 0x200]
lea edx, [ebp - 0x204]
mov eax, ebx
call fcn.0042f960
mov eax, dword [ebp - 0x204]
mov ecx, edi
add ecx, ecx
mov edx, esi
call fcn.00407720
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x78cc2f
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x78cc19
lea eax, [ebp - 0x200]
cmp esi, eax
je 0x78cc44
mov eax, esi
call fcn.0040717c
jmp 0x78cc44
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x78cc66
lea eax, [ebp - 0x204]
call fcn.0040b8b4
pop eax
jmp eax
Function at 0x7ae22c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe4
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 4], edx
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x7ae3cf
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x8d6e4c], 0
jne 0x7ae3a7
mov eax, dword [0x8dce98]
cmp dword [eax], 0
jne 0x7ae26f
mov al, 0x1a
call fcn.00407330
mov eax, dword [0x9783c8]
call fcn.0040a630
or edx, 0xffffffff
call fcn.0040a3ac
xor eax, eax
push ebp
push 0x7ae3a0
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [0x8d6e4c], 0
jne 0x7ae386
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040c9b0
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 4]
call fcn.0040c824
push eax
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 0xc]
call fcn.0051840c
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
mov byte [ebp - 0x14], 0x11
lea edx, [ebp - 0x18]
xor ecx, ecx
mov eax, 0x7ae3ec
call fcn.00431adc
mov eax, dword [ebp - 0x10]
call fcn.0040c824
push eax
push 0x80000000
call sub.advapi32.dll_RegQueryValueW
test eax, eax
jne 0x7ae307
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
call fcn.0040c9b0
jmp 0x7ae33e
lea eax, [ebp - 4]
mov edx, 0x7ae428
call fcn.0040bcec
xor eax, eax
push ebp
push 0x7ae334
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
call fcn.00518940
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x7ae33e
mov eax, dword [ebp - 4]
call fcn.0040c824
push eax
call sub.kernel32.dll_LoadLibraryW
mov dword [0x8d6e4c], eax
cmp dword [0x8d6e4c], 0
jne 0x7ae371
mov ecx, dword [0x8dd05c]
mov dl, 1
mov eax, dword [0x428344]
call fcn.004389c0
call fcn.0040af20
push 0x7ae43c
mov eax, dword [0x8d6e4c]
push eax
call fcn.00417314
mov dword [0x9783cc], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7ae3a7
mov eax, dword [0x9783c8]
call fcn.0040a58c
pop eax
jmp eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7ae3d6
lea eax, [ebp - 0x1c]
call fcn.0040b8b4
lea eax, [ebp - 0x10]
call fcn.0040b8b4
lea eax, [ebp - 4]
call fcn.0040b8b4
pop eax
jmp eax
Function at 0x7c4c47
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
lea edx, [ebp - 8]
push edx
lea ecx, [ebp - 4]
push ecx
push 0
push 0x4001f
push 0
push 0
push 0
push eax
push 0x80000000
call sub.advapi32.dll_RegCreateKeyExA
mov ebx, eax
test ebx, ebx
jne 0x7c4c9b
push esi
call sub.msvcrt.dll_strlen
pop ecx
inc eax
push eax
push esi
push 1
push 0
push edi
push dword [ebp - 4]
call sub.advapi32.dll_RegSetValueExA
mov ebx, eax
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey
mov eax, ebx
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret
Function at 0x7fae8c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff94
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x6c], ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
mov edi, ecx
mov dword [ebp - 0xc], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x7fb012
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x7fb02c
push ebx
push 0x7fb02c
lea eax, [ebp - 0x6c]
mov edx, 3
call fcn.0040cb14
mov edx, dword [ebp - 0x6c]
lea eax, [ebp - 4]
call fcn.0040c928
call sub.kernel32.dll_GetCurrentProcess
mov ebx, eax
mov esi, 4
lea eax, [ebp - 0x58]
xor ecx, ecx
mov edx, 0x44
call fcn.00408280
mov dword [ebp - 0x58], 0x44
mov dword [ebp - 0x2c], 1
lea eax, [ebp - 8]
mov edx, 0x7fb034
call fcn.0040bd40
mov eax, dword [ebp - 8]
call fcn.0040c5ac
mov dword [ebp - 0x50], eax
lea eax, [ebp - 0x10]
push eax
push 2
push ebx
call sub.advapi32.dll_OpenProcessToken
test eax, eax
je 0x7fafe7
xor eax, eax
push ebp
push 0x7fafe0
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x14]
push eax
push 1
push 2
push 0
push 0x2000000
mov eax, dword [ebp - 0x10]
push eax
call sub.advapi32.dll_DuplicateTokenEx
test eax, eax
je 0x7fafc1
xor eax, eax
push ebp
push 0x7fafba
push dword fs:[eax]
mov dword fs:[eax], esp
push esi
lea eax, [ebp - 0xc]
push eax
push 0xc
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_SetTokenInformation
test eax, eax
je 0x7fafa1
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x58]
push eax
push 0
push 0
push 0x20
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.0040c5ac
push eax
push 0
mov eax, dword [ebp - 0x14]
push eax
call sub.advapi32.dll_CreateProcessAsUserW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7fafc7
mov eax, dword [ebp - 0x14]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
mov dword [edi], 0xf423b
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7fafed
mov eax, dword [ebp - 0x10]
push eax
call sub.kernel32.dll_CloseHandle
pop eax
jmp eax
mov dword [edi], 0xf423c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x7fb019
lea eax, [ebp - 0x6c]
call fcn.0040b8b4
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040b984
pop eax
jmp eax
Function at 0x80fc1c
Capabilities:
Manipulate console buffer

Disassembly:
add esp, 0xffffffe8
mov word [esp + 4], 1
mov dword [esp + 8], 0xffffffff
mov word [esp + 0xc], 1
mov word [esp + 0xe], 0
mov word [esp + 0x10], 0
mov byte [esp + 0x12], cl
xor eax, eax
mov dword [esp + 0x14], eax
push esp
push 1
lea eax, [esp + 0xc]
push eax
push edx
call sub.kernel32.dll_WriteConsoleInputW
add esp, 0x18
ret
Function at 0x812158
Capabilities:
Terminate process

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
lea eax, [esp + 4]
push eax
push 0x1388
push 2
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_SendMessageTimeoutW
push ebx
call sub.user32.dll_IsWindow
test eax, eax
je 0x8121b1
push esp
push ebx
call sub.user32.dll_GetWindowThreadProcessId
cmp dword [esp], 0
je 0x8121b1
mov eax, dword [esp]
push eax
push 0
push 0x401
call sub.kernel32.dll_OpenProcess
mov ebx, eax
test ebx, ebx
je 0x8121b1
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
push ebx
call sub.kernel32.dll_CloseHandle
pop ecx
pop edx
pop ebx
ret

Function at 0x812191
Capabilities:
Terminate process

Disassembly:
push ebx
add esp, 0xfffffff8
mov ebx, eax
lea eax, [esp + 4]
push eax
push 0x1388
push 2
push 0
push 0
push 0x10
push ebx
call sub.user32.dll_SendMessageTimeoutW
push ebx
call sub.user32.dll_IsWindow
test eax, eax
je 0x8121b1
push esp
push ebx
call sub.user32.dll_GetWindowThreadProcessId
cmp dword [esp], 0
je 0x8121b1
mov eax, dword [esp]
push eax
push 0
push 0x401
call sub.kernel32.dll_OpenProcess
mov ebx, eax
test ebx, ebx
je 0x8121b1
push 0
push ebx
call sub.kernel32.dll_TerminateProcess
push ebx
call sub.kernel32.dll_CloseHandle
pop ecx
pop edx
pop ebx
ret
Function at 0x81d2a8
Capabilities:
Get session information
Get session user name

Disassembly:
push ebp
mov ebp, esp
mov ecx, 8
push 0
push 0
dec ecx
jne 0x81d2b0
push ecx
push ebx
push esi
push edi
mov dword [ebp - 0xc], eax
xor eax, eax
push ebp
push 0x81d4bd
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.0040b8d8
xor edx, edx
push ebp
push 0x81d478
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x10]
push eax
push 1
push 0
push 0
call sub.WTSAPI32.DLL_WTSEnumerateSessionsW
test eax, eax
jne 0x81d2fe
call fcn.0043b224
xor edx, edx
push ebp
push 0x81d467
push dword fs:[edx]
mov dword fs:[edx], esp
cmp dword [ebp - 0x18], 0
jbe 0x81d44e
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x18]
dec eax
test eax, eax
jb 0x81d44e
inc eax
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax + 8], 0
jne 0x81d441
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x20]
push eax
push 5
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
push eax
push 0
call sub.WTSAPI32.DLL_WTSQuerySessionInformationW
test eax, eax
je 0x81d441
mov eax, dword [ebp - 0x20]
test eax, eax
je 0x81d441
cmp word [eax], 0
je 0x81d441
lea edx, [ebp - 8]
mov eax, dword [ebp - 0x20]
call fcn.0040e678
lea eax, [ebp - 4]
mov edx, dword [ebp - 8]
mov ecx, 0
call fcn.0040c4b4
mov eax, dword [ebp - 0xc]
cmp dword [eax + 0x30], 0
je 0x81d3a1
mov eax, dword [ebp - 0xc]
add eax, 0x30
mov edx, 0x81d4d8
call fcn.0040c0e8
mov eax, dword [ebp - 0xc]
add eax, 0x30
mov edx, dword [ebp - 4]
call fcn.0040c0e8
xor eax, eax
push ebp
push 0x81d437
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
call fcn.007a256c
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
mov eax, dword [eax + 0x40]
xor edx, edx
call fcn.0078e2c0
push eax
lea eax, [ebp - 0x34]
mov edx, dword [ebp - 0x14]
mov edx, dword [edx]
mov cl, 4
call fcn.004488b0
lea edx, [ebp - 0x34]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x118]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
mov eax, dword [eax + 0x40]
mov edx, 1
call fcn.0078e2c0
push eax
lea eax, [ebp - 0x44]
mov edx, dword [ebp - 4]
call fcn.00448b54
lea edx, [ebp - 0x44]
pop eax
mov ecx, dword [eax]
call dword [ecx + 0x118]
mov eax, dword [ebp - 0xc]
mov eax, dword [eax + 0x38]
mov edx, dword [eax]
call dword [edx + 0x324]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x81d441
add dword [ebp - 0x14], 0xc
dec dword [ebp - 0x24]
jne 0x81d32c
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x81d46e
mov eax, dword [ebp - 0x10]
push eax
call sub.WTSAPI32.DLL_WTSFreeMemory
pop eax
jmp eax
Function at 0x81f39c
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffdf8
push ebx
push esi
push edi
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x81f3fb
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x208]
push eax
call sub.kernel32.dll_GetComputerNameW
test eax, eax
je 0x81f3e9
mov eax, dword [ebp - 4]
lea edx, [ebp - 0x208]
mov ecx, pe_nt_image_headers32
call fcn.0040c8d8
jmp 0x81f3f1
mov eax, dword [ebp - 4]
call fcn.0040b8b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x81f40d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x826dfc
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, edx
push esp
push 0
push 0
push eax
push 0
call sub.shell32.dll_SHGetFolderPathW
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.0040c8d8
add esp, 0x20c
pop ebx
ret

Function at 0x828ee0
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffdf4
mov ebx, edx
push esp
push 0
push 0
push eax
push 0
call sub.shell32.dll_SHGetFolderPathW
mov eax, ebx
mov edx, esp
mov ecx, 0x105
call fcn.0040c8d8
add esp, 0x20c
pop ebx
ret
Function at 0x8339fc
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x833b1f
push dword fs:[eax]
mov dword fs:[eax], esp
mov dl, 1
mov eax, dword [0x8338c8]
call fcn.0040999c
mov dword [ebp - 0xc], eax
lea eax, [ebp - 8]
mov edx, dword [ebp - 0xc]
test edx, edx
je 0x833a36
sub edx, 0xfffffff8
call fcn.00410d98
mov eax, dword [ebp - 0xc]
mov esi, ebx
mov dword [eax + 0xc], esi
lea eax, [ebp - 4]
call fcn.0040b8b4
xor eax, eax
push ebp
push 0x833a71
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [esi + 0x30]
mov edx, dword [0x833b30]
mov ecx, dword [eax]
call dword [ecx + 0x4c]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x833acf
mov eax, dword [0x8dc9cc]
cmp byte [eax], 1
je 0x833af2
mov edx, dword [ebp - 0xc]
test edx, edx
je 0x833ae3
sub edx, 0xfffffff0
xor eax, eax
call fcn.004c776c
lea eax, [ebp - 4]
call fcn.0040b8b4
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x833b26
lea eax, [ebp - 0x18]
mov edx, 3
call fcn.0040b914
lea eax, [ebp - 8]
call fcn.00410d80
lea eax, [ebp - 4]
call fcn.0040b8b4
pop eax
jmp eax

Function at 0x83b4cc
Capabilities:
Get hostname
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffe2c
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x1d4], ecx
mov esi, edx
xor eax, eax
push ebp
push 0x83b592
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x1d0]
push eax
push 0x101
call sub.wsock32.dll_WSAStartup
mov eax, esi
call fcn.0040b8b4
push 0x40
lea eax, [ebp - 0x40]
push eax
call sub.wsock32.dll_gethostname
lea eax, [ebp - 0x40]
push eax
call sub.wsock32.dll_gethostbyname
test eax, eax
je 0x83b577
mov edi, dword [eax + 0xc]
xor ebx, ebx
jmp 0x83b556
push dword [esi]
mov eax, dword [edi + ebx*4]
mov eax, dword [eax]
call fcn.0063a3cc
lea edx, [ebp - 0x1d4]
call fcn.0063a7c8
push dword [ebp - 0x1d4]
push 0x83b5ac
mov eax, esi
mov edx, 3
call fcn.0040cb14
inc ebx
cmp dword [edi + ebx*4], 0
jne 0x83b527
mov eax, dword [esi]
test eax, eax
je 0x83b565
mov eax, dword [eax - 4]
mov edx, esi
mov ecx, 1
xchg edx, eax
call fcn.0040cca4
call sub.wsock32.dll_WSACleanup
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x83b599
lea eax, [ebp - 0x1d4]
call fcn.0040b8b4
pop eax
jmp eax

Function at 0x849e9c
Capabilities:
Find taskbar

Disassembly:
push 0
push 0x849ec0
call sub.user32.dll_FindWindowW
test eax, eax
je 0x849ebc
push 0
push 0x849edc
push 0
push eax
call sub.user32.dll_FindWindowExW
ret
xor eax, eax
ret
Function at 0x84c524
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x84c662
push dword fs:[eax]
mov dword fs:[eax], esp
push ebx
call sub.user32.dll_IsIconic
test eax, eax
je 0x84c558
cmp byte [0x1578b21], 0
jne 0x84c558
push 9
push ebx
call sub.user32.dll_ShowWindow
call sub.user32.dll_GetForegroundWindow
cmp ebx, eax
jne 0x84c56a
mov byte [ebp - 1], 1
jmp 0x84c658
call fcn.00439d54
cmp eax, 2
jne 0x84c57e
call fcn.00439d68
cmp eax, 4
jg 0x84c5af
call fcn.00439d54
dec eax
jne 0x84c641
call fcn.00439d68
cmp eax, 4
jg 0x84c5af
call fcn.00439d68
cmp eax, 4
jne 0x84c641
call fcn.00439d70
test eax, eax
jle 0x84c641
mov byte [ebp - 1], 0
push 0
call sub.user32.dll_GetForegroundWindow
push eax
call sub.user32.dll_GetWindowThreadProcessId
mov esi, eax
push 0
push ebx
call sub.user32.dll_GetWindowThreadProcessId
mov edi, eax
push 0xffffffffffffffff
push esi
push edi
call sub.user32.dll_AttachThreadInput
test eax, eax
je 0x84c5f9
push ebx
call sub.user32.dll_BringWindowToTop
push ebx
call sub.user32.dll_SetForegroundWindow
push 0
push esi
push edi
call sub.user32.dll_AttachThreadInput
call sub.user32.dll_GetForegroundWindow
cmp ebx, eax
sete byte [ebp - 1]
cmp byte [ebp - 1], 0
jne 0x84c64d
push 0
lea eax, [ebp - 8]
push eax
push 0
push 0x2000
call sub.user32.dll_SystemParametersInfoW
push 2
push 0
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoW
push ebx
call sub.user32.dll_BringWindowToTop
push ebx
call sub.user32.dll_SetForegroundWindow
push 2
mov eax, dword [ebp - 8]
push eax
push 0
push 0x2001
call sub.user32.dll_SystemParametersInfoW
jmp 0x84c64d
push ebx
call sub.user32.dll_BringWindowToTop
push ebx
call sub.user32.dll_SetForegroundWindow
call sub.user32.dll_GetForegroundWindow
cmp ebx, eax
sete byte [ebp - 1]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x84c66c
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
pop ecx
pop ecx
pop ebp
ret

Function at 0x85247c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffbc
push ebx
push esi
push edi
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov ebx, eax
mov eax, dword [ebp - 4]
call fcn.0040b9a8
mov eax, dword [ebp - 8]
call fcn.0040b9a8
xor eax, eax
push ebp
push 0x852544
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
push ebp
push 0x85251b
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x44]
xor ecx, ecx
mov edx, 0x3c
call fcn.00408280
mov dword [ebp - 0x44], 0x3c
mov dword [ebp - 0x3c], ebx
mov dword [ebp - 0x40], 0x500
mov eax, 0x852554
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 4]
call fcn.0040c824
mov dword [ebp - 0x34], eax
cmp dword [ebp - 8], 0
je 0x8524fd
mov eax, dword [ebp - 8]
call fcn.0040c824
mov dword [ebp - 0x30], eax
xor eax, eax
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x44]
push eax
call sub.shell32.dll_ShellExecuteExW
cmp eax, 1
sbb ebx, ebx
inc ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x852527
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x85254b
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040b914
pop eax
jmp eax
Function at 0x853dc4
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
mov ecx, 7
push 0
push 0
dec ecx
jne 0x853dcc
xor eax, eax
push ebp
push 0x854039
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.0070fde4
mov edx, dword [ebp - 0x10]
lea eax, [ebp - 8]
mov ecx, 0
call fcn.0040c4b4
lea eax, [ebp - 8]
push eax
mov ecx, 0x6e
mov edx, 1
mov eax, dword [ebp - 8]
call fcn.0040c31c
lea eax, [ebp - 0xc]
mov edx, dword [0x97896c]
mov edx, dword [edx + 0x488]
call fcn.0040bcec
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 0xc]
call fcn.008529b0
lea eax, [ebp - 4]
mov edx, 0x854050
call fcn.0040bd94
push dword [ebp - 4]
push 0x8540a4
lea eax, [ebp - 0x14]
mov edx, dword [ebp - 0xc]
mov ecx, 0
call fcn.0040c4b4
push dword [ebp - 0x14]
push 0x8540bc
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 0xc]
mov ecx, 0
call fcn.0040c4b4
push dword [ebp - 0x18]
push 0x8540cc
lea eax, [ebp - 4]
mov edx, 6
call fcn.0040c1c4
lea eax, [ebp - 4]
mov edx, 0x8540dc
call fcn.0040c0e8
push dword [ebp - 4]
lea eax, [ebp - 0x24]
mov edx, dword [ebp - 8]
call fcn.0040c8f4
mov eax, dword [ebp - 0x24]
lea edx, [ebp - 0x20]
call fcn.0042fb4c
mov edx, dword [ebp - 0x20]
lea eax, [ebp - 0x1c]
mov ecx, 0
call fcn.0040c4b4
push dword [ebp - 0x1c]
push 0x8540bc
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040c1c4
push dword [ebp - 4]
lea edx, [ebp - 0x2c]
mov eax, 0x8540f0
call fcn.0042fb4c
mov edx, dword [ebp - 0x2c]
lea eax, [ebp - 0x28]
mov ecx, 0
call fcn.0040c4b4
push dword [ebp - 0x28]
push 0x8540bc
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040c1c4
push dword [ebp - 4]
lea edx, [ebp - 0x34]
mov eax, 0x85410c
call fcn.0042fb4c
mov edx, dword [ebp - 0x34]
lea eax, [ebp - 0x30]
mov ecx, 0
call fcn.0040c4b4
push dword [ebp - 0x30]
push 0x854144
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040c1c4
lea eax, [ebp - 4]
mov edx, 0x854154
call fcn.0040c0e8
push dword [ebp - 4]
push 0x854174
lea eax, [ebp - 0x38]
mov edx, dword [ebp - 0xc]
mov ecx, 0
call fcn.0040c4b4
push dword [ebp - 0x38]
push 0x8541b4
lea eax, [ebp - 4]
mov edx, 4
call fcn.0040c1c4
lea edx, [ebp - 4]
mov eax, dword [ebp - 4]
call fcn.00852cf0
push 0x8541e0
push dword [ebp - 4]
push 0x8541f4
lea eax, [ebp - 4]
mov edx, 3
call fcn.0040c1c4
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.008554fc
push 1
call sub.kernel32.dll_Sleep
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.008554fc
push 1
call sub.kernel32.dll_Sleep
lea eax, [ebp - 4]
mov edx, 0x854208
call fcn.0040bd94
mov dl, 1
mov eax, dword [ebp - 4]
call fcn.008554fc
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x854040
lea eax, [ebp - 0x38]
call fcn.0040b8d8
lea eax, [ebp - 0x34]
call fcn.0040b8b4
lea eax, [ebp - 0x30]
call fcn.0040b8d8
lea eax, [ebp - 0x2c]
call fcn.0040b8b4
lea eax, [ebp - 0x28]
call fcn.0040b8d8
lea eax, [ebp - 0x24]
mov edx, 2
call fcn.0040b914
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.0040b94c
lea eax, [ebp - 0x10]
mov edx, 2
call fcn.0040b914
lea eax, [ebp - 8]
mov edx, 2
call fcn.0040b94c
pop eax
jmp eax
Function at 0x855e6c
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffdc
push ebx
push esi
push edi
xor eax, eax
push ebp
push 0x855e99
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x24]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, dword [ebp - 0x10]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x855ea8
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x8577c8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
mov edi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x857938
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 8]
mov eax, ebx
call fcn.0042f6d4
mov eax, dword [ebp - 8]
test eax, eax
je 0x857807
mov eax, dword [eax - 4]
mov edx, eax
sar edx, 1
jns 0x857810
adc edx, 0
lea eax, [ebp - 4]
xor ecx, ecx
call fcn.0040c438
mov ebx, 1
xor eax, eax
push ebp
push 0x857898
push dword fs:[eax]
mov dword fs:[eax], esp
jmp 0x857880
push 0x857954
lea eax, [ebp - 0x18]
mov edx, dword [ebp - 8]
movzx edx, word [edx + ebx*2 - 2]
call fcn.0040c844
push dword [ebp - 0x18]
lea eax, [ebp - 0x1c]
mov edx, dword [ebp - 8]
movzx edx, word [edx + ebx*2]
call fcn.0040c844
push dword [ebp - 0x1c]
lea eax, [ebp - 0x14]
mov edx, 3
call fcn.0040cb14
mov eax, dword [ebp - 0x14]
call fcn.004306a8
mov edx, ebx
sar edx, 1
jns 0x857877
adc edx, 0
mov ecx, dword [ebp - 4]
mov byte [ecx + edx], al
add ebx, 2
mov esi, dword [ebp - 8]
test esi, esi
je 0x85788a
mov esi, dword [esi - 4]
cmp esi, ebx
jg 0x85782f
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x8578b1
mov eax, dword [ebp - 4]
test eax, eax
je 0x8578bb
mov eax, dword [eax - 4]
dec eax
test eax, eax
jl 0x8578ed
inc eax
xor ebx, ebx
mov edx, dword [ebp - 4]
movzx edx, byte [edx + ebx]
mov dword [ebp - 0x10], edx
mov edx, dword [ebp - 4]
movzx ecx, di
shr ecx, 8
xor byte [edx + ebx], cl
add di, word [ebp - 0x10]
imul dx, di, 0xc8f4
add dx, 0x7c21
mov edi, edx
inc ebx
dec eax
jne 0x8578c3
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 4]
call fcn.00412244
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0xc]
call fcn.0040c914
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x85793f
lea eax, [ebp - 0x20]
call fcn.0040b8fc
lea eax, [ebp - 0x1c]
mov edx, 3
call fcn.0040b914
lea eax, [ebp - 8]
call fcn.0040b8b4
lea eax, [ebp - 4]
call fcn.0040b8d8
pop eax
jmp eax