joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100076c7
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x434
mov eax, dword [0x1003b300]
xor eax, esp
mov dword [esp + 0x430], eax
mov eax, fcn.10007ab3
push esi
test eax, eax
je 0x10007754
push 0x424
lea eax, [esp + 0x10]
push 0
push eax
call fcn.1001a170
add esp, 0xc
push dword [ebp + 8]
mov dword [esp + 0xc], 0x428
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 4], esi
test esi, esi
je 0x1000774b
cmp esi, 0xffffffff
je 0x1000774b
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Module32FirstW
jmp 0x10007747
push edi
lea eax, [esp + 0xc]
push eax
call fcn.10007ab3
test eax, eax
je 0x1000774b
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x1000772d
lea eax, [esp + 4]
call fcn.10006cbe
mov ecx, dword [esp + 0x434]
pop esi
xor ecx, esp
call fcn.10017861
mov esp, ebp
pop ebp
ret 4

Function at 0x10007769
Capabilities:
Enumerate processes

Disassembly:
push ebp
lea ebp, [esp - 0x1b4]
sub esp, 0x234
mov eax, dword [0x1003b300]
xor eax, ebp
mov dword [ebp + 0x1b0], eax
mov eax, fcn.10007a61
test eax, eax
je 0x100077f0
push esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x80], esi
test esi, esi
je 0x100077e7
cmp esi, 0xffffffff
je 0x100077e7
push 0x228
lea eax, [ebp - 0x78]
push 0
push eax
mov dword [ebp - 0x7c], 0x22c
call fcn.1001a170
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x100077e3
push edi
lea eax, [ebp - 0x7c]
push eax
call fcn.10007a61
test eax, eax
je 0x100077e7
lea eax, [ebp - 0x7c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x100077cb
lea eax, [ebp - 0x80]
call fcn.10006cbe
pop esi
mov ecx, dword [ebp + 0x1b0]
xor ecx, ebp
call fcn.10017861
add ebp, 0x1b4
leave
ret

Function at 0x10007805
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push esi
xor esi, esi
push edi
cmp dword [ebp + 8], esi
jne 0x10007818
xor eax, eax
jmp 0x10007871
push 0x40
lea eax, [ebp - 0x58]
push esi
push eax
mov dword [ebp - 0x5c], 0x44
call fcn.1001a170
mov dword [ebp - 0x14], esi
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
add esp, 0xc
call fcn.10006f3f
mov edi, eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x5c]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x10007869
push dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.10006f6c
mov eax, esi
pop edi
pop esi
leave
ret 4
Function at 0x10007952
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
xor esi, esi
push edi
cmp dword [ebp + 8], esi
jne 0x1000796b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
call fcn.10007877
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
call fcn.10007769
cmp dword [ebp - 0x14], esi
je 0x10007962
push dword [ebp - 0x18]
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x10], eax
cmp eax, esi
je 0x100079a1
cmp eax, 0xffffffff
jne 0x100079ad
lea eax, [ebp - 0x10]
call fcn.10006cbe
mov eax, esi
jmp 0x10007964
lea ecx, [ebp - 8]
push ecx
push 0xf01ff
push eax
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x100079a1
push esi
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], esi
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x10007a57
mov edi, dword [ebp + 8]
call fcn.10006f3f
push 0x40
mov dword [ebp + 8], eax
lea eax, [ebp - 0x68]
push esi
push eax
mov dword [ebp - 0x6c], 0x44
call fcn.1001a170
add esp, 0xc
push 5
pop eax
mov word [ebp - 0x3c], ax
xor eax, eax
mov dword [ebp - 0x20], esi
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
push dword [ebp - 0xc]
mov dword [ebp - 0x40], 1
push 0x420
push esi
push esi
push esi
push dword [ebp + 8]
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x10007a46
push dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
call ebx
push dword [ebp + 8]
call fcn.10006f6c
push dword [ebp - 0xc]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
push dword [ebp - 8]
call ebx
jmp 0x100079a1
Function at 0x10007f18
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002f631
mov eax, dword fs:[0]
push eax
mov eax, 0x203c
call fcn.1002a760
mov eax, dword [0x1003b300]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
push eax
mov dword [ebp - 0x2024], eax
mov dword [ebp - 0x2028], edi
call fcn.1000831d
xor ebx, ebx
inc ebx
push ebx
push dword [ebp + 0xc]
lea esi, [ebp - 0x2020]
mov dword [ebp - 0x2028], ebx
call fcn.10006cd4
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x201c], edi
je 0x1000802e
xor eax, eax
push 0x1ffe
mov word [ebp - 0x2010], ax
lea eax, [ebp - 0x200e]
push edi
push eax
mov dword [ebp - 0x2014], edi
call fcn.1001a170
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
add esp, 0xc
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x2018]
push eax
lea eax, [ebp - 0x2010]
push eax
push edi
jmp 0x10008018
inc dword [ebp - 0x2014]
lea eax, [ebp - 0x2010]
push eax
lea esi, [ebp - 0x2044]
call fcn.10003093
mov eax, esi
mov byte [ebp - 4], 2
push eax
mov eax, dword [ebp - 0x2024]
call fcn.10008356
push edi
push 1
mov byte [ebp - 4], 1
call fcn.10001b40
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x2018]
push eax
lea eax, [ebp - 0x2010]
push eax
push dword [ebp - 0x2014]
push dword [ebp - 0x201c]
mov dword [ebp - 0x2018], 0x1000
call ebx
test eax, eax
je 0x10007fca
mov dword [ebp - method.RegHandleHolder.virtual_0], vtable.RegHandleHolder.0
cmp dword [ebp - 0x201c], edi
je 0x1000804c
push dword [ebp - 0x201c]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x2024]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.10017861
leave
ret
Function at 0x1000806c
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1002f5d1
mov eax, dword fs:[0]
push eax
mov eax, 0x2040
call fcn.1002a760
mov eax, dword [0x1003b300]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 8]
xor edi, edi
mov dword [ebp - 4], edi
push eax
mov dword [ebp - 0x2028], eax
mov dword [ebp - 0x202c], edi
call fcn.1000831d
xor ebx, ebx
push 8
inc ebx
push str.SoftwareprojonepodlpworkflowcompletedCase_
lea esi, [ebp - 0x2024]
mov dword [ebp - 0x202c], ebx
call fcn.10006cd4
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x2020], edi
je 0x10008185
xor eax, eax
push 0x1ffe
mov word [ebp - 0x2014], ax
lea eax, [ebp - 0x2012]
push edi
push eax
mov dword [ebp - 0x2018], edi
call fcn.1001a170
mov ebx, dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
add esp, 0xc
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x201c]
push eax
lea eax, [ebp - 0x2014]
push eax
push edi
jmp 0x1000816f
inc dword [ebp - 0x2018]
lea eax, [ebp - 0x2014]
push eax
lea esi, [ebp - 0x2048]
call fcn.10003093
mov eax, esi
mov byte [ebp - 4], 2
push eax
mov eax, dword [ebp - 0x2028]
call fcn.10008356
push edi
push 1
mov byte [ebp - 4], 1
call fcn.10001b40
push edi
push edi
push edi
push edi
lea eax, [ebp - 0x201c]
push eax
lea eax, [ebp - 0x2014]
push eax
push dword [ebp - 0x2018]
push dword [ebp - 0x2020]
mov dword [ebp - 0x201c], 0x1000
call ebx
test eax, eax
je 0x10008121
mov dword [ebp - method.RegHandleHolder.virtual_0], vtable.RegHandleHolder.0
cmp dword [ebp - 0x2020], edi
je 0x100081a3
push dword [ebp - 0x2020]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, dword [ebp - 0x2028]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.10017861
leave
ret

Function at 0x100159c5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
push edi
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
test edi, edi
je 0x100159fe
push dword [ebp + 0x10]
push dword [ebp - 4]
push str.thread__d_created:__s
call fcn.100155c7
add esp, 0xc
mov eax, edi
pop edi
leave
ret 0xc
Function at 0x10015cca
Capabilities:
Get common file path

Disassembly:
push ebp
sub esp, 0x224
lea ebp, [esp - 4]
mov eax, dword [0x1003b300]
xor eax, ebp
mov dword [ebp + 0x224], eax
push 4
mov eax, 0x1002eeba
call fcn.100185a1
mov edi, dword [ebp + 0x230]
mov esi, dword [ebp + 0x238]
xor eax, eax
xor ebx, ebx
push 0x206
mov word [ebp + 0x1c], ax
lea eax, [ebp + 0x1e]
push ebx
push eax
mov dword [ebp - 0x10], ebx
call fcn.1001a170
add esp, 0xc
push 0x104
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
cmp dword [ebp + 0x234], 1
jne 0x10015d36
push str.projonepodlp
jmp 0x10015d44
cmp dword [ebp + 0x234], 2
jne 0x10015d63
push str.projonepotcm
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
cmp esi, ebx
je 0x10015d5d
push esi
lea eax, [ebp + 0x1c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp + 0x1c]
push eax
jmp 0x10015db6
cmp dword [ebp + 0x234], ebx
jne 0x10015db1
push ebx
lea eax, [ebp]
push 2
push eax
call fcn.10015cca
add esp, 0xc
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x18], 8
mov eax, dword [ebp + 4]
jae 0x10015d89
lea eax, [ebp + 4]
push eax
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
push esi
test eax, eax
je 0x10015dad
push 2
push edi
call fcn.10015cca
add esp, 0xc
push ebx
push 1
lea esi, [ebp]
call fcn.10001b40
jmp 0x10015dbd
push 1
jmp 0x10015d97
push 0x100339fc
mov esi, edi
call fcn.10003093
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x224]
xor ecx, ebp
call fcn.10017861
add ebp, 0x228
leave
ret

Function at 0x10015eec
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x47c
mov eax, dword [0x1003b300]
xor eax, ebp
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
and dword [ebp - 0x47c], 0
push ebx
mov dword [ebp - 0x478], eax
push esi
lea eax, [ebp - 0x474]
call fcn.100176c2
push edi
mov ebx, 0x400
push ebx
lea eax, [ebp - 0x41c]
push 1
push eax
call fcn.10019e5d
add esp, 0x10
jmp 0x10015f5b
lea ecx, [ebp - 0x41c]
push ecx
lea esi, [ebp - 0x474]
call fcn.100176e6
push edi
push ebx
lea eax, [ebp - 0x41c]
push 1
push eax
call fcn.10019e5d
add esp, 0x14
test eax, eax
jne 0x10015f36
lea ecx, [ebp - 0x474]
lea ebx, [ebp - 0x18]
call fcn.1001777c
mov esi, dword [ebp - 0x478]
push 0x10
mov eax, ebx
push eax
call fcn.100081c3
mov ecx, dword [ebp - 8]
mov eax, esi
pop esi
xor ecx, ebp
pop ebx
call fcn.10017861
leave
ret

Function at 0x10016435
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 4
shl eax, 4
pop edx
mov esi, ecx
lea edi, [eax + ecx + 0x3c]
mov dword [ebp - 4], edx
xor eax, eax
mov ecx, edi
mov bl, byte [ecx]
xor byte [esi + eax], bl
inc eax
add ecx, edx
cmp eax, edx
jl 0x1001644f
inc edi
add esi, edx
dec dword [ebp - 4]
jne 0x1001644b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1001656a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1003b300]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 4
lea esi, [ebp - 8]
lea ecx, [eax + 4]
pop edi
mov al, byte [esi - 0xc]
mov dl, byte [esi - 8]
call fcn.10016730
mov bl, al
mov al, dl
call fcn.10016730
xor bl, al
xor bl, byte [esi - 4]
mov al, dl
xor bl, byte [esi]
xor bl, dl
mov byte [ecx - 4], bl
call fcn.10016730
mov bl, al
mov al, byte [esi - 4]
call fcn.10016730
xor bl, al
xor bl, byte [esi - 0xc]
mov al, byte [esi - 4]
xor bl, byte [esi]
xor bl, al
mov byte [ecx], bl
call fcn.10016730
mov bl, al
mov al, byte [esi]
call fcn.10016730
xor bl, al
mov al, byte [esi]
xor bl, dl
xor bl, byte [esi - 0xc]
xor bl, al
mov byte [ecx + 4], bl
call fcn.10016730
mov bl, al
mov al, byte [esi - 0xc]
call fcn.10016730
xor bl, al
xor bl, dl
xor bl, byte [esi - 4]
xor bl, byte [esi - 0xc]
inc ecx
mov byte [ecx + 7], bl
inc esi
dec edi
jne 0x10016592
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10017861
leave
ret 4

Function at 0x1001661f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1003b300]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x10]
lea esi, [eax + 4]
mov dword [ebp - 0x1c], 4
mov al, byte [edi - 4]
mov bl, byte [edi + 4]
call fcn.100167ac
push ebx
mov dl, al
call fcn.10016785
xor dl, al
movzx eax, byte [edi + 8]
push eax
call fcn.10016740
xor dl, al
movzx eax, byte [edi]
push eax
call fcn.1001675e
xor dl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi - 4], dl
call fcn.10016740
push ebx
mov byte [ebp - 0x15], al
call fcn.1001675e
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi + 8]
push eax
mov byte [ebp - 0x15], cl
call fcn.10016785
mov cl, byte [ebp - 0x15]
xor cl, al
mov al, byte [edi]
mov byte [ebp - 0x15], cl
call fcn.100167ac
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi], cl
call fcn.10016785
mov bl, al
mov al, byte [edi + 4]
call fcn.100167ac
movzx edx, byte [edi + 8]
push edx
xor bl, al
call fcn.1001675e
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.10016740
xor bl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi + 4], bl
call fcn.1001675e
mov bl, al
movzx eax, byte [edi + 4]
push eax
call fcn.10016740
xor bl, al
mov al, dl
call fcn.100167ac
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.10016785
xor bl, al
mov byte [esi + 8], bl
inc esi
inc edi
dec dword [ebp - 0x1c]
jne 0x1001664b
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10017861
leave
ret 4
Function at 0x10016e6b
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push 0x2c
mov eax, 0x1002e7e9
call fcn.1001860a
mov eax, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
xor esi, esi
mov eax, edi
mov dword [ebp - 0x30], esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x10016e8a
sub eax, ecx
push esi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 0xf
call fcn.10001cc1
xor ebx, ebx
inc ebx
cmp dword [ebp - 0x30], 0
mov dword [ebp - 4], esi
jbe 0x10016f8f
jmp 0x10016ebb
mov edi, dword [ebp + 0xc]
movsx eax, byte [esi + edi]
mov al, byte [eax + 0x10034870]
inc esi
cmp esi, dword [ebp - 0x30]
jae 0x10016ecf
cmp al, 0xff
je 0x10016ebb
cmp al, 0xff
je 0x10016f8f
movsx ecx, byte [esi + edi]
mov cl, byte [ecx + 0x10034870]
inc esi
mov byte [ebp - 0x32], cl
cmp esi, dword [ebp - 0x30]
jae 0x10016eef
cmp cl, 0xff
je 0x10016ed7
cmp cl, 0xff
je 0x10016f8f
sar cl, 4
shl al, 2
and cl, 3
or cl, al
movzx eax, cl
push eax
lea edi, [ebp - 0x2c]
call fcn.100083bd
mov eax, dword [ebp + 0xc]
mov al, byte [esi + eax]
inc esi
cmp al, 0x3d
je 0x10016f8f
movsx eax, al
mov al, byte [eax + 0x10034870]
mov byte [ebp - 0x31], al
cmp esi, dword [ebp - 0x30]
jae 0x10016f2f
cmp al, 0xff
je 0x10016f0f
cmp al, 0xff
je 0x10016f8f
mov cl, al
mov al, byte [ebp - 0x32]
sar cl, 2
shl al, 4
and cl, 0xf
or cl, al
movzx eax, cl
push eax
lea edi, [ebp - 0x2c]
call fcn.100083bd
mov eax, dword [ebp + 0xc]
mov al, byte [esi + eax]
inc esi
cmp al, 0x3d
je 0x10016f8f
movsx eax, al
mov cl, byte [eax + 0x10034870]
cmp esi, dword [ebp - 0x30]
jae 0x10016f6d
cmp cl, 0xff
je 0x10016f4f
cmp cl, 0xff
je 0x10016f8f
mov al, byte [ebp - 0x31]
shl al, 6
or al, cl
movzx eax, al
push eax
lea edi, [ebp - 0x2c]
call fcn.100083bd
cmp esi, dword [ebp - 0x30]
jb 0x10016eb8
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x2c]
push eax
call fcn.10001920
push 0
push ebx
lea ecx, [ebp - 0x2c]
call fcn.10001a6f
mov eax, dword [ebp - 0x38]
call fcn.1001868d
ret

Function at 0x100176c2
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x10017861
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1003b300]
jne 0x1001786b
repz ret
jmp fcn.10019f6d
Function at 0x10023111
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1001a25c
and dword [ebp - 4], 0
cmp dword [0x1003dc6c], 0
mov ebx, eax
jne 0x100231c2
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x10023273
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x10023273
push eax
call fcn.1001a1ea
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1003dc6c], eax
call esi
push eax
call fcn.1001a1ea
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1003dc70], eax
call esi
push eax
call fcn.1001a1ea
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1003dc74], eax
call esi
push eax
call fcn.1001a1ea
pop ecx
mov dword [0x1003dc7c], eax
test eax, eax
je 0x100231c2
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1001a1ea
pop ecx
mov dword [0x1003dc78], eax
mov eax, dword [0x1003dc78]
cmp eax, ebx
je 0x1002321a
cmp dword [0x1003dc7c], ebx
je 0x1002321a
push eax
call fcn.1001a265
push dword [0x1003dc7c]
mov esi, eax
call fcn.1001a265
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1002321a
test edi, edi
je 0x1002321a
call esi
test eax, eax
je 0x10023211
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10023211
test byte [ebp - 0xc], 1
jne 0x1002321a
or dword [ebp + 0x10], 0x200000
jmp 0x10023253
mov eax, dword [0x1003dc70]
cmp eax, ebx
je 0x10023253
push eax
call fcn.1001a265
pop ecx
test eax, eax
je 0x10023253
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x10023253
mov eax, dword [0x1003dc74]
cmp eax, ebx
je 0x10023253
push eax
call fcn.1001a265
pop ecx
test eax, eax
je 0x10023253
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1003dc6c]
call fcn.1001a265
pop ecx
test eax, eax
je 0x10023273
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x10023275
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x6d60d7d5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x6d616878]
jne 0x6d60d7df
repz ret
jmp fcn.6d60de74

Function at 0x6d60e202
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x6d60e211
pop dword [ebp - 0x40]
mov eax, 0x47640b0e
add eax, 0x25fcd703
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x6bb8ac08
sub dword [ebp - 0x50], 0x1d6666bd
mov dword [ebp - 0x4c], 0x46015173
sub dword [ebp - 0x4c], 0x13ce052e
mov dword [ebp - 0x48], 0xd05ddb6e
sub dword [ebp - 0x48], 0x84119740
mov dword [ebp - 0x44], 0xaf7a7f0f
add dword [ebp - 0x44], 0x508580f1
lea eax, [ebp - 0x50]
push eax
mov eax, 0x5f0563ce
add eax, 0xe5b8c56
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xc6f41d4b
sub dword [ebp - 0x50], 0x5281b3f5
mov dword [ebp - 0x4c], 0xc9702aa3
add dword [ebp - 0x4c], 0x77fc36d2
mov dword [ebp - 0x48], 0x68e33934
sub dword [ebp - 0x48], 0x573ccc8
mov dword [ebp - 0x44], 0xe5c693f
add dword [ebp - 0x44], 0xf1a396c1
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0xc40f50b1
add eax, 0xa9519f6f
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x35300
push 0
call eax
mov ecx, 0x44deb51d
add ecx, 0xbb218a31
mov edx, eax
mov esi, 0x6d619c00
add esi, dword [ebp - 0x40]
mov ebx, 0x164355ef
add ebx, 0x3cf4b69e
add dword [ebp - 0x30], ebx
mov edi, dword [esi]
sub dword [ebp - 0xc], edi
xor edi, ebx
mov dword [edx], edi
add edx, 0xb93363d2
sub edx, 0xb93363ce
add esi, 0x3cd303f8
add esi, 0xc32cfc0c
loop 0x6d60e32d
add eax, 0x1296106b
sub eax, 0x12952060
xor ebx, ebx
add ebx, eax
add eax, 0x359dd681
sub eax, 0x359dd67c
mov ecx, 0x405899d7
sub ecx, 0xd2f899d7
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x401378
Capabilities:
Accept command line arguments
Query environment variable

Disassembly:
jmp 0x40138a
mov eax, dword [0x48808b]
shl eax, 2
mov dword [0x48808f], eax
push edx
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov edx, eax
call fcn.0047bdc8
pop edx
call fcn.0047bd2c
call fcn.0047be08
push 0
call fcn.0047d214
pop ecx
push 0x488034
push 0
call sub.KERNEL32.DLL_GetModuleHandleA
mov dword [0x488093], eax
push 0
jmp fcn.004823b4

Function at 0x403a18
Capabilities:
Enumerate gui resources

Disassembly:
mov byte [eax + 0xc], 0
mov byte [eax + 0xd], 0
xor edx, edx
mov dword [eax + 4], edx
push eax
push 0x403964
call sub.USER32.DLL_EnumWindows
ret

Function at 0x403b3c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x403bb9
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.00403588
call sub.KERNEL32.DLL_GetTickCount
mov ebx, eax
push 0
call sub.KERNEL32.DLL_Sleep
call sub.KERNEL32.DLL_GetTickCount
sub eax, ebx
cmp eax, 0x3e8
jbe 0x403b61
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.004031e0
cmp dword [ebp - 4], 0
je 0x403ba3
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.00479858
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.USER32.DLL_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403bc0
lea eax, [ebp - 4]
call fcn.004793a8
ret

Function at 0x40fff4
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
mov ebx, edx
mov word [ebp - 2], ax
mov eax, ebx
call fcn.004793a8
push 0
xor eax, eax
mov al, byte [ebp - 2]
push eax
call sub.USER32.DLL_MapVirtualKeyA
shl eax, 0x10
test eax, eax
je 0x410043
push 0x100
lea edx, [ebp - 0x102]
push edx
push eax
call sub.USER32.DLL_GetKeyNameTextA
mov eax, ebx
lea edx, [ebp - 0x102]
mov ecx, 0x100
call fcn.00479610
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4180b8
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4180be
ret

Function at 0x41a694
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.KERNEL32.DLL_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x41a6e5
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x41a6cc
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x41a6bc
jmp 0x41a6e5
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x41a6cd
pop ebx
mov esp, ebp
pop ebp
ret