joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10627a0
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 0xc]
xor dl, dl
xor eax, eax
push esi
mov byte [ebp - 4], dl
test ecx, ecx
jbe 0x10627c3
mov esi, dword [ebp + 8]
xor dl, byte [eax + esi]
inc eax
cmp eax, ecx
jb 0x10627b8
mov byte [ebp - 4], dl
cmp dword [ebp + 0x18], 0
je 0x10627e1
mov eax, dword [ebp - 4]
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push eax
push ecx
push edx
call fcn.0102d4c0
pop esi
mov esp, ebp
pop ebp
ret 0x14
mov esi, dword [ebp + 0x10]
test esi, esi
je 0x1062820
mov ecx, dword [ebp + 0x14]
test ecx, ecx
je 0x1062820
xor byte [esi], 0xac
add ecx, 0xffffffff
je 0x1062820
movzx eax, dl
push edi
cdq
mov edi, 0xff
idiv edi
pop edi
lea eax, [ecx + esi]
or esi, 0xffffffff
push ebx
jmp 0x1062810
mov bl, dl
add bl, cl
xor bl, byte [esi + eax]
dec ecx
xor byte [eax], bl
dec eax
test ecx, ecx
ja 0x1062810
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x14

Function at 0x10631a0
Capabilities:
Delete file
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 0
push 0x80
push 2
push 0
push 3
push 0xc0000000
lea edi, [ebx + 0x323]
push edi
call dword [sym.imp.KERNEL32.DLL_CreateFileA]
mov esi, eax
test esi, esi
je 0x1063211
cmp esi, 0xffffffff
je 0x1063211
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
push 0
lea eax, [ebp + 8]
push eax
push ecx
push edx
push esi
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
push ebx
call fcn.01063100
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
pop edi
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x14
pop edi
pop esi
mov eax, 2
pop ebx
pop ebp
ret 0x14

Function at 0x1063320
Capabilities:
Delete file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2dc
push ebx
push esi
push 0x9c
lea eax, [ebp - 0xa0]
push 0
mov esi, 2
push eax
mov dword [ebp - 4], esi
call sub.msvcrt.dll_memset
push 0x23c
lea ecx, [ebp - 0x2dc]
push 0
push ecx
call sub.msvcrt.dll_memset
mov edx, dword [ebp + 0xc]
add esp, 0x18
lea eax, [ebp - 0xa0]
push eax
mov dword [ebp - 0x9c], edx
mov dword [ebp - 0x98], 1
call fcn.01175960
mov ebx, eax
test ebx, ebx
je 0x10633fd
push edi
mov edi, dword [ebp + 8]
mov dword [ebp + 0xc], 0
mov edi, edi
lea ecx, [ebp - 0x2dc]
push ecx
push ebx
call fcn.01178140
test eax, eax
jne 0x10633eb
cmp dword [ebp - 0xcc], 0x1400000
jae 0x10633e5
lea esi, [edi + 0x323]
push esi
push eax
push 2
push ebx
call fcn.01178110
test eax, eax
jne 0x10633de
push 3
lea edx, [ebp - 0x1d8]
push edx
push edi
call fcn.01063100
mov dword [ebp - 4], eax
test eax, eax
je 0x10633de
mov dword [ebp + 0xc], 1
push esi
call dword [sym.imp.KERNEL32.DLL_DeleteFileA]
cmp dword [ebp + 0xc], 0
je 0x1063390
push ebx
call fcn.01174e80
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1066ba0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x14]
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
sub esp, 8
xor eax, eax
and edx, 7
cmp ecx, 5
jae 0x1066bc0
mov esp, ebp
pop ebp
ret 0x14
add dword [ebp + 0x10], 5
push ebx
push esi
mov esi, dword [ebp + 8]
lea ebx, [esi + ecx - 4]
push edi
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 8], ebx
mov esi, dword [ebp + 8]
lea edi, [eax + esi]
cmp edi, ebx
jae 0x1066bef
mov al, byte [edi]
and al, 0xfe
cmp al, 0xe8
je 0x1066bef
inc edi
cmp edi, ebx
jb 0x1066be2
mov eax, edi
sub eax, esi
mov ecx, eax
sub ecx, dword [ebp - 4]
cmp edi, ebx
jae 0x1066d10
cmp ecx, 3
jbe 0x1066c0c
xor esi, esi
mov dword [ebp + 0xc], esi
jmp 0x1066c4f
dec ecx
shl edx, cl
and edx, 7
mov dword [ebp + 0xc], edx
je 0x1066c4c
mov ecx, edx
movzx edx, byte [ecx + 0x100a980]
mov esi, edi
sub esi, edx
cmp byte [ecx + 0x100a978], 0
mov dl, byte [esi + 4]
je 0x1066c39
test dl, dl
je 0x1066c39
cmp dl, 0xff
jne 0x1066c4c
and ecx, 3
add ecx, ecx
or ecx, 1
mov dword [ebp - 4], eax
mov dword [ebp + 0xc], ecx
inc eax
mov edx, ecx
jmp 0x1066bd8
mov esi, dword [ebp + 0xc]
mov cl, byte [edi + 4]
mov dword [ebp - 4], eax
test cl, cl
je 0x1066c71
cmp cl, 0xff
je 0x1066c71
and esi, 3
add esi, esi
or esi, 1
mov dword [ebp + 0xc], esi
inc eax
mov edx, esi
jmp 0x1066bd8
movzx edx, cl
movzx ecx, byte [edi + 3]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 2]
shl edx, 8
or edx, ecx
movzx ecx, byte [edi + 1]
shl edx, 8
or edx, ecx
nop
cmp dword [ebp + 0x18], 0
je 0x1066c9e
lea ebx, [edx + eax]
add ebx, dword [ebp + 0x10]
jmp 0x1066ca5
sub edx, eax
sub edx, dword [ebp + 0x10]
mov ebx, edx
test esi, esi
je 0x1066ce0
movzx esi, byte [esi + 0x100a980]
add esi, esi
add esi, esi
add esi, esi
mov ecx, 0x18
sub ecx, esi
mov edx, ebx
shr edx, cl
test dl, dl
je 0x1066cca
cmp dl, 0xff
jne 0x1066ce0
mov ecx, 0x20
sub ecx, esi
mov esi, dword [ebp + 0xc]
mov edx, 1
shl edx, cl
dec edx
xor edx, ebx
jmp 0x1066c90
mov edx, ebx
shr edx, 0x18
and dl, 1
dec dl
not dl
mov byte [edi + 4], dl
mov edx, ebx
mov ecx, ebx
shr edx, 8
shr ecx, 0x10
mov byte [edi + 2], dl
mov edx, dword [ebp + 0xc]
mov byte [edi + 1], bl
mov ebx, dword [ebp - 8]
mov byte [edi + 3], cl
add eax, 5
jmp 0x1066bd8
pop edi
pop esi
pop ebx
cmp ecx, 3
jbe 0x1066d25
mov ecx, dword [ebp + 0x14]
xor edx, edx
mov dword [ecx], edx
mov esp, ebp
pop ebp
ret 0x14
dec ecx
shl edx, cl
mov ecx, dword [ebp + 0x14]
and edx, 7
mov dword [ecx], edx
mov esp, ebp
pop ebp
ret 0x14
Function at 0x106adb0
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0xc]
push ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x106ae17
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
push 0x802
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x106ae10
push 0x802
push 0
push esi
call sub.msvcrt.dll_memset
mov eax, dword [ebp + 0xc]
add esp, 0xc
test eax, eax
je 0x106ae07
push 0x3ff
push eax
push esi
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
push esi
push 0xd
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop ebp
ret 8

Function at 0x106b560
Capabilities:
Identify system language via api

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
add edi, 0x3b2
cmp byte [edi], 0
mov dword [ebp - 4], 0xffffffff
je 0x106b5b4
xor ebx, ebx
mov esi, 0x117fac0
mov eax, dword [esi]
test edi, edi
je 0x106b59a
test eax, eax
je 0x106b59e
push eax
push edi
call dword [sym.imp.msvcrt.dll__stricmp]
add esp, 8
test eax, eax
je 0x106b5ac
add esi, 0x20
inc ebx
cmp esi, 0x117fc60
jl 0x106b585
jmp 0x106b5b4
mov dword [ebp - 4], ebx
cmp ebx, 0xffffffff
jne 0x106b5ee
call dword [sym.imp.KERNEL32.DLL_GetUserDefaultUILanguage]
movzx edi, ax
test edi, edi
je 0x106b5ee
xor esi, esi
mov edx, 0x117facc
xor eax, eax
mov ecx, edx
lea esp, [esp]
cmp dword [ecx], edi
je 0x106b5df
inc eax
add ecx, 4
cmp eax, 5
jl 0x106b5d0
jmp 0x106b5e2
mov dword [ebp - 4], esi
add edx, 0x20
inc esi
cmp edx, 0x117fc6c
jl 0x106b5c8
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x106b830
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
xor edi, edi
cmp dword [esi + 0x4064], edi
jne 0x106b8fe
push ebx
lea ebx, [esi + 0x1c]
test ebx, ebx
je 0x106b8fd
push ebx
call dword [sym.imp.KERNEL32.DLL_EnterCriticalSection]
mov eax, dword [esi + 0x4060]
cmp eax, 0x1000
jge 0x106b8f2
mov ecx, dword [ebp + 0x10]
shl eax, 5
mov dword [eax + esi + 0x40cc], ecx
mov edx, dword [esi + 0x4060]
mov ecx, dword [ebp + 0xc]
shl edx, 5
mov dword [edx + esi + 0x40d0], 1
mov eax, dword [esi + 0x4060]
shl eax, 5
lea eax, [eax + esi + 0x40bc]
push eax
push edi
push eax
push ecx
push edi
push edi
call dword [sym.imp.KERNEL32.DLL_CreateThread]
mov edi, eax
test edi, edi
je 0x106b8de
cmp edi, 0xffffffff
je 0x106b8de
mov edx, dword [esi + 0x4060]
mov dword [esi + edx*4 + 0x60], edi
mov eax, dword [esi + 0x4060]
inc eax
and eax, 0x80000fff
jns 0x106b8d6
dec eax
or eax, 0xfffff000
inc eax
mov dword [esi + 0x4060], eax
jmp 0x106b8f2
mov ecx, dword [esi + 0x4060]
shl ecx, 5
mov dword [ecx + esi + 0x40d0], 0
test ebx, ebx
je 0x106b8fd
push ebx
call dword [sym.imp.KERNEL32.DLL_LeaveCriticalSection]
pop ebx
mov eax, edi
pop edi
pop esi
pop ebp
ret 0xc
Function at 0x106e9f0
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetTickCount]
push edi
call esi
mov edi, eax
mov eax, dword [ebp + 8]
cmp dword [eax + 0xcc], 0
jne 0x106ea30
push ebx
mov ebx, dword [sym.imp.KERNEL32.DLL_Sleep]
push 0x32
call ebx
call esi
sub eax, edi
cmp eax, 0x3e8
jae 0x106ea2f
mov ecx, dword [ebp + 8]
cmp dword [ecx + 0xcc], 0
je 0x106ea14
pop ebx
pop edi
pop esi
pop ebp
ret 4

Function at 0x1070490
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi]
cmp dword [eax + 0x2a56c], 0
je 0x1070505
mov ecx, dword [edi + 0xc]
push ecx
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1070505
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
push 0x401
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x10704fe
push 0x401
push 0
push esi
call sub.msvcrt.dll_memset
mov edx, dword [edi]
mov eax, dword [edx + 0x2a56c]
add esp, 0xc
test eax, eax
je 0x10704f5
push 0x24
push eax
push esi
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0xc
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop edi
pop ebp
ret 4

Function at 0x1070510
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 8]
mov eax, dword [edi + 0xc]
push eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1070577
push esi
call dword [sym.imp.USER32.dll_EmptyClipboard]
push 0x401
push 0x40
call dword [sym.imp.KERNEL32.DLL_GlobalAlloc]
mov esi, eax
test esi, esi
je 0x1070570
push 0x401
push 0
push esi
call sub.msvcrt.dll_memset
mov eax, dword [edi]
add esp, 0xc
add eax, 0x2b6f4
je 0x1070567
push 0x24
push eax
push esi
call dword [sym.imp.msvcrt.dll_strncpy]
add esp, 0xc
push esi
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop esi
pop edi
pop ebp
ret 4
Function at 0x1074050
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.USER32.dll_SendMessageW]
push esi
mov esi, dword [ebp + 0xc]
mov eax, dword [esi + 0x25a8c]
mov eax, dword [eax + 0x1c]
push edi
push 0
push 0
push 0x147
push eax
call ebx
mov edi, dword [ebp + 0x10]
push 0
mov dword [edi + 0x1fc], eax
mov eax, dword [esi + 0x25a90]
mov ecx, dword [eax + 0x1c]
push 0
push 0x147
push ecx
call ebx
mov ebx, dword [ebp + 8]
push 0x3f
lea edx, [edi + 0x308]
mov dword [edi + 0x1f8], eax
mov eax, dword [esi + 0x25aa0]
push edx
push eax
push ebx
call fcn.01056a50
mov edx, dword [esi + 0x25a9c]
push 0x3f
lea ecx, [edi + 0x286]
push ecx
push edx
push ebx
call fcn.01056a50
push 0x3f
lea eax, [edi + 0x204]
push eax
mov eax, dword [esi + 0x25a94]
push eax
push ebx
call fcn.01056a50
lea eax, [edi + 0x204]
push eax
push esi
call fcn.01073f90
mov esi, dword [esi + 0x25a98]
test ebx, ebx
je 0x1074156
push 0x403
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x1074156
test esi, esi
je 0x1074124
mov ecx, dword [esi + 0x1c]
push 0x1ff
push ebx
push ecx
call dword [sym.imp.USER32.dll_GetWindowTextW]
push ebx
call dword [sym.imp.msvcrt.dll__wtoi]
add esp, 4
cmp eax, 0xffff
mov dword [edi + 0x200], eax
jle 0x1074140
mov eax, 0xffff
push ebx
push 0
mov dword [edi + 0x200], eax
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
pop esi
pop ebx
pop ebp
ret 0xc

Function at 0x1076470
Capabilities:
Get disk information

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, 1
test esi, esi
je 0x10764a5
push 2
push 0x100c684
push esi
call dword [sym.imp.msvcrt.dll__wcsnicmp]
add esp, 0xc
test eax, eax
jne 0x10764a5
pop edi
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret 4
mov cx, word [esi + 2]
mov ax, word [esi]
mov dx, word [esi + 4]
mov word [ebp - 6], cx
mov word [ebp - 8], ax
lea ecx, [ebp - 8]
xor eax, eax
push ecx
mov word [ebp - 4], dx
mov word [ebp - 2], ax
call dword [sym.imp.KERNEL32.DLL_GetDriveTypeW]
cmp eax, 3
jne 0x107649b
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10770d0
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
mov ecx, dword [ebp + 0xc]
push esi
lea eax, [ebp + 0x10]
push eax
push ecx
push 0
lea edx, [ebp - 4]
push edx
mov dword [ebp - 4], 0
call fcn.0102c230
mov esi, dword [ebp - 4]
test esi, esi
je 0x10771f9
lea eax, [eax + eax + 0x864]
test eax, eax
je 0x10771e9
push ebx
inc eax
push eax
push 8
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x10771e8
push edi
push 9
push esi
call fcn.0102aa50
mov edi, eax
mov dword [ebp - 8], edi
test edi, edi
je 0x107718f
mov eax, dword [ebp - 4]
mov esi, edi
sub esi, eax
sar esi, 1
push esi
push eax
push ebx
call fcn.0102a670
cmp esi, 0x31
jl 0x1077156
mov esi, 0x31
cmp esi, 0x32
jge 0x1077180
mov eax, 0x20
movzx edx, ax
mov eax, edx
shl edx, 0x10
mov ecx, 0x32
sub ecx, esi
or eax, edx
shr ecx, 1
lea edi, [ebx + esi*2]
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [ebp - 8]
add edi, 2
push edi
push ebx
call fcn.0102a600
mov esi, dword [ebp - 4]
jmp 0x107719f
push 0x103
push esi
push ebx
call dword [sym.imp.msvcrt.dll_wcsncpy]
add esp, 0xc
cmp word [ebx], 0
mov eax, ebx
pop edi
je 0x10771b9
jmp 0x10771b0
add eax, 2
cmp word [eax], 0
jne 0x10771b0
sub eax, ebx
push 0
sar eax, 1
lea ecx, [ebp - 0xc]
push ecx
lea edx, [eax + eax]
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 0x30900]
push edx
push ebx
push ecx
call dword [sym.imp.KERNEL32.DLL_WriteFile]
push ebx
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop ebx
push esi
push 0
call dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1077ea0
Capabilities:
Get local ipv4 addresses
Get mac address on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push edi
push 0x281
push 8
mov dword [ebp - 4], 0x280
call esi
mov ebx, dword [sym.imp.KERNEL32.DLL_HeapAlloc]
push eax
call ebx
mov edi, eax
mov dword [ebp - 8], edi
test edi, edi
je 0x10780a9
lea eax, [ebp - 4]
push eax
push edi
call sub.iphlpapi.dll_GetAdaptersInfo
cmp eax, 0x6f
jne 0x1077f0b
push edi
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
mov eax, dword [ebp - 4]
test eax, eax
je 0x10780a9
inc eax
push eax
push 8
call esi
push eax
call ebx
mov dword [ebp - 8], eax
mov edi, eax
test edi, edi
je 0x10780a9
lea ecx, [ebp - 4]
push ecx
push edi
call sub.iphlpapi.dll_GetAdaptersInfo
test eax, eax
jne 0x107809d
mov esi, dword [ebp + 8]
mov ebx, dword [sym.imp.msvcrt.dll_strncpy]
mov edi, edi
mov eax, dword [esi + 0x2e664]
cmp eax, 8
jge 0x1078094
imul eax, eax, 0x360
push 0x103
lea edx, [edi + 0x10c]
push edx
lea eax, [eax + esi + 0x2cc69]
push eax
call ebx
mov edx, dword [esi + 0x2e664]
imul edx, edx, 0x360
push 0x103
lea ecx, [edi + 8]
push ecx
lea eax, [edx + esi + 0x2cb64]
push eax
call ebx
mov eax, dword [edi + 0x190]
add esp, 0x18
cmp eax, 0x41
jb 0x1077f8d
mov eax, 0x41
mov ecx, dword [esi + 0x2e664]
imul ecx, ecx, 0x360
mov dword [ecx + esi + 0x2cdb0], eax
mov edx, dword [esi + 0x2e664]
imul edx, edx, 0x360
mov ecx, dword [edx + esi + 0x2cdb0]
lea eax, [edx + esi]
push ecx
lea edx, [edi + 0x194]
push edx
add eax, 0x2cd6e
push eax
call sub.msvcrt.dll_memcpy
mov eax, dword [esi + 0x2e664]
mov ecx, dword [edi + 0x1a0]
imul eax, eax, 0x360
mov dword [eax + esi + 0x2cec0], ecx
mov eax, dword [esi + 0x2e664]
imul eax, eax, 0x360
push 0x3f
lea edx, [edi + 0x1b0]
push edx
lea ecx, [eax + esi + 0x2cdb4]
push ecx
call ebx
mov eax, dword [esi + 0x2e664]
imul eax, eax, 0x360
push 0x3f
lea edx, [edi + 0x1c0]
push edx
lea ecx, [eax + esi + 0x2cdf5]
push ecx
call ebx
mov eax, dword [esi + 0x2e664]
imul eax, eax, 0x360
push 0x3f
lea edx, [edi + 0x1d8]
push edx
lea ecx, [eax + esi + 0x2ce36]
push ecx
call ebx
add esp, 0x30
cmp dword [edi + 0x1a4], 0
je 0x1078084
mov edx, dword [esi + 0x2e664]
imul edx, edx, 0x360
mov dword [edx + esi + 0x2ce78], 1
mov ecx, dword [esi + 0x2e664]
imul ecx, ecx, 0x360
push 0x3f
lea eax, [edi + 0x200]
push eax
lea edx, [ecx + esi + 0x2ce7c]
push edx
call ebx
add esp, 0xc
inc dword [esi + 0x2e664]
mov edi, dword [edi]
test edi, edi
jne 0x1077f30
mov edi, dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.DLL_GetProcessHeap]
push edi
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.DLL_HeapFree]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x1078640
Capabilities:
List user accounts

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 8], edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 0xc], edi
lea eax, [ebp - 0xc]
push eax
lea ecx, [ebp - 0x10]
push ecx
lea edx, [ebp - 8]
push edx
push 0xffffffffffffffff
lea eax, [ebp - 4]
push eax
push 2
push 2
push edi
call sub.NETAPI32.dll_NetUserEnum
mov ebx, eax
cmp ebx, edi
je 0x1078680
cmp ebx, 0xea
jne 0x10786b9
mov eax, dword [ebp - 4]
cmp eax, edi
je 0x10786cd
cmp dword [ebp - 8], edi
jbe 0x10786bc
lea esi, [eax + 0x24]
nop
mov ecx, dword [esi - 0x18]
mov edx, dword [esi]
mov eax, dword [esi + 0x10]
push ecx
mov ecx, dword [esi + 0x2c]
push edx
mov edx, dword [esi - 0x1c]
push eax
mov eax, dword [esi - 0x24]
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
push ecx
call fcn.010785b0
inc edi
add esi, 0x60
cmp edi, dword [ebp - 8]
jb 0x1078690
mov eax, dword [ebp - 4]
xor edi, edi
cmp eax, edi
je 0x10786cd
push eax
call sub.NETAPI32.dll_NetApiBufferFree
xor eax, eax
mov dword [ebp - 4], eax
cmp ebx, 0xea
je 0x1078656
cmp eax, edi
pop edi
pop esi
pop ebx
je 0x10786e2
push eax
call sub.NETAPI32.dll_NetApiBufferFree
mov esp, ebp
pop ebp
ret 4
Function at 0x1079c00
Capabilities:
Write file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x74
mov eax, dword [ebp + 8]
push esi
push eax
call dword [sym.imp.USER32.dll_GetWindowDC]
mov esi, eax
mov dword [ebp - 8], esi
test esi, esi
je 0x1079d6b
push ebx
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ebx, eax
test ebx, ebx
je 0x1079d5f
push edi
push 0
push 0
mov ecx, 1
mov word [ebp - 0x3c], cx
mov edx, 0x18
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0x48], 0x28
mov dword [ebp - 0x44], 0x2a6
mov dword [ebp - 0x40], 0x1c2
mov word [ebp - 0x3a], dx
mov dword [ebp - 0x38], 0
mov dword [ebp - 0x34], 0xdfae8
mov ecx, 0xa
lea esi, [ebp - 0x48]
lea edi, [ebp - 0x74]
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp - 8]
push 0
lea ecx, [ebp - 0x74]
push ecx
push esi
call dword [sym.imp.GDI32.dll_CreateDIBSection]
test eax, eax
je 0x1079d54
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push 0xcc0020
push 0
push 0
push esi
push 0x1c2
push 0x2a6
push 0
push 0
push ebx
mov dword [ebp - 0x10], eax
call dword [sym.imp.GDI32.dll_BitBlt]
mov eax, dword [ebp - 0x40]
imul eax, dword [ebp - 0x44]
mov ecx, dword [ebp + 0xc]
push 0
push 0x80
push 2
push 0
add eax, 0x12
push 0
lea edx, [eax + eax*2]
push 0x40000000
mov eax, 0x4d42
push ecx
mov dword [ebp - 0x16], 0x36
mov dword [ebp - 0x1e], edx
mov word [ebp - 0x20], ax
call dword [sym.imp.KERNEL32.DLL_CreateFileW]
mov esi, eax
test esi, esi
je 0x1079d42
cmp esi, 0xffffffff
je 0x1079d42
mov edi, dword [sym.imp.KERNEL32.DLL_WriteFile]
push 0
lea edx, [ebp - 4]
push edx
push 0xe
lea eax, [ebp - 0x20]
push eax
push esi
call edi
push 0
lea ecx, [ebp - 4]
push ecx
push 0x28
lea edx, [ebp - 0x48]
push edx
push esi
call edi
mov ecx, dword [ebp - 0x34]
mov edx, dword [ebp - 0xc]
push 0
lea eax, [ebp - 4]
push eax
push ecx
push edx
push esi
call edi
push esi
call dword [sym.imp.KERNEL32.DLL_CloseHandle]
mov eax, dword [ebp - 0x10]
push eax
push ebx
call dword [sym.imp.GDI32.dll_SelectObject]
push eax
call dword [sym.imp.GDI32.dll_DeleteObject]
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
mov esi, dword [ebp - 8]
pop edi
mov ecx, dword [ebp + 8]
push esi
push ecx
call dword [sym.imp.USER32.dll_ReleaseDC]
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 8
Function at 0x107bd40
Capabilities:
Log keystrokes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
mov ebx, dword [sym.imp.USER32.dll_ShowWindow]
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi + 0xc]
push edi
push 5
push eax
call ebx
mov edi, dword [esi + 0xc]
push edi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x107bd6c
push 9
push edi
call ebx
push 0x13
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [esi + 0xc]
mov edx, dword [esi]
push ecx
add edx, 0x2c608
push edx
call dword [sym.imp.KERNEL32.DLL_InterlockedExchange]
mov esi, dword [esi + 0xc]
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov ebx, eax
cmp ebx, esi
je 0x107bddf
lea eax, [ebp + 8]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 0
push ebx
mov edi, eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push 1
mov ebx, eax
push ebx
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
test eax, eax
je 0x107bddf
push esi
call dword [sym.imp.USER32.dll_SetForegroundWindow]
push esi
call dword [sym.imp.USER32.dll_SetFocus]
push 0
push ebx
push edi
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx + 8]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x107be00
Capabilities:
Hide graphical window

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0
push 0
push 0xf
push esi
call fcn.0105ce00
mov eax, dword [esi + 0xc]
mov edi, dword [sym.imp.USER32.dll_ShowWindow]
push 5
push eax
call edi
mov esi, dword [esi + 0xc]
push esi
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x107be37
push 9
push esi
call edi
push 0x13
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push esi
call dword [sym.imp.USER32.dll_SetWindowPos]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ecx]
mov eax, dword [edx + 0x1c]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
pop edi
pop esi
pop ebp
ret 8

Function at 0x107e160
Capabilities:
Encode data using xor

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
test esi, esi
je 0x107e1a6
cmp byte [esi], 0
je 0x107e1a6
mov ecx, esi
push edi
mov edx, esi
lea edi, [ecx + 1]
lea ebx, [ebx]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x107e180
sub ecx, edi
lea ecx, [ecx + esi - 1]
pop edi
cmp ecx, esi
jbe 0x107e1a6
push ebx
mov al, byte [ecx]
xor byte [edx], al
mov bl, byte [edx]
xor byte [ecx], bl
mov bl, byte [ecx]
xor byte [edx], bl
inc edx
dec ecx
cmp ecx, edx
ja 0x107e193
pop ebx
mov eax, esi
pop esi
pop ebp
ret 4