joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4f1cf0
Capabilities:
Log keystrokes

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
mov esi, ecx
mov eax, dword [esi]
push edi
call dword [eax + 0x150]
mov edi, eax
movzx eax, word [ebp + 8]
push 2
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyW]
cmp byte [ebp + 0xc], 0
movzx eax, ax
jne 0x4f1d35
test edi, edi
jl 0x4f1d35
cmp ax, 0x20
je 0x4f1d2a
cmp word [ebp + 8], 0x71
jne 0x4f1d35
mov eax, dword [esi]
push edi
mov ecx, esi
call dword [eax + 0x168]
pop edi
pop esi
pop ebp
ret 8

Function at 0x4f6f4f
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x56e19c]
jne 0x4f6f59
repz ret
jmp fcn.004fe9a6

Function at 0x502d9a
Capabilities:
Contain obfuscated stackstrings

Disassembly:
shl eax, 3
sub eax, dword [ebp + 0x10]
add eax, esi
mov dword [ebp - 0xb4], eax
mov dword [ebp - 8], eax
call fcn.00502b7e
aam 0xd
or byte [edi + 0x66], dl
mov eax, dword [edi + 6]
cmp ax, bx
jbe 0x502dd8
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x502dd2
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x502dc3
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
mov byte [ebp - 0x4a], 0xc9
leave
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.00502b7e
fdivr dword [ebx + 0x458d9d86]
test al, 0x50
call fcn.00502b8e
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00502b43
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x502e6c
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00502b7e
mov ch, 0xc6
invalid

Function at 0x502f9c
Capabilities:
Contain obfuscated stackstrings

Disassembly:
aam 0x88
pop ebp
aam 0x50
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
invalid
inc ebp
Function at 0x50cfb8
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.004fe30a
and dword [ebp - 4], 0
cmp dword [0x57566c], 0
mov ebx, eax
jne 0x50d069
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x50d11a
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x50d11a
push eax
call fcn.004fe298
mov dword [esp], 0x54ee74
push edi
mov dword [0x57566c], eax
call esi
push eax
call fcn.004fe298
mov dword [esp], 0x54ee60
push edi
mov dword [0x575670], eax
call esi
push eax
call fcn.004fe298
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x575674], eax
call esi
push eax
call fcn.004fe298
pop ecx
mov dword [0x57567c], eax
test eax, eax
je 0x50d069
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004fe298
pop ecx
mov dword [0x575678], eax
mov eax, dword [0x575678]
cmp eax, ebx
je 0x50d0c1
cmp dword [0x57567c], ebx
je 0x50d0c1
push eax
call fcn.004fe313
push dword [0x57567c]
mov esi, eax
call fcn.004fe313
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x50d0c1
test edi, edi
je 0x50d0c1
call esi
test eax, eax
je 0x50d0b8
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x50d0b8
test byte [ebp - 0xc], 1
jne 0x50d0c1
or dword [ebp + 0x10], 0x200000
jmp 0x50d0fa
mov eax, dword [0x575670]
cmp eax, ebx
je 0x50d0fa
push eax
call fcn.004fe313
pop ecx
test eax, eax
je 0x50d0fa
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x50d0fa
mov eax, dword [0x575674]
cmp eax, ebx
je 0x50d0fa
push eax
call fcn.004fe313
pop ecx
test eax, eax
je 0x50d0fa
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x57566c]
call fcn.004fe313
pop ecx
test eax, eax
je 0x50d11a
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x50d11c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4039c1
Capabilities:
Encode data using xor

Disassembly:
add byte [ebx - 0x7a2f080e], cl
div byte [ebp - 0x73]
movsb byte es:[edi], byte [esi]
and al, 0
add byte [ebp], cl
add cl, al
add esi, dword [ecx + ebx + 0xf]
mov dh, 0x11
xor edx, eax
and edx, 0xc100ff
add al, ch
or byte [ebx], dh
add al, 0x95
or byte [ebx + ebx*4], dh
add byte [ecx + 0x4e], al
jne 0x403711
loop 0x403731
add dh, bh
and byte [edi], cl
or byte [ebx], 2
add byte [eax], al
mov edi, esi
shr edi, 5
cld
add byte [eax], al
add dword [ebx + 0x10eac1d0], ecx
mov ebx, eax
shr ebx, 8
and ebx, 0xf
and edx, 0xff
mov edx, dword [edx*4 + 0x7d9b3808]
add byte [eax], al
popfd
or byte [ebx + ebx*4], bh
add byte [ebx + 0x18ebc1d8], cl
xor edx, dword [ebx*4 + 0xc2]
and eax, 0xff
xor edx, dword [eax*4 + 0x9b4008]
adc al, byte [eax]
add byte [ebx + 0x10e8c1c2], cl
and eax, 0xff
mov eax, dword [eax*4 + 0x75]
mov ebx, edx
shr ebx, 8
and ebx, 0xff
xor edi, dword [ecx]
add byte [eax], al
cmp al, 0x9b
add byte [ebx + 0x18ebc1da], cl
xor eax, dword [ebx*4 + 0x303408]
add dl, ah
inc dword [eax]
add byte [eax], al
xor eax, dword [edx*4 + 0x9b4008]
xor esp, dword [0xc1d00000]
ljmp 0x8eb
add byte [ebx + 0xc4d8bec], cl
test ecx, ecx
jne 0x4039cf
xor eax, eax
pop ebp
ret
push es
add byte [eax], al
mov eax, dword [ebp + 8]
pop ebp
jmp 0x403701

Function at 0x44e641
Capabilities:
Encode data using xor

Disassembly:
add byte [ebx - 0x7a2f080e], cl
div byte [ebp - 0x73]
movsb byte es:[edi], byte [esi]
and al, 0
add byte [ebp], cl
add cl, al
add esi, dword [ecx + ebx + 0xf]
mov dh, 0x11
xor edx, eax
and edx, 0xc100ff
add al, ch
or byte [ebx], dh
add al, 0x95
or byte [ebx + ebx*4], dh
add byte [ecx + 0x4e], al
jne 0x44e391
loop 0x44e3b1
add dh, bh
and byte [edi], cl
or byte [ebx], 2
add byte [eax], al
mov edi, esi
shr edi, 5
cld
add byte [eax], al
add dword [ebx + 0x10eac1d0], ecx
mov ebx, eax
shr ebx, 8
and ebx, 0xf
and edx, 0xff
mov edx, dword [edx*4 + 0x7d9b3808]
add byte [eax], al
popfd
or byte [ebx + ebx*4], bh
add byte [ebx + 0x18ebc1d8], cl
xor edx, dword [ebx*4 + 0xc2]
and eax, 0xff
xor edx, dword [eax*4 + 0x9b4008]
adc al, byte [eax]
add byte [ebx + 0x10e8c1c2], cl
and eax, 0xff
mov eax, dword [eax*4 + 0x75]
mov ebx, edx
shr ebx, 8
and ebx, 0xff
xor edi, dword [ecx]
add byte [eax], al
cmp al, 0x9b
add byte [ebx + 0x18ebc1da], cl
xor eax, dword [ebx*4 + 0x303408]
add dl, ah
inc dword [eax]
add byte [eax], al
xor eax, dword [edx*4 + 0x9b4008]
xor esp, dword [0xc1d00000]
ljmp 0x8eb
add byte [ebx + 0xc4d8bec], cl
test ecx, ecx
jne 0x44e64f
xor eax, eax
pop ebp
ret
push es
add byte [eax], al
mov eax, dword [ebp + 8]
pop ebp
jmp 0x44e381
Function at 0x499081
Capabilities:
Encode data using xor

Disassembly:
add byte [ebx - 0x7a2f080e], cl
div byte [ebp - 0x73]
movsb byte es:[edi], byte [esi]
and al, 0
add byte [ebp], cl
add cl, al
add esi, dword [ecx + ebx + 0xf]
mov dh, 0x11
xor edx, eax
and edx, 0xc100ff
add al, ch
or byte [ebx], dh
add al, 0x95
or byte [ebx + ebx*4], dh
add byte [ecx + 0x4e], al
jne 0x498dd1
loop 0x498df1
add dh, bh
and byte [edi], cl
or byte [ebx], 2
add byte [eax], al
mov edi, esi
shr edi, 5
cld
add byte [eax], al
add dword [ebx + 0x10eac1d0], ecx
mov ebx, eax
shr ebx, 8
and ebx, 0xf
and edx, 0xff
mov edx, dword [edx*4 + 0x7d9b3808]
add byte [eax], al
popfd
or byte [ebx + ebx*4], bh
add byte [ebx + 0x18ebc1d8], cl
xor edx, dword [ebx*4 + 0xc2]
and eax, 0xff
xor edx, dword [eax*4 + 0x9b4008]
adc al, byte [eax]
add byte [ebx + 0x10e8c1c2], cl
and eax, 0xff
mov eax, dword [eax*4 + 0x75]
mov ebx, edx
shr ebx, 8
and ebx, 0xff
xor edi, dword [ecx]
add byte [eax], al
cmp al, 0x9b
add byte [ebx + 0x18ebc1da], cl
xor eax, dword [ebx*4 + 0x303408]
add dl, ah
inc dword [eax]
add byte [eax], al
xor eax, dword [edx*4 + 0x9b4008]
xor esp, dword [0xc1d00000]
ljmp 0x8eb
add byte [ebx + 0xc4d8bec], cl
test ecx, ecx
jne 0x49908f
xor eax, eax
pop ebp
ret
push es
add byte [eax], al
mov eax, dword [ebp + 8]
pop ebp
jmp 0x498dc1

Function at 0x4e3cd1
Capabilities:
Encode data using xor

Disassembly:
add byte [ebx - 0x7a2f080e], cl
div byte [ebp - 0x73]
movsb byte es:[edi], byte [esi]
and al, 0
add byte [ebp], cl
add cl, al
add esi, dword [ecx + ebx + 0xf]
mov dh, 0x11
xor edx, eax
and edx, 0xc100ff
add al, ch
or byte [ebx], dh
add al, 0x95
or byte [ebx + ebx*4], dh
add byte [ecx + 0x4e], al
jne 0x4e3a21
loop 0x4e3a41
add dh, bh
and byte [edi], cl
or byte [ebx], 2
add byte [eax], al
mov edi, esi
shr edi, 5
cld
add byte [eax], al
add dword [ebx + 0x10eac1d0], ecx
mov ebx, eax
shr ebx, 8
and ebx, 0xf
and edx, 0xff
mov edx, dword [edx*4 + 0x7d9b3808]
add byte [eax], al
popfd
or byte [ebx + ebx*4], bh
add byte [ebx + 0x18ebc1d8], cl
xor edx, dword [ebx*4 + 0xc2]
and eax, 0xff
xor edx, dword [eax*4 + 0x9b4008]
adc al, byte [eax]
add byte [ebx + 0x10e8c1c2], cl
and eax, 0xff
mov eax, dword [eax*4 + 0x75]
mov ebx, edx
shr ebx, 8
and ebx, 0xff
xor edi, dword [ecx]
add byte [eax], al
cmp al, 0x9b
add byte [ebx + 0x18ebc1da], cl
xor eax, dword [ebx*4 + 0x303408]
add dl, ah
inc dword [eax]
add byte [eax], al
xor eax, dword [edx*4 + 0x9b4008]
xor esp, dword [0xc1d00000]
ljmp 0x8eb
add byte [ebx + 0xc4d8bec], cl
test ecx, ecx
jne 0x4e3cdf
xor eax, eax
pop ebp
ret
push es
add byte [eax], al
mov eax, dword [ebp + 8]
pop ebp
jmp 0x4e3a11
Function at 0x52e691
Capabilities:
Encode data using xor

Disassembly:
add byte [ebx - 0x7a2f080e], cl
div byte [ebp - 0x73]
movsb byte es:[edi], byte [esi]
and al, 0
add byte [ebp], cl
add cl, al
add esi, dword [ecx + ebx + 0xf]
mov dh, 0x11
xor edx, eax
and edx, 0xc100ff
add al, ch
or byte [ebx], dh
add al, 0x95
or byte [ebx + ebx*4], dh
add byte [ecx + 0x4e], al
jne 0x52e3e1
loop 0x52e401
add dh, bh
and byte [edi], cl
or byte [ebx], 2
add byte [eax], al
mov edi, esi
shr edi, 5
cld
add byte [eax], al
add dword [ebx + 0x10eac1d0], ecx
mov ebx, eax
shr ebx, 8
and ebx, 0xf
and edx, 0xff
mov edx, dword [edx*4 + 0x7d9b3808]
add byte [eax], al
popfd
or byte [ebx + ebx*4], bh
add byte [ebx + 0x18ebc1d8], cl
xor edx, dword [ebx*4 + 0xc2]
and eax, 0xff
xor edx, dword [eax*4 + 0x9b4008]
adc al, byte [eax]
add byte [ebx + 0x10e8c1c2], cl
and eax, 0xff
mov eax, dword [eax*4 + 0x75]
mov ebx, edx
shr ebx, 8
and ebx, 0xff
xor edi, dword [ecx]
add byte [eax], al
cmp al, 0x9b
add byte [ebx + 0x18ebc1da], cl
xor eax, dword [ebx*4 + 0x303408]
add dl, ah
inc dword [eax]
add byte [eax], al
xor eax, dword [edx*4 + 0x9b4008]
xor esp, dword [0xc1d00000]
ljmp 0x8eb
add byte [ebx + 0xc4d8bec], cl
test ecx, ecx
jne 0x52e69f
xor eax, eax
pop ebp
ret
push es
add byte [eax], al
mov eax, dword [ebp + 8]
pop ebp
jmp 0x52e3d1

Function at 0x579441
Capabilities:
Encode data using xor

Disassembly:
add byte [ebx - 0x7a2f080e], cl
div byte [ebp - 0x73]
movsb byte es:[edi], byte [esi]
and al, 0
add byte [ebp], cl
add cl, al
add esi, dword [ecx + ebx + 0xf]
mov dh, 0x11
xor edx, eax
and edx, 0xc100ff
add al, ch
or byte [ebx], dh
add al, 0x95
or byte [ebx + ebx*4], dh
add byte [ecx + 0x4e], al
jne 0x579191
loop 0x5791b1
add dh, bh
and byte [edi], cl
or byte [ebx], 2
add byte [eax], al
mov edi, esi
shr edi, 5
cld
add byte [eax], al
add dword [ebx + 0x10eac1d0], ecx
mov ebx, eax
shr ebx, 8
and ebx, 0xf
and edx, 0xff
mov edx, dword [edx*4 + 0x7d9b3808]
add byte [eax], al
popfd
or byte [ebx + ebx*4], bh
add byte [ebx + 0x18ebc1d8], cl
xor edx, dword [ebx*4 + 0xc2]
and eax, 0xff
xor edx, dword [eax*4 + 0x9b4008]
adc al, byte [eax]
add byte [ebx + 0x10e8c1c2], cl
and eax, 0xff
mov eax, dword [eax*4 + 0x75]
mov ebx, edx
shr ebx, 8
and ebx, 0xff
xor edi, dword [ecx]
add byte [eax], al
cmp al, 0x9b
add byte [ebx + 0x18ebc1da], cl
xor eax, dword [ebx*4 + 0x303408]
add dl, ah
inc dword [eax]
add byte [eax], al
xor eax, dword [edx*4 + 0x9b4008]
xor esp, dword [0xc1d00000]
ljmp 0x8eb
add byte [ebx + 0xc4d8bec], cl
test ecx, ecx
jne 0x57944f
xor eax, eax
pop ebp
ret
push es
add byte [eax], al
mov eax, dword [ebp + 8]
pop ebp
jmp 0x579181
Function at 0x5c4b11
Capabilities:
Encode data using xor

Disassembly:
add byte [ebx - 0x7a2f080e], cl
div byte [ebp - 0x73]
movsb byte es:[edi], byte [esi]
and al, 0
add byte [ebp], cl
add cl, al
add esi, dword [ecx + ebx + 0xf]
mov dh, 0x11
xor edx, eax
and edx, 0xc100ff
add al, ch
or byte [ebx], dh
add al, 0x95
or byte [ebx + ebx*4], dh
add byte [ecx + 0x4e], al
jne 0x5c4861
loop 0x5c4881
add dh, bh
and byte [edi], cl
or byte [ebx], 2
add byte [eax], al
mov edi, esi
shr edi, 5
cld
add byte [eax], al
add dword [ebx + 0x10eac1d0], ecx
mov ebx, eax
shr ebx, 8
and ebx, 0xf
and edx, 0xff
mov edx, dword [edx*4 + 0x7d9b3808]
add byte [eax], al
popfd
or byte [ebx + ebx*4], bh
add byte [ebx + 0x18ebc1d8], cl
xor edx, dword [ebx*4 + 0xc2]
and eax, 0xff
xor edx, dword [eax*4 + 0x9b4008]
adc al, byte [eax]
add byte [ebx + 0x10e8c1c2], cl
and eax, 0xff
mov eax, dword [eax*4 + 0x75]
mov ebx, edx
shr ebx, 8
and ebx, 0xff
xor edi, dword [ecx]
add byte [eax], al
cmp al, 0x9b
add byte [ebx + 0x18ebc1da], cl
xor eax, dword [ebx*4 + 0x303408]
add dl, ah
inc dword [eax]
add byte [eax], al
xor eax, dword [edx*4 + 0x9b4008]
xor esp, dword [0xc1d00000]
ljmp 0x8eb
add byte [ebx + 0xc4d8bec], cl
test ecx, ecx
jne 0x5c4b1f
xor eax, eax
pop ebp
ret
push es
add byte [eax], al
mov eax, dword [ebp + 8]
pop ebp
jmp 0x5c4851

Function at 0x60f991
Capabilities:
Encode data using xor

Disassembly:
add byte [ebx - 0x7a2f080e], cl
div byte [ebp - 0x73]
movsb byte es:[edi], byte [esi]
and al, 0
add byte [ebp], cl
add cl, al
add esi, dword [ecx + ebx + 0xf]
mov dh, 0x11
xor edx, eax
and edx, 0xc100ff
add al, ch
or byte [ebx], dh
add al, 0x95
or byte [ebx + ebx*4], dh
add byte [ecx + 0x4e], al
jne 0x60f6e1
loop 0x60f701
add dh, bh
and byte [edi], cl
or byte [ebx], 2
add byte [eax], al
mov edi, esi
shr edi, 5
cld
add byte [eax], al
add dword [ebx + 0x10eac1d0], ecx
mov ebx, eax
shr ebx, 8
and ebx, 0xf
and edx, 0xff
mov edx, dword [edx*4 + 0x7d9b3808]
add byte [eax], al
popfd
or byte [ebx + ebx*4], bh
add byte [ebx + 0x18ebc1d8], cl
xor edx, dword [ebx*4 + 0xc2]
and eax, 0xff
xor edx, dword [eax*4 + 0x9b4008]
adc al, byte [eax]
add byte [ebx + 0x10e8c1c2], cl
and eax, 0xff
mov eax, dword [eax*4 + 0x75]
mov ebx, edx
shr ebx, 8
and ebx, 0xff
xor edi, dword [ecx]
add byte [eax], al
cmp al, 0x9b
add byte [ebx + 0x18ebc1da], cl
xor eax, dword [ebx*4 + 0x303408]
add dl, ah
inc dword [eax]
add byte [eax], al
xor eax, dword [edx*4 + 0x9b4008]
xor esp, dword [0xc1d00000]
ljmp 0x8eb
add byte [ebx + 0xc4d8bec], cl
test ecx, ecx
jne 0x60f99f
xor eax, eax
pop ebp
ret
push es
add byte [eax], al
mov eax, dword [ebp + 8]
pop ebp
jmp 0x60f6d1
Function at 0x10008ec0
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x10090f9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.10085fdf
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x10008f42
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.10083ef1
mov eax, dword [eax]
push 0x100afc58
push eax
call fcn.10076194
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.1008626a
test bl, bl
je 0x10008f42
push 0x100afc58
lea ecx, [esp + 0xc]
call fcn.100865fa
push 0x100afc64
lea ecx, [esp + 0xc]
call fcn.100865fa
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x10008f7e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.1008626a
jmp 0x10009049
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x10009002
lea edx, [esp + 0x7c]
push 0x100afc60
push edx
call fcn.10076194
add esp, 8
test eax, eax
je 0x10009002
lea eax, [esp + 0x7c]
push 0x100afc5c
push eax
call fcn.10076194
add esp, 8
test eax, eax
je 0x10009002
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10008f92
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.1008626a
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x10009840
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x100098a2
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x100098b0
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x1009101b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x100c06a8]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x100099e8
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x10009916
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.1008626a
xor eax, eax
jmp 0x10009a5f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.100863a7
push esi
lea ecx, [esp + 0xc]
call fcn.10086636
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x10009a3d
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.10009840
test eax, eax
jne 0x10009a3d
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.10009840
test eax, eax
jne 0x10009a3d
lea eax, [esp + 0x14]
push str.__1_
push eax
call fcn.10077210
mov esi, eax
add esp, 8
test esi, esi
jne 0x10009a1c
lea ecx, [esp + 0x14]
push 0x100afc70
push ecx
call fcn.10077190
mov esi, eax
add esp, 8
test esi, esi
jne 0x10009a1c
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x10009a1f
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.10086357
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x1000992e
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.1008626a
xor eax, eax
jmp 0x10009a5f
mov byte [esi], 0
push 0x100afc6c
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.1008626a
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x10018e30
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x10018e9e
cmp si, 0x69
ja 0x10018e9e
add esi, 0xffd0
cmp si, 0x11
je 0x10018e6e
push 0x11
call edi
test ax, ax
jge 0x10018e6e
or esi, 0x2000
cmp si, 0x10
je 0x10018e83
push 0x10
call edi
test ax, ax
jge 0x10018e83
or esi, 0x4000
cmp si, 0x12
je 0x10018e98
push 0x12
call edi
test ax, ax
jge 0x10018e98
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x10018eab
mov esi, 0xbd
jmp 0x10018e5f
cmp si, 0x6e
jne 0x10018eb8
mov esi, 0xbe
jmp 0x10018e5f
cmp si, 0x6f
jne 0x10018e59
mov esi, 0xbf
jmp 0x10018e5f

Function at 0x1001a680
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x100d0e20]
xor edx, edx
cmp eax, edx
jne 0x1001a6a6
xor eax, eax
mov byte [eax + 0x100d0d20], al
inc eax
cmp eax, 0x100
jl 0x1001a68e
mov dword [0x100d0e20], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x100d0d20
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x1001a737
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x1001a70a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x1001a6d8
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x1001a740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x1001a793
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x1001a77a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret