joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000cad0
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x10019e78
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x2c]
push ebp
push esi
mov al, byte [ebx]
mov dword [esp + 0xc], ecx
push edi
push eax
lea ecx, [esp + 0x18]
call fcn.1000c280
lea ecx, [ebx + 1]
add ebx, 0xd
mov dword [esp + 0x30], 0
mov esi, dword [ecx]
mov dword [esp + 0x1c], esi
mov eax, dword [ecx + 4]
mov dword [esp + 0x20], eax
mov ecx, dword [ecx + 8]
test ecx, ecx
jbe 0x1000cbfe
test eax, eax
jbe 0x1000cbfe
test esi, esi
jle 0x1000cb94
lea edi, [esi + 1]
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, edi
mov ebp, eax
mov edx, ecx
xor eax, eax
mov edi, ebp
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebp
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, esi
mov esi, ebx
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
call fcn.1000c340
test eax, eax
jne 0x1000cb81
mov ecx, dword [esp + 0x10]
call fcn.1000c520
jmp 0x1000cbfe
mov edx, dword [esp + 0x1c]
push ebp
add ebx, edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [esp + 0x24]
add esp, 4
lea esi, [eax + 1]
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, esi
mov ebp, eax
mov edx, ecx
xor eax, eax
mov edi, ebp
mov esi, ebx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
and ecx, 3
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x24]
mov edi, ebp
mov ecx, eax
add ebx, eax
mov edx, ecx
push ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.1000ca90
add esp, 8
lea ecx, [esp + 0x14]
push eax
push ebp
call fcn.1000c3e0
mov ecx, dword [esp + 0x10]
test eax, eax
je 0x1000cbf0
call fcn.1000c540
jmp 0x1000cbf5
call fcn.1000c520
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.1000c2e0
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 4
Function at 0x1000cc30
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x10019e98
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
push ebx
mov ebx, dword [esp + 0x2c]
push ebp
push esi
mov al, byte [ebx]
mov dword [esp + 0xc], ecx
push edi
push eax
lea ecx, [esp + 0x18]
call fcn.1000c280
lea ecx, [ebx + 1]
add ebx, 0xd
mov dword [esp + 0x30], 0
mov esi, dword [ecx]
mov dword [esp + 0x1c], esi
mov ebp, dword [ecx + 4]
mov dword [esp + 0x20], ebp
mov eax, dword [ecx + 8]
test eax, eax
jbe 0x1000cd5a
test ebp, ebp
jbe 0x1000cd5a
test esi, esi
jle 0x1000ccf4
lea edi, [esi + 1]
push edi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov ecx, edi
mov ebp, eax
mov edx, ecx
xor eax, eax
mov edi, ebp
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
push ebp
and ecx, 3
rep stosb byte es:[edi], al
mov ecx, esi
mov esi, ebx
mov eax, ecx
mov edi, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
call fcn.1000c340
test eax, eax
jne 0x1000cce1
mov ecx, dword [esp + 0x10]
call fcn.1000c520
jmp 0x1000cd5a
mov edx, dword [esp + 0x1c]
push ebp
add ebx, edx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov ebp, dword [esp + 0x24]
add esp, 4
lea esi, [ebp + 1]
push esi
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
mov edx, eax
mov ecx, esi
xor eax, eax
mov edi, edx
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, esi
mov esi, ebx
and ecx, 3
add esp, 4
rep stosb byte es:[edi], al
mov ecx, ebp
mov edi, edx
mov eax, ecx
add ebx, ebp
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x1c]
mov dword [esp + 0x40], edx
call fcn.1000c450
mov ecx, dword [esp + 0x10]
test eax, eax
je 0x1000cd48
call fcn.1000c540
jmp 0x1000cd4d
call fcn.1000c520
mov ecx, dword [esp + 0x38]
push ecx
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
lea ecx, [esp + 0x14]
mov dword [esp + 0x30], 0xffffffff
call fcn.1000c2e0
mov ecx, dword [esp + 0x28]
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x24
ret 4
Function at 0x1000cd80
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x10019ece
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
mov eax, dword [esp + 0x54]
push ebx
push ebp
push esi
push edi
mov esi, ecx
push eax
mov dword [esp + 0x14], esi
call fcn.1000bae0
mov dword [esp + 0x5c], 0
mov dword [esi + 0x24], 0x1001b34c
mov dword [esp + 0x14], 0x7f8a
mov dword [esp + 0x18], 0x7f00
mov dword [esp + 0x1c], 0x7f03
mov dword [esp + 0x20], 0x7f89
mov dword [esp + 0x24], 0x7f8b
mov dword [esp + 0x28], 0x7f01
mov dword [esp + 0x2c], 0x7f81
mov dword [esp + 0x30], 0x7f88
mov dword [esp + 0x34], 0x7f80
mov dword [esp + 0x38], 0x7f86
mov dword [esp + 0x3c], 0x7f83
mov dword [esp + 0x40], 0x7f85
mov dword [esp + 0x44], 0x7f82
mov dword [esp + 0x48], 0x7f84
mov dword [esp + 0x4c], 0x7f04
mov dword [esp + 0x50], 0x7f02
lea ebp, [esp + 0x14]
lea edi, [esi + 0x68]
mov ebx, 0x10
mov eax, dword [ebp]
push eax
push 0
mov dword [edi - 0x40], eax
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [edi], eax
add ebp, 4
add edi, 4
dec ebx
jne 0x1000ce47
mov ebx, 1
push 0x110
mov byte [esp + 0x60], bl
mov dword [esi], 0x1001b344
mov byte [esi + 0x13], bl
mov dword [esi + 0x18], 8
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [esp + 0x64], eax
test eax, eax
mov byte [esp + 0x5c], 2
je 0x1000cea3
push 0x64
push 0
push 8
mov ecx, eax
call fcn.1000dc60
jmp 0x1000cea5
xor eax, eax
push ebx
push 0
push 0
push esi
push 0x1000d670
push 0
push 0
mov byte [esp + 0x78], bl
mov dword [esi + 0xa8], eax
mov byte [esi + 0x10], bl
mov byte [esi + 0x12], 0
mov byte [esi + 0x11], 0
mov byte [esi + 0x14], 0
call fcn.1000ff60
push ebx
push 0
push 0
push esi
push 0x1000d6e0
push 0
push 0
mov dword [esi + 0x1c], eax
call fcn.1000ff60
mov ecx, dword [esp + 0x8c]
add esp, 0x38
mov dword [esi + 0x20], eax
mov eax, esi
pop edi
pop esi
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x50
ret 4
Function at 0x1000d060
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10019ef3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x18], esi
mov dword [esi], 0x1001b344
mov edi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push str.CloseHandle
push str.KERNEL32.dll
mov dword [ebp - 4], 1
call edi
mov ebx, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.WaitForSingleObject
push str.KERNEL32.dll
mov dword [ebp - 0x14], eax
call edi
push eax
call ebx
push str.InterlockedExchange
push str.KERNEL32.dll
mov dword [ebp - 0x10], eax
call edi
push eax
call ebx
mov ebx, eax
lea eax, [esi + 0x12]
push 0
push eax
call ebx
lea ecx, [esi + 0x10]
push 0
push ecx
call ebx
mov edx, dword [esi + 0x1c]
mov ebx, dword [ebp - 0x10]
push 0xffffffffffffffff
push edx
call ebx
mov eax, dword [esi + 0x20]
push 0xffffffffffffffff
push eax
call ebx
mov ecx, dword [esi + 0x1c]
mov ebx, dword [ebp - 0x14]
push ecx
call ebx
mov edx, dword [esi + 0x20]
push edx
call ebx
mov ecx, dword [esi + 0xa8]
test ecx, ecx
je 0x1000d113
mov eax, dword [ecx]
push 1
call dword [eax]
push str.User32.dll
mov byte [ebp - 4], 0
mov dword [esi + 0x24], 0x1001b34c
call edi
mov dword [ebp - 0x10], eax
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov ecx, dword [ebp - 0x10]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DestroyCursor
push ecx
call esi
push str.FreeLibrary
push str.KERNEL32.dll
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call esi
mov dword [ebp - 0x1c], eax
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov ebx, dword [ebp - 0x18]
mov edi, 0x10
lea esi, [ebx + 0x68]
mov edx, dword [esi]
push edx
call dword [ebp - 0x14]
add esi, 4
dec edi
jne 0x1000d17b
mov eax, dword [ebp - 0x10]
push eax
call dword [ebp - 0x1c]
mov ecx, ebx
mov dword [ebp - 4], 0xffffffff
call fcn.1000bbe0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d880
Capabilities:
Log keystrokes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
xor edx, edx
mov ecx, 0x1c
div ecx
test edx, edx
jne 0x1000da31
call fcn.10010410
mov eax, 0x24924925
mul esi
sub esi, edx
shr esi, 1
add esi, edx
shr esi, 4
test esi, esi
jle 0x1000da31
mov edx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [sym.imp.USER32.dll_mouse_event]
push edi
lea ebx, [edx + 8]
mov dword [esp + 0x18], esi
mov eax, dword [ebx - 4]
cmp eax, 0x200
jb 0x1000d8fd
cmp eax, 0x208
ja 0x1000d8fd
mov edi, dword [ebx + 4]
xor esi, esi
mov si, word [ebx + 4]
shr edi, 0x10
push edi
push esi
call dword [sym.imp.USER32.dll_SetCursorPos]
push edi
push esi
call dword [sym.imp.USER32.dll_WindowFromPoint]
push eax
call dword [sym.imp.USER32.dll_SetCapture]
mov eax, dword [ebx - 4]
cmp eax, 0x203
ja 0x1000d9ad
je 0x1000d995
cmp eax, 0x105
ja 0x1000d969
je 0x1000d94b
sub eax, 0x100
je 0x1000d92d
dec eax
je 0x1000d94b
sub eax, 3
jne case.0x1000d9b7.521
mov eax, dword [ebx]
push 0
push 0
push 0
push eax
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
mov cl, byte [ebx]
push eax
push ecx
call dword [sym.imp.USER32.dll_keybd_event]
jmp case.0x1000d9b7.521
mov edx, dword [ebx]
push 0
push 2
push 0
push edx
call dword [sym.imp.USER32.dll_MapVirtualKeyA]
push eax
mov al, byte [ebx]
push eax
call dword [sym.imp.USER32.dll_keybd_event]
jmp case.0x1000d9b7.521
sub eax, 0x201
je 0x1000d986
dec eax
jne case.0x1000d9b7.521
push 0
push 0
push 0
push 0
push 4
jmp 0x1000da1a
push 0
push 0
push 0
push 0
push 2
jmp 0x1000da1a
push 0
push 0
push 0
push 0
push 6
call ebp
push 0
push 0
push 0
push 0
push 6
jmp 0x1000da1a
add eax, 0xfffffdfc
cmp eax, 6
ja case.0x1000d9b7.521
jmp dword [eax*4 + 0x1000da38]
push 0
push 0
push 0
push 0
push 8
jmp 0x1000da1a
push 0
push 0
push 0
push 0
push 0x10
jmp 0x1000da1a
push 0
push 0
push 0
push 0
push 0x18
call ebp
push 0
push 0
push 0
push 0
push 0x18
jmp 0x1000da1a
push 0
push 0
push 0
push 0
push 0x20
jmp 0x1000da1a
push 0
push 0
push 0
push 0
push 0x40
jmp 0x1000da1a
mov ecx, dword [ebx]
push 0
shr ecx, 0x10
movsx edx, cx
push edx
push 0
push 0
push 0x800
call ebp
mov eax, dword [esp + 0x18]
add ebx, 0x1c
dec eax
mov dword [esp + 0x18], eax
jne 0x1000d8c9
pop edi
pop ebp
pop ebx
pop esi
ret 8
Function at 0x1000da60
Capabilities:
Open clipboard
Write clipboard data

Disassembly:
sub esp, 8
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.GlobalAlloc
push str.KERNEL32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.GlobalLock
push str.KERNEL32.dll
mov ebx, eax
call esi
push eax
call edi
push str.GlobalUnlock
push str.KERNEL32.dll
mov ebp, eax
call esi
push eax
call edi
push str.GlobalFree
push str.KERNEL32.dll
mov dword [esp + 0x18], eax
call esi
push eax
call edi
push 0
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1000db11
call dword [sym.imp.USER32.dll_EmptyClipboard]
mov esi, dword [esp + 0x20]
push esi
push 0x2000
call ebx
mov ebx, eax
test ebx, ebx
je 0x1000db0b
push ebx
call ebp
mov ecx, esi
mov esi, dword [esp + 0x1c]
mov edi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
push ebx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call dword [esp + 0x14]
push ebx
push 1
call dword [sym.imp.USER32.dll_SetClipboardData]
push ebx
call dword [esp + 0x18]
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret 8

Function at 0x1000db20
Capabilities:
Open clipboard
Read clipboard data

Disassembly:
sub esp, 0xc
push ebx
push ebp
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push edi
push str.GlobalSize
mov dword [esp + 0x1c], ecx
push str.KERNEL32.dll
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.GlobalLock
push str.KERNEL32.dll
mov ebx, eax
call esi
push eax
call edi
push str.GlobalUnlock
push str.KERNEL32.dll
mov ebp, eax
call esi
push eax
call edi
push 0
mov dword [esp + 0x18], eax
call dword [sym.imp.USER32.dll_OpenClipboard]
test eax, eax
je 0x1000dbe9
push 1
call dword [sym.imp.USER32.dll_GetClipboardData]
mov esi, eax
test esi, esi
mov dword [esp + 0x10], esi
jne 0x1000db98
call dword [sym.imp.USER32.dll_CloseClipboard]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
push esi
call ebx
mov ebx, eax
push esi
inc ebx
call ebp
push ebx
mov esi, eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
lea ecx, [ebx - 1]
mov ebp, eax
mov eax, ecx
add esp, 4
lea edi, [ebp + 1]
mov byte [ebp], 0x76
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x10]
push ecx
call dword [esp + 0x18]
call dword [sym.imp.USER32.dll_CloseClipboard]
mov ecx, dword [esp + 0x18]
push ebx
push ebp
call fcn.1000bc20
push ebp
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
pop edi
pop esi
pop ebp
pop ebx
add esp, 0xc
ret
Function at 0x1000e030
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10019f7e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x10], ecx
mov dword [ecx], 0x1001b350
mov eax, dword [ecx + 0x44]
mov ecx, dword [ecx + 0x10c]
push eax
push ecx
mov dword [ebp - 4], 0
call dword [sym.imp.USER32.dll_ReleaseDC]
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov edx, dword [0x1002181c]
push str.DeleteDC
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x14], eax
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0x14]
mov eax, dword [esi + 0x48]
push eax
call edi
mov ecx, dword [esi + 0x4c]
push ecx
call edi
mov edx, dword [esi + 0x50]
push edx
call edi
mov eax, dword [esi + 0x80]
push eax
call edi
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov ecx, dword [0x1002181c]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DeleteObject
push ecx
call esi
push str.FreeLibrary
push str.KERNEL32.dll
mov dword [ebp - 0x14], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call esi
mov dword [ebp - 0x18], eax
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0x14]
mov edx, dword [esi + 0x54]
push edx
call edi
mov eax, dword [esi + 0x58]
push eax
call edi
mov ecx, dword [esi + 0x84]
push ecx
call edi
mov eax, dword [esi + 0x1c]
test eax, eax
je 0x1000e125
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov eax, dword [esi + 0x68]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [esi + 0x64]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov eax, dword [esi + 0x6c]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
mov edx, dword [0x1002181c]
add esp, 0xc
push edx
call dword [ebp - 0x18]
push str.User32.dll
mov dword [ebp - 4], 0xffffffff
mov dword [esi + 0x88], 0x1001b34c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x14], eax
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov eax, dword [ebp - 0x14]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.DestroyCursor
push eax
call esi
push str.FreeLibrary
push str.KERNEL32.dll
mov dword [ebp - 0x18], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call esi
mov dword [ebp - 0x1c], eax
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov ecx, dword [ebp - 0x10]
mov edi, 0x10
lea esi, [ecx + 0xcc]
mov edx, dword [esi]
push edx
call dword [ebp - 0x18]
add esi, 4
dec edi
jne 0x1000e1c2
mov eax, dword [ebp - 0x14]
push eax
call dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000fc60
Capabilities:
Shutdown system

Disassembly:
push str.SeShutdownPrivilege
call fcn.10012880
mov eax, dword [esp + 8]
add esp, 4
push 0
push eax
call dword [sym.imp.USER32.dll_ExitWindowsEx]
push str.SeShutdownPrivilege
call fcn.10012880
pop ecx
ret

Function at 0x1000ff60
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
mov al, 0x65
push ebx
mov byte [ebp - 0x2b], al
mov byte [ebp - 0x28], al
mov al, 0x6c
push esi
push edi
mov byte [ebp - 0x2c], 0x6b
mov byte [ebp - 0x2a], 0x72
mov byte [ebp - 0x29], 0x6e
mov byte [ebp - 0x27], al
mov byte [ebp - 0x26], 0x33
mov byte [ebp - 0x25], 0x32
mov byte [ebp - 0x24], 0x2e
mov byte [ebp - 0x23], 0x64
mov byte [ebp - 0x22], al
mov byte [ebp - 0x21], al
mov byte [ebp - 0x20], 0
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov al, 0x65
mov cl, 0x74
mov byte [ebp - 0x1c], 0x43
mov byte [ebp - 0x1b], 0x72
mov byte [ebp - 0x1a], al
mov byte [ebp - 0x19], 0x61
mov byte [ebp - 0x18], cl
mov byte [ebp - 0x17], al
mov byte [ebp - 0x16], 0x45
mov byte [ebp - 0x15], 0x76
mov byte [ebp - 0x14], al
mov byte [ebp - 0x13], 0x6e
mov byte [ebp - 0x12], cl
mov byte [ebp - 0x11], 0x41
mov byte [ebp - 0x10], 0
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
lea eax, [ebp - 0x1c]
lea ecx, [ebp - 0x2c]
push eax
push ecx
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push str.WaitForSingleObject
push str.KERNEL32.dll
mov dword [ebp - 4], eax
call esi
push eax
call edi
push str.CloseHandle
push str.KERNEL32.dll
mov dword [ebp - 8], eax
call esi
push eax
call edi
mov dword [ebp - 0xc], eax
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
mov cl, byte [ebp + 0x20]
push 0
push 0
push 0
push 0
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x38], eax
mov byte [ebp - 0x34], cl
call dword [ebp - 4]
mov edx, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
push edx
mov edx, dword [ebp + 0xc]
lea ecx, [ebp - 0x3c]
push eax
mov eax, dword [ebp + 8]
push ecx
push 0x1000fec0
push edx
push eax
call dword [sym.imp.MSVCRT.dll__beginthreadex]
mov ecx, dword [ebp - 0x30]
add esp, 0x18
mov esi, eax
push 0xffffffffffffffff
push ecx
call dword [ebp - 8]
mov edx, dword [ebp - 0x30]
push edx
call dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10010160
Capabilities:
Get session information
Get session user name

Disassembly:
sub esp, 8
push edi
push str.lstrcpyA
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
lea ecx, [esp + 8]
lea edx, [esp + 4]
push ecx
mov edi, eax
push edx
xor eax, eax
push 5
push 0xffffffffffffffff
push eax
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], eax
call sub.WTSAPI32.dll_WTSQuerySessionInformationA
test eax, eax
je 0x100101c9
push esi
push pe_nt_image_headers32
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov esi, eax
mov eax, dword [esp + 8]
push eax
push esi
call edi
mov ecx, dword [esp + 8]
push ecx
call sub.WTSAPI32.dll_WTSFreeMemory
mov eax, esi
pop esi
pop edi
add esp, 8
ret
xor eax, eax
pop edi
add esp, 8
ret

Function at 0x100105d0
Capabilities:
Simulate ctrl alt del

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
push edi
push str.GetCurrentThreadId
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
call eax
push eax
call dword [sym.imp.USER32.dll_GetThreadDesktop]
mov dword [ebp - 4], eax
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov cl, 0x6e
mov al, 0x6f
mov byte [ebp - 0x10], cl
mov byte [ebp - 0xf], al
mov byte [ebp - 0xe], 0x67
mov byte [ebp - 0xd], al
mov byte [ebp - 0xc], 0x6c
mov byte [ebp - 0xb], cl
mov byte [ebp - 0xa], 0x69
mov byte [ebp - 9], 0x57
mov byte [ebp - 8], 0
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
lea eax, [ebp - 0x10]
push eax
call dword [sym.imp.MSVCRT.dll__strrev]
add esp, 4
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
lea ecx, [ebp - 0x10]
push ecx
call fcn.10010580
add esp, 4
test eax, eax
jne 0x10010662
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x2e0003
push 0
push 0x312
push 0xffff
call dword [sym.imp.USER32.dll_PostMessageA]
mov eax, dword [ebp - 4]
test eax, eax
je 0x10010689
push eax
call fcn.10010500
add esp, 4
pop edi
pop esi
mov eax, 1
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100109d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov al, 0x65
push ebx
mov byte [ebp - 0x2f], al
mov byte [ebp - 0x2c], al
mov al, 0x6c
push esi
push edi
mov dword [ebp - 4], ecx
mov dword [ecx], 0x1001b374
mov byte [ebp - 0x30], 0x6b
mov byte [ebp - 0x2e], 0x72
mov byte [ebp - 0x2d], 0x6e
mov byte [ebp - 0x2b], al
mov byte [ebp - 0x2a], 0x33
mov byte [ebp - 0x29], 0x32
mov byte [ebp - 0x28], 0x2e
mov byte [ebp - 0x27], 0x64
mov byte [ebp - 0x26], al
mov byte [ebp - 0x25], al
mov byte [ebp - 0x24], 0
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov al, 0x65
mov cl, 0x74
mov byte [ebp - 0x20], 0x43
mov byte [ebp - 0x1f], 0x72
mov byte [ebp - 0x1e], al
mov byte [ebp - 0x1d], 0x61
mov byte [ebp - 0x1c], cl
mov byte [ebp - 0x1b], al
mov byte [ebp - 0x1a], 0x45
mov byte [ebp - 0x19], 0x76
mov byte [ebp - 0x18], al
mov byte [ebp - 0x17], 0x6e
mov byte [ebp - 0x16], cl
mov byte [ebp - 0x15], 0x41
mov byte [ebp - 0x14], 0
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x30]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x10021838], eax
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
call dword [ebp - 8]
mov esi, dword [ebp - 4]
mov dword [esi + 4], eax
mov dword [esi + 8], ebx
mov dword [esi + 0xc], ebx
call fcn.10010cf0
test al, al
je 0x10010bb7
cmp byte [0x10021834], bl
jne 0x10010bb7
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov edx, dword [0x10021838]
push str.CreateWindowExA
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push bind
push 0x10020d00
push str.32770
push 0
call dword [ebp - 8]
mov ecx, dword [ebp - 4]
mov dword [ecx + 0x10], eax
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
push 0x30
call dword [sym.imp.MSVCRT.dll_putchar]
add esp, 4
push str.AVICAP32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 8], eax
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov edx, dword [ebp - 8]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.capCreateCaptureWindowA
push edx
call esi
push str.FreeLibrary
push str.KERNEL32.dll
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call esi
mov dword [ebp - 0x10], eax
inc eax
dec eax
pushal
sub eax, 0xa
add eax, 0xa
popal
mov esi, dword [ebp - 4]
push 0
mov eax, dword [esi + 0x10]
push eax
push 0
push 0
push 0
push 0
push 0x50000000
push str.CVideoCap
call dword [ebp - 0xc]
push 0x30
mov dword [esi + 0x14], eax
call dword [sym.imp.MSVCRT.dll_putchar]
mov ecx, dword [ebp - 8]
add esp, 4
push ecx
call dword [ebp - 0x10]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret