joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4be4e0
Capabilities:
Encode data using xor

Disassembly:
mov dword [esp + 0x14], edi
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
mov esi, dword [edi + 0xf0]
lea esi, [esi + esi - 2]
lea esi, [edi + esi*8]
mov dword [esp + 0x18], esi
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 3]
mov edi, ecx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, edx
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8]
movzx edi, ch
xor esi, dword [ebp + edi*8 + 3]
mov edi, edx
shr edi, 0x10
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
mov edi, eax
shr edi, 0x18
xor esi, dword [ebp + edi*8 + 1]
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8]
movzx edi, dh
xor esi, dword [ebp + edi*8 + 3]
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
xor esi, dword [ebp + edi*8 + 2]
movzx edi, bh
xor esi, dword [ebp + edi*8 + 1]
mov edi, dword [esp + 0x14]
mov edx, dword [ebp + edx*8]
movzx eax, ah
xor edx, dword [ebp + eax*8 + 3]
mov eax, dword [esp + 4]
and ebx, 0xff
xor edx, dword [ebp + ebx*8 + 2]
mov ebx, dword [esp + 8]
xor edx, dword [ebp + ecx*8 + 1]
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
cmp edi, dword [esp + 0x18]
mov dword [esp + 0x14], edi
jb 0x4be500
mov esi, eax
and esi, 0xff
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, bh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, ecx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, edx
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 4], esi
mov esi, ebx
and esi, 0xff
shr ebx, 0x10
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, ch
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, edx
shr edi, 0x10
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
mov edi, eax
shr edi, 0x18
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov dword [esp + 8], esi
mov esi, ecx
and esi, 0xff
shr ecx, 0x18
mov esi, dword [ebp + esi*8 + 2]
and esi, 0xff
movzx edi, dh
mov edi, dword [ebp + edi*8]
and edi, 0xff00
xor esi, edi
mov edi, eax
shr edi, 0x10
and edx, 0xff
and edi, 0xff
mov edi, dword [ebp + edi*8]
and edi, 0xff0000
xor esi, edi
movzx edi, bh
mov edi, dword [ebp + edi*8 + 2]
and edi, 0xff000000
xor esi, edi
mov edi, dword [esp + 0x14]
and edx, 0xff
mov edx, dword [ebp + edx*8 + 2]
and edx, 0xff
movzx eax, ah
mov eax, dword [ebp + eax*8]
and eax, 0xff00
xor edx, eax
mov eax, dword [esp + 4]
and ebx, 0xff
mov ebx, dword [ebp + ebx*8]
and ebx, 0xff0000
xor edx, ebx
mov ebx, dword [esp + 8]
mov ecx, dword [ebp + ecx*8 + 2]
and ecx, 0xff000000
xor edx, ecx
mov ecx, esi
add edi, 0x10
xor eax, dword [edi]
xor ebx, dword [edi + 4]
xor ecx, dword [edi + 8]
xor edx, dword [edi + 0xc]
ret
Function at 0x4c0a70
Capabilities:
Encode data using xor

Disassembly:
push ebp
push ebx
push esi
push edi
mov ecx, dword [esp + 0x1c]
cmp ecx, 0
je 0x4c0c2d
call fcn.004c0a86
Function at 0x518c80
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
sub esp, 0x4c
push ebx
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x518d8c
test eax, eax
je 0x518d8c
push esi
push edi
mov ecx, 0x10
mov esi, 0x533ff0
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
mov esi, dword [ebp + 0x14]
mov esi, dword [esi]
add esi, eax
mov dword [ebp - 8], esi
xor esi, esi
mov dword [ebp - 4], 0
mov ecx, eax
test edx, edx
jbe 0x518d73
lea edi, [eax + 4]
jmp 0x518cd7
mov ebx, dword [ebp + 8]
movzx eax, byte [esi + ebx]
inc esi
shl eax, 0x10
cmp esi, edx
jne 0x518cec
mov dword [ebp - 4], 2
jmp 0x518d0d
movzx ebx, byte [esi + ebx]
shl ebx, 8
inc esi
or eax, ebx
cmp esi, edx
jne 0x518d03
mov dword [ebp - 4], 1
jmp 0x518d0d
mov edx, dword [ebp + 8]
movzx edx, byte [esi + edx]
or eax, edx
inc esi
mov edx, eax
and edx, 0x3f
cmp edi, dword [ebp - 8]
ja 0x518d83
mov ebx, eax
shr ebx, 0x12
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
mov byte [ecx], bl
mov ebx, eax
shr ebx, 0xc
and ebx, 0x3f
movzx ebx, byte [ebp + ebx - 0x4c]
inc ecx
inc edi
mov byte [ecx], bl
mov ebx, dword [ebp - 4]
inc ecx
inc edi
cmp ebx, 1
jbe 0x518d46
mov byte [ecx], 0x3d
jmp 0x518d52
shr eax, 6
and eax, 0x3f
mov al, byte [ebp + eax - 0x4c]
mov byte [ecx], al
inc ecx
inc edi
test ebx, ebx
jbe 0x518d5d
mov byte [ecx], 0x3d
jmp 0x518d63
mov dl, byte [ebp + edx - 0x4c]
mov byte [ecx], dl
mov edx, dword [ebp + 0xc]
inc ecx
inc edi
cmp esi, edx
jb 0x518cd4
mov eax, dword [ebp + 0x10]
sub ecx, eax
mov eax, dword [ebp + 0x14]
pop edi
pop esi
mov dword [eax], ecx
mov al, 1
pop ebx
mov esp, ebp
pop ebp
ret
pop edi
pop esi
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
xor al, al
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x56b099
Capabilities:
Execute anti-debugging instructions
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push 0x48d34b7e
call fcn.00581724
call fcn.0041ff20
push 0xffffffffffffffff
push 0
jmp loc.00421047

Function at 0x5a9af0
Capabilities:
Parse pe header

Disassembly:
push ebp
add ah, 0x40
or bp, 0xdda
mov ebp, esp
shrd ax, bx, 0xf3
movzx eax, bx
sub esp, 0x148
xor ax, 0xe87
mov eax, dword [0x5015e8]
cmp ebp, esp
xor eax, ebp
jmp 0x70ba81
push ebx
jmp 0x750341
mov dword [ebp - 4], eax
jmp 0x6ccc45
push esi
jmp loc.00402c89
Function at 0x69c7b3
Capabilities:
Read file on windows

Disassembly:
call fcn.00779c20
push 0x206
bts cx, di
mov dword [esp + 0x14], eax
movzx ecx, si
test sp, 0x3a07
mov ecx, 0x34213e7f
lea ecx, [esp + 0x12e]
sub eax, eax
jmp 0x7fe2c7
mov dword [esp + 0x6c], eax
jmp 0x761dcc
mov dword [esp + 0x18], edi
jmp 0x79e40a
push 0x48d34b7e
call fcn.00581724
mov dword [esp + 0x60], eax
mov dword [esp + 0x64], eax
jmp 0x7a1ee6
push ecx
jmp 0x64fb14
lea edx, [esp + 0x58]
jmp loc.00414276
mov dword [esp + 0x70], eax
jmp 0x55f0db
call fcn.0045a370
add esp, 0xc
xchg dx, dx
inc dl
add esi, 0x4da
not dh
push esi
jmp 0x729159
mov word [esp + 0x134], ax
jmp 0x765e77
mov dword [esp + 0x68], eax
jmp 0x59ddfa
push edi
jmp 0x701085

Function at 0x6b2138
Capabilities:
Authenticate hmac
Execute anti-debugging instructions
Reference processor manufacturer constants

Disassembly:
je 0x80922d
sub al, al
test edx, ebp
test bl, 0xe7
pop edi
pop esi
movzx ebx, di
pop ebx
bts ecx, ecx
btc ecx, esp
mov ecx, dword [ebp - 4]
xor ecx, ebp
jmp 0x6e54fb
mov dword [ebp - 0x2c], 0
test di, 0x2a0a
cmp bp, cx
mov dword [esi], eax
mov dword [esi + 4], ebx
clc
mov dword [esi + 8], ecx
test ch, 0xc3
mov dword [esi + 0xc], edx
cmp esi, ecx
test byte [ebp - 0x2c], 1
jmp 0x5249d0
push ecx
jmp 0x659fef
jne 0x80922d
cmp dword [ebp - 0x24], 0x76482074
jmp 0x6f1978
call fcn.0045593f
mov esp, ebp
pop ebp
jmp fcn.0040b924
mov byte [ebp - 0x30], 0x6b
jmp loc.0041f164
je 0x7f33a5
sub eax, eax
setnp bl
bt ecx, ebp
xor bl, bh
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], eax
dec dl
bsf eax, eax
rol al, 0x35
mov eax, 0x40000000
cpuid
mov dword [esi], eax
mov dword [esi + 4], ebx
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
test esp, 0x33c37179
cmc
cmp dword [ebp - 0x2c], 0x7263694d
jmp 0x663f7c
jne 0x80922d
cmp dword [ebp - 0x28], 0x666f736f
jmp 0x5d0c70
push ebp
mov ebp, esp
sub esp, 0x94
or ah, 0xe1
clc
sbb dh, al
mov eax, dword [0x5015e8]
sbb dl, 0xf9
dec ecx
xor eax, ebp
movsx cx, dl
cmove ecx, edx
cmp ebx, 0x13563570
mov dword [ebp - 4], eax
push ebx
mov eax, 1
cmovo ecx, esi
sbb dx, si
cpuid
stc
cmc
push esi
or esi, edx
sub esi, 0x1ee32d8e
lea esi, [ebp - 0x30]
stc
cmp ch, bh
mov dword [esi], eax
mov dword [esi + 4], ebx
sal ah, cl
btc ax, 0x92
mov dword [esi + 8], ecx
stc
cbw
bt ax, sp
mov dword [esi + 0xc], edx
add eax, 0x86d07c7
mov eax, dword [ebp - 0x28]
stc
sar eax, 0x1f
test bx, 0x660a
push edi
test si, 0xe3b
test al, 1
jmp 0x65ed51
call fcn.0045593f
mov esp, ebp
pop ebp
jmp 0x786d47
jne 0x80922d
mov eax, 0x40000003
cmp cx, di
sub cx, 0xc93
cpuid
stc
cmp si, bp
jmp 0x57b696
ret
xor ecx, ebp
jmp 0x5da49f
lea ecx, [ebp - 0x30]
movzx ebx, bx
mov ebx, 0x65
jmp 0x593e1d
mov al, 1
bsf esi, esp
pop edi
pop esi
pop ebx
mov cx, 0x7a7b
mov ecx, dword [ebp - 4]
test ecx, esi
test ebp, 0x7b43355
jmp 0x7edb58
Function at 0x779c20
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 0x8d], 0x70
jmp 0x7a6e57
mov byte [esp + 0x20b], al
jmp 0x7b01f5
mov byte [esp + 0x270], 0x43
jmp 0x6582da
mov byte [esp + 0x27a], 0x66
jmp 0x6ff799
mov byte [esp + 0x20a], cl
jmp 0x560c09
mov byte [esp + 0x210], 0x6b
mov byte [esp + 0x211], bl
jmp 0x701b8b
mov byte [esp + 0x7e], 0x64
jmp 0x7d8bfd
mov byte [esp + 0x94], 0x64
jmp 0x7ee1bc
mov byte [esp + 0x275], cl
jmp 0x6d5e5b
mov byte [esp + 0x277], dl
jmp 0x7ce79f
mov byte [esp + 0x8c], 0x73
jmp 0x548ccd
mov byte [esp + 0x1de], 0x64
jmp loc.00402b55
mov byte [esp + 0x208], 0x57
jmp 0x73273a
mov byte [esp + 0x273], 0x74
mov byte [esp + 0x274], 0x75
jmp 0x5c776d
mov byte [esp + 0x27d], 0x6d
mov byte [esp + 0x27e], bl
jmp 0x75a1d1
mov byte [esp + 0x271], 0x61
jmp 0x750285
mov byte [esp + 0x276], 0x69
jmp 0x5c77ef
mov byte [esp + 0x27b], cl
jmp 0x75f964
mov byte [esp + 0x13c], 0x2e
jmp 0x832630
mov byte [esp + 0x1dd], 0x69
jmp 0x5e4294
mov byte [esp + 0x20f], cl
jmp 0x5a0123
mov byte [esp + 0x13f], 0x61
jmp 0x81da84
mov byte [esp + 0x209], 0x69
jmp 0x59f49d
mov byte [esp + 0x81], 0x6c
jmp 0x7b73ea
mov byte [esp + 0x141], bl
jmp 0x576e7a
mov byte [esp + 0x272], 0x70
jmp 0x60e100
mov byte [esp + 0x1dc], 0x46
jmp 0x7041e1
mov byte [esp + 0x27c], 0x6f
jmp 0x6477af
push 0x48d34b7e
call fcn.00581724
mov byte [esp + 0x7c], 0x70
mov byte [esp + 0x7d], 0x73
jmp 0x5a80ea
mov byte [esp + 0x91], 0x68
mov byte [esp + 0x92], 0x6b
mov byte [esp + 0x93], 0x2e
jmp 0x5c0c56
mov byte [esp + 0x8e], 0x79
mov byte [esp + 0x8f], 0x78
mov byte [esp + 0x90], 0x78
jmp 0x79e766
mov byte [esp + 0x20c], 0x73
mov byte [esp + 0x20d], 0x68
jmp 0x7fa0bf
mov byte [esp + 0x82], 0x6c
jmp 0x7d04d7
mov byte [esp + 0x278], 0x67
mov byte [esp + 0x279], 0x20
jmp 0x5859b9
mov byte [esp + 0x83], bl
jmp 0x5ccde9
mov byte [esp + 0x7f], 0x2e
jmp 0x827159
mov byte [esp + 0x95], 0x6c
jmp 0x7f5b5d
mov byte [esp + 0x96], 0x6c
jmp 0x8409a4
mov byte [esp + 0x20e], 0x61
jmp 0x70cb5e
mov byte [esp + 0x140], 0x70
jmp 0x745251
mov byte [esp + 0x80], 0x64
jmp 0x73f8c7
mov byte [esp + 0x13d], 0x70
mov byte [esp + 0x13e], 0x63
jmp 0x729916
mov byte [esp + 0x97], bl
jmp 0x5f8621
Function at 0x77d14e
Capabilities:
Execute anti-debugging instructions

Disassembly:
lea eax, [esp + 0x3fc]
cwd
xchg dx, dx
lea edx, [eax + 1]
lea ecx, [ecx]
mov cl, byte [eax]
inc eax
clc
cmp cl, bl
jmp 0x6dc388
lea ecx, [esp + 0x400]
jmp 0x64e7a0
call fcn.00457400
add esp, 8
cmp si, 0x788a
test bp, 0x42db
cmp di, cx
test eax, eax
jmp 0x68b26f
push ebx
jmp 0x62696c
call fcn.00457400
add esp, 8
cmc
test cl, al
cmp bx, 0x4b11
test eax, eax
jmp 0x820c4a
push 0x40f9b0
jmp 0x7f875a
test eax, eax
jmp 0x74916f
push ecx
jmp 0x7d0519
push ecx
jmp 0x7c4929
je 0x81ca5a
push 0x104
movsx eax, di
lea eax, [esp + 0x2f8]
push eax
push ebx
jmp 0x81ca4d
jne 0x7c493a
lea ecx, [esp + 0x270]
movzx edx, ax
cwd
push ecx
mov dh, 0x78
lea edx, [esp + 0x400]
jmp 0x71a181
push ebx
jmp 0x403293
jne 0x7c493a
lea eax, [esp + 0x1dc]
cmovne ecx, esp
xchg cl, cl
jmp 0x804c37
push 0x4d
jmp 0x75328b
mov byte [esp + 0xed], 0x64
mov byte [esp + 0xee], 0x73
jmp 0x74a886
push edx
jmp 0x74522a
mov byte [esp + 0xec], 0x63
jmp 0x70d8aa
push edx
jmp 0x730004
call fcn.00457400
add esp, 8
jmp 0x6438ca
call fcn.00457400
add esp, 8
test eax, eax
jmp 0x6d356d
jne 0x7c493a
lea eax, [esp + 0x244]
bswap cx
push eax
setnp ch
mov cl, 0xd7
jmp 0x56ede4
mov byte [esp + 0xef], 0x73
mov byte [esp + 0xf0], 0x73
mov byte [esp + 0xf1], bl
jmp 0x75a095
push ecx
jmp 0x71ef20
call 0x78447d
mov edi, eax
cmc
cmp edi, ebx
jmp 0x6599a2
call fcn.00713bc0
add esp, 0x18
jmp 0x7a8238
push 0x48d34b7e
call fcn.00581724
jne 0x7c493a
lea edx, [esp + 0x13c]
cwde
movsx ax, al
push edx
nop
movzx ax, bl
lea eax, [esp + 0x400]
jmp 0x80b6e8
push ebx
push ebx
jmp 0x5fe570
push 0x410
jmp 0x759e61
call fcn.00457400
lea esp, [esp + 8]
test eax, eax
je 0x4032a0
mov edx, dword [esp + 0x10]
jmp 0x7f0cb1
call fcn.00457400
lea esp, [esp + 8]
test eax, eax
jne 0x7c493a
lea edx, [esp + 0x2cc]
lahf
mov eax, esi
push edx
not ax
movzx ax, ch
lea eax, [esp + 0x400]
push eax
jmp 0x608df3
push edx
push ebx
jmp 0x7b997b
push ebx
jmp 0x68fc51
push eax
not cl
lea ecx, [esp + 0x400]
jmp 0x64953f
push eax
jmp 0x59d044
push edi
call 0x836214
push edi
call dword [0x4ca3e8]
lea ecx, [esp + 0x2f4]
cwd
push ecx
movzx edx, si
xchg ah, al
lea edx, [esp + 0x500]
cbw
movsx eax, dx
push edx
lea eax, [esp + 0x404]
mov ecx, 0x2f0e23bc
not ecx
push eax
push 4
not cl
movsx cx, ch
mov cx, 0x602d
lea ecx, [esp + 0xe4]
jmp 0x6e81e4
jne 0x7c493a
lea ecx, [esp + 0x250]
push ecx
xchg dl, dl
not dx
lea edx, [esp + 0x400]
jmp 0x7277f1

Function at 0x7d61f1
Capabilities:
Read file on windows
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and ax, di
rol ah, 0xf1
push 0xffffffffffffffff
push 0x4c8d8e
rcl eax, 0x87
mov eax, dword fs:[0]
clc
push eax
test dx, 0x4814
add ah, 0x6b
rcr al, cl
lea esp, [esp - 0xf4c]
mov eax, dword [0x5015e8]
test bl, 0xf8
cmc
xor eax, ebp
cmc
mov dword [ebp - 0x10], eax
push ebx
cmp dl, 0xf1
test edi, ecx
stc
push esi
test si, 0x6b5f
push edi
push eax
lea eax, [ebp - 0xc]
test eax, esp
cmp bx, di
mov dword fs:[0], eax
mov eax, dword [0x50ce70]
sub ebx, ebx
push ebx
jmp 0x8093c0
push eax
jmp loc.00431fd5
Function at 0x809c6b
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov byte [esp + 0x14d], bl
lea ecx, [esp + 0x148]
jmp 0x8270f3
push 0x48d34b7e
call fcn.00581724
push ecx
bswap ecx
movzx ecx, ax
mov byte [esp + 0x148], 0x63
setge cl
not ch
mov byte [esp + 0x149], 0x64
xchg cx, cx
setp cl
mov byte [esp + 0x14a], 0x73
mov byte [esp + 0x14b], 0x73
movsx ecx, sp
mov byte [esp + 0x14c], 0x73
jmp 0x603226
jmp 0x759649
Function at 0x1002d10
Capabilities:
Log keystrokes via polling

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
call dword [sym.imp.USER32.dll_GetForegroundWindow]
cmp eax, dword [ebp + 8]
jne 0x1002d31
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jl 0x1002dd2
push esi
xor esi, esi
cmp dword [0x1015e74], esi
push edi
jle 0x1002d52
mov ecx, dword [esi*4 + 0x1015e78]
mov eax, dword [ecx]
call dword [eax + 0x18]
inc esi
cmp esi, dword [0x1015e74]
jl 0x1002d3d
movzx eax, byte [0x1016554]
mov ecx, dword [0x1015020]
imul eax, ecx
push ebx
push 0x64
xor edx, edx
pop esi
div esi
mov ebx, eax
cmp ebx, ecx
jb 0x1002d73
lea ebx, [ecx - 1]
mov esi, dword [sym.imp.KERNEL32.dll_GetProcessHeap]
push 0x80
push 0
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov edi, eax
test edi, edi
je 0x1002da8
movzx eax, byte [0x1016554]
push eax
push 0x1015ae0
push 0x40
push edi
call dword [sym.imp.SHLWAPI.dll_wnsprintfW]
add esp, 0x10
push edi
push ebx
push 0x402
push dword [0x1015e40]
call dword [sym.imp.USER32.dll_PostThreadMessageW]
test eax, eax
pop ebx
jne 0x1002dcb
push edi
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_HeapFree]
call fcn.01002bfb
pop edi
pop esi
pop ebp
ret 8
Function at 0x1003a3a
Capabilities:
Create thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
xor esi, esi
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push 0x10039f8
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
je 0x1003a6a
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1003a8d
push 0x1001760
lea ecx, [ebp - 0x1c]
call fcn.01012b16
push esi
push 3
push 2
push dword [ebp + 8]
call dword [sym.imp.ntdll.dll_NtInitiatePowerAction]
lea ecx, [ebp - 0x1c]
call fcn.01012b84
pop esi
leave
ret 4

Function at 0x1003af4
Capabilities:
Create thread
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
xor esi, esi
lea eax, [ebp - 4]
push eax
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push 0x1003abd
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp eax, esi
je 0x1003b24
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x1003b43
push 0x1001760
lea ecx, [ebp - 0x1c]
call fcn.01012b16
push esi
push dword [ebp + 8]
call dword [sym.imp.USER32.dll_ExitWindowsEx]
lea ecx, [ebp - 0x1c]
call fcn.01012b84
pop esi
leave
ret 4

Function at 0x1003b4d
Capabilities:
Lock the desktop
Log keystrokes via polling
Shutdown system

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
push 0x1000
call dword [sym.imp.USER32.dll_GetSystemMetrics]
mov eax, dword [ebp + 0xc]
add eax, 0xfffff05e
cmp eax, 8
ja case.default.0x1003b71
jmp dword [eax*4 + 0x1003c1e]
push 2
jmp 0x1003b7e
push 3
call fcn.01003a3a
jmp case.default.0x1003b71
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x1003ba6
push 0x1001760
lea ecx, [ebp - 0x18]
call fcn.01012b16
push 2
jmp 0x1003bdd
lea eax, [ebp + 0xc]
push eax
push 0
push 0
call fcn.010031c5
mov eax, dword [ebp + 0xc]
neg eax
sbb eax, eax
and eax, 7
inc eax
push eax
jmp 0x1003bef
push 0x11
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
jge 0x1003bed
push 0x1001760
lea ecx, [ebp - 0x18]
call fcn.01012b16
push 1
call dword [sym.imp.ntdll.dll_NtShutdownSystem]
lea ecx, [ebp - 0x18]
call fcn.01012b84
jmp case.default.0x1003b71
push 2
call fcn.01003af4
jmp case.default.0x1003b71
push 0
push 0
call dword [sym.imp.USER32.dll_ExitWindowsEx]
jmp case.default.0x1003b71
push 0
call dword [sym.imp.MSGINA.dll_Ordinal_4]
jmp case.default.0x1003b71
call dword [0x1015e8c]
jmp case.default.0x1003b71
call dword [sym.imp.USER32.dll_LockWorkStation]
leave
ret 8

Function at 0x1003ccc
Capabilities:
Get geographical location

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1015494]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
push edi
push 0x20
push 0x10155e0
push 0x1e
mov edi, 0x400
mov dword [ebp - 4], eax
push edi
call esi
push 0x20
push 0x10155a0
push 0xf
push edi
call esi
push 0x20
push 0x1015560
push 0xe
push edi
call esi
push 8
lea eax, [ebp - 0x14]
push eax
push 0x10
push edi
call esi
push 0xa
lea eax, [ebp - 0x14]
push 0
push eax
call dword [sym.imp.ntdll.dll_wcstol]
mov ecx, dword [ebp - 4]
add esp, 0xc
pop edi
mov dword [0x1015558], eax
pop esi
call fcn.010120da
leave
ret
Function at 0x1003dc9
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x134
mov eax, dword [0x1015494]
push ebx
mov ebx, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
xor ecx, ecx
push edi
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [esi], ecx
mov dword [eax], ecx
push 0x47
mov dword [ebp - 0x12c], eax
mov dword [ebx], ecx
pop ecx
xor eax, eax
lea edi, [ebp - 0x120]
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x120]
push eax
mov dword [ebp - 0x120], 0x11c
call dword [sym.imp.KERNEL32.dll_GetVersionExW]
test eax, eax
je 0x1003eef
test word [ebp - 8], 0x110
je 0x1003eef
xor edi, edi
inc edi
cmp byte [ebp - 6], 3
mov dword [esi], edi
je 0x1003eed
cmp byte [ebp - 6], 2
je 0x1003eed
cmp byte [ebp - 6], 1
jne 0x1003eef
cmp word [ebp - 8], 0x100
jne 0x1003eef
push 4
pop esi
lea eax, [ebp - 0x124]
push eax
push edi
xor ebx, ebx
push ebx
push 0x10019d0
push 0x80000002
mov dword [ebp - 0x124], ebx
mov dword [ebp - 0x134], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x1003ec6
lea eax, [ebp - 0x134]
push eax
lea eax, [ebp - 0x130]
push eax
lea eax, [ebp - 0x128]
push eax
push ebx
push 0x100199c
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x1003ec6
cmp dword [ebp - 0x128], esi
jne 0x1003ec6
cmp dword [ebp - 0x130], ebx
jne 0x1003ec8
xor edi, edi
cmp dword [ebp - 0x124], ebx
je 0x1003edc
push dword [ebp - 0x124]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 0x12c]
xor eax, eax
cmp edi, ebx
sete al
mov dword [ecx], eax
jmp 0x1003eef
mov dword [ebx], edi
mov ecx, dword [ebp - 4]
pop edi
pop esi
pop ebx
call fcn.010120da
leave
ret 0xc

Function at 0x1003f03
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x168
push esi
mov esi, dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
push 0
push 0x2c
lea eax, [ebp - 0x30]
push eax
push 0
mov byte [ebp - 1], 1
call esi
test eax, eax
jl 0x1003f66
xor edx, edx
mov eax, 0x100000
div dword [ebp - 0x28]
push edi
push 0
push 0x138
mov edi, eax
lea eax, [ebp - 0x168]
push eax
push 2
call esi
test eax, eax
jl 0x1003f65
mov eax, dword [ebp - 0x134]
sub eax, dword [ebp - 0x138]
xor edx, edx
div edi
cmp eax, 8
jbe 0x1003f65
mov byte [ebp - 1], 0
pop edi
mov al, byte [ebp - 1]
pop esi
leave
ret

Function at 0x1004251
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push ecx
push edi
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0x20006
push 0
push 0x1001a3c
push 0
push 0x1001500
push 0x80000001
mov edi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExW]
test eax, eax
jne 0x10042ab
push 0x29c
push edi
push 3
push eax
push 0x1001574
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
test eax, eax
push dword [ebp - 4]
je 0x10042b2
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
call fcn.01003327
jmp 0x10042ba
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
pop edi
leave
ret
Function at 0x10042c2
Capabilities:
Log keystrokes via polling
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
push 0x10
mov esi, ecx
call edi
test ax, ax
jge 0x10042f8
push 0x12
call edi
test ax, ax
jge 0x10042f8
push 0x11
call edi
test ax, ax
jge 0x10042f8
mov ecx, esi
call fcn.010026f2
jmp 0x1004317
lea eax, [ebp - 8]
push eax
push 0x20019
push 0
push 0x1001500
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
je 0x100431c
xor eax, eax
inc eax
jmp 0x100437f
lea eax, [ebp - 4]
push eax
push esi
lea eax, [ebp - 0xc]
push eax
push 0
push 0x1001574
push dword [ebp - 8]
mov edi, 0x29c
mov dword [ebp - 4], edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100436a
cmp dword [ebp - 0xc], 3
jne 0x100436a
cmp dword [ebp - 4], edi
jne 0x100436a
push eax
lea eax, [esi + 0x14]
push eax
call dword [sym.imp.USER32.dll_MonitorFromRect]
test eax, eax
je 0x100436a
mov eax, dword [0x1015e74]
dec eax
cmp dword [esi + 0x24], eax
jg 0x100436a
xor esi, esi
jmp 0x1004374
mov ecx, esi
call fcn.010026f2
xor esi, esi
inc esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop edi
pop esi
leave
ret