joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003ec10
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1003fbe1
mov eax, dword fs:[0]
push eax
sub esp, 0x1c
mov eax, dword [0x10070020]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor esi, esi
cmp byte [0x100713d2], 0
je 0x1003ed4d
call fcn.1003ef30
test ax, ax
je 0x1003ec68
mov eax, dword [0x100713d4]
mov eax, dword [eax + 0x10]
test eax, eax
je 0x1003ec68
call eax
mov byte [0x100713d1], 1
call fcn.1003ef30
test ax, ax
je 0x1003ed4d
mov eax, dword [0x100713d4]
mov eax, dword [eax + 0xc]
test eax, eax
je 0x1003ed4d
call eax
cmp byte [0x100713d1], 0
je 0x1003ed4d
push 0x48
push dword [0x100713d4]
call fcn.10002a03
xor eax, eax
mov dword [0x100713d4], esi
mov ecx, 0x2710
mov edi, 0x100713e0
rep stosd dword es:[edi], eax
mov ecx, dword [0x1007b048]
add esp, 8
test ecx, ecx
je 0x1003ecf7
mov edx, dword [0x1007b044]
test edx, edx
je 0x1003eceb
mov eax, dword [ecx]
push edx
push ecx
call dword [eax + 0x50]
mov eax, dword [0x1007b044]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov ecx, dword [0x1007b048]
mov dword [0x1007b044], esi
mov eax, dword [ecx]
push ecx
call dword [eax + 8]
mov dword [0x1007b048], esi
cmp dword [0x10070880], esi
je 0x1003ed2a
cmp dword [0x10070884], 8
mov eax, 0x10070870
cmovae eax, dword [0x10070870]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
push 0x1004631c
mov ecx, 0x10070870
call fcn.10001a20
cmp byte [0x100713d0], 0
mov byte [0x100713d2], 0
je 0x1003ed4d
push dword [0x100713d8]
call dword [sym.imp.KERNEL32.dll_FreeLibrary]
mov byte [0x100713d0], 0
call fcn.1003ef30
test ax, ax
je 0x1003edc3
mov eax, dword [0x100713d4]
mov eax, dword [eax + 8]
test eax, eax
je 0x1003edc3
call eax
cmp byte [0x100713d0], 0
movzx esi, ax
jne 0x1003edb5
lea ecx, [ebp - 0x28]
call fcn.100158f0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.10013b20
cmp dword [ebp - 0x14], 8
lea eax, [ebp - 0x28]
cmovae eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [0x100713d8], eax
mov byte [0x100713d0], 1
mov dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10001800
mov byte [0x100713d1], 0
mov byte [0x100713d2], 1
mov ax, si
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100029f5
mov esp, ebp
pop ebp
ret

Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x408ecc
nop
mov ecx, 0x53b904f4
nop
nop
test eax, eax
nop
nop
je 0x43004e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x430024
nop
nop
mov eax, section..data
nop
nop
mov ebx, 0x42e1d0
nop
mov ecx, 0x453b07e0
nop
nop
nop
nop
test eax, eax
je 0x430084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x43006c
nop
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x401219
Function at 0x1000f290
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x10208238
push 0x10041500
mov eax, dword fs:[0]
push eax
sub esp, 0x58
push ebx
push esi
push edi
mov eax, dword [0x1020e080]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
mov dl, 0x22
mov dword [ebp - 0x34], 0x47515722
mov dword [ebp - 0x30], 0xc101150
mov dword [ebp - 0x2c], 0x4e4e46
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0xa
jae 0x1000f2fb
mov al, byte [ebp + ecx - 0x33]
xor al, dl
mov byte [ebp + ecx - 0x33], al
inc ecx
mov dl, byte [ebp - 0x34]
jmp 0x1000f2e3
mov byte [ebp - 0x29], 0
lea eax, [ebp - 0x33]
push eax
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryA]
call esi
mov ebx, eax
mov dl, 0xb
mov dword [ebp - 0x54], 0x796e600b
mov dword [ebp - 0x50], 0x38676e65
mov dword [ebp - 0x4c], 0x676f2539
mov word [ebp - 0x48], 0x67
xor ecx, ecx
mov dword [ebp - 0x20], ecx
cmp ecx, 0xc
jae 0x1000f344
mov al, byte [ebp + ecx - 0x53]
xor al, dl
mov byte [ebp + ecx - 0x53], al
inc ecx
mov dl, byte [ebp - 0x54]
jmp 0x1000f32c
mov byte [ebp - 0x47], 0
lea eax, [ebp - 0x53]
push eax
call esi
mov edi, eax
mov dl, 0x16
mov dword [ebp - 0x44], 0x787f5016
mov dword [ebp - 0x40], 0x787f4172
mov dword [ebp - 0x3c], 0x57617972
mov byte [ebp - 0x38], 0
xor ecx, ecx
mov dword [ebp - 0x24], ecx
cmp ecx, 0xb
jae 0x1000f385
mov al, byte [ebp + ecx - 0x43]
xor al, dl
mov byte [ebp + ecx - 0x43], al
inc ecx
mov dl, byte [ebp - 0x44]
jmp 0x1000f36d
mov byte [ebp - 0x38], 0
lea eax, [ebp - 0x43]
push eax
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
call esi
mov dword [0x10215f48], eax
movaps xmm0, xmmword [0x102056b0]
movups xmmword [ebp - 0x68], xmm0
mov word [ebp - 0x58], 0x45
xor ecx, ecx
mov dword [ebp - 0x28], ecx
cmp ecx, 0x10
jae 0x1000f3c4
mov al, byte [ebp + ecx - 0x67]
xor al, byte [ebp - 0x68]
mov byte [ebp + ecx - 0x67], al
inc ecx
jmp 0x1000f3ae
mov byte [ebp - 0x57], 0
lea eax, [ebp - 0x67]
push eax
push edi
call esi
mov dword [0x102160a8], eax
cmp dword [0x10215f48], 0
je 0x1000f3e1
test eax, eax
jne 0x1000f3f8
push ebx
mov esi, dword [sym.imp.KERNEL32.dll_FreeLibrary]
call esi
push edi
call esi
jmp 0x1000f3f8
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000f440
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1020a800
push 0x10041500
mov eax, dword fs:[0]
push eax
sub esp, 0x18
mov eax, dword [0x1020e080]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov esi, dword [0x1021726c]
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
push 0x40
push 6
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov eax, 0x10011d80
sub eax, esi
sub eax, 5
mov byte [esi], 0xe9
mov dword [esi + 1], eax
mov eax, 5
mov dword [ebp - 0x28], eax
cmp eax, 6
jae 0x1000f4b6
mov byte [esi + eax], 0x60
inc eax
jmp 0x1000f4a7
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push 6
push esi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1000f4d1
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1003d35c
mov esp, ebp
pop ebp
ret

Function at 0x1000f500
Capabilities:
Set console window title

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x1020e080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_AllocConsole]
mov cl, 0x4a
mov byte [ebp - 0x16], 0
mov bh, 0x29
mov byte [ebp - 0x18], cl
mov al, 0x3d
mov byte [ebp - 8], 0
xor al, cl
mov byte [ebp - 0x16], 0
mov cl, 0x66
mov byte [ebp - 0x17], al
mov bl, cl
mov byte [ebp - 0x10], bh
mov al, 0x6a
mov byte [ebp - 8], 0
mov dl, 0x67
mov ah, 0x7c
mov ch, 0x7d
mov dh, 0xd
xor al, bh
xor cl, bh
xor dl, bh
mov byte [ebp - 0xf], al
xor ah, bh
mov byte [ebp - 0xe], cl
xor ch, bh
mov byte [ebp - 0xd], dl
xor dh, bh
mov byte [ebp - 0xb], ah
xor bl, bh
mov byte [ebp - 0xa], ch
push 1
mov byte [ebp - 0xc], bl
mov byte [ebp - 9], dh
call fcn.10048441
add esp, 4
push eax
lea eax, [ebp - 0x17]
push eax
lea eax, [ebp - 0xf]
push eax
call fcn.10045105
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetConsoleWindow]
mov esi, eax
lea eax, [ebp - 0x14]
push eax
push esi
call dword [sym.imp.USER32.dll_GetWindowRect]
push 1
push 0x320
push 0x1f4
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push esi
call dword [sym.imp.USER32.dll_MoveWindow]
push 0x10201d48
call dword [sym.imp.KERNEL32.dll_SetConsoleTitleA]
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d35c
mov esp, ebp
pop ebp
ret
Function at 0x1000f5d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1020a820
push 0x10041500
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x1020e080]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov bl, dl
mov edi, ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
push 0x40
push 8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov byte [edi], bl
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push 8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1000f63d
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1003d35c
mov esp, ebp
pop ebp
ret

Function at 0x1000f660
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1020a840
push 0x10041500
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x1020e080]
xor dword [ebp - 8], eax
xor eax, ebp
mov dword [ebp - 0x1c], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov ebx, edx
mov edi, ecx
mov dword [ebp - 4], 0
lea eax, [ebp - 0x20]
push eax
push 0x40
push 8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [edi], ebx
lea eax, [ebp - 0x24]
push eax
push dword [ebp - 0x20]
push 8
push edi
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x1000f6cd
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x1c]
xor ecx, ebp
call fcn.1003d35c
mov esp, ebp
pop ebp
ret

Function at 0x1000f7d0
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [0x1020e080]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
cmp dword [ecx], 0xcccccccc
je 0x1000f7fa
nop dword [eax + eax]
inc esi
cmp dword [ecx + esi], 0xcccccccc
jne 0x1000f7f0
lea eax, [ebp - 8]
push eax
push 0x40
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov ecx, dword [ebp - 4]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.1003d35c
mov esp, ebp
pop ebp
ret
Function at 0x1000f820
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov byte [ebp - 0x10], 5
mov al, 0x6b
xor al, byte [ebp - 0x10]
mov bl, 0x69
mov ah, bl
mov byte [ebp - 0xf], al
mov al, byte [ebp - 0x10]
mov dl, 0x61
mov bh, ah
mov byte [ebp - 1], ah
mov dh, dl
mov byte [ebp - 6], 0
xor dl, al
mov byte [ebp - 6], 0
xor bl, al
mov byte [ebp - 0xd], dl
xor ah, al
mov byte [ebp - 0xc], bl
xor dh, al
mov byte [ebp - 0xb], ah
xor bh, al
mov byte [ebp - 9], dh
mov cl, 0x71
mov byte [ebp - 8], bh
xor cl, al
mov ch, 0x2b
xor ch, al
mov byte [ebp - 0xe], cl
mov al, byte [ebp - 1]
xor al, byte [ebp - 0x10]
mov byte [ebp - 7], al
lea eax, [ebp - 0xf]
push eax
mov byte [ebp - 0xa], ch
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
movaps xmm0, xmmword [0x10205990]
mov edx, eax
movups xmmword [ebp - 0x28], xmm0
mov dword [ebp - 0x18], 0x6a624a6b
xor eax, eax
mov dword [ebp - 0x14], 0x7e7568
mov cl, byte [ebp - 0x28]
xor byte [ebp + eax - 0x27], cl
inc eax
cmp eax, 0x16
jb 0x1000f8a2
lea eax, [ebp - 0x27]
mov byte [ebp - 0x11], 0
push eax
push edx
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [0x10215fe0], eax
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000f8d0
Capabilities:
Resolve dns
Send icmp echo request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
mov eax, dword [0x1020e080]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push ecx
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x1000f9de
movsx ecx, word [eax + 0xa]
xorps xmm0, xmm0
mov eax, dword [eax + 0xc]
push ecx
movups xmmword [ebp - 0x48], xmm0
push dword [eax]
lea eax, [ebp - 0x44]
push eax
call fcn.10041830
add esp, 0xc
call dword [sym.imp.IPHLPAPI.DLL_IcmpCreateFile]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000f9de
push dword [ebp - 0x44]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
push eax
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ecx, dword [0x10201d54]
movq xmm0, qword [str.Data_Buffer]
push 0x3e8
push 0x28
mov dword [ebp - 8], ecx
lea ecx, [ebp - 0x38]
push ecx
push 0
push 0xc
lea ecx, [ebp - 0x10]
movq qword [ebp - 0x10], xmm0
push ecx
push eax
push esi
call dword [sym.imp.IPHLPAPI.DLL_IcmpSendEcho]
push esi
test eax, eax
je 0x1000f9bb
call dword [sym.imp.IPHLPAPI.DLL_IcmpCloseHandle]
push 0x14
call fcn.1003d9d9
add esp, 4
mov byte [ebp - 0x4c], 0
mov esi, eax
mov byte [ebp - 0x4c], 0
mov al, 0x79
mov cl, 0x5c
mov dl, 0x15
mov byte [ebp - 0x50], al
push dword [ebp - 0x30]
mov bl, 0x1d
xor cl, al
xor dl, al
mov byte [ebp - 0x4f], cl
xor bl, al
mov byte [ebp - 0x4e], dl
lea eax, [ebp - 0x4f]
mov byte [ebp - 0x4d], bl
push eax
push esi
call fcn.1000e480
add esp, 0xc
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003d35c
mov esp, ebp
pop ebp
ret
call dword [sym.imp.IPHLPAPI.DLL_IcmpCloseHandle]
push 0xc
call fcn.1003d9d9
add esp, 4
lea eax, [ebp - 0x4f]
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1003d35c
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov eax, 0x10072181
pop esi
xor ecx, ebp
pop ebx
call fcn.1003d35c
mov esp, ebp
pop ebp
ret
Function at 0x10012f10
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, ecx
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_GetWindowLongA]
and eax, 0xff30ffff
push eax
push 0xfffffffffffffff0
push edi
call dword [sym.imp.USER32.dll_SetWindowLongA]
push 0x464
push 1
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
push eax
push 0
push 0
push 0
push edi
call dword [sym.imp.USER32.dll_SetWindowPos]
push 3
push edi
call dword [sym.imp.USER32.dll_ShowWindow]
pop edi
ret
Function at 0x10012fd0
Capabilities:
Allocate or change rwx memory
Execute shellcode via indirect call
Get number of processors
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10068610
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x1020e080]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov bl, cl
mov dword [ebp - 4], 0
mov edx, 0x20
mov eax, dword [0x102175ec]
add eax, 0x64
mov dword [0x10215f24], eax
lea ecx, [eax - 0xc]
call fcn.1000f660
mov esi, dword [0x10217294]
lea eax, [ebp - 0x18]
mov edi, dword [sym.imp.KERNEL32.dll_VirtualProtect]
add esi, 0x18
push eax
push 0x40
push 8
push esi
mov dword [ebp - 0x1c], 0
call edi
movzx eax, bl
mov dword [esi], eax
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x18]
push 8
push esi
call edi
mov esi, dword [0x10217294]
lea eax, [ebp - 0x18]
push eax
push 0x40
push 8
add esi, 0x30
mov dword [ebp - 0x1c], 0
push esi
call edi
lea eax, [ebp - 0x1c]
mov byte [esi], 0
push eax
push dword [ebp - 0x18]
push 8
push esi
call edi
mov edx, dword [ebp + 8]
test edx, edx
je 0x1001308e
mov ecx, 0x1c
call fcn.10012f60
mov edx, dword [ebp + 0xc]
test edx, edx
je 0x1001309f
mov ecx, 0x20
call fcn.10012f60
mov ecx, 0x18
call fcn.1003a810
mov ecx, dword [0x10215f24]
mov edx, eax
add ecx, 0xffffffd4
mov dword [0x1021606c], eax
call fcn.1000f660
mov ecx, 0x3c
call fcn.1003a810
mov ecx, dword [0x10215f24]
mov edx, eax
add ecx, 0xffffffdc
mov dword [0x1021606c], eax
call fcn.1000f660
mov ecx, 0x40
call fcn.1003a810
mov ecx, dword [0x10215f24]
mov edx, eax
add ecx, 0xffffffe0
mov dword [0x1021606c], eax
call fcn.1000f660
mov ecx, 0x30
call fcn.1003a880
movzx ecx, al
mov dl, al
mov dword [0x102172a0], ecx
mov ecx, dword [0x10215f24]
add ecx, 0xffffffd8
call fcn.1000f5d0
mov ecx, 0x31
call fcn.1003a880
movzx ecx, al
mov dl, al
mov dword [0x102172a0], ecx
mov ecx, dword [0x10215f24]
add ecx, 0xffffffe4
call fcn.1000f5d0
mov ecx, 0x51
call fcn.1003a880
mov ecx, dword [0x10215f24]
movzx edx, al
mov dword [0x102172a0], edx
mov dl, al
lea ecx, [ecx - 0x1b]
call fcn.1000f5d0
mov ecx, 0x1c
call fcn.1003a810
mov ecx, dword [0x10215f24]
mov edx, eax
mov dword [0x1021606c], eax
lea ecx, [ecx - 0x18]
call fcn.1000f660
mov ecx, 0x20
call fcn.1003a810
mov ecx, dword [0x10215f24]
mov edx, eax
add ecx, 0xffffffec
mov dword [0x1021606c], eax
call fcn.1000f660
mov ecx, 0x24
call fcn.1003a810
mov ecx, dword [0x10215f24]
mov edx, eax
add ecx, 0xfffffff0
mov dword [0x1021606c], eax
call fcn.1000f660
mov ecx, 0x28
call fcn.1003a810
mov ecx, dword [0x10215f24]
mov edx, eax
add ecx, 0xfffffff8
mov dword [0x1021606c], eax
call fcn.1000f660
mov ecx, 0x2c
call fcn.1003a810
mov ecx, dword [0x10215f24]
mov edx, eax
add ecx, 0xfffffffc
mov dword [0x1021606c], eax
call fcn.1000f660
mov eax, dword [0x10215f24]
sub eax, 0x2c
push eax
call dword [0x10215fec]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1003d35c
mov esp, ebp
pop ebp
ret
Function at 0x1001a850
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push 0xfffffffffffffffe
push 0x1020ace0
push 0x10041500
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x1020e080]
xor dword [ebp - 8], eax
xor eax, ebp
push eax
lea eax, [ebp - 0x10]
mov dword fs:[0], eax
mov dword [ebp - 0x18], esp
mov cl, 0xa
mov dword [ebp - 0x28], 0x63655a0a
mov dword [ebp - 0x24], 0x482a7e64
mov dword [ebp - 0x20], 0x61646b66
mov byte [ebp - 0x1c], 0
xor eax, eax
xor byte [ebp + eax - 0x27], cl
inc eax
cmp eax, 0xb
jae 0x1001a8af
mov cl, byte [ebp - 0x28]
jmp 0x1001a8a0
mov byte [ebp - 0x1c], 0
lea eax, [ebp - 0x27]
push eax
push 0
call dword [sym.imp.USER32.dll_FindWindowA]
push eax
call dword [sym.imp.USER32.dll_IsIconic]
test eax, eax
je 0x1001a8e3
mov byte [0x10215f2d], 1
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 4], 0
jmp 0x1001a8fc
jmp 0x1001a90e
jmp 0x1001a920
jmp 0x1001a932
cmp dword [0x10216008], 0
setne al
movzx eax, al
push eax
cmp dword [0x102172a8], 0
setne al
movzx eax, al
push eax
cmp dword [0x10215f04], 0
setne al
movzx eax, al
push eax
cmp dword [0x10215f5c], 0
setne al
movzx eax, al
push eax
movzx eax, byte [0x10215f89]
push eax
movzx eax, byte [0x10216268]
push eax
cmp dword [0x10215ffc], 0
setne al
movzx eax, al
push eax
cmp dword [0x10215f40], 0
setne dl
mov ecx, dword [0x102144b0]
call fcn.1001a320
add esp, 0x1c
jmp 0x1001a9b2
jmp 0x1001a9bd
mov dword [ebp - 4], 0xfffffffe
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001a9e0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_Sleep]
push esi
mov esi, dword [sym.imp.KERNEL32.dll_GetTickCount64]
push edi
mov edi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
nop dword [eax]
push 9
call edi
shr ax, 0xf
push 0x75
mov byte [0x102160ae], al
call edi
shr ax, 0xf
push 0x76
mov byte [0x10215f2c], al
call edi
shr ax, 0xf
push 0x78
mov byte [0x10215f8e], al
call edi
shr ax, 0xf
push 0x7a
mov byte [0x10215f03], al
call edi
test ax, ax
jns 0x1001aa80
cmp dword [0x102144b0], 6
mov byte [0x10215f2e], 1
jg 0x1001aa74
call esi
mov ecx, dword [0x1021761c]
add ecx, 0x1f4
test edx, edx
jb 0x1001aa87
ja 0x1001aa65
cmp eax, ecx
jbe 0x1001aa87
call esi
inc dword [0x102144b0]
mov dword [0x1021761c], eax
jmp 0x1001aa87
mov dword [0x102144b0], 1
jmp 0x1001aa87
mov byte [0x10215f2e], 0
call esi
mov ecx, dword [0x10215f10]
add ecx, 0x12c
test edx, edx
jb 0x1001aae8
ja 0x1001aa9f
cmp eax, ecx
jbe 0x1001aae8
call esi
cmp dword [0x10215f5c], 1
mov dword [0x10215f10], eax
jne 0x1001aadb
mov eax, dword [0x10215f68]
add eax, dword [0x10216258]
push 0
push eax
call fcn.1003a6d0
add esp, 8
movzx ecx, al
call fcn.100107d0
test eax, eax
je 0x1001aadb
movss xmm0, dword [0x10201f14]
jmp 0x1001aae3
movss xmm0, dword [0x10201f10]
call fcn.100134f0
call esi
mov ecx, dword [0x10217624]
add ecx, 0x64
test edx, edx
jb 0x1001ab10
ja 0x1001aafd
cmp eax, ecx
jbe 0x1001ab10
call esi
mov dword [0x10217624], eax
mov byte [0x10215f8c], 0
call fcn.1001a850
call esi
mov ecx, dword [0x10217620]
add ecx, 0x3e8
test edx, edx
jb 0x1001ab34
ja 0x1001ab28
cmp eax, ecx
jbe 0x1001ab34
call esi
mov dword [0x10217620], eax
call fcn.1000fe30
push 0xa
call ebx
jmp 0x1001aa00
Function at 0x1001b7c0
Capabilities:
Enumerate threads
Hijack thread execution
Resume thread
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2fc
mov eax, dword [0x1020e080]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10215ff4]
mov dword [ebp - 0x2f0], eax
mov eax, dword [0x10217230]
push edi
mov dword [ebp - 0x2fc], eax
mov eax, dword [0x10217254]
push 0
mov dword [ebp - 0x2f8], eax
mov eax, dword [0x10217258]
push 4
mov dword [ebp - 0x2f4], eax
call dword [sym.imp.KERNEL32.dll_CreateToolhelp32Snapshot]
mov edi, eax
test edi, edi
je 0x1001b907
push ebx
lea eax, [ebp - 0x2ec]
mov dword [ebp - 0x2ec], 0x1c
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32First]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
jne 0x1001b83a
push edi
call ebx
push esi
nop dword [eax + eax]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
cmp dword [ebp - 0x2e0], eax
jne 0x1001b8ec
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
mov ecx, dword [ebp - 0x2e4]
cmp ecx, eax
je 0x1001b8ec
push ecx
push 0
push 0x1a
call dword [sym.imp.KERNEL32.dll_OpenThread]
mov esi, eax
test esi, esi
je 0x1001b8ec
push esi
mov dword [ebp - 0x2d0], 0x10010
call dword [sym.imp.KERNEL32.dll_SuspendThread]
lea eax, [ebp - 0x2d0]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadContext]
test eax, eax
je 0x1001b8e2
mov eax, dword [ebp - 0x2f4]
mov dword [ebp - 0x2cc], eax
mov eax, dword [ebp - 0x2f8]
mov dword [ebp - 0x2c8], eax
mov eax, dword [ebp - 0x2fc]
mov dword [ebp - 0x2c4], eax
mov eax, dword [ebp - 0x2f0]
mov dword [ebp - 0x2c0], eax
lea eax, [ebp - 0x2d0]
push eax
push esi
mov dword [ebp - 0x2b8], 0x55
call dword [sym.imp.KERNEL32.dll_SetThreadContext]
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push esi
call ebx
lea eax, [ebp - 0x2ec]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_Thread32Next]
test eax, eax
jne 0x1001b840
pop esi
push edi
call ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop edi
call fcn.1003d35c
mov esp, ebp
pop ebp
ret