joyce8/EMBER2024-capa huggingface dataset:
Function at 0x477480
Capabilities:
Check for software breakpoints

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x10], 0xca
jne 0x4774ae
mov eax, ebx
call fcn.00477f24
cmp dword [ebx + 0x3c], 0
je 0x4774a7
mov dword [ebx + 0x10], 0xcf
mov eax, 1
pop ebx
ret
mov dword [ebx + 0x10], 0xcb
cmp dword [ebx + 0x10], 0xcb
jne 0x47751f
mov edx, dword [ebx + 0x1a6]
cmp dword [edx + 0x10], 0
je 0x477511
cmp dword [ebx + 8], 0
je 0x4774d0
mov eax, ebx
mov edx, dword [eax + 8]
call dword [edx]
mov eax, ebx
mov edx, dword [eax + 0x1a6]
call dword [edx]
test eax, eax
jne 0x4774e2
xor eax, eax
pop ebx
ret
cmp eax, 2
je 0x477511
cmp dword [ebx + 8], 0
je 0x4774c3
cmp eax, 3
je 0x4774f5
dec eax
jne 0x4774c3
mov edx, dword [ebx + 8]
inc dword [edx + 4]
mov ecx, dword [edx + 4]
mov eax, dword [ebx + 8]
cmp ecx, dword [eax + 8]
jl 0x4774c3
mov edx, dword [ebx + 0x132]
add dword [eax + 8], edx
jmp 0x4774c3
mov ecx, dword [ebx + 0x8c]
mov dword [ebx + 0x94], ecx
jmp 0x47753d
cmp dword [ebx + 0x10], 0xcc
je 0x47753d
mov eax, dword [ebx]
mov dword [eax + 0x14], 0x12
mov edx, dword [ebx + 0x10]
mov dword [eax + 0x18], edx
mov eax, ebx
mov edx, dword [eax]
call dword [edx]
mov eax, ebx
call fcn.00477548
pop ebx
ret

Function at 0x488638
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
push 0
mov eax, dword [0x4c49d8]
call fcn.004374a4
push eax
call sub.user32.dll_ShowWindow
push 5
mov eax, dword [0x4c3370]
mov eax, dword [eax]
call fcn.004374a4
push eax
call sub.user32.dll_ShowWindow
mov dword [ebx + 0x318], 1
pop ebx
ret

Function at 0x4899e0
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
cmp dword [ebx + 0x2dc], 1
jne 0x489a4c
cmp dword [ebx + 0x2e0], 0
jne 0x489a2f
push 5
mov eax, dword [0x4c3370]
mov eax, dword [eax]
call fcn.004374a4
push eax
call sub.user32.dll_ShowWindow
mov eax, dword [0x4c3024]
mov eax, dword [eax]
cmp dword [eax + 0x318], 0
jne 0x489a45
push 5
mov eax, dword [0x4c3024]
mov eax, dword [eax]
call fcn.004374a4
push eax
call sub.user32.dll_ShowWindow
jmp 0x489a45
mov eax, dword [0x4c30ec]
cmp dword [eax], 0
je 0x489a45
mov eax, dword [0x4c30ec]
mov eax, dword [eax]
call fcn.0044c76c
mov eax, ebx
call fcn.0044c5b4
pop ebx
ret
Function at 0x4a7aa0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
push esi
mov ebx, eax
xor eax, eax
push ebp
push 0x4a7bfa
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x698]
mov eax, dword [eax + 0x254]
call fcn.0045c9d0
test eax, eax
jle 0x4a7bdf
mov eax, dword [ebx + 0x698]
call fcn.0045e570
call fcn.0045c228
mov esi, dword [ebx + 0x4fac0]
mov edx, esi
dec edx
cmp eax, edx
jle 0x4a7bc2
cmp esi, 0x64
jge 0x4a7bc2
mov dl, 1
mov eax, dword [ebx + 0x790]
call fcn.00452844
push 0x4a7c10
lea edx, [ebp - 4]
mov eax, dword [ebx + 0x4fac0]
call fcn.004090ac
push dword [ebp - 4]
push 0x4a7c30
push 0x4a7c44
push 0x4a7c50
lea eax, [ebx + 0xa55c]
mov edx, 5
call fcn.00403f00
push 9
lea edx, [ebp - 0xc]
mov eax, dword [0x4c3254]
mov eax, dword [eax]
call fcn.0044fd68
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00409400
mov eax, dword [ebp - 8]
call fcn.00404004
push eax
mov eax, dword [0x4c63a4]
mov edx, dword [eax + 0x4fa8c]
lea eax, [ebp - 0x10]
mov ecx, 0x4a7c84
call fcn.00403e8c
mov eax, dword [ebp - 0x10]
call fcn.00404004
push eax
lea edx, [ebp - 0x18]
mov eax, dword [0x4c3254]
mov eax, dword [eax]
call fcn.0044fd68
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00409434
mov eax, dword [ebp - 0x14]
call fcn.00404004
push eax
push 0x4a7ca0
mov eax, dword [0x4c3254]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4a7bdf
xor edx, edx
mov eax, dword [ebx + 0x698]
call fcn.0045e2f8
mov eax, dword [ebx + 0x698]
call fcn.0045e570
call fcn.0045c654
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a7c01
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00403be4
ret
Function at 0x4a7ca8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4a7e27
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebx + 0x698]
mov eax, dword [eax + 0x254]
call fcn.0045c9d0
test eax, eax
jle 0x4a7e0c
mov eax, dword [ebx + 0x698]
call fcn.0045e570
call fcn.0045c228
mov edx, dword [ebx + 0x4fac0]
dec edx
cmp eax, edx
jle 0x4a7dcb
cmp dword [ebx + 0x4fabc], 0xb
jne 0x4a7dcb
mov dl, 1
mov eax, dword [ebx + 0x790]
call fcn.00452844
push 0x4a7e3c
lea edx, [ebp - 4]
mov eax, dword [ebx + 0x4fac0]
call fcn.004090ac
push dword [ebp - 4]
push 0x4a7e58
push 0x4a7e68
push 0x4a7e74
lea eax, [ebx + 0xa55c]
mov edx, 5
call fcn.00403f00
push 9
lea edx, [ebp - 0xc]
mov eax, dword [0x4c3254]
mov eax, dword [eax]
call fcn.0044fd68
mov eax, dword [ebp - 0xc]
lea edx, [ebp - 8]
call fcn.00409400
mov eax, dword [ebp - 8]
call fcn.00404004
push eax
mov eax, dword [0x4c63a4]
mov edx, dword [eax + 0x4fa8c]
lea eax, [ebp - 0x10]
mov ecx, 0x4a7ea8
call fcn.00403e8c
mov eax, dword [ebp - 0x10]
call fcn.00404004
push eax
lea edx, [ebp - 0x18]
mov eax, dword [0x4c3254]
mov eax, dword [eax]
call fcn.0044fd68
mov eax, dword [ebp - 0x18]
lea edx, [ebp - 0x14]
call fcn.00409434
mov eax, dword [ebp - 0x14]
call fcn.00404004
push eax
push 0x4a7ec4
mov eax, dword [0x4c3254]
mov eax, dword [eax]
mov eax, dword [eax + 0x24]
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4a7e0c
push 1
mov ecx, 0x4a7ecc
mov edx, 0x4a7ed4
mov eax, dword [0x4c3254]
mov eax, dword [eax]
call fcn.0044f9f8
dec eax
jne 0x4a7e0c
mov eax, dword [ebx + 0x698]
call fcn.0045e570
call fcn.0045c228
mov edx, eax
mov eax, ebx
call fcn.004a7ef0
mov edx, dword [ebx + 0xaea0]
mov eax, ebx
call fcn.004a3a70
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4a7e2e
lea eax, [ebp - 0x18]
mov edx, 6
call fcn.00403be4
ret
Function at 0x4b02c8
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4b02d0
push ecx
push ebx
mov ebx, eax
xor eax, eax
push ebp
push 0x4b0470
push dword fs:[eax]
mov dword fs:[eax], esp
cmp dword [ebx + 0x4fad0], 0
je 0x4b0302
lea edx, [ebp - 4]
mov eax, dword [ebx + 0x4fad0]
call fcn.00408f2c
jmp 0x4b0359
call fcn.0042c42c
lea edx, [ebp - 0x10]
call fcn.0042c04c
mov eax, dword [ebx + 0x6f8]
call fcn.00428070
call fcn.0042c42c
lea edx, [ebp - 0x14]
call fcn.0042c04c
mov eax, dword [ebp - 0x14]
lea edx, [ebp - 4]
call fcn.00408f2c
call fcn.0042c42c
mov edx, dword [ebp - 0x10]
call fcn.0042c0cc
mov eax, dword [ebx + 0x6f8]
mov edx, dword [eax]
call dword [edx + 0xb8]
test eax, eax
jne 0x4b0359
lea eax, [ebp - 4]
call fcn.00403bc0
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00408f2c
cmp dword [ebp - 0x18], 0
jne 0x4b0377
lea eax, [ebp - 4]
mov edx, 0x4b0484
call fcn.00403c58
lea eax, [ebp - 8]
push eax
mov ecx, 7
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404048
lea eax, [ebp - 0xc]
push eax
mov ecx, 4
mov edx, 1
mov eax, dword [ebp - 4]
call fcn.00404048
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.00408d90
mov eax, dword [ebp - 0x1c]
mov edx, 0x4b04ac
call fcn.00403f50
jne 0x4b03e0
push 3
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404004
push eax
push 0
mov eax, dword [0x4c63a4]
call fcn.004374a4
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4b044a
mov eax, dword [ebx + 0x3e8]
cmp byte [eax + 0x2c], 0
jne 0x4b0440
lea edx, [ebp - 0x20]
mov eax, dword [ebp - 8]
call fcn.00408d90
mov eax, dword [ebp - 0x20]
mov edx, 0x4b04bc
call fcn.00403f50
je 0x4b0420
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 0xc]
call fcn.00408d90
mov eax, dword [ebp - 0x24]
mov edx, 0x4b04cc
call fcn.00403f50
jne 0x4b0440
push 3
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404004
push eax
push 0
mov eax, ebx
call fcn.004374a4
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4b044a
mov edx, dword [ebp - 4]
mov eax, ebx
call fcn.004b04d4
lea eax, [ebx + 0x4fad0]
call fcn.00403bc0
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b0477
lea eax, [ebp - 0x24]
mov edx, 9
call fcn.00403be4
ret
Function at 0x4b04d4
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
mov ecx, 4
push 0
push 0
dec ecx
jne 0x4b04dc
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], edx
mov esi, eax
mov eax, dword [ebp - 4]
call fcn.00403ff4
xor eax, eax
push ebp
push 0x4b06c5
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 0x10]
call fcn.00403bc0
lea eax, [ebp - 0x10]
call fcn.00403bc0
mov dl, 1
mov eax, dword [0x4606a4]
call fcn.004607a4
mov ebx, eax
mov edx, 0x80000000
mov eax, ebx
call fcn.00460844
xor ecx, ecx
mov edx, 0x4b06dc
mov eax, ebx
call fcn.004608a8
test al, al
je 0x4b058e
lea ecx, [ebp - 8]
xor edx, edx
mov eax, ebx
call fcn.00460a70
lea edx, [ebp - 0x14]
mov eax, dword [ebp - 8]
call fcn.00408d90
mov edx, dword [ebp - 0x14]
mov eax, 0x4b0704
call fcn.0040412c
mov edi, eax
lea eax, [ebp - 8]
push eax
lea ecx, [edi + 2]
mov edx, 2
mov eax, dword [ebp - 8]
call fcn.00404048
lea edx, [ebp - 0x10]
mov eax, dword [ebp - 8]
call fcn.00409434
lea edx, [ebp - 0xc]
mov eax, dword [ebp - 8]
call fcn.00409400
mov eax, ebx
call fcn.00460814
mov eax, ebx
call fcn.00402f38
cmp dword [ebp - 0x10], 0
je 0x4b0660
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
call fcn.00408d90
mov edx, dword [ebp - 0x18]
mov eax, 0x4b0714
call fcn.0040412c
test eax, eax
jg 0x4b05de
lea edx, [ebp - 0x1c]
mov eax, dword [ebp - 4]
call fcn.00408d90
mov edx, dword [ebp - 0x1c]
mov eax, 0x4b0724
call fcn.0040412c
test eax, eax
jle 0x4b0612
push 3
mov eax, dword [ebp - 0xc]
call fcn.00404004
push eax
mov eax, dword [ebp - 4]
call fcn.00404004
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404004
push eax
push 0x4b072c
mov eax, esi
call fcn.004374a4
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4b06aa
lea ecx, [ebp - 0x20]
mov edx, dword [ebp - 4]
mov eax, esi
call fcn.004b32d0
mov ecx, dword [ebp - 0x20]
lea eax, [ebp - 4]
mov edx, 0x4b073c
call fcn.00403e8c
push 3
mov eax, dword [ebp - 0xc]
call fcn.00404004
push eax
mov eax, dword [ebp - 4]
call fcn.00404004
push eax
mov eax, dword [ebp - 0x10]
call fcn.00404004
push eax
push 0x4b072c
mov eax, esi
call fcn.004374a4
push eax
call sub.shell32.dll_ShellExecuteA
jmp 0x4b06aa
lea edx, [ebp - 0x24]
mov eax, dword [ebp - 4]
call fcn.00408d90
mov edx, dword [ebp - 0x24]
mov eax, 0x4b0714
call fcn.0040412c
test eax, eax
jne 0x4b068c
lea eax, [ebp - 4]
mov ecx, dword [ebp - 4]
mov edx, 0x4b0714
call fcn.00403e8c
push 3
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00404004
push eax
push 0
mov eax, esi
call fcn.004374a4
push eax
call sub.shell32.dll_ShellExecuteA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b06cc
lea eax, [ebp - 0x24]
mov edx, 9
call fcn.00403be4
ret
Function at 0x4b3944
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00403ff4
xor eax, eax
push ebp
push 0x4b3b49
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
shl eax, 8
mov edx, dword [ebp - 4]
movzx edx, byte [edx + 1]
add eax, edx
cmp eax, 0xc2e8
jge 0x4b3a33
cmp eax, 0xb7a2
jge 0x4b39d6
cmp eax, 0xb2c1
jge 0x4b39ab
add eax, 0xffff4f5f
sub eax, 0x24
jb 0x4b3ad5
sub eax, 0x1fc
jb 0x4b3ad9
jmp 0x4b3b31
add eax, 0xffff4d3f
sub eax, 0x22d
jb 0x4b3add
sub eax, 0x1fc
jb 0x4b3ae1
sub eax, 0xb8
jb 0x4b3ae5
jmp 0x4b3b31
cmp eax, 0xbbf7
jge 0x4b3a08
add eax, 0xffff485e
sub eax, 0x11f
jb 0x4b3ae9
sub eax, 0x13d
jb 0x4b3aed
sub eax, 0x1f9
jb 0x4b3af1
jmp 0x4b3b31
add eax, 0xffff4409
sub eax, 0x3af
jb 0x4b3af5
sub eax, 0x106
jb 0x4b3af9
sub eax, 0x23c
jb 0x4b3afd
jmp 0x4b3b31
cmp eax, 0xc8f6
jge 0x4b3a93
cmp eax, 0xc5be
jge 0x4b3a6a
add eax, 0xffff3d18
sub eax, 0x1db
jb 0x4b3b01
sub eax, 0xf3
jb 0x4b3b05
sub eax, 8
jb 0x4b3b09
jmp 0x4b3b31
add eax, 0xffff3a42
sub eax, 0x11c
jb 0x4b3b0d
sub eax, 0x1e1
jb 0x4b3b11
sub eax, 0x3b
jb 0x4b3b15
jmp 0x4b3b31
cmp eax, 0xcef4
jge 0x4b3ab6
add eax, 0xffff370a
sub eax, 0x304
jb 0x4b3b19
sub eax, 0x1e0
jb 0x4b3b1d
sub eax, 0x11a
jb 0x4b3b21
jmp 0x4b3b31
add eax, 0xffff310c
sub eax, 0x295
jb 0x4b3b25
add eax, 0xffffffd0
sub eax, 0x318
jb 0x4b3b29
sub eax, 0x329
jb 0x4b3b2d
jmp 0x4b3b31
mov bl, 0x41
jmp 0x4b3b33
mov bl, 0x42
jmp 0x4b3b33
mov bl, 0x43
jmp 0x4b3b33
mov bl, 0x44
jmp 0x4b3b33
mov bl, 0x45
jmp 0x4b3b33
mov bl, 0x46
jmp 0x4b3b33
mov bl, 0x47
jmp 0x4b3b33
mov bl, 0x48
jmp 0x4b3b33
mov bl, 0x4a
jmp 0x4b3b33
mov bl, 0x4b
jmp 0x4b3b33
mov bl, 0x4c
jmp 0x4b3b33
mov bl, 0x4d
jmp 0x4b3b33
mov bl, 0x4e
jmp 0x4b3b33
mov bl, 0x4f
jmp 0x4b3b33
mov bl, 0x50
jmp 0x4b3b33
mov bl, 0x51
jmp 0x4b3b33
mov bl, 0x52
jmp 0x4b3b33
mov bl, 0x53
jmp 0x4b3b33
mov bl, 0x54
jmp 0x4b3b33
mov bl, 0x57
jmp 0x4b3b33
mov bl, 0x58
jmp 0x4b3b33
mov bl, 0x59
jmp 0x4b3b33
mov bl, 0x5a
jmp 0x4b3b33
mov bl, 0x20
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4b3b50
lea eax, [ebp - 4]
call fcn.00403bc0
ret
Function at 0x10001370
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov word [0x4d99ad], 0x9090
mov word [0x4d99af], 0x9090
push 0
mov word [0x4d99b1], 0x9090
push str.ScreenShot
mov bl, 0x90
mov word [0x4d99b3], 0x9090
call dword [sym.imp.KERNEL32.dll_CreateDirectoryA]
mov dword [0x61ff59], 0x10022280
mov word [0x58b6cd], 0x9090
mov word [0x58b6cf], 0x9090
mov byte [0x58b6d1], bl
mov word [0x408abf], 0x9090
mov word [0x408ac1], 0x9090
mov byte [0x408ac3], bl
mov al, 0x2f
mov byte [0x5cd9a7], al
mov byte [0x58fbaf], al
mov byte [0x58fac8], al
mov word [0x58b677], 0x9090
mov word [0x58b679], 0x9090
mov byte [0x58b67b], bl
mov word [0x594264], 0x9090
mov word [0x594266], 0x9090
mov byte [0x594268], bl
mov word [0x5cd966], 0x9090
mov word [0x5cd968], 0x9090
mov byte [0x5cd96a], bl
mov word [0x5dacd2], 0x28e9
push 5
mov word [0x5dacd4], 2
push 0x41ad1b
mov word [0x5dacd6], 0x9000
call fcn.10001750
push 5
push 0x41ad59
call fcn.10001750
push 5
push 0x41ad5e
call fcn.10001750
push 5
push 0x41ad92
call fcn.10001750
push 2
push 0x4198a2
call fcn.10001750
push 5
push 0x4198ab
call fcn.10001750
push 5
push 0x5df485
call fcn.10001750
push 5
push 0x422a02
call fcn.10001750
mov eax, 0x69159c
mov byte [eax], 0xa0
mov dword [ebp - 4], 0x90900d6a
mov eax, dword [ebp - 4]
mov dword [0x4b3c0a], eax
mov dword [0x4b3c4a], eax
mov ecx, 0x90909090
mov edx, 0x4b3c8a
mov dword [edx], ecx
mov word [edx + 4], cx
mov dword [0x4b3c8a], eax
mov al, 0x7f
mov byte [0x5f71ae], al
mov byte [0x5f72cf], al
mov byte [0x5f72fa], al
mov byte [0x5f733e], al
mov byte [0x5f7382], al
mov byte [0x5f73c6], al
mov byte [0x5f7420], al
mov byte [0x5f74e3], al
mov byte [0x5f750e], al
mov byte [0x5f7db1], al
mov byte [0x5f7e72], al
add esp, 0x40
mov byte [0x5f5512], al
mov byte [0x5f5a32], al
mov byte [0x5f5ac5], al
mov byte [0x5f5b50], al
mov byte [0x5f5bc1], al
mov byte [0x5f559d], al
mov byte [0x504079], 0x8c
mov byte [0x5f345b], 0x10
mov word [0x4ca845], 0x9090
mov dword [0x4b248b], 0x10001260
call fcn.1000fb50
mov ecx, 0x100399c8
call fcn.10010700
push 0x10001330
push 0x620369
call fcn.10001730
push 0x1000fb90
push 0x6042d8
call fcn.10001780
push 0x1000fc20
push 0x6042dd
call fcn.10001780
call fcn.1000ff90
push 0x10001980
push 0x59192a
push pe_nt_image_headers32
call fcn.100017a0
add esp, 0x24
call fcn.10002280
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100015d0
Capabilities:
Create thread
Log keystrokes via application hook

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x104
mov eax, dword [0x100376d0]
xor eax, ebp
mov dword [ebp - 4], eax
push 0xa8
push 0x27
push 0x38
push 0x95
lea eax, [ebp - 0x104]
push str._d._d._d._d
push eax
call fcn.10001350
lea ecx, [ebp - 0x104]
push ecx
call fcn.10001820
add esp, 0x1c
call fcn.10001370
push str.._Glow.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [0x10038a04], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThreadId]
push eax
push 0
push 0x10001010
push 2
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
push 0
push 0
push 0
push 0x1000ec00
push 0
push 0
mov dword [0x10038a08], eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [ebp - 4]
xor ecx, ebp
mov dword [0x10038b44], eax
call fcn.100119ff
mov esp, ebp
pop ebp
ret

Function at 0x100017c0
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 8]
push eax
push str.SoftwareWebzenMUConfig
push 0x80000001
mov dword [ebp - 4], 0
mov dword [ebp - 0xc], 4
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyA]
test eax, eax
jne 0x10001819
lea ecx, [ebp - 0xc]
push ecx
mov ecx, dword [ebp - 8]
lea edx, [ebp - 4]
push edx
push eax
push eax
mov eax, dword [ebp + 8]
push eax
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x1000180f
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp - 8]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10001820
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
lea eax, [ebp - 4]
push eax
push 2
push 0
push str.SoftwareWebzenMuConfig
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov edi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
je 0x1000184d
mov ecx, dword [ebp - 4]
push ecx
call edi
push esi
mov esi, dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_lstrlenA]
mov edx, dword [ebp - 4]
inc eax
push eax
push esi
push 1
push 0
push str.ConnectIp
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
pop esi
test eax, eax
je 0x10001879
mov eax, dword [ebp - 4]
push eax
call edi
mov ecx, dword [ebp - 4]
push ecx
call edi
xor eax, eax
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10002420
Capabilities:
Enumerate processes
Terminate process
Terminate process by name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x378
mov eax, dword [0x100376d0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0
push 2
mov byte [ebp - 0x35d], 0
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x378], esi
cmp esi, 0xffffffff
je 0x10002619
lea eax, [ebp - 0x35c]
push eax
push esi
mov dword [ebp - 0x35c], 0x128
call sub.KERNEL32.dll_Process32First
push ebx
push edi
mov edi, edi
mov ecx, dword [ebp - 0x354]
push ecx
push 0
push 0x1fffff
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov edi, eax
test edi, edi
je 0x10002602
lea ebx, [ebp - 0x24]
xor esi, esi
mov dword [ebp - 0x36c], 0
mov dword [ebp - 0x364], 0x1002c044
sub ebx, 0x1002c044
mov dword [ebp - 0x368], 0x510
jmp 0x100024c0
mov ecx, dword [ebp - 0x364]
lea edx, [ebp - 0x374]
push edx
mov edx, dword [ecx - 4]
push 0x20
lea eax, [ebp - 0x24]
push eax
push edx
push edi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
test eax, eax
je 0x100025b1
mov ecx, 0x20
cmp dword [ebp - 0x374], ecx
jne 0x100025b1
mov eax, dword [ebp - 0x364]
lea ecx, [ecx]
mov edx, dword [ebx + eax]
cmp edx, dword [eax]
jne 0x100025b1
sub ecx, 4
add eax, 4
cmp ecx, 4
jae 0x10002500
push 0
push 0
push esi
push str.:D:__d:_d:_d
push 0x10038a40
call fcn.10001350
add esp, 0x14
lea eax, [ebp - 0x234]
push eax
call dword [sym.imp.KERNEL32.dll_GetLocalTime]
lea ecx, [ebp - 0x224]
push str.Customs.txt
push ecx
call dword [sym.imp.USER32.dll_wsprintfA]
push 0x100223b0
lea edx, [ebp - 0x224]
push edx
lea eax, [ebp - 0x370]
push eax
call fcn.10012688
movzx ecx, word [ebp - 0x228]
movzx edx, word [ebp - 0x22a]
movzx eax, word [ebp - 0x22c]
push 0x10038a40
push ecx
mov ecx, dword [ebp - 0x370]
push edx
push eax
push 0x10022398
push ecx
call fcn.100124c0
mov edx, dword [ebp - 0x370]
push edx
call fcn.1001244c
add esp, 0x30
push 0
push edi
mov byte [ebp - 0x35d], 1
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0x36c]
inc ecx
mov eax, 0x51eb851f
imul ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
imul eax, eax, 0x32
mov dword [ebp - 0x36c], ecx
sub ecx, eax
jne 0x100025de
push 1
call dword [sym.imp.KERNEL32.dll_Sleep]
add dword [ebp - 0x364], 0x24
inc esi
sub ebx, 0x24
dec dword [ebp - 0x368]
jne 0x100024c0
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov esi, dword [ebp - 0x378]
lea ecx, [ebp - 0x35c]
push ecx
push esi
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x10002470
pop edi
pop ebx
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, dword [ebp - 4]
mov al, byte [ebp - 0x35d]
xor ecx, ebp
pop esi
call fcn.100119ff
mov esp, ebp
pop ebp
ret
Function at 0x1001083e
Capabilities:
Parse pe header

Disassembly:
push 0x24
push 0x1002a148
call fcn.10012f60
push 0x1c
lea eax, [ebp - 0x34]
push eax
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
and dword [ebp - 4], 0
mov eax, 0x5a4d
mov edx, dword [ebp - 0x30]
cmp word [edx], ax
jne 0x100108a6
mov eax, dword [edx + 0x3c]
add eax, edx
cmp dword [eax], 0x4550
jne 0x100108a6
mov ecx, dword [eax + 0xd8]
lea esi, [ecx + edx]
cmp dword [ebp + 0xc], esi
jb 0x100108a6
mov eax, dword [eax + 0xdc]
add eax, ecx
add eax, edx
cmp dword [ebp + 0xc], eax
jae 0x100108a6
mov dword [ebp - 4], 0xfffffffe
mov al, 1
jmp 0x100108af
mov dword [ebp - 4], 0xfffffffe
xor al, al
call fcn.10012fa5
ret
Function at 0x100109a7
Capabilities:
Allocate or change rwx memory
Hook routines via microsoft detours

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
mov esi, eax
push edi
mov ebx, 0x10000
cmp esi, 0x7ff80000
jbe 0x100109ca
lea eax, [esi - 0x7ff80000]
mov dword [ebp - 4], eax
jmp 0x100109cd
mov dword [ebp - 4], ebx
cmp esi, 0x80000000
jae 0x100109e0
lea eax, [esi + 0x7ff80000]
mov dword [ebp - 8], eax
jmp 0x100109e7
mov dword [ebp - 8], 0xfff80000
mov eax, dword [0x1003a864]
mov ecx, dword [0x1003a860]
test eax, eax
jne 0x10010a01
test ecx, ecx
je 0x10010a16
mov eax, ecx
mov dword [0x1003a864], eax
mov edx, dword [eax + 8]
test edx, edx
je 0x10010a16
cmp edx, dword [ebp - 4]
jb 0x10010a16
cmp edx, dword [ebp - 8]
jbe 0x10010ae7
mov eax, ecx
test ecx, ecx
jmp 0x10010a3a
test eax, eax
je 0x10010a35
mov ecx, dword [eax + 8]
test ecx, ecx
je 0x10010a35
cmp ecx, dword [ebp - 4]
jb 0x10010a35
cmp ecx, dword [ebp - 8]
jbe 0x10010ae7
mov eax, dword [eax + 4]
test eax, eax
mov dword [0x1003a864], eax
jne 0x10010a1c
mov eax, esi
and eax, 0xffff
sub esi, eax
mov edi, esi
cmp esi, dword [ebp - 4]
jbe 0x10010b79
lea eax, [edi - 0x70000000]
cmp eax, 0x10000000
ja 0x10010a67
mov edi, 0x6fff0000
push 0x1c
lea eax, [ebp - 0x40]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10010b79
cmp dword [ebp - 0x30], ebx
jne 0x10010a86
cmp dword [ebp - 0x34], ebx
jae 0x10010a99
mov edi, dword [ebp - 0x3c]
add edi, 0xffff0000
cmp edi, dword [ebp - 4]
ja 0x10010a55
jmp 0x10010b79
push 0x40
push 0x3000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x1003a864], eax
test eax, eax
je 0x10010b79
mov ecx, dword [0x1003a860]
xor edx, edx
mov dword [eax + 4], ecx
mov dword [eax], 0x52727464
mov dword [eax + 8], edx
mov dword [0x1003a860], eax
lea ecx, [eax + 0xffe0]
mov esi, 0x7fd
mov dword [ecx + 0x18], edx
mov edx, ecx
sub ecx, 0x20
dec esi
jne 0x10010ad9
mov dword [eax + 8], edx
mov esi, dword [eax + 8]
cmp esi, dword [ebp - 4]
jb 0x10010b7e
cmp esi, dword [ebp - 8]
ja 0x10010b7e
mov ecx, dword [esi + 0x18]
push 0x20
push 0xcc
push esi
mov dword [eax + 8], ecx
call fcn.10012700
add esp, 0xc
mov eax, esi
jmp 0x10010b80
lea eax, [esi - 0x70000000]
cmp eax, 0x10000000
ja 0x10010b28
mov esi, 0x80010000
push 0x1c
lea eax, [ebp - 0x24]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
test eax, eax
je 0x10010b7e
cmp dword [ebp - 0x14], ebx
jne 0x10010b73
cmp dword [ebp - 0x18], ebx
jb 0x10010b73
movzx ecx, si
test ecx, ecx
je 0x10010b57
mov eax, ebx
sub eax, ecx
sub dword [ebp - 0x18], eax
add dword [ebp - 0x24], eax
mov esi, dword [ebp - 0x24]
push 0x40
push 0x3000
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov dword [0x1003a864], eax
test eax, eax
jne 0x10010ab5
mov esi, dword [ebp - 0x24]
add esi, dword [ebp - 0x18]
cmp esi, dword [ebp - 8]
jb 0x10010b16
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret