joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4d85b0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x674284]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4d877e
sub esp, 0x44
mov eax, 0
mov dword [esp + 0x40], eax
mov byte [esp + 0x13], 0
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 0
mov eax, dword [esp + 0x48]
movzx ecx, byte [eax + 0x50]
mov byte [esp + 0x12], cl
test cl, cl
je 0x4d86a5
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
lea eax, [0x5448e1]
mov dword [esp], eax
mov dword [esp + 4], 7
call sym.runtime.convTstring
mov eax, dword [esp + 8]
lea ecx, [0x527f00]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
mov dword [esp + 0x2c], ecx
lea eax, [0x576598]
mov dword [esp + 0x30], eax
mov eax, dword [esp + 0x48]
mov dword [esp], eax
lea ecx, [esp + 0x24]
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
mov dword [esp + 0xc], 2
call sym.go_parser._parser_.printTrace
mov eax, dword [esp + 0x48]
inc dword [eax + 0x54]
mov dword [esp + 0x38], 0
mov dword [esp + 0x3c], 0
lea ecx, [sym.go_parser._parser_.parseElement.deferwrap1]
mov dword [esp + 0x38], ecx
mov dword [esp + 0x3c], eax
lea ecx, [esp + 0x38]
mov dword [esp + 0x40], ecx
mov byte [esp + 0x13], 1
mov dword [esp], eax
call sym.go_parser._parser_.parseValue
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x48]
cmp dword [edx + 0x7c], 0x3a
jne 0x4d8750
mov dword [esp + 0x14], eax
mov dword [esp + 0x20], ecx
mov eax, dword [edx + 0x78]
mov dword [esp + 0x18], eax
mov dword [esp], edx
call sym.go_parser._parser_.next
mov eax, dword [esp + 0x48]
mov dword [esp], eax
call sym.go_parser._parser_.parseValue
mov eax, dword [esp + 4]
mov dword [esp + 0x1c], eax
mov ecx, dword [esp + 8]
mov dword [esp + 0x34], ecx
lea edx, [0x531f60]
mov dword [esp], edx
call sym.runtime.newobject
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x14]
mov dword [eax], ecx
mov ecx, dword [0x674338]
test ecx, ecx
jne 0x4d8722
mov ecx, dword [esp + 0x20]
mov ebx, dword [esp + 0x34]
jmp 0x4d8734
call sym.runtime.gcWriteBarrier2
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
mov ebx, dword [esp + 0x34]
mov dword [edi + 4], ebx
mov dword [eax + 4], ecx
mov ebp, dword [esp + 0x18]
mov dword [eax + 8], ebp
mov ebp, dword [esp + 0x1c]
mov dword [eax + 0xc], ebp
mov dword [eax + 0x10], ebx
mov ecx, eax
lea eax, [0x5772f8]
mov dword [esp + 0x4c], eax
mov dword [esp + 0x50], ecx
movzx eax, byte [esp + 0x12]
test al, 1
je 0x4d8771
and eax, 0xfffffffe
mov byte [esp + 0x13], al
mov edx, dword [esp + 0x40]
mov eax, dword [edx]
call eax
add esp, 0x44
ret
call sym.runtime.morestack_noctxt
jmp sym.go_parser._parser_.parseElement
Function at 0x4db2d0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x674284]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4db4b0
sub esp, 0x40
mov eax, 0
mov dword [esp + 0x3c], eax
mov byte [esp + 0x13], 0
mov dword [esp + 0x48], 0
mov eax, dword [esp + 0x44]
movzx ecx, byte [eax + 0x50]
mov byte [esp + 0x12], cl
test cl, cl
je 0x4db3bd
mov dword [esp + 0x2c], 0
mov dword [esp + 0x30], 0
mov dword [esp + 0x34], 0
mov dword [esp + 0x38], 0
lea eax, [0x545183]
mov dword [esp], eax
mov dword [esp + 4], 0xa
call sym.runtime.convTstring
mov eax, dword [esp + 8]
lea ecx, [0x527f00]
mov dword [esp + 0x2c], ecx
mov dword [esp + 0x30], eax
mov dword [esp + 0x34], ecx
lea eax, [0x576598]
mov dword [esp + 0x38], eax
mov eax, dword [esp + 0x44]
mov dword [esp], eax
lea ecx, [esp + 0x2c]
mov dword [esp + 4], ecx
mov dword [esp + 8], 2
mov dword [esp + 0xc], 2
call sym.go_parser._parser_.printTrace
mov eax, dword [esp + 0x44]
inc dword [eax + 0x54]
mov dword [esp + 0x24], 0
mov dword [esp + 0x28], 0
lea ecx, [sym.go_parser._parser_.parseReturnStmt.deferwrap1]
mov dword [esp + 0x24], ecx
mov dword [esp + 0x28], eax
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], ecx
mov byte [esp + 0x13], 1
mov ecx, dword [eax + 0x78]
mov dword [esp + 0x1c], ecx
mov dword [esp], eax
mov dword [esp + 4], 0x50
call sym.go_parser._parser_.expect
mov eax, dword [esp + 0x44]
mov ecx, dword [eax + 0x7c]
cmp ecx, 0x39
je 0x4db428
cmp ecx, 0x38
jne 0x4db3ed
xor ecx, ecx
xor edx, edx
xor ebx, ebx
jmp 0x4db42e
movzx ecx, byte [eax + 0x94]
mov byte [esp + 0x11], cl
mov byte [eax + 0x94], 1
mov dword [esp], eax
call sym.go_parser._parser_.parseExprList
mov eax, dword [esp + 4]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0xc]
movzx ebx, byte [esp + 0x11]
mov ebp, dword [esp + 0x44]
mov byte [ebp + 0x94], bl
mov ebx, eax
mov eax, ebp
jmp 0x4db42e
xor ecx, ecx
xor edx, edx
xor ebx, ebx
mov dword [esp + 0x14], ecx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x18], edx
mov dword [esp], eax
call sym.go_parser._parser_.expectSemi
lea eax, [0x52e620]
mov dword [esp], eax
call sym.runtime.newobject
mov eax, dword [esp + 4]
mov ecx, dword [esp + 0x1c]
mov dword [eax], ecx
mov ecx, dword [esp + 0x14]
mov dword [eax + 8], ecx
mov ecx, dword [esp + 0x18]
mov dword [eax + 0xc], ecx
mov ecx, dword [0x674338]
test ecx, ecx
jne 0x4db478
mov ecx, dword [esp + 0x20]
jmp 0x4db483
call sym.runtime.gcWriteBarrier1
mov ecx, dword [esp + 0x20]
mov dword [edi], ecx
mov dword [eax + 4], ecx
mov dword [esp + 0x48], eax
movzx eax, byte [esp + 0x12]
test al, 1
je 0x4db4a3
and eax, 0xfffffffe
mov byte [esp + 0x13], al
mov edx, dword [esp + 0x3c]
mov eax, dword [edx]
call eax
add esp, 0x40
ret
call sym.runtime.morestack_noctxt
jmp sym.go_parser._parser_.parseReturnStmt
Function at 0x4fc1e0
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov ecx, dword [0x674284]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x4fc3a5
sub esp, 0x30
mov eax, dword [esp + 0x34]
movzx ecx, byte [eax + 0x28]
test cl, cl
je 0x4fc235
movzx ecx, byte [esp + 0x38]
cmp cl, 0xa
ja 0x4fc219
cmp cl, 9
je 0x4fc21e
cmp cl, 0xa
je 0x4fc22a
jmp 0x4fc23a
cmp cl, 0xb
jne 0x4fc225
mov ecx, 0x20
jmp 0x4fc23a
cmp cl, 0xc
jne 0x4fc23a
mov byte [eax + 0x28], 0
mov ecx, 0xc
jmp 0x4fc23a
movzx ecx, byte [esp + 0x38]
mov byte [esp + 0x23], cl
cmp dword [eax + 0x7c], 1
jne 0x4fc255
mov edx, dword [eax + 8]
add edx, dword [eax + 0x1c]
mov dword [esp + 0x24], edx
mov ebx, edx
jmp 0x4fc31a
mov edx, dword [esp + 0x3c]
mov ebx, edx
jmp 0x4fc265
mov dword [eax + 0x14], esi
mov byte [esi + edi - 1], cl
dec edx
test edx, edx
jle 0x4fc2e2
mov ebp, dword [eax + 0x18]
mov esi, dword [eax + 0x14]
inc esi
mov edi, dword [eax + 0x10]
cmp ebp, esi
jae 0x4fc25d
mov dword [esp + 0x2c], edx
mov dword [esp], edi
mov dword [esp + 4], esi
mov dword [esp + 8], ebp
mov dword [esp + 0xc], 1
lea eax, [0x527f80]
mov dword [esp + 0x10], eax
call sym.runtime.growslice
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x34]
mov dword [ebx + 0x18], eax
mov eax, dword [0x674338]
test eax, eax
je 0x4fc2c7
call sym.runtime.gcWriteBarrier2
mov dword [edi], ecx
mov eax, dword [ebx + 0x10]
mov dword [edi + 4], eax
mov dword [ebx + 0x10], ecx
mov eax, ebx
mov ebx, dword [esp + 0x3c]
mov esi, edx
mov edi, ecx
movzx ecx, byte [esp + 0x23]
mov edx, dword [esp + 0x2c]
jmp 0x4fc25d
add dword [eax + 0x60], ebx
cmp cl, 0xa
je 0x4fc2ef
cmp cl, 0xc
jne 0x4fc307
add dword [eax + 0x64], ebx
add dword [eax + 0x78], ebx
mov dword [eax + 0x68], 1
mov dword [eax + 0x7c], 1
add esp, 0x30
ret
add dword [eax + 0x68], ebx
add dword [eax + 0x7c], ebx
add esp, 0x30
ret
mov dword [eax + 0x14], esi
mov byte [esi + edi - 1], 9
dec edx
test edx, edx
jle 0x4fc397
mov ebp, dword [eax + 0x18]
mov esi, dword [eax + 0x14]
inc esi
mov edi, dword [eax + 0x10]
cmp ebp, esi
jae 0x4fc311
mov dword [esp + 0x28], edx
mov dword [esp], edi
mov dword [esp + 4], esi
mov dword [esp + 8], ebp
mov dword [esp + 0xc], 1
lea eax, [0x527f80]
mov dword [esp + 0x10], eax
call sym.runtime.growslice
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x18]
mov ebx, dword [esp + 0x34]
mov dword [ebx + 0x18], eax
mov eax, dword [0x674338]
test eax, eax
je 0x4fc37c
call sym.runtime.gcWriteBarrier2
mov dword [edi], ecx
mov eax, dword [ebx + 0x10]
mov dword [edi + 4], eax
mov dword [ebx + 0x10], ecx
mov eax, ebx
mov ebx, dword [esp + 0x24]
mov esi, edx
mov edi, ecx
movzx ecx, byte [esp + 0x23]
mov edx, dword [esp + 0x28]
jmp 0x4fc311
add dword [eax + 0x60], ebx
add dword [eax + 0x68], ebx
add dword [eax + 0x7c], ebx
jmp 0x4fc255
call sym.runtime.morestack_noctxt
jmp sym.go_printer._printer_.writeByte
Function at 0x503e30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov ecx, dword [0x674284]
mov ecx, dword fs:[ecx]
mov ecx, dword [ecx]
cmp esp, dword [ecx + 8]
jbe 0x503f2a
sub esp, 0x20
mov ecx, dword [esp + 0x24]
test byte [ecx], al
mov edx, dword [esp + 0x28]
mov ebx, edx
and edx, 0x7f
shl edx, 5
add ecx, edx
mov dword [esp + 0x1c], ecx
xor eax, eax
jmp 0x503e70
mov ebp, dword [esp + 0x14]
inc ebp
mov ecx, dword [esp + 0x1c]
mov ebx, eax
mov eax, ebp
cmp eax, 4
jge 0x503ea9
mov dword [esp + 0x14], eax
lea edx, [ecx + eax*8]
mov dword [esp], edx
call sym.sync_atomic.LoadUint64
mov eax, dword [esp + 0x28]
cmp dword [esp + 4], eax
sete cl
mov edx, dword [esp + 0x2c]
cmp dword [esp + 8], edx
sete bl
and ebx, ecx
test bl, bl
je 0x503e63
mov byte [esp + 0x30], 1
add esp, 0x20
ret
xor eax, eax
mov edx, 0x84222325
jmp 0x503eb3
inc eax
cmp eax, 4
jge 0x503ec9
mov dword [esp + 0x18], eax
lea ebp, [ecx + eax*8]
mov esi, dword [ebp]
mov ebp, dword [ebp + 4]
xor edi, edi
jmp 0x503f23
and edx, 3
lea eax, [ecx + edx*8]
mov dword [esp], eax
mov dword [esp + 4], ebx
mov eax, dword [esp + 0x2c]
mov dword [esp + 8], eax
call sym.sync_atomic.StoreUint64
mov byte [esp + 0x30], 0
add esp, 0x20
ret
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], ebp
and esi, 0xff
xor edx, esi
mov esi, dword [esp + 0xc]
shr esi, 8
shl ebp, 0x18
mov eax, edx
mov ebx, 0x1b3
mul ebx
inc edi
or esi, ebp
mov ebp, dword [esp + 0x10]
shr ebp, 8
mov ebx, dword [esp + 0x28]
mov edx, eax
mov eax, dword [esp + 0x18]
cmp edi, 8
jl 0x503eec
jmp 0x503eb2
call sym.runtime.morestack_noctxt
jmp sym.internal_bisect._dedup_.seenLossy
Function at 0x100559e8
Capabilities:
Encode data using xor

Disassembly:
add eax, 0x100
add byte [ecx], al
add byte [eax], al
add byte [ecx], al
add byte [eax], al
add ah, cl
pop ecx
add eax, 0x559d200
add al, dl
pop ecx
add eax, 0x1033c00
add byte [eax], al
add dh, dl
pop ecx
add eax, 0x756e4500
insd dword es:[edi], dx
push ebx
outsd dx, dword [esi]
jne 0x10055a50
arpl word [ebp + 0x46], sp
imul ebp, dword [ebp + 0x73], 0x8d000000
lea esp, [esp + 0x2c]
lea esp, [esp + 0x2c]
jb fcn.10066c1d
clc
call fcn.10064b5b
add byte [eax], al
inc esp
jbe 0x10055a67
arpl word [ebp + 0x49], sp
outsd dx, dword [esi]
inc ebx
outsd dx, dword [esi]
outsb dx, byte [esi]
je 0x10055a79
outsd dx, dword [esi]
insb byte es:[edi], dx
add byte [edx + ebp*8 + 0xed02e9], al
add byte [ecx - 0x5e], cl
daa
test dh, cl
jne 0x100559b2
mov esi, 0x79d92271
sbb cl, byte [ecx + 0x5b8f26d0]
popal
xchg esi, eax
pop es
invalid
mov cl, 0xbe
and esi, dword [edx + 0x6f62b876]
add dword [edx + 0x27], edx
fiadd dword [esi - 0xab3c435]
mov cl, 0x77
and esp, esp
nop
push ecx
mov bl, 0x41
ja 0x10055a48
call 0x9b9cd65
mov ah, 0xf9
aaa
cwde
popal
invalid
mov word [edi - 0x29], cs
das
xchg ebx, eax
mov cl, 0x8b
pop edx
jl 0x10055a95
iretd
mov ah, 0x3d
scasd eax, dword es:[edi]
pop es
loopne 0x10055a76
jbe 0x10055a9e
or dword [edi + 0x196f32d4], edx
rcr dword [edx + 0x13], 0xc2
xchg edi, eax
aam 0x32
outsd dx, dword [esi]
sbb ecx, eax
pop edx
adc eax, edx
pop esi
add ch, byte [esi + 0x21d5fb12]
adc bh, bl
aad 0x21
cmp ecx, 0x2c068de2
or byte [ebx + ecx - 0x7a], dl
mov dword [0xf4c814f7], eax
sub eax, 0xeab02a6d
push ebp
xchg ebp, eax
mov al, byte [0x9ce6bae2]
xor al, 0xda
push esp
js 0x10055aaa
sub bl, ah
jne 0x10055ae5
fdivr qword [ecx + 0x36]
mov esp, 0x615a4efe
dec edi
mov byte [0x8cb347c3], al
inc eax
push ebx
out dx, eax
mov edx, 0xed48240
adc ah, 0xe
mov eax, 0x85c60e55
xor ah, bl
cmpsd dword [esi], dword es:[edi]
pushal
daa
fisub word [edi - 0x7d52da6]
lea edi, [ecx - 0x3d]
or edx, dword [ebp - 0x53a304a9]
cmp dword [esi + ecx*8 - 0x74165e8b], eax
xor dl, al
mov byte [edi], ah
ret 0x1f53
Function at 0x10006320
Capabilities:
Access peb ldr_data

Disassembly:
push 0xffffffffffffffff
push 0x10081110
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x18
mov eax, dword [esp + 0x30]
push ebp
push esi
push edi
mov ecx, dword [eax]
push ecx
lea ecx, [esp + 0x10]
call fcn.1007661c
mov esi, dword [esp + 0xc]
lea ecx, [esp + 0x10]
mov dword [esp + 0x2c], 0
xor ebp, ebp
call fcn.10007070
mov ecx, dword [esp + 0x40]
mov byte [esp + 0x2c], 1
cmp ecx, 3
ja case.default.0x10006374
jmp dword [ecx*4 + 0x100064dc]
mov al, byte [esi]
test al, al
je 0x100063a2
cmp al, 0x20
je 0x1000638e
cmp al, 0xa1
jne 0x100063a2
cmp byte [esi + 1], al
jne 0x100063a2
test al, 0x80
je 0x1000639a
mov al, byte [esi + 1]
inc esi
test al, al
je 0x100063a2
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x10006381
test ecx, ecx
je case.default.0x10006374
mov dl, byte [esi]
xor ecx, ecx
test dl, dl
mov eax, esi
je case.default.0x10006374
mov edi, dword [esp + 0x3c]
mov dl, byte [eax]
test dl, 0x80
je 0x100063e8
cmp dl, 0xa1
jne 0x100063dc
cmp byte [eax + 1], 0xa1
jne 0x100063dc
test ecx, ecx
jne 0x100063d4
mov edi, eax
mov ecx, 1
inc eax
jmp 0x100063fc
mov dl, byte [eax + 1]
inc eax
xor ecx, ecx
test dl, dl
je 0x10006416
jmp 0x100063fc
cmp dl, 0x20
jne 0x100063fa
test ecx, ecx
jne 0x100063f3
mov edi, eax
mov ecx, 1
jmp 0x100063fc
xor ecx, ecx
mov dl, byte [eax + 1]
inc eax
test dl, dl
jne 0x100063bc
cmp ecx, 1
jne case.default.0x10006374
mov dl, byte [edi]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x10006374
mov dl, byte [eax - 1]
lea edi, [eax - 1]
mov ebp, edi
mov byte [esp + 0x3c], dl
mov byte [edi], 0
jmp case.default.0x10006374
mov al, byte [esi]
test al, al
je 0x1000646e
test al, 0x80
mov byte [esp + 0x3c], al
je 0x10006454
mov cl, byte [esi + 1]
test cl, cl
je 0x1000646e
cmp al, 0xa1
jne 0x10006444
cmp cl, al
je 0x10006451
mov ax, word [esi]
lea ecx, [esp + 0x10]
push eax
call fcn.10007340
inc esi
jmp 0x10006466
cmp al, 0x20
je 0x10006466
mov ecx, dword [esp + 0x3c]
push ecx
lea ecx, [esp + 0x14]
call fcn.10007380
mov al, byte [esi + 1]
inc esi
test al, al
jne 0x1000642d
push 0
lea ecx, [esp + 0x14]
call fcn.10007380
mov esi, dword [esp + 0x20]
mov eax, dword [esp + 0x18]
neg esi
sbb esi, esi
and esi, eax
push esi
call fcn.10014030
mov edx, dword [esp + 0x38]
add esp, 4
test ebp, ebp
mov dword [edx], eax
je 0x100064a1
mov al, byte [esp + 0x3c]
mov byte [ebp], al
lea ecx, [esp + 0x10]
mov byte [esp + 0x2c], 0
mov dword [esp + 0x10], 0x10088924
call fcn.10007270
lea ecx, [esp + 0xc]
mov dword [esp + 0x2c], 0xffffffff
call fcn.100765ae
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
mov dword fs:[0], ecx
add esp, 0x24
ret
Function at 0x1000eb70
Capabilities:
Enumerate files on windows

Disassembly:
push 0xffffffffffffffff
push 0x100818cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x180
push ebx
push ebp
mov ebp, ecx
lea ecx, [esp + 8]
lea eax, [ebp + 0x40]
push eax
call fcn.10076323
mov ecx, dword [esp + 8]
mov dword [esp + 0x190], 0
mov eax, dword [ecx - 8]
test eax, eax
je 0x1000ebf2
lea edx, [esp + 0x10]
push 1
push edx
lea ecx, [esp + 0x10]
call fcn.100741fd
mov eax, dword [eax]
push 0x1009ec78
push eax
call fcn.10066eb4
add esp, 8
lea ecx, [esp + 0x10]
test eax, eax
setne bl
call fcn.100765ae
test bl, bl
je 0x1000ebf2
push 0x1009ec78
lea ecx, [esp + 0xc]
call fcn.1007693e
push 0x1009ec84
lea ecx, [esp + 0xc]
call fcn.1007693e
mov ecx, dword [esp + 8]
lea eax, [esp + 0x48]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
mov dword [esp + 0xc], eax
jne 0x1000ec2e
lea ecx, [esp + 8]
mov dword [esp + 0x190], eax
call fcn.100765ae
jmp 0x1000ecf9
push esi
mov esi, dword [esp + 0x19c]
push edi
mov edi, dword [sym.imp.USER32.dll_SendMessageA]
mov ebx, 0x23
test byte [esp + 0x50], 0x10
je 0x1000ecb2
lea edx, [esp + 0x7c]
push 0x1009ec80
push edx
call fcn.10066eb4
add esp, 8
test eax, eax
je 0x1000ecb2
lea eax, [esp + 0x7c]
push 0x1009ec7c
push eax
call fcn.10066eb4
add esp, 8
test eax, eax
je 0x1000ecb2
mov eax, dword [ebp + 0x1c]
lea edx, [esp + 0x1c]
push edx
push 0
lea ecx, [esp + 0x84]
push 0x1100
push eax
mov dword [esp + 0x2c], esi
mov dword [esp + 0x30], 0xffff0003
mov dword [esp + 0x4c], 0
mov dword [esp + 0x50], 1
mov dword [esp + 0x44], ecx
mov dword [esp + 0x34], ebx
call edi
mov edx, dword [esp + 0x14]
lea ecx, [esp + 0x50]
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x1000ec42
mov eax, dword [esp + 0x14]
push eax
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp + 0x1c]
push esi
push 2
push 0x1102
push ecx
call edi
lea ecx, [esp + 0x10]
mov dword [esp + 0x198], 0xffffffff
call fcn.100765ae
pop edi
pop esi
mov ecx, dword [esp + 0x188]
pop ebp
pop ebx
mov dword fs:[0], ecx
add esp, 0x18c
ret 4

Function at 0x1000f4f0
Capabilities:
Query or enumerate registry value

Disassembly:
mov ecx, dword [esp + 8]
mov edx, dword [esp + 4]
sub esp, 0x10c
lea eax, [esp]
push esi
push eax
push 1
push 0
push ecx
push edx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov esi, eax
test esi, esi
jne 0x1000f552
mov edx, dword [esp + 4]
lea eax, [esp + 8]
lea ecx, [esp + 0xc]
push eax
push ecx
push esi
push edx
mov dword [esp + 0x18], 0x104
call dword [sym.imp.ADVAPI32.dll_RegQueryValueA]
mov ecx, dword [esp + 0x11c]
lea eax, [esp + 0xc]
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_lstrcpyA]
mov edx, dword [esp + 4]
push edx
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
add esp, 0x10c
ret 0xc
Function at 0x1000f560
Capabilities:
Create process on windows

Disassembly:
push 0xffffffffffffffff
push 0x1008194b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20c
mov eax, dword [0x100a853c]
push esi
push edi
mov edi, ecx
mov dword [esp + 8], eax
mov eax, dword [edi + 0x44]
mov dword [esp + 0x21c], 0
test eax, eax
jne 0x1000f698
mov ecx, dword [edi + 0x48]
lea esi, [edi + 0x48]
mov eax, dword [ecx - 8]
test eax, eax
jne 0x1000f5c6
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.100765ae
xor eax, eax
jmp 0x1000f70f
push str.mailto:
lea ecx, [esp + 0xc]
call fcn.100766eb
push esi
lea ecx, [esp + 0xc]
call fcn.1007697a
mov ecx, dword [esp + 8]
push ebx
push ebp
mov ebp, dword [esp + 0x22c]
push ebp
push 0
push 0
push ecx
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
mov esi, eax
cmp esi, 0x20
ja 0x1000f6ed
lea edx, [esp + 0x14]
mov ecx, edi
push edx
push str..htm
push closesocket
call fcn.1000f4f0
test eax, eax
jne 0x1000f6ed
mov ebx, dword [sym.imp.KERNEL32.dll_lstrcatA]
lea eax, [esp + 0x14]
push str._shellopencommand
push eax
call ebx
lea ecx, [esp + 0x14]
lea edx, [esp + 0x14]
push ecx
push edx
push closesocket
mov ecx, edi
call fcn.1000f4f0
test eax, eax
jne 0x1000f6ed
lea eax, [esp + 0x14]
push 0x1009ec94
push eax
call fcn.10067f30
mov esi, eax
add esp, 8
test esi, esi
jne 0x1000f6cc
lea ecx, [esp + 0x14]
push 0x1009ec90
push ecx
call fcn.10067eb0
mov esi, eax
add esp, 8
test esi, esi
jne 0x1000f6cc
lea edx, [esp + 0x14]
push edx
call dword [sym.imp.KERNEL32.dll_lstrlenA]
lea esi, [esp + eax + 0x13]
jmp 0x1000f6cf
lea edx, [edi + 0x4c]
lea ecx, [esp + 8]
push edx
call fcn.1007669b
mov eax, dword [esp + 8]
mov ecx, dword [eax - 8]
test ecx, ecx
jne 0x1000f5de
lea ecx, [esp + 8]
mov dword [esp + 0x21c], 0xffffffff
call fcn.100765ae
xor eax, eax
jmp 0x1000f70f
mov byte [esi], 0
push 0x1009ec8c
push esi
call ebx
mov eax, dword [esp + 0x10]
push eax
push esi
call ebx
lea ecx, [esp + 0x14]
push ebp
push ecx
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esi, eax
xor edx, edx
cmp esi, 0x20
setg dl
lea ecx, [esp + 0x10]
mov esi, edx
mov dword [esp + 0x224], 0xffffffff
call fcn.100765ae
pop ebp
mov eax, esi
pop ebx
mov ecx, dword [esp + 0x214]
pop edi
pop esi
mov dword fs:[0], ecx
add esp, 0x218
ret 4
Function at 0x1001fd10
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, dword [esp + 4]
push esi
push edi
mov edi, dword [sym.imp.USER32.dll_GetKeyState]
mov cl, byte [eax + 8]
and ecx, 0xff
mov esi, ecx
cmp si, 0x60
jb 0x1001fd7e
cmp si, 0x69
ja 0x1001fd7e
add esi, 0xffd0
cmp si, 0x11
je 0x1001fd4e
push 0x11
call edi
test ax, ax
jge 0x1001fd4e
or esi, 0x2000
cmp si, 0x10
je 0x1001fd63
push 0x10
call edi
test ax, ax
jge 0x1001fd63
or esi, 0x4000
cmp si, 0x12
je 0x1001fd78
push 0x12
call edi
test ax, ax
jge 0x1001fd78
or esi, 0x8000
mov ax, si
pop edi
pop esi
ret
cmp si, 0x6d
jne 0x1001fd8b
mov esi, 0xbd
jmp 0x1001fd3f
cmp si, 0x6e
jne 0x1001fd98
mov esi, 0xbe
jmp 0x1001fd3f
cmp si, 0x6f
jne 0x1001fd39
mov esi, 0xbf
jmp 0x1001fd3f

Function at 0x10021610
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ecx
mov eax, dword [0x100b8ca8]
xor edx, edx
cmp eax, edx
jne 0x10021636
xor eax, eax
mov byte [eax + 0x100b8ba8], al
inc eax
cmp eax, 0x100
jl 0x1002161e
mov dword [0x100b8ca8], 1
mov eax, dword [esp + 0xc]
push ebx
mov ebx, dword [esp + 0x14]
push esi
push edi
mov ecx, 0x40
mov esi, 0x100b8ba8
mov edi, ebx
rep movsd dword es:[edi], dword [esi]
cmp eax, edx
mov byte [ebx + 0x100], dl
mov byte [ebx + 0x101], dl
jle 0x100216c7
xor esi, esi
push ebp
mov byte [esp + 0x20], dl
xor ecx, ecx
mov edi, dword [esp + 0x20]
mov ebp, dword [esp + 0x18]
mov al, byte [esi + ebx]
and edi, 0xff
xor edx, edx
mov dl, byte [edi + ebp]
mov ebp, eax
and ebp, 0xff
add ecx, edx
add ecx, ebp
and ecx, 0x800000ff
jns 0x1002169a
dec ecx
or ecx, 0xffffff00
inc ecx
mov byte [esp + 0x10], cl
mov ecx, dword [esp + 0x10]
and ecx, 0xff
mov dl, byte [ecx + ebx]
mov byte [esi + ebx], dl
mov byte [ecx + ebx], al
lea eax, [edi + 1]
cdq
idiv dword [esp + 0x1c]
inc esi
cmp esi, 0x100
mov byte [esp + 0x20], dl
jl 0x10021668
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret

Function at 0x10021740
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
mov eax, dword [ebp + 0x10]
push ebx
push esi
push edi
mov cl, byte [eax + 0x100]
mov dl, byte [eax + 0x101]
mov dword [ebp - 8], eax
mov byte [ebp - 1], cl
mov byte [ebp - 2], dl
xor ebx, ebx
mov bl, byte [ebp - 1]
xor edx, edx
mov dl, byte [ebp - 2]
mov esi, dword [ebp - 8]
mov edi, dword [ebp + 8]
xor eax, eax
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jle 0x10021793
inc bl
mov al, byte [esi + ebx]
add dl, al
xchg byte [esi + edx], al
mov byte [esi + ebx], al
add al, byte [esi + edx]
mov al, byte [esi + eax]
xor byte [edi], al
inc edi
dec ecx
jne 0x1002177a
mov byte [ebp - 1], bl
mov byte [ebp - 2], dl
mov eax, dword [ebp + 0x10]
mov cl, byte [ebp - 1]
mov dl, byte [ebp - 2]
pop edi
pop esi
mov byte [eax + 0x100], cl
mov byte [eax + 0x101], dl
pop ebx
mov esp, ebp
pop ebp
ret