joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402766
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
push dword [ebp + 8]
mov esi, ecx
call fcn.004023c3
xor edi, edi
lea eax, [ebp - 4]
push eax
push edi
push esi
push 0x40266d
push edi
push edi
mov dword [0x422724], esi
mov dword [0x422728], edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x422720], eax
cmp eax, edi
je 0x4027c1
cmp dword [0x422770], 2
je 0x4027b3
call fcn.00408c2e
mov eax, dword [0x422720]
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
mov eax, dword [0x422720]
mov ecx, dword [0x422728]
mov dword [0x4228c4], edi
cmp ecx, edi
je 0x402807
cmp ecx, 1
je 0x4027fb
cmp ecx, 2
je 0x4027f7
cmp ecx, 3
je 0x4027f3
cmp ecx, 0x67
jle 0x4027ee
cmp ecx, 0x6b
jle 0x402870
push ecx
push 0x14
jmp 0x402841
push 0x12
jmp 0x4027fd
push 0x13
jmp 0x4027fd
push 0x11
push edi
call fcn.00409684
pop ecx
pop ecx
jmp 0x402870
mov dword [ebp + 8], edi
cmp dword [0x4228cc], edi
jne 0x402870
cmp eax, edi
je 0x40282e
lea ecx, [ebp + 8]
push ecx
push eax
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x40282e
cmp dword [ebp + 8], edi
jne 0x40282e
xor eax, eax
jmp 0x402875
mov ecx, dword [ebp + 8]
mov eax, 0x80070000
and ecx, eax
cmp ecx, eax
je 0x402844
push dword [ebp + 8]
push 0x21
push edi
jmp 0x402868
mov eax, dword [ebp + 8]
and eax, 0xffff
cmp eax, 0xe
jne 0x40285a
cmp dword [0x422774], 0xffffffff
je 0x402870
push eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push dword [ebp + 8]
push 0x22
push 1
call fcn.00409684
add esp, 0xc
mov eax, 0x80004005
pop edi
pop esi
leave
ret 4
Function at 0x4042b5
Capabilities:
Check if file exists
Get common file path
Get file attributes

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov dword [esp + 0x10], edx
mov esi, ecx
call fcn.004147df
push 2
mov ecx, esi
call fcn.0040420b
mov edi, dword [sym.imp.KERNEL32.dll_GetTempPathW]
push eax
push 1
call edi
mov ecx, dword [esi]
xor ebp, ebp
xor edx, edx
mov dword [esi + 4], ebp
mov word [ecx], dx
cmp eax, ebp
jbe 0x4042ff
lea ebx, [eax + 1]
push ebx
mov ecx, esi
call fcn.0040420b
push eax
push ebx
call edi
mov ecx, esi
call fcn.004041f0
mov eax, dword [esi + 4]
lea ebx, [eax + 0xf]
lea edi, [eax + eax]
push ebx
mov ecx, esi
call fcn.0040420b
push ebp
push dword [esp + 0x14]
add eax, edi
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0xc
mov ecx, esi
call fcn.004041f0
push dword [esi]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x40433e
inc ebp
cmp ebp, 0xfff
jl 0x404308
pop edi
mov eax, esi
pop esi
pop ebp
pop ebx
pop ecx
ret

Function at 0x404b33
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov byte [ebp - 0x68], 0x17
mov byte [ebp - 0x67], 0x28
mov byte [ebp - 0x66], 0x33
mov byte [ebp - 0x65], 0x35
mov byte [ebp - 0x64], 0x34
mov byte [ebp - 0x63], 0x20
mov byte [ebp - 0x62], 0x2d
mov byte [ebp - 0x61], 0x11
mov byte [ebp - 0x60], 0x33
mov byte [ebp - 0x5f], 0x2e
mov byte [ebp - 0x5e], 0x35
mov byte [ebp - 0x5d], 0x24
mov byte [ebp - 0x5c], 0x22
mov byte [ebp - 0x5b], 0x35
mov byte [ebp - 0x5a], 0x41
call fcn.00404778
push eax
push esi
push dword [ebp + 8]
call fcn.0040472d
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
dec edi
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
mov byte [ebp - 0x22], 0x49
mov byte [ebp - 0x21], 0x59
mov byte [ebp - 0x20], 0x4a
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00404778
push eax
push esi
push dword [ebp + 8]
call fcn.0040472d
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00404768
loopne 0x404bf9
xor byte [0xff7c9d88], 0xff
dec dword [eax - 0x8263]
inc esi
test dword [esi - 1], edi
invalid
invalid

Function at 0x40709f
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push esi
lea eax, [ebp + 8]
push eax
xor eax, eax
push eax
push dword [ebp + 8]
mov esi, ecx
push edx
push eax
push eax
call dword [sym.imp.MSVCRT.dll__beginthreadex]
add esp, 0x18
mov ecx, eax
mov dword [esi], eax
call fcn.0040705a
pop esi
pop ebp
ret 4
Function at 0x40d3d8
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x418418]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00408a8b
mov dword [ebp - 0x14], eax
cmp dword [0x4ac5a4], esi
jne 0x40d4cb
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d458
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d5ab
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d5ab
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d5ab
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4ac5a4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4ac5a8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4ac5ac], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4ac5b4], eax
test eax, eax
je 0x40d4c8
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4ac5b0], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d4f0
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d4e3
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d505
push 4
pop eax
jmp 0x40d5ad
cmp dword [ebp - 0x14], esi
je 0x40d505
push dword [0x4ac5a4]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d4ea
mov eax, dword [0x4ac5b0]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d563
cmp dword [0x4ac5b4], edi
je 0x40d563
push eax
call ebx
push dword [0x4ac5b4]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d563
test eax, eax
je 0x40d563
call ecx
test eax, eax
je 0x40d558
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d558
test byte [ebp - 8], 1
jne 0x40d563
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d593
mov eax, dword [0x4ac5a8]
cmp eax, edi
je 0x40d590
push eax
call ebx
test eax, eax
je 0x40d590
call eax
mov esi, eax
test esi, esi
je 0x40d590
mov eax, dword [0x4ac5ac]
cmp eax, edi
je 0x40d590
push eax
call ebx
test eax, eax
je 0x40d590
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4ac5a4]
call ebx
test eax, eax
je 0x40d5ab
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d5ad
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403f8b
mov esp, ebp
pop ebp
ret
Function at 0x402b18
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
movzx eax, word [0x40600c]
mov dword [ebp - 8], eax
lea eax, [ebp - 4]
push eax
push 1
push 0
push 0x402bb0
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA
test eax, eax
jne 0x402b90
xor eax, eax
push ebp
push 0x402b89
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 0xc], 4
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x402bcc
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegQueryValueExA
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x402b90
mov eax, dword [ebp - 4]
push eax
call sub.advapi32.dll_RegCloseKey
ret
mov ax, word [0x40600c]
and ax, 0xffc0
mov dx, word [ebp - 8]
and dx, 0x3f
or ax, dx
mov word [0x40600c], ax
mov esp, ebp
pop ebp
ret

Function at 0x403218
Capabilities:
Write file on windows

Disassembly:
push ecx
cmp byte [0x407034], 0
je 0x403279
cmp word [0x407208], 0xd7b2
jne 0x403241
cmp dword [0x407210], 0
jbe 0x403241
mov eax, 0x407204
call dword [0x407220]
push 0
lea eax, [esp + 4]
push eax
push 0x1e
push 0x406054
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile_1
push 0
lea eax, [esp + 4]
push eax
push 2
push 0x4032a0
push 0xfffffffffffffff5
call sub.KERNEL32.DLL_GetStdHandle
push eax
call sub.KERNEL32.DLL_WriteFile_1
pop edx
ret
cmp byte [0x406018], 0
jne 0x403295
push 0
push 0x40604c
push 0x406054
push 0
call sub.user32.dll_MessageBoxA_1
pop edx
ret

Function at 0x403d7c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
push ebx
xor edx, edx
mov dword [ebp - 0x10], edx
xor edx, edx
push ebp
push 0x403de2
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 0xb]
push edx
push 0x1004
push eax
call sub.KERNEL32.DLL_GetLocaleInfoA
lea eax, [ebp - 0x10]
lea edx, [ebp - 0xb]
mov ecx, 7
call fcn.0040359c
mov eax, dword [ebp - 0x10]
lea edx, [ebp - 4]
call fcn.00402a0c
mov ebx, eax
cmp dword [ebp - 4], 0
je 0x403dcc
xor ebx, ebx
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x403de9
lea eax, [ebp - 0x10]
call fcn.004033a4
ret

Function at 0x404b28
Capabilities:
Check internet connectivity via wininet

Disassembly:
push ecx
mov dword [esp], 7
push 0
lea eax, [esp + 4]
push eax
call sub.wininet.dll_InternetGetConnectedState
cmp eax, 1
sbb eax, eax
inc eax
pop edx
ret
Function at 0x404b44
Capabilities:
Create http request

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffde4
push ebx
push esi
push edi
xor ecx, ecx
mov dword [ebp - 0x218], ecx
mov dword [ebp - 0x21c], ecx
mov esi, edx
mov edi, eax
xor eax, eax
push ebp
push 0x404c40
push dword fs:[eax]
mov dword fs:[eax], esp
xor eax, eax
mov dword [ebp - 0xc], eax
mov eax, esi
call fcn.004033a4
mov ebx, 0x4240300
push 0
push 0
push 0
push 0
push 0x404c50
call sub.wininet.dll_InternetOpenA
mov dword [ebp - 4], eax
push 0
push ebx
push 0
push 0
mov eax, edi
call fcn.004037c8
push eax
mov eax, dword [ebp - 4]
push eax
call sub.wininet.dll_InternetOpenUrlA
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x404c10
mov dword [ebp - 0x10], 0x201
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x211]
push eax
push 0x21
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_HttpQueryInfoA
test eax, eax
je 0x404c10
lea eax, [ebp - 0x21c]
lea edx, [ebp - 0x211]
mov ecx, 0x201
call fcn.00403a3c
mov eax, dword [ebp - 0x21c]
lea edx, [ebp - 0x218]
call fcn.00404ad8
mov edx, dword [ebp - 0x218]
mov eax, esi
call fcn.004035b4
mov eax, dword [ebp - 8]
push eax
call sub.wininet.dll_InternetCloseHandle
mov eax, dword [ebp - 4]
push eax
call sub.wininet.dll_InternetCloseHandle
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404c47
lea eax, [ebp - 0x21c]
mov edx, 2
call fcn.0040390c
ret

Function at 0x404d04
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa4
push ebx
mov ebx, eax
mov byte [ebp - 1], 0
lea eax, [ebp - 0x4c]
xor ecx, ecx
mov edx, 0x44
call fcn.00402980
mov dword [ebp - 0x4c], 0x44
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x4c]
push eax
push 0
push 0
push 0x8000000
push 0
push 0
push 0
mov eax, ebx
call fcn.00403a80
push eax
push 0
call sub.KERNEL32.DLL_CreateProcessW
test eax, eax
je 0x404db0
xor eax, eax
push ebp
push 0x404da9
push dword fs:[eax]
mov dword fs:[eax], esp
push 0xffffffffffffffff
mov eax, dword [ebp - 0x5c]
push eax
call sub.KERNEL32.DLL_WaitForSingleObject
test eax, eax
jne 0x404d89
lea eax, [ebp - 8]
push eax
mov eax, dword [ebp - 0x5c]
push eax
call sub.KERNEL32.DLL_GetExitCodeProcess
test eax, eax
je 0x404d89
cmp dword [ebp - 8], 0
jne 0x404d89
mov byte [ebp - 1], 1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404db0
mov eax, dword [ebp - 0x5c]
push eax
call sub.KERNEL32.DLL_CloseHandle
mov eax, dword [ebp - 0x58]
push eax
call sub.KERNEL32.DLL_CloseHandle
ret
mov al, byte [ebp - 1]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x404e10
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push ebx
mov ebx, eax
push ebx
call sub.KERNEL32.DLL_GetFileAttributesW
mov dword [0x407684], eax
cmp dword [0x407684], 0xffffffff
je 0x404e30
test byte [0x407684], 0x10
je 0x404e34
xor eax, eax
pop ebx
ret
mov al, 1
pop ebx
ret
Function at 0x404e38
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
call fcn.004037b8
lea eax, [ebp - 8]
call fcn.00403c64
xor eax, eax
push ebp
push 0x404edf
push dword fs:[eax]
mov dword fs:[eax], esp
push 0
push 0x80
push 2
push 0
push 2
push 0x40000000
mov eax, dword [ebp - 8]
call fcn.00403a80
push eax
call sub.KERNEL32.DLL_CreateFileW
mov ebx, eax
cmp ebx, 0xffffffff
je 0x404eba
push 0
push 0
push 0
push ebx
call sub.KERNEL32.DLL_SetFilePointer
push 0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.004035c8
push eax
lea eax, [ebp - 4]
call fcn.00403818
push eax
push ebx
call sub.KERNEL32.DLL_WriteFile
push ebx
call sub.KERNEL32.DLL_CloseHandle
cmp dword [ebp - 0xc], 0
setne bl
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404ee6
lea eax, [ebp - 8]
call fcn.004038f4
lea eax, [ebp - 4]
call fcn.004033a4
ret

Function at 0x404fe4
Capabilities:
Get common file path
Get program files directory

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, eax
push 0xffffffffffffffff
push 0x26
lea eax, [esp + 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00403a54
add esp, 0x200
pop ebx
ret

Function at 0x405014
Capabilities:
Get common file path

Disassembly:
push ebx
add esp, 0xfffffe00
mov ebx, eax
push 0xffffffffffffffff
push 0x10
lea eax, [esp + 8]
push eax
push 0
call sub.shell32.dll_SHGetSpecialFolderPathW
mov eax, ebx
mov edx, esp
mov ecx, pe_nt_image_headers32
call fcn.00403a54
add esp, 0x200
pop ebx
ret
Function at 0xf3bc08
Capabilities:
Encode data using xor

Disassembly:
jmp 0xf3bc12
pushal
call 0xf3bc18
pop ebp
sub ebp, 0x10
sub ebp, 0xb3bc08
jmp 0xf3bc2e
mov eax, 0xb3bc08
add eax, ebp
add eax, 0x4c
mov ecx, 0x5c2
mov edx, 0xd311773a
xor byte [eax], dl
inc eax
dec ecx
jne 0xf3bc45
jmp 0xf3bc58
mov cl, 0xf7
mov cl, 0xb3
push es
cmp bh, byte [edx]
cmp bh, byte [ebx + 0x3a3ac2fb]
cmp bh, byte [ecx]
test dword [edx + 0x3a3a3a33], 0x3a3a1280
cmp cl, ch
fdivr dword [ecx]
mov cl, 0xbb
cmp bh, byte ss:[edx]
cmp bh, byte [ecx]
jmp [edx - 0x49]

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x10001100
Capabilities:
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
and esp, 0xfffffff8
sub esp, 0x68
lea eax, [esp + 0x60]
mov dword [esp + 0x5c], eax
xor eax, eax
mov dword [esp + 0x58], eax
jmp 0x10001133
mov eax, esp
mov dword [eax], 0xc16b3f
mov eax, dword [sym.imp.USER32.dll_SetFocus]
call eax
sub esp, 4
mov dword [esp + 0x54], eax
jmp 0x100011aa
mov eax, dword [esp + 0x58]
mov ecx, esp
mov dword [ecx + 4], 0xe7f
mov dword [ecx], 0xb40f77
mov ecx, dword [sym.imp.USER32.dll_SetWindowContextHelpId]
mov dword [esp + 0x50], eax
call ecx
sub esp, 8
mov ecx, esp
mov dword [ecx], 0x66c4a1
mov ecx, dword [sym.imp.KERNEL32.dll_SetConsoleActiveScreenBuffer]
mov dword [esp + 0x4c], eax
call ecx
sub esp, 4
mov ecx, esp
mov dword [ecx], 0xc2f
mov ecx, dword [sym.imp.USER32.dll_GetClipboardData]
mov dword [esp + 0x48], eax
call ecx
sub esp, 4
xor ecx, ecx
mov dword [esp + 0x44], eax
mov dword [esp + 0x40], ecx
mov eax, dword [esp + 0x40]
mov ecx, 0x13
mov dword [esp + 0x3c], eax
xor edx, edx
div ecx
cmp edx, 4
je 0x1000111b
mov eax, dword [esp + 0x3c]
add eax, 1
cmp eax, 0x2d5
mov dword [esp + 0x40], eax
jne 0x1000118d
xor eax, eax
xor ecx, ecx
mov edx, dword [esp + 0x50]
sub edx, 4
mov dword [esp + 0x38], eax
mov dword [esp + 0x34], ecx
mov dword [esp + 0x30], edx
je 0x10001232
jmp 0x100011d9
mov eax, dword [esp + 0x50]
sub eax, 0x42
mov ecx, dword [esp + 0x34]
mov dword [esp + 0x2c], eax
mov dword [esp + 0x28], ecx
jne 0x10001267
jmp 0x100011f0
mov eax, esp
mov dword [eax + 8], 0x655
mov dword [eax + 4], 0x655
mov dword [eax], 0xf27834
mov eax, dword [sym.imp.USER32.dll_CheckMenuItem]
call eax
sub esp, 0xc
mov ecx, esp
mov dword [ecx + 4], 0xf79
mov dword [ecx], 0xf79
mov ecx, dword [sym.imp.USER32.dll_SetCaretPos]
mov dword [esp + 0x24], eax
call ecx
sub esp, 8
mov dword [esp + 0x20], eax
mov eax, esp
mov dword [eax], 0xf42f57
mov eax, dword [sym.imp.USER32.dll_GetTopWindow]
call eax
sub esp, 4
mov dword [esp + 0x1c], eax
mov eax, esp
mov dword [eax + 4], 0x9e8240
mov dword [eax], 0xe45
mov eax, dword [sym.imp.KERNEL32.dll_SetStdHandle]
call eax
sub esp, 8
mov dword [esp + 0x18], eax
jmp 0x100012ba
mov eax, dword [esp + 0x28]
add eax, 1
mov ecx, esp
mov dword [ecx], 0xd63
mov ecx, dword [sym.imp.USER32.dll_SetCaretBlinkTime]
mov dword [esp + 0x14], eax
call ecx
sub esp, 4
mov ecx, dword [esp + 0x5c]
mov edx, dword [ecx]
mov esi, dword [ecx + 4]
mov edi, esp
mov dword [edi + 4], esi
mov dword [edi], edx
mov edx, dword [sym.imp.USER32.dll_WindowFromPoint]
mov dword [esp + 0x10], eax
call edx
sub esp, 8
mov ecx, dword [esp + 0x14]
cmp ecx, 0xa
mov dword [esp + 0xc], eax
mov dword [esp + 0x28], ecx
jne 0x10001267
mov eax, dword [esp + 0x50]
add eax, 1
cmp eax, 0xe5
mov dword [esp + 0x58], eax
jne 0x10001133
lea esp, [ebp - 8]
pop esi
pop edi
pop ebp
ret

Function at 0x10002d8c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10028ac0]
jne 0x10002d96
repz ret
jmp fcn.1000303d
Function at 0x100035a0
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x10028aa8], 0
mov byte [0x10028aac], 0
mov dword [0x10028aa0], 0x795
mov dword [0x10028aa4], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
jmp 0x100035f3
mov dword [0x10028aa4], 0
jmp 0x1000362a
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x10028a9c]
add eax, 0x1d21
mov dword [0x10028a9c], eax
mov eax, dword [0x10028aa4]
add eax, 1
mov dword [0x10028aa4], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x100035f3
jmp 0x100035e7
mov eax, 0x100
mov dword [0x10028ab0], 0
mov ecx, dword [0x10028aa8]
mov edx, dword [0x10028aa4]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + edx]
add edi, ecx
mov dword [ebp - 0x20], eax
mov eax, edx
xor edx, edx
mov ecx, dword [ebp - 0x10]
div ecx
mov ebx, dword [ebp - 0x14]
movzx edx, byte [ebx + edx]
add edi, edx
mov dword [0x10028ab0], edi
mov eax, edi
cdq
mov edi, dword [ebp - 0x20]
idiv edi
mov dword [0x10028aa8], edx
mov dword [0x10028a9c], 0x1faf
mov edx, dword [0x10028aa4]
mov cl, byte [esi + edx]
mov byte [0x10028aac], cl
mov dword [0x10028aa0], 0x1ad8
mov edx, dword [0x10028aa8]
mov cl, byte [esi + edx]
mov edx, dword [0x10028aa4]
mov byte [esi + edx], cl
mov cl, byte [0x10028aac]
mov edx, dword [0x10028aa8]
mov byte [esi + edx], cl
mov dword [0x10028aa0], 0x1b2b
mov edx, dword [0x10028aa4]
add edx, 1
mov dword [0x10028aa4], edx
cmp edx, 0x100
jl 0x1000362a
mov eax, dword [0x10028a9c]
add eax, 0xfffff0a3
mov dword [0x10028a9c], eax
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10003710
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x60
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [0x10028a9c], 0x2509
mov edx, ecx
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x34], edx
mov dword [ebp - 0x38], ecx
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x34]
lea edx, section..data
imul esi, eax, 0x118
mov edi, edx
add edi, esi
add edi, 0xfc
mov esi, dword [edi]
imul edi, eax, 0x118
add edx, edi
add edx, 0xb6
movzx edx, word [edx]
xor edx, esi
add edx, ecx
add eax, 1
cmp eax, 0x1fb
mov ecx, edx
mov dword [ebp - 0x3c], edx
mov dword [ebp - 0x34], ecx
mov dword [ebp - 0x38], eax
jne 0x10003733
lea eax, [0x100056c3]
mov ecx, 0xe
lea edx, [ebp - 0x2c]
mov dword [0x10028aa0], 0x19f4
mov dword [0x10028a9c], 0x24db
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x44], ecx
call fcn.10004220
mov eax, dword [ebp - 0x40]
mov dword [esp], eax
call fcn.10003330
mov ecx, eax
mov dword [0x10028abc], eax
mov eax, esp
mov edx, dword [ebp - 0x3c]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov dword [0x10028aa0], 0x21a6
mov edx, ecx
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x4c], edx
mov dword [ebp - 0x50], ecx
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x4c]
lea edx, section..data
imul esi, eax, 0x118
mov edi, edx
add edi, esi
add edi, 0xfc
mov esi, dword [edi]
imul edi, eax, 0x118
mov ebx, edx
add ebx, edi
mov edi, dword [ebx]
imul ebx, eax, 0x118
add edx, ebx
add edx, 0xb6
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x48]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x58], ecx
mov dword [ebp - 0x5c], edx
call fcn.10004150
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x58]
add eax, ecx
mov edx, dword [ebp - 0x54]
add edx, 1
cmp edx, 0x1fb
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], edx
jne 0x10003803
mov eax, dword [ebp - 0x48]
mov dword [esp], eax
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x3c]
mov dword [esp + 8], ecx
call fcn.100040a0
xor eax, eax
mov dword [0x10028a9c], 0x1dea
mov ecx, dword [ebp - 0x48]
add ecx, 0x44086
mov edx, dword [ebp - 0x30]
mov dword [edx], ecx
mov dword [edx + 4], 0x12a000
mov ecx, dword [0x10028a9c]
add ecx, 0x1e87
mov dword [0x10028a9c], ecx
mov ecx, dword [ebp - 0x48]
add ecx, 0x3c524
mov dword [edx + 8], ecx
mov ecx, dword [0x10028a9c]
add ecx, 0xfffff308
mov dword [0x10028aa0], ecx
mov dword [edx + 0xc], 0x2000
mov ecx, dword [0x10028aa0]
add ecx, 0x21ef
mov dword [0x10028a9c], ecx
add esp, 0x60
pop esi
pop edi
pop ebx
pop ebp
ret