joyce8/EMBER2024-capa huggingface dataset:
Function at 0x421700
Capabilities:
Get common file path

Disassembly:
push ecx
cmp dword [ebx], 0
push esi
push edi
jne 0x4217a8
cmp dword [ebx + 4], 0xffffffff
jne 0x4217a8
lea edi, [ebx + 0x244]
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
mov eax, edi
lea edx, [eax + 2]
lea ecx, [ecx]
mov cx, word [eax]
add eax, 2
test cx, cx
jne 0x421730
sub eax, edx
sar eax, 1
movzx eax, word [ebx + eax*2 + 0x242]
cmp ax, 0x5c
je 0x421769
cmp ax, 0x2f
je 0x421769
add edi, 0xfffffffe
mov ax, word [edi + 2]
add edi, 2
test ax, ax
jne 0x421756
mov eax, dword [0x44e4d0]
mov dword [edi], eax
mov ecx, dword [esp + 0x14]
mov edx, dword [esp + 0x10]
push ecx
push edx
lea esi, [esp + 0x1c]
call fcn.004204d0
add esp, 8
test eax, eax
jne 0x42178d
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ecx
ret 8
call fcn.004208a0
mov dword [ebx], eax
neg eax
sbb eax, eax
and eax, 0xfffffe00
add eax, 0x200
pop edi
pop esi
pop ecx
ret 8
pop edi
mov eax, 0x1000000
pop esi
pop ecx
ret 8
Function at 0x422af0
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ecx
mov ecx, dword [esp + 8]
mov eax, dword [ecx]
push ebx
push ebp
push esi
mov esi, dword [ecx + 4]
mov ecx, eax
shr ecx, 4
xor ecx, esi
and ecx, 0xf0f0f0f
xor esi, ecx
shl ecx, 4
xor eax, ecx
mov ecx, eax
shr ecx, 0x10
xor ecx, esi
and ecx, 0xffff
xor esi, ecx
shl ecx, 0x10
xor eax, ecx
mov ecx, esi
shr ecx, 2
xor ecx, eax
and ecx, 0x33333333
xor eax, ecx
add ecx, ecx
add ecx, ecx
xor esi, ecx
mov ecx, esi
shr ecx, 8
xor ecx, eax
and ecx, 0xff00ff
xor eax, ecx
shl ecx, 8
xor ecx, esi
rol ecx, 1
mov esi, ecx
xor ecx, eax
and ecx, 0xaaaaaaaa
xor esi, ecx
xor ecx, eax
rol ecx, 1
push edi
mov edi, ecx
mov dword [esp + 0x10], 8
jmp 0x422b70
mov eax, esi
ror eax, 4
xor eax, dword [edx]
add edx, 4
mov ecx, eax
shr ecx, 0x18
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
and ecx, 0x3f
mov ecx, dword [ecx*4 + 0x455818]
or ecx, dword [ebx*4 + 0x455a18]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
or ecx, dword [ebx*4 + 0x455c18]
and eax, 0x3f
or ecx, dword [eax*4 + 0x455e18]
mov eax, dword [edx]
xor eax, esi
mov ebx, eax
shr ebx, 0x18
and ebx, 0x3f
mov ebx, dword [ebx*4 + 0x455918]
mov ebp, eax
shr ebp, 0x10
and ebp, 0x3f
or ebx, dword [ebp*4 + 0x455b18]
mov ebp, eax
shr ebp, 8
and ebp, 0x3f
or ebx, dword [ebp*4 + 0x455d18]
and eax, 0x3f
or ebx, dword [eax*4 + 0x455f18]
add edx, 4
or ebx, ecx
xor edi, ebx
mov eax, edi
ror eax, 4
xor eax, dword [edx]
add edx, 4
mov ecx, eax
shr ecx, 0x18
mov ebx, eax
shr ebx, 0x10
and ebx, 0x3f
and ecx, 0x3f
mov ecx, dword [ecx*4 + 0x455818]
or ecx, dword [ebx*4 + 0x455a18]
mov ebx, eax
shr ebx, 8
and ebx, 0x3f
or ecx, dword [ebx*4 + 0x455c18]
and eax, 0x3f
or ecx, dword [eax*4 + 0x455e18]
mov eax, dword [edx]
xor eax, edi
mov ebx, eax
shr ebx, 0x18
and ebx, 0x3f
mov ebx, dword [ebx*4 + 0x455918]
mov ebp, eax
shr ebp, 0x10
and ebp, 0x3f
or ebx, dword [ebp*4 + 0x455b18]
mov ebp, eax
shr ebp, 8
and ebp, 0x3f
or ebx, dword [ebp*4 + 0x455d18]
and eax, 0x3f
or ebx, dword [eax*4 + 0x455f18]
add edx, 4
or ebx, ecx
xor esi, ebx
sub dword [esp + 0x10], 1
jne 0x422b70
ror esi, 1
mov eax, esi
xor eax, edi
and eax, 0xaaaaaaaa
xor esi, eax
xor eax, edi
ror eax, 1
mov ecx, eax
shr ecx, 8
xor ecx, esi
and ecx, 0xff00ff
xor esi, ecx
shl ecx, 8
xor eax, ecx
mov ecx, eax
shr ecx, 2
xor ecx, esi
and ecx, 0x33333333
xor esi, ecx
lea edx, [ecx*4]
mov ecx, esi
shr ecx, 0x10
xor eax, edx
mov edx, dword [esp + 0x18]
xor ecx, eax
and ecx, 0xffff
xor eax, ecx
shl ecx, 0x10
xor esi, ecx
mov ecx, esi
shr ecx, 4
xor ecx, eax
and ecx, 0xf0f0f0f
mov edi, ecx
shl edi, 4
xor edi, esi
mov dword [edx], edi
pop edi
pop esi
xor ecx, eax
pop ebp
mov dword [edx + 4], ecx
pop ebx
pop ecx
ret
Function at 0x423aa0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push 0xffffffffffffffff
push 0x43ef81
mov eax, dword fs:[0]
push eax
sub esp, 8
push ebx
push ebp
push esi
push edi
mov eax, dword [0x454654]
xor eax, esp
push eax
lea eax, [esp + 0x1c]
mov dword fs:[0], eax
xor ebx, ebx
mov dword [esp + 0x18], ebx
mov edi, 1
mov dword [esp + 0x24], edi
mov eax, dword [0x45a98c]
mov edx, dword [eax + 0xc]
mov ecx, 0x45a98c
call edx
mov ecx, dword [esp + 0x2c]
add eax, 0x10
mov dword [ecx], eax
mov edx, dword [esp + 0x30]
push edx
mov dword [esp + 0x1c], edi
call dword [sym.imp.WS2_32.dll_inet_addr]
mov ebp, eax
cmp ebp, ebx
je 0x423b95
push edi
lea eax, [esp + 0x18]
push eax
push ebx
mov dword [esp + 0x20], ebx
call sub.IPHLPAPI.DLL_GetIpNetTable
cmp eax, 0x7a
jne 0x423b95
mov ecx, dword [esp + 0x14]
push ecx
push 0x40
call dword [sym.imp.KERNEL32.dll_GlobalAlloc]
push edi
lea edx, [esp + 0x18]
mov esi, eax
push edx
push esi
call sub.IPHLPAPI.DLL_GetIpNetTable
test eax, eax
jne 0x423b8e
cmp esi, ebx
je 0x423b95
mov edx, dword [esi]
cmp edx, ebx
jbe 0x423b8e
lea ecx, [esi + 0x14]
cmp ebp, dword [ecx]
je 0x423b57
add eax, edi
add ecx, 0x18
cmp eax, edx
jb 0x423b48
jmp 0x423b8e
mov edi, dword [esp + 0x2c]
lea eax, [eax + eax*2]
movzx ecx, byte [esi + eax*8 + 0x11]
movzx edx, byte [esi + eax*8 + 0x10]
lea eax, [esi + eax*8]
push ecx
movzx ecx, byte [eax + 0xf]
push edx
movzx edx, byte [eax + 0xe]
push ecx
movzx ecx, byte [eax + 0xd]
push edx
movzx edx, byte [eax + 0xc]
push ecx
push edx
push 0x44e9d0
call fcn.004049a0
add esp, 0x1c
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov byte [esp + 0x24], bl
mov eax, dword [esp + 0x30]
mov esi, dword [eax - 0x10]
cmp dword [eax - 0xc], ebx
lea edx, [eax - 0x10]
je 0x423bf4
cmp dword [edx + 0xc], ebx
lea ecx, [edx + 0xc]
jge 0x423bce
cmp dword [eax - 8], ebx
jge 0x423bbf
push 0x80070057
call fcn.00401960
mov dword [eax - 0xc], ebx
mov eax, dword [esp + 0x30]
mov byte [eax], bl
mov eax, dword [esp + 0x30]
jmp 0x423bf4
or eax, 0xffffffff
lock xadd dword [ecx], eax
dec eax
test eax, eax
jg 0x423be4
mov ecx, dword [edx]
mov eax, dword [ecx]
push edx
mov edx, dword [eax + 4]
call edx
mov eax, dword [esi]
mov edx, dword [eax + 0xc]
mov ecx, esi
call edx
add eax, 0x10
mov dword [esp + 0x30], eax
add eax, 0xfffffff0
lea ecx, [eax + 0xc]
or edx, 0xffffffff
lock xadd dword [ecx], edx
dec edx
test edx, edx
jg 0x423c10
mov ecx, dword [eax]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 4]
call eax
mov eax, dword [esp + 0x2c]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x14
ret
Function at 0x42609f
Capabilities:
Write file on windows

Disassembly:
push 0x48
mov eax, 0x43e798
call fcn.00429c06
mov esi, ecx
xor ebx, ebx
cmp dword [esi + 0x3c], ebx
je 0x4261b1
cmp byte [esi + 0x42], bl
je 0x4261b1
mov eax, dword [esi]
mov edi, 0xffff
push edi
call dword [eax + 4]
movzx eax, ax
cmp di, ax
jne 0x4260db
xor al, al
jmp 0x4261b3
push ebx
push 8
lea ecx, [ebp - 0x2c]
call fcn.00424d50
mov dword [ebp - 4], ebx
lea eax, [ebp - 0x54]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041b410
mov ecx, eax
call fcn.004124a0
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x3c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041b410
mov ecx, eax
call fcn.004124a0
mov ecx, dword [esi + 0x3c]
mov edx, dword [ecx]
mov dword [ebp - 0x34], eax
lea eax, [ebp - 0x30]
push eax
add edi, ebx
push edi
push dword [ebp - 0x34]
lea eax, [esi + 0x44]
push eax
call dword [edx + 0x18]
sub eax, 0
je 0x42614b
dec eax
je 0x42614f
dec eax
dec eax
je 0x4261ad
xor bl, bl
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00405530
mov al, bl
jmp 0x4261b3
mov byte [esi + 0x42], 0
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041b410
mov ecx, eax
call fcn.004124a0
mov edi, dword [ebp - 0x30]
sub edi, eax
je 0x42618f
lea eax, [ebp - 0x44]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041b410
mov ecx, eax
call fcn.004124a0
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0042a418
add esp, 0x10
cmp edi, eax
jne 0x426139
cmp byte [esi + 0x42], 0
je 0x4261ad
test edi, edi
jne 0x4260e9
push edi
push 8
lea ecx, [ebp - 0x2c]
call fcn.00407f60
jmp 0x4260e9
mov bl, 1
jmp 0x42613b
mov al, 1
call fcn.00429c50
ret
Function at 0x42625a
Capabilities:
Write file on windows

Disassembly:
push 0x54
mov eax, 0x43e6c8
call fcn.00429c06
mov edi, dword [ebp + 8]
mov eax, 0xffff
mov esi, ecx
cmp ax, di
jne 0x426284
lea eax, [ebp + 8]
push eax
call fcn.004259ae
pop ecx
jmp 0x4263ff
mov eax, dword [esi + 0x24]
mov ecx, dword [eax]
xor ebx, ebx
cmp ecx, ebx
je 0x4262b2
mov eax, dword [esi + 0x34]
mov edx, dword [eax]
lea edx, [ecx + edx*2]
cmp ecx, edx
jae 0x4262b2
dec dword [eax]
mov esi, dword [esi + 0x24]
mov eax, dword [esi]
lea ecx, [eax + 2]
mov dword [esi], ecx
mov word [eax], di
mov ax, di
jmp 0x4263ff
mov eax, dword [esi + 0x4c]
cmp eax, ebx
je 0x4263fa
cmp dword [esi + 0x3c], ebx
jne 0x4262db
push eax
push edi
call fcn.00425a1b
pop ecx
test al, al
pop ecx
movzx eax, di
jne 0x4263ff
jmp 0x4263fa
movzx eax, di
push ebx
push 8
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
call fcn.00424d50
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
mov dword [ebp - 4], ebx
call fcn.0041b410
mov ecx, eax
call fcn.004124a0
mov edi, dword [ebp - 0x18]
mov ebx, eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041b410
mov ecx, eax
call fcn.004124a0
lea edx, [ebp - 0x38]
add edi, ebx
push edx
lea ebx, [esi + 0x44]
jmp 0x4263cc
cmp eax, 1
jg 0x426407
lea eax, [ebp - 0x58]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041b410
mov ecx, eax
call fcn.004124a0
mov edi, dword [ebp - 0x38]
sub edi, eax
je 0x426371
lea eax, [ebp - 0x60]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041b410
mov ecx, eax
call fcn.004124a0
push dword [esi + 0x4c]
push edi
push 1
push eax
call fcn.0042a418
add esp, 0x10
cmp edi, eax
jne 0x4263ee
lea eax, [ebp - 0x30]
mov byte [esi + 0x42], 1
cmp dword [ebp - 0x3c], eax
jne 0x426437
test edi, edi
ja 0x426397
cmp dword [ebp - 0x18], 0x20
push 0
lea ecx, [ebp - 0x2c]
jae 0x4263f3
push 8
call fcn.00407f60
lea eax, [ebp - 0x48]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041b410
mov ecx, eax
call fcn.004124a0
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x50]
push eax
lea ecx, [ebp - 0x2c]
call fcn.0041b410
mov ecx, eax
call fcn.004124a0
lea edx, [ebp - 0x38]
push edx
mov edx, dword [ebp - 0x40]
add edi, edx
mov ecx, dword [esi + 0x3c]
push edi
push eax
lea edx, [ebp - 0x3c]
push edx
lea edx, [ebp - 0x2e]
push edx
lea edx, [ebp - 0x30]
push edx
mov dword [ebp - 0x34], eax
mov eax, dword [ecx]
push ebx
call dword [eax + 0x14]
test eax, eax
jge 0x426328
push 0
lea ecx, [ebp - 0x2c]
push 1
call fcn.00405530
mov eax, 0xffff
call fcn.00429c50
ret 4
cmp eax, 3
jne 0x4263ee
push dword [esi + 0x4c]
push dword [ebp - 0x30]
call fcn.00425a1b
movzx esi, word [ebp + 8]
pop ecx
pop ecx
test al, al
jne 0x426426
mov esi, 0xffff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00405530
mov ax, si
jmp 0x4263ff
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.00405530
mov ax, word [ebp + 8]
jmp 0x4263ff

Function at 0x42761e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x454654]
jne 0x427628
repz ret
jmp fcn.0042f8c5
Function at 0x43ac84
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.0042f2d4
and dword [ebp - 4], 0
cmp dword [0x45b890], 0
mov ebx, eax
jne 0x43ad35
push 0x4431e0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x43ade6
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push 0x4431d4
push edi
call esi
test eax, eax
je 0x43ade6
push eax
call fcn.0042f262
mov dword [esp], 0x4431c4
push edi
mov dword [0x45b890], eax
call esi
push eax
call fcn.0042f262
mov dword [esp], 0x4431b0
push edi
mov dword [0x45b894], eax
call esi
push eax
call fcn.0042f262
mov dword [esp], 0x443194
push edi
mov dword [0x45b898], eax
call esi
push eax
call fcn.0042f262
pop ecx
mov dword [0x45b8a0], eax
test eax, eax
je 0x43ad35
push 0x44317c
push edi
call esi
push eax
call fcn.0042f262
pop ecx
mov dword [0x45b89c], eax
mov eax, dword [0x45b89c]
cmp eax, ebx
je 0x43ad8d
cmp dword [0x45b8a0], ebx
je 0x43ad8d
push eax
call fcn.0042f2dd
push dword [0x45b8a0]
mov esi, eax
call fcn.0042f2dd
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x43ad8d
test edi, edi
je 0x43ad8d
call esi
test eax, eax
je 0x43ad84
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43ad84
test byte [ebp - 0xc], 1
jne 0x43ad8d
or dword [ebp + 0x10], 0x200000
jmp 0x43adc6
mov eax, dword [0x45b894]
cmp eax, ebx
je 0x43adc6
push eax
call fcn.0042f2dd
pop ecx
test eax, eax
je 0x43adc6
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x43adc6
mov eax, dword [0x45b898]
cmp eax, ebx
je 0x43adc6
push eax
call fcn.0042f2dd
pop ecx
test eax, eax
je 0x43adc6
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x45b890]
call fcn.0042f2dd
pop ecx
test eax, eax
je 0x43ade6
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43ade8
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x1000441f
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005ec8e
call fcn.1005e6e0
sub esp, 0x3c
push ebx
push esi
mov dword [ebp - 0x24], 0x5e87
cmp dword [ebp - 0x24], 0x5fa5
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], ecx
jle 0x100044b2
xor esi, esi
mov dword [ebp - 0x20], esi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
xor eax, eax
mov dword [ebp - 0x14], esi
mov ecx, ebx
mov dword [ebp - 0x18], eax
shl esi, cl
mov dword [ebp - 0x14], esi
mov ecx, eax
mov dword [ebp - 0x28], esi
xor ebx, ebx
shl esi, cl
mov ecx, ebx
mov eax, esi
sar eax, cl
mov ecx, 0x1007ab78
cdq
push edx
push eax
call fcn.10001bfe
inc ebx
cmp ebx, 0x1502
jl 0x10004467
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x12e3
jl 0x1000445e
mov ebx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
inc ebx
mov dword [ebp - 0x1c], ebx
cmp ebx, 0x79e7
jl 0x1000444f
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x7eff
jl 0x1000444a
cmp byte [ebp + 0x18], 0
je 0x100044fd
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x10]
sub ecx, dword [eax]
sar ecx, 1
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.1000ef8b
mov dword [ebp - 4], 4
cmp dword [ebp - 0x24], 0x5cbe
jge 0x100044ec
mov edx, str.spk_rkzbdzkm_ngv_tvaaaju_zea_likbqln_pbx_aormvb_orn_eqjptnzma_zqyiznc_nqdbnwjrz_zzvfnxaq
mov ecx, 0x1007ab78
call fcn.100039fb
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x20], 0x549d
cmp dword [ebp - 0x20], 0x5535
jle 0x1000454e
xor esi, esi
xor ebx, ebx
lea eax, [ebx + esi]
cdq
lea ecx, [ebp - 0x44]
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10004529
mov eax, dword [eax]
push eax
call fcn.10047d34
pop ecx
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.10002050
inc ebx
cmp ebx, 0x7d47
jl 0x10004511
inc esi
cmp esi, 0x2f98
jl 0x1000450f
cmp dword [ebp - 0x20], 0x5185
jge 0x10004562
push str.mlbtitdkw_bqgcwi_fqmlfltd
call fcn.10047d34
pop ecx
mov eax, dword [ebp - 0x2c]
or dword [ebp - 4], 0xffffffff
cmp byte [eax], 0
je 0x100044cd
mov edx, 0x676
xor cl, cl
call fcn.10006d40
mov dword [ebp - 0x18], 0x16ea
cmp dword [ebp - 0x18], 0x187e
jle 0x100045cd
xor esi, esi
mov dword [ebp - 0x1c], esi
mov ebx, esi
mov dword [ebp - 0x20], 0x6f3a
xor esi, esi
mov eax, ebx
mov ecx, 0x1007ab78
xor eax, esi
cdq
push edx
push eax
call fcn.10001bfe
inc esi
cmp esi, 0x6e1a
jl 0x1000459e
dec ebx
dec dword [ebp - 0x20]
jne 0x1000459c
mov esi, dword [ebp - 0x1c]
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x3244
jl 0x10004593
mov dword [ebp - 4], 2
cmp dword [ebp - 0x18], 0x1688
jge 0x100044cd
mov edx, str.axzvld_htiocviuf_snn_qlftgkgec_wmiz_plk_ylr_glwinty_rrhbqn_farfzsb_teshobu
mov ecx, 0x1007ab78
call fcn.100039fb
jmp 0x100044cd
Function at 0x100048a7
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005ecce
call fcn.1005e6e0
sub esp, 0x10
push ebx
push esi
mov byte [ebp - 0x14], cl
mov dword [ebp - 0x18], 0x4832
cmp dword [ebp - 0x18], 0x4a41
push edi
mov dword [ebp - 0x10], esp
jle 0x1000490d
push 0
push 0x1beb
call dword [sym.imp.GDI32.dll_SetTextColor]
xor esi, esi
xor edi, edi
xor ebx, ebx
lea eax, [edi + esi]
mov ecx, 0x1007ab78
xor eax, ebx
cdq
push edx
push eax
call fcn.10001bfe
inc ebx
cmp ebx, 0xa59
jl 0x100048e0
inc edi
cmp edi, 0xd25
jl 0x100048de
inc esi
cmp esi, 0x5112
jl 0x100048dc
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x4757
jge 0x10004929
mov edx, str.bizruybc_dkelfrn_hbifk_ozmxlnf_lirgjst_xumzfvn_ltct_plihn_awnfrsw_dkjnqe_rpymxl_elc_drbjq_fffmk
mov ecx, 0x1007ab78
call fcn.100039fb
cmp byte [ebp - 0x14], 0
je 0x10004968
mov eax, dword [ebp + 0x20]
cmp byte [eax], 0
je 0x100049d6
push 0
push 1
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventA]
jmp 0x100049d6
mov ecx, dword [ebp + 0x14]
mov edi, dword [ebp + 0x28]
cmp dword [ecx], 0
jne 0x10004975
mov eax, dword [edi]
mov esi, dword [ebp + 0xc]
xor edx, edx
mov ebx, dword [ebp + 0x18]
mov eax, dword [esi]
mov eax, dword [ecx]
mov eax, dword [ebx]
mov ecx, dword [esi]
mov eax, dword [esi]
cmp ecx, eax
setge dl
test edx, edx
jns 0x10004992
mov eax, dword [esi]
mov eax, dword [esi]
xor ecx, ecx
cmp eax, 1
sete cl
xor eax, eax
add ecx, 0x68d2
cmp ecx, 0xfffffffd
mov ecx, dword [ebx]
setle al
imul ecx, eax
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
mov ecx, dword [ebp + 0x2c]
mov eax, dword [eax]
mov dword [ecx], eax
mov edx, dword [edi]
mov eax, dword [ecx]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp + 0x24]
sete cl
xor edx, edx
cmp ecx, 0x725dc8ff
setg dl
mov dword [eax], edx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000593f
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov esi, edx
mov byte [ebp - 8], cl
je 0x100059df
test cl, cl
je 0x100059c8
mov esi, dword [ebp + 0x14]
xor edx, edx
mov eax, dword [ebp + 8]
xor ebx, ebx
mov ecx, dword [esi]
mov eax, dword [eax]
cmp dword [eax + ecx*4], ebx
mov eax, dword [ebp + 0xc]
setne dl
xor ecx, ecx
cmp edx, 0x4067
setne cl
xor edx, edx
imul ecx, dword [eax]
mov eax, dword [esi]
cmp ecx, 0xfffffffe
setl dl
neg edx
neg edx
sbb edx, edx
add edx, 0x8eb9672e
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
sete cl
xor eax, eax
cmp ecx, 0x2e0f
setge al
cmp eax, 0x949f
je 0x100059bb
mov eax, dword [ebp + 0x20]
cmp dword [eax], ebx
je 0x100059be
xor ebx, ebx
inc ebx
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
jmp 0x10005aea
push 0xe8
push 0x884
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
jmp 0x10005aea
push 0
pop ebx
cmp byte [ebp + 0x1c], bl
je 0x10005ad0
mov dword [ebp - 0x10], 0x41b0
cmp dword [ebp - 0x10], 0x4450
jle 0x10005a70
push 0x129f
call dword [sym.imp.USER32.dll_GetKeyState]
mov esi, ebx
mov edi, ebx
mov eax, ebx
mov dword [ebp + 0x10], ebx
mov ecx, ebx
mov dword [ebp - 0xc], ebx
add eax, ecx
lea ecx, [ebp - 0x38]
xor eax, edi
or eax, esi
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10005a2f
mov eax, dword [eax]
push eax
call fcn.10047d34
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x38]
call fcn.10002050
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp + 0x10]
inc ecx
mov dword [ebp - 0xc], ecx
cmp ecx, 0x3204
jl 0x10005a14
inc eax
mov dword [ebp + 0x10], eax
cmp eax, 0x7a22
jl 0x10005a0f
inc edi
cmp edi, 0x41a1
jl 0x10005a0a
inc esi
cmp esi, 0xd2
jl 0x10005a08
cmp dword [ebp - 0x10], 0x3e01
jge 0x10005a84
push str.luyvha_enix_tsoqjmlfx_ywjk_mofanp_kfsiyl_wsknsourc_fdkrmlxj_igqvk_dqhgcki_nycvvh_tbwww
call fcn.10047d34
pop ecx
mov dword [ebp + 0x10], 0xd6c05baf
mov byte [ebp + 0x13], bl
cmp byte [ebp + 0x13], 0
je 0x10005aa4
push 0x1bc
push 0x19e1
call dword [sym.imp.GDI32.dll_RestoreDC]
mov dword [ebp + 0x10], 0xffffffe5
cmp dword [ebp + 0x10], 0xfffffffd
jl 0x10005aea
push 6
pop eax
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x18], ebx
jne 0x10005aea
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], 0xfffffffd
jge 0x10005ab4
jmp 0x10005aea
mov ecx, dword [esi]
xor edx, edx
mov eax, dword [esi]
cmp ecx, eax
mov eax, dword [esi]
setge dl
sub edx, eax
je 0x10005ae8
cmp dword [esi], ebx
je 0x10005ae8
xor ebx, ebx
inc ebx
mov dword [esi], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007078
Capabilities:
Encode data using xor
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x1005ed54
call fcn.1005e6e0
sub esp, 0x2c
push ebx
push esi
mov dword [ebp - 0x14], 0x290c
xor esi, esi
cmp dword [ebp - 0x14], 0x2b0a
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], ecx
jle 0x100070d1
mov edi, esi
mov ebx, esi
mov eax, ebx
mov ecx, 0x1007ab78
xor eax, edi
cdq
push edx
push eax
call fcn.10001bfe
inc ebx
cmp ebx, 0x19e8
jl 0x100070a7
inc edi
cmp edi, 0x2dbc
jl 0x100070a5
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x14], 0x2554
jge 0x100070ec
mov edx, str.xglpuxp_wrpujtev_nye_ajmdpljzb_gihhakhmn_pjo_zxzkm_mdskq_chyfxxp_splfjuj_gni_ijwn_snju
mov ecx, 0x1007ab78
call fcn.100039fb
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x20], 0
je 0x10007129
push esi
push 0x1463
call dword [sym.imp.USER32.dll_BeginPaint]
jmp 0x100071ea
mov dword [ebp - 0x18], 0x3665
cmp dword [ebp - 0x18], 0x3889
jle 0x10007181
mov edi, esi
mov dword [ebp - 0x14], esi
mov ebx, edi
mov edi, 0xc83
mov eax, ebx
lea ecx, [ebp - 0x38]
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000715c
mov eax, dword [eax]
push eax
call fcn.10047d34
pop ecx
push esi
push 1
lea ecx, [ebp - 0x38]
call fcn.10002050
dec ebx
dec edi
jne 0x10007145
mov edi, dword [ebp - 0x14]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x2c92
jl 0x1000713e
cmp dword [ebp - 0x18], 0x35a5
jge 0x10007195
push str.drqvft_mfuho_zvplizmub_xackuk_dwdmtzw_jtkulcrn_vfuqpdue_clrvy_axctq_fkml_gdrw_pcmmme_acrcf
call fcn.10047d34
pop ecx
mov edx, dword [ebp + 0x1c]
mov ebx, dword [ebp + 0x10]
mov edi, dword [ebp + 0x24]
mov dword [edx], esi
mov dword [ebx], esi
mov eax, dword [edi]
cmp dword [edi], esi
mov esi, dword [ebp + 8]
jne 0x100071d5
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, dword [edx]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp - 0x20]
setge dl
xor ecx, ecx
mov eax, dword [eax]
cmp edx, eax
mov edx, dword [ebp + 0x18]
setl cl
mov dword [edx], ecx
mov ecx, dword [ebp - 0x1c]
mov eax, dword [edx]
mov eax, dword [ecx]
mov eax, dword [esi]
jmp 0x100071db
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp - 0x1c]
mov eax, dword [esi]
mov eax, dword [edi]
mov eax, dword [ecx]
mov eax, dword [edx]
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebx]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret