joyce8/EMBER2024-capa huggingface dataset:
Function at 0x200019d0
Capabilities:
Enumerate devices by category

Disassembly:
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x200195a0
push eax
mov dword fs:[0], esp
sub esp, 0x1c
push ebx
push edi
mov edi, dword [esp + 0x34]
xor ebx, ebx
cmp edi, ebx
jge 0x20001a09
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov dword [esp + 8], ebx
lea eax, [esp + 8]
mov dword [esp + 0x2c], ebx
push eax
push 0x2001e258
push 1
push ebx
push 0x2001e2e8
call dword [0x2001a5e8]
cmp eax, ebx
je 0x20001a58
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
cmp eax, ebx
je 0x20001aa2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov dword [esp + 0x34], ebx
mov eax, dword [esp + 8]
lea ecx, [esp + 0x34]
push ebx
push ecx
mov edx, dword [eax]
push 0x2001e2d8
push eax
mov byte [esp + 0x3c], 1
call dword [edx + 0xc]
cmp eax, ebx
je 0x20001ab7
mov eax, dword [esp + 0x34]
mov byte [esp + 0x2c], bl
cmp eax, ebx
je 0x20001a8c
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
cmp eax, ebx
je 0x20001aa2
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
pop edi
xor al, al
pop ebx
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
add esp, 0x28
ret 8
mov eax, dword [esp + 0x34]
push esi
push eax
mov edx, dword [eax]
call dword [edx + 0x14]
mov eax, dword [esp + 0x38]
lea edx, [esp + 0x14]
push edx
lea edx, [esp + 0x14]
mov ecx, dword [eax]
push edx
push 1
push eax
xor esi, esi
call dword [ecx + 0xc]
cmp edi, ebx
jl 0x20001b76
push ebp
mov ebp, dword [esp + 0x40]
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x40]
push edx
push 0x2001ad20
mov ecx, dword [eax]
push ebx
push ebx
push eax
call dword [ecx + 0x24]
cmp eax, ebx
jl 0x20001b4c
mov eax, dword [esp + 0x40]
lea edx, [esp + 0x1c]
push ebx
mov word [esp + 0x20], 8
mov ecx, dword [eax]
push edx
push 0x20021314
push eax
call dword [ecx + 0xc]
cmp eax, ebx
jne 0x20001b42
cmp esi, edi
jne 0x20001b37
mov eax, dword [esp + 0x14]
push ebp
push 0x2001e248
push ebx
mov ecx, dword [eax]
push ebx
push eax
call dword [ecx + 0x20]
mov edx, dword [esp + 0x24]
push edx
call dword [0x2001a3dc]
mov eax, dword [esp + 0x40]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
mov eax, dword [esp + 0x14]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov eax, dword [esp + 0x3c]
lea edx, [esp + 0x18]
push edx
lea edx, [esp + 0x18]
mov ecx, dword [eax]
push edx
push 1
push eax
inc esi
call dword [ecx + 0xc]
cmp esi, edi
jle 0x20001ae7
pop ebp
mov eax, dword [esp + 0x38]
mov byte [esp + 0x30], bl
cmp eax, ebx
pop esi
je 0x20001b89
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [esp + 8]
mov dword [esp + 0x2c], 0xffffffff
cmp eax, ebx
je 0x20001b9f
mov edx, dword [eax]
push eax
call dword [edx + 8]
mov ecx, dword [esp + 0x24]
pop edi
mov al, 1
pop ebx
mov dword fs:[0], ecx
add esp, 0x28
ret 8
Function at 0x20003060
Capabilities:
Get number of processors

Disassembly:
push 0xffffffffffffffff
push 0x200195e3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
mov eax, dword [esp + 0x14]
push ebx
push esi
mov esi, ecx
push eax
mov dword [esp + 0xc], esi
call fcn.200140b0
xor ebx, ebx
push 0x134
mov dword [esp + 0x18], ebx
mov dword [esi], 0x2001ac50
mov byte [esi + 0x1c], 1
mov dword [esi + 0x28], 8
call fcn.20019304
add esp, 4
mov dword [esp + 0x1c], eax
cmp eax, ebx
mov byte [esp + 0x14], 1
je 0x200030c7
push 0x64
push ebx
push 8
mov ecx, eax
call sym.dbghelp.dll_StackWalk64
jmp 0x200030c9
xor eax, eax
push 1
push ebx
push ebx
push esi
push 0x20012c40
push ebx
push ebx
mov byte [esp + 0x30], bl
mov dword [esi + 0x34], eax
mov dword [esi + 0x10], 1
mov dword [esi + 0x18], ebx
mov byte [esi + 0x14], bl
mov byte [esi + 0x24], bl
call fcn.20003670
push 1
push ebx
push ebx
push esi
push 0x2000d450
push ebx
push ebx
mov dword [esi + 0x2c], eax
call fcn.20003670
mov ecx, dword [esp + 0x44]
add esp, 0x38
mov dword [esi + 0x30], eax
mov eax, esi
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x10
ret 4
Function at 0x20003120
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x114
xor ecx, ecx
push ebx
mov ebx, dword [esp + 0x11c]
push ebp
push esi
cmp ebx, ecx
push edi
je 0x2000322d
mov eax, dword [ebx + 0x3c]
mov ebp, dword [esp + 0x12c]
add eax, ebx
mov dword [esp + 0x10], ecx
mov esi, dword [eax + 0x78]
mov eax, dword [eax + 0x7c]
add esi, ebx
mov dword [esp + 0x1c], eax
test ebp, 0x80000000
jne 0x200031cb
mov eax, dword [esi + 0x20]
mov edx, dword [esi + 0x18]
add eax, ebx
cmp edx, ecx
mov dword [esp + 0x18], ecx
jbe 0x200031e9
mov dword [esp + 0x14], eax
mov ecx, dword [esp + 0x14]
push 0
mov edi, dword [ecx]
add edi, ebx
push edi
call fcn.20003a90
add esp, 4
push eax
push edi
call fcn.20004760
and eax, 0x7fffffff
add esp, 0xc
cmp eax, ebp
je 0x200031b6
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x14]
mov ecx, dword [esi + 0x18]
inc eax
add edx, 4
cmp eax, ecx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], edx
jb 0x20003173
jmp 0x200031e9
mov edx, dword [esi + 0x24]
mov eax, dword [esp + 0x18]
lea ecx, [edx + eax*2]
mov dx, word [ecx + ebx]
mov word [esp + 0x10], dx
jmp 0x200031e9
mov ecx, dword [esi + 0x10]
mov edx, dword [esi + 0x14]
mov eax, ebp
add edx, ecx
and eax, 0xffff
cmp eax, edx
jae 0x2000322d
cmp eax, ecx
jb 0x2000322d
sub bp, cx
mov dword [esp + 0x10], ebp
mov eax, dword [esp + 0x10]
mov ecx, dword [esi + 0x1c]
and eax, 0xffff
lea edx, [ecx + eax*4]
mov eax, dword [edx + ebx]
add eax, ebx
je 0x2000322f
cmp eax, esi
jb 0x2000322f
mov ecx, dword [esp + 0x1c]
add ecx, esi
cmp eax, ecx
jae 0x2000322f
mov dl, byte [eax]
xor ecx, ecx
test dl, dl
mov esi, eax
je 0x2000322d
lea edx, [esp + 0x20]
sub edx, eax
mov al, byte [esi]
inc ecx
mov byte [edx + esi], al
inc esi
cmp al, 0x2e
je 0x2000323a
cmp byte [esi], 0
jne 0x2000321d
xor eax, eax
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret
test ecx, ecx
jle 0x2000322d
mov byte [esp + ecx + 0x20], 0x64
inc ecx
mov al, 0x6c
lea edx, [esp + 0x20]
mov byte [esp + ecx + 0x20], al
inc ecx
push edx
mov byte [esp + ecx + 0x24], al
mov byte [esp + ecx + 0x25], 0
call fcn.2000a790
add esp, 4
lea eax, [esp + 0x20]
push eax
call sym.dbghelp.dll_SymEnumTypes
push 0
push esi
mov edi, eax
call fcn.20003a90
add esp, 4
push eax
push esi
call fcn.20004760
and eax, 0x7fffffff
push eax
push edi
call fcn.20003120
add esp, 0x14
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x114
ret
Function at 0x20003890
Capabilities:
Clear file content
Query service configuration

Disassembly:
sub esp, 0x40
push ebx
push esi
xor esi, esi
push 0xf003f
push esi
mov dword [esp + 0x24], ecx
push esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, eax
cmp ebx, esi
je 0x200039f6
push ebp
lea eax, [esp + 0x10]
push edi
mov edi, dword [esp + 0x54]
lea ecx, [esp + 0x10]
mov esi, dword [sym.imp.ADVAPI32.dll_QueryServiceConfigA]
push eax
lea edx, [esp + 0x1c]
push ecx
push edx
lea eax, [esp + 0x38]
push 0x24
push eax
push 3
push edi
push ebx
call esi
mov ecx, dword [esp + 0x18]
push ecx
call dword [0x2001a324]
add esp, 4
lea edx, [esp + 0x14]
lea ecx, [esp + 0x10]
mov dword [esp + 0x28], eax
push edx
push ecx
mov ecx, dword [esp + 0x20]
lea edx, [esp + 0x1c]
push edx
push ecx
push eax
push 3
push edi
push ebx
call esi
mov eax, dword [esp + 0x10]
mov edx, eax
shl edx, 7
add edx, eax
lea edi, [edx*8 + 1]
push edi
call fcn.20019304
mov ecx, edi
mov ebp, eax
mov edx, ecx
xor eax, eax
mov edi, ebp
add esp, 4
shr ecx, 2
rep stosd dword es:[edi], eax
mov ecx, edx
lea esi, [ebp + 1]
and ecx, 3
mov dword [esp + 0x1c], 1
rep stosb byte es:[edi], al
mov eax, dword [esp + 0x10]
mov dword [esp + 0x20], 0
test eax, eax
jbe 0x200039c6
mov eax, dword [esp + 0x28]
lea edi, [eax + 0xc]
mov ecx, dword [esp + 0x54]
mov eax, dword [edi - 4]
test ecx, eax
je 0x200039b2
mov edx, dword [edi - 0xc]
push 0x63
push edx
push esi
call dword [0x2001a33c]
mov eax, dword [edi]
add esp, 0xc
mov dword [esi + 0x2bc], eax
mov ecx, dword [edi + 4]
push 0
mov dword [esi + 0x2c8], ecx
mov ecx, dword [esp + 0x28]
push esi
push ebx
call fcn.200102e0
mov eax, dword [esp + 0x1c]
add esi, 0x408
add eax, 0x408
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x20]
mov ecx, dword [esp + 0x10]
inc eax
add edi, 0x24
cmp eax, ecx
mov dword [esp + 0x20], eax
jb 0x20003966
mov edx, dword [esp + 0x1c]
mov ecx, dword [esp + 0x24]
push edx
push ebp
mov byte [ebp], 0x8b
call fcn.20013f10
mov eax, dword [esp + 0x28]
push eax
call dword [0x2001a320]
push ebp
call fcn.200192a0
add esp, 8
push ebx
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop edi
pop ebp
pop esi
pop ebx
add esp, 0x40
ret 4

Function at 0x20004760
Capabilities:
Encode data using xor

Disassembly:
push esi
call fcn.20008590
mov esi, dword [esp + 0xc]
mov ecx, dword [esp + 8]
or eax, 0xffffffff
test esi, esi
jbe 0x20004795
push ebx
mov edx, eax
xor ebx, ebx
mov bl, byte [ecx]
and edx, 0xff
xor edx, ebx
shr eax, 8
mov edx, dword [edx*4 + 0x20023ab0]
xor eax, edx
inc ecx
dec esi
jne 0x20004776
pop ebx
not eax
mov esi, eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x200047b1
push esi
push 0x20021874
push eax
call dword [0x2001a4a8]
add esp, 0xc
mov eax, esi
pop esi
ret
Function at 0x20004cd0
Capabilities:
Query service status

Disassembly:
sub esp, 0x11c
push ebx
push ebp
push esi
push 0x400
mov dword [esp + 0x20], ecx
push 0x40
mov dword [esp + 0x14], 0xff
call dword [0x2001a26c]
mov esi, dword [esp + 0x130]
mov ebp, eax
push esi
lea eax, [ebp + 2]
mov byte [ebp], 0x8f
push eax
mov byte [ebp + 1], 0xa
call dword [0x2001a23c]
push esi
call dword [0x2001a240]
lea ecx, [esp + 0x20]
mov ebx, eax
push ecx
mov ecx, dword [esp + 0x130]
push 0
push 0
lea edx, [esp + 0x18]
push 0
lea eax, [esp + 0x38]
push edx
push eax
push 0
push ecx
add ebx, 3
mov dword [esp + 0x30], 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp eax, 0x103
je 0x20004e38
push edi
test eax, eax
jne 0x20004df7
push ebp
call dword [0x2001a1b0]
mov edx, dword [esp + 0x10]
lea ecx, [ebx + edx + 2]
cmp ecx, eax
jbe 0x20004d80
lea edx, [ebx + 0x400]
push 0x42
push edx
push ebp
call dword [0x2001a268]
mov ebp, eax
mov ecx, dword [esp + 0x10]
lea esi, [esp + 0x2c]
mov eax, ecx
lea edi, [ebx + ebp]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
lea edx, [esp + 0x18]
and ecx, 3
push edx
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x14]
push 1
lea eax, [esp + 0x34]
push 0
lea ebx, [ebx + ecx + 1]
mov ecx, dword [esp + 0x13c]
push eax
push ecx
call dword [sym.imp.MSVCRT.dll_void____cdecl_operator_new_unsigned_int_]
test eax, eax
jne 0x20004df6
push eax
push eax
push eax
push eax
push eax
push eax
lea edx, [esp + 0x34]
push eax
push edx
push eax
push eax
mov dword [esp + 0x44], eax
push eax
mov eax, dword [esp + 0x44]
push eax
call dword [0x2001a010]
mov eax, dword [esp + 0x1c]
test eax, eax
je 0x20004deb
mov byte [ebx + ebp], 1
mov ecx, dword [esp + 0x18]
push ecx
call dword [sym.imp.MSVCRT.dll_strchr]
inc ebx
mov eax, dword [esp + 0x14]
lea edx, [esp + 0x24]
push edx
push 0
push 0
lea ecx, [esp + 0x1c]
push 0
lea edx, [esp + 0x3c]
inc eax
push ecx
push edx
mov dword [esp + 0x2c], eax
push eax
mov eax, dword [esp + 0x14c]
push eax
mov dword [esp + 0x30], 0xff
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
cmp eax, 0x103
jne 0x20004d53
pop edi
mov ecx, dword [esp + 0x1c]
push ebx
push ebp
call fcn.20013f10
push ebp
call dword [0x2001a25c]
pop esi
pop ebp
pop ebx
add esp, 0x11c
ret 8
Function at 0x20005050
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x808
lea eax, [esp + 0x10c]
push ebx
push esi
push edi
push 0x104
push eax
call dword [0x2001a2a0]
lea edi, [esp + 0x118]
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x14]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push 0x200212cc
mov eax, ecx
mov esi, edi
mov edi, edx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x18]
push ecx
call dword [0x2001a24c]
lea edx, [esp + 0x14]
push edx
call dword [0x2001a240]
lea ebx, [esp + eax + 0x14]
mov eax, dword [0x20022a00]
or ecx, 0xffffffff
push ebx
lea edi, [eax + 0x10]
xor eax, eax
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push ebx
mov edx, ecx
mov esi, edi
mov edi, ebx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
call fcn.20008a20
mov edi, str.3yG___AcKm_oM_li_0uW_WG_GLPUU_ngl
or ecx, 0xffffffff
xor eax, eax
add esp, 8
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
push eax
mov esi, edi
mov edx, ecx
mov edi, ebx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, edx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
push 0x80
push 4
mov ecx, edx
push eax
push eax
and ecx, 3
lea eax, [esp + 0x28]
push 2
rep movsb byte es:[edi], byte [esi]
push eax
call dword [0x2001a27c]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x200051f1
mov esi, dword [0x20022a00]
mov ecx, 0x17e
lea edi, [esp + 0x21c]
push 0
rep movsd dword es:[edi], dword [esi]
lea esi, [esp + 0x220]
call dword [0x2001a35c]
push eax
call dword [0x2001a358]
mov edi, dword [0x2001a34c]
add esp, 8
call edi
mov dword [esp + 0xc], eax
fild dword [esp + 0xc]
fmul qword [0x2001aca8]
call fcn.20019340
test al, al
je 0x20005161
mov ecx, 0x5f8
mov dl, byte [esi]
xor dl, al
mov byte [esi], dl
inc esi
dec ecx
jne 0x2000517f
lea ecx, [esp + 0x10]
push 0
push ecx
lea edx, [esp + 0x224]
push 0x5f8
push edx
push ebx
call dword [0x2001a288]
push ebx
call dword [0x2001a21c]
mov edi, 0x20021b74
or ecx, 0xffffffff
xor eax, eax
lea edx, [esp + 0x118]
repne scasb al, byte es:[edi]
not ecx
sub edi, ecx
mov esi, edi
mov ebx, ecx
mov edi, edx
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov ecx, ebx
dec edi
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, ebx
lea eax, [esp + 0x14]
and ecx, 3
push eax
rep movsb byte es:[edi], byte [esi]
lea ecx, [esp + 0x11c]
push ecx
call fcn.200047c0
add esp, 8
pop edi
pop esi
pop ebx
add esp, 0x808
ret
Function at 0x200057e0
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x108
mov eax, dword [0x20022a00]
push ebx
push ebp
mov ebp, ecx
add eax, 0x10
push esi
lea ecx, [esp + 0x10]
xor esi, esi
push eax
push ecx
mov dword [esp + 0x14], esi
call dword [0x2001a23c]
lea edx, [esp + 0x10]
push 0x2002192c
push edx
call fcn.200125c0
add esp, 8
lea eax, [esp + 0x10]
push esi
push 0x80
push 3
push esi
push 3
push 0x80000000
push eax
call dword [0x2001a27c]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x2000589d
push edi
push esi
push ebx
call dword [0x2001a278]
mov edi, eax
push edi
call dword [0x2001a324]
add esp, 4
lea ecx, [esp + 0x10]
mov esi, eax
push 0
push ecx
push edi
push esi
push ebx
call dword [0x2001a280]
xor eax, eax
test edi, edi
jbe 0x20005874
mov cl, byte [eax + esi]
xor cl, 0x44
mov byte [eax + esi], cl
inc eax
cmp eax, edi
jb 0x20005866
push edi
push esi
mov ecx, ebp
call fcn.20008370
push esi
mov edi, eax
call dword [0x2001a320]
add esp, 4
push ebx
call dword [0x2001a21c]
mov eax, edi
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
mov eax, esi
pop esi
pop ebp
pop ebx
add esp, 0x108
ret
Function at 0x20006600
Capabilities:
Modify service
Query service configuration

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x2001ac98
push 0x200192a6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x530
push ebx
push esi
push edi
mov byte [ebp - 0x53c], 0
mov ecx, 0xff
xor eax, eax
lea edi, [ebp - 0x53b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
xor eax, eax
mov dword [ebp - 0x540], eax
mov dword [ebp - 0x13c], eax
mov dword [ebp - 4], eax
push 0xf003f
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov edi, eax
mov dword [ebp - 0x13c], edi
push 0xf01ff
mov ebx, dword [ebp + 8]
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov esi, eax
mov dword [ebp - 0x540], esi
test edi, edi
jne 0x20006685
test esi, esi
je 0x200066f0
lea eax, [ebp - 0x138]
push eax
push esi
call dword [0x2001a040]
test eax, eax
je 0x200066f0
cmp dword [ebp - 0x134], 1
je 0x200066bf
lea ecx, [ebp - 0x138]
push ecx
push 1
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceConfig2A]
test eax, eax
je 0x200066f0
push 0x320
call dword [0x2001a298]
push ebx
mov edx, dword [0x200212d0]
push edx
lea eax, [ebp - 0x53c]
push eax
call dword [0x2001a4a8]
add esp, 0xc
push esi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigA]
lea ecx, [ebp - 0x53c]
push ecx
push 0x80000002
call dword [0x2001a404]
mov dword [ebp - 4], 0xffffffff
call fcn.20006719
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x20008140
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ecx, 0x5f8
mov eax, esi
mov dl, byte [esi + 0xf]
mov bl, byte [eax]
xor bl, dl
mov byte [eax], bl
inc eax
dec ecx
jne 0x20008150
mov al, byte [esi]
mov cl, byte [esi + 0xe]
pop esi
cmp al, cl
pop ebx
jne 0x2000816c
cmp al, 0x2b
jne 0x2000816c
mov al, 1
ret
xor al, al
ret
Function at 0x200083d0
Capabilities:
Enumerate process modules
Log keystrokes via input method manager

Disassembly:
push ecx
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x18]
mov esi, ecx
mov dword [esp + 0x18], 0
push 0
mov ebx, dword [edi + 8]
mov edx, dword [edi]
mov eax, dword [esi + 0x11c]
mov ebp, dword [edi + 0xc]
mov ecx, dword [edi + 4]
sub ebx, edx
sub ebp, ecx
mov dword [eax + 4], ebx
mov ecx, dword [esi + 0x11c]
push 0
mov dword [ecx + 8], ebp
mov edx, dword [esi + 0x120]
imul edx, ebx
add edx, 0x1f
mov eax, dword [esi + 0x11c]
sar edx, 3
and edx, 0xfffffffc
lea ecx, [esp + 0x20]
imul edx, ebp
mov dword [eax + 0x14], edx
mov edx, dword [esi + 0x11c]
mov eax, dword [esi + 0xf4]
push ecx
push 0
push edx
push eax
call dword [0x2001a0e4]
mov ecx, dword [esi + 0x100]
push eax
push ecx
mov dword [esp + 0x18], eax
call dword [sym.imp.PSAPI.DLL_GetModuleBaseNameA]
mov edx, dword [esi + 0xc0]
mov eax, dword [edi + 4]
mov ecx, dword [edi]
push edx
mov edx, dword [esi + 0xf4]
push eax
push ecx
push edx
push ebp
push ebx
push eax
mov eax, dword [esi + 0xfc]
push ecx
push eax
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringA]
mov ecx, dword [edi + 4]
mov edx, dword [edi]
mov eax, dword [esi + 0xfc]
push 0xcc0020
push ecx
mov ecx, dword [esi + 0x100]
push edx
push eax
push ebp
push ebx
push 0
push 0
push ecx
call dword [sym.imp.IMM32.dll_ImmGetCompositionStringA]
push 0x10
push edi
mov ecx, esi
call fcn.20013e70
mov edx, dword [esi + 0x11c]
mov ecx, dword [esp + 0x18]
mov eax, dword [edx + 0x14]
push eax
push ecx
mov ecx, esi
call fcn.20013e70
mov edx, dword [esp + 0x10]
push edx
call dword [sym.imp.PSAPI.DLL_EnumProcessModules]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret 4

Function at 0x20008590
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor edx, edx
mov ecx, 0x20023ab0
mov eax, edx
mov esi, 8
test al, 1
je 0x200085ac
shr eax, 1
xor eax, 0xedb88320
jmp 0x200085ae
shr eax, 1
dec esi
jne 0x2000859f
mov dword [ecx], eax
add ecx, 4
inc edx
cmp ecx, 0x20023eb0
jl 0x20008598
pop esi
ret
Function at 0x20008c70
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x2001ace8
push 0x200192a6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x140
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push 0xbe037055
xor esi, esi
push esi
call fcn.2000fb80
add esp, 8
cmp eax, esi
jne 0x20008cc0
xor eax, eax
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x30], esi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], esi
mov dword [ebp - 4], esi
push eax
push esi
push 0x400
call dword [0x2001a15c]
mov ebx, eax
mov dword [ebp - 0x1c], ebx
cmp ebx, esi
je 0x20008da0
lea eax, [ebp - 0x30]
push eax
push 8
push ebx
call dword [sym.imp.KERNEL32.dll_LocalSize]
mov dword [ebp - 0x24], eax
cmp eax, esi
je 0x20008da0
mov dword [ebp - 0x38], esi
lea ecx, [ebp - 0x38]
push ecx
push esi
push esi
push 1
mov edx, dword [ebp - 0x30]
push edx
mov edi, dword [0x2001a004]
call edi
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x38]
test eax, eax
jbe 0x20008da0
push eax
call fcn.20019304
add esp, 4
mov esi, eax
mov dword [ebp - 0x148], esi
mov dword [ebp - 0x28], esi
lea eax, [ebp - 0x38]
push eax
mov ecx, dword [ebp - 0x38]
push ecx
push esi
push 1
mov edx, dword [ebp - 0x30]
push edx
call edi
mov dword [ebp - 0x24], eax
test eax, eax
je 0x20008da0
mov dword [ebp - 0x140], 0x104
mov dword [ebp - 0x144], 0x100
push 0x100
call fcn.20019304
add esp, 4
mov dword [ebp - 0x14c], eax
mov dword [ebp - 0x2c], eax
lea ecx, [ebp - 0x34]
push ecx
lea edx, [ebp - 0x140]
push edx
lea ecx, [ebp - 0x13c]
push ecx
lea edx, [ebp - 0x144]
push edx
push eax
mov eax, dword [esi]
push eax
push 0
call dword [sym.imp.SHLWAPI.dll_SHDeleteKeyA]
mov dword [ebp - 0x24], eax
mov dword [ebp - 4], 0xffffffff
call 0x20008db2
mov ebx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x28]
test ebx, ebx
je 0x20008dbd
push ebx
call dword [0x2001a21c]
mov eax, dword [ebp - 0x30]
test eax, eax
je 0x20008dcb
push eax
call dword [0x2001a21c]
test esi, esi
je 0x20008dd8
push esi
call fcn.200192a0
add esp, 4
mov esp, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x2000a8e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push ecx
mov dword [ebp - 4], 1
call fcn.20010510
add esp, 8
nop
xor ecx, ecx
test eax, eax
jle 0x2000a934
push ebx
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
add bl, 0x7a
mov byte [ecx + edx], bl
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
xor bl, 0x5f
mov byte [ecx + edx], bl
mov edx, dword [ebp - 4]
mov bl, byte [ecx + edx]
xor bl, 0x46
mov byte [ecx + edx], bl
inc ecx
cmp ecx, eax
jl 0x2000a903
mov eax, dword [ebp - 4]
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esp, ebp
pop ebp
ret