joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10020228
Capabilities:
Get file attributes

Disassembly:
mov eax, 0x100646cc
call fcn.10063758
sub esp, 0x10
push ebx
push esi
mov byte [ebp - 0x14], cl
mov ebx, edx
mov dword [ebp - 0x18], 0x1a26
cmp dword [ebp - 0x18], 0x1cc8
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ebx
jle 0x10020282
xor esi, esi
mov edi, esi
mov ebx, 0x203d
mov eax, edi
mov ecx, 0x10080d98
cdq
push edx
push eax
call fcn.10001b47
dec edi
dec ebx
jne 0x1002025c
inc esi
cmp esi, 0x629e
jl 0x10020255
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ebx, dword [ebp - 0x1c]
cmp byte [ebp - 0x14], 0
je 0x100202aa
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x100202af
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
or dword [eax + ecx*4], 0xffffffff
inc dword [edx]
cmp dword [edx], 2
jl 0x10020299
jmp 0x100202af
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x16d5
jge 0x100202cb
mov edx, str.rfkqpqs_jqbjx_qarii_gajexo_xycmvist_jhtwkuixa_vcmvzo_yetqh_zxqaup
mov ecx, 0x10080d98
call fcn.10003a21
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10020717
Capabilities:
Get disk information
Start service

Disassembly:
mov eax, 0x100646ea
call fcn.10063758
sub esp, 0x28
push ebx
push esi
mov byte [ebp - 0x14], dl
mov dword [ebp - 0x20], 0xdc7
cmp dword [ebp - 0x20], 0xecb
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], ecx
jle 0x100207b5
push 0
push 0xde3
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x18], edi
lea eax, [edi + esi]
mov edi, 0x6989
mov dword [ebp - 0x24], eax
mov esi, eax
mov ecx, esi
mov eax, ebx
shl eax, cl
mov ecx, 0x10080d98
cdq
push edx
push eax
call fcn.10001b47
dec esi
dec edi
jne 0x10020768
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0xab7
jl 0x1002075b
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x2771
jl 0x10020756
inc ebx
cmp ebx, 0x3bb9
jl 0x10020751
push 0x1648
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0xac0
jge 0x100207d1
mov edx, str.higbjtxpg_xbiezqw_tnfxcjmu_cwlohncou_huwxxop
mov ecx, 0x10080d98
call fcn.10003a21
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x14], 0
je 0x10020855
mov esi, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x14]
mov ecx, dword [esi]
mov eax, dword [edx]
cmp dword [eax + ecx*4], 1
jl 0x10020810
push esi
push edx
call fcn.1002143c
pop ecx
pop ecx
jmp 0x1002085d
push 2
lea ecx, [ebp - 0x34]
call fcn.10001cd1
mov dword [ebp - 0x18], 0
jmp 0x10020830
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10020823
push esi
push ecx
push dword [ebp + 8]
xor cl, cl
push dword [ebp - 0x28]
push dword [ebp + 0x20]
call fcn.1001c584
add esp, 0x14
lea ecx, [ebp - 0x34]
call fcn.10001d54
jmp 0x1002085d
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x24]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100208b0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 8], 0
je 0x100208eb
cmp byte [edx], 0
je 0x100208f8
push 0x32d3
push ecx
push 0
push 0x62ee
push 0x78e0
push 0x4013
push ecx
push 0x695a
mov ecx, 0x5134
call fcn.1001fbfe
add esp, 0x20
jmp 0x100208f8
push 0x10c1
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
pop ecx
pop ebp
ret
Function at 0x10020996
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov byte [esp + 4], cl
push ebx
push esi
push edi
test cl, cl
je 0x10020ae9
mov esi, dword [ebp + 0xc]
mov dword [esi], 0xffffffe4
cmp dword [esi], 0x11
jg 0x10020b03
xor ebx, ebx
mov dword [esp + 0x24], 0x905d
cmp dword [esp + 0x24], ebx
jne 0x10020b03
mov byte [esp + 0xf], bl
mov dword [esp + 0x24], 0x5950
cmp dword [esp + 0x24], 0x5bb9
jle 0x10020a8f
push ebx
push 0x465
call dword [sym.imp.USER32.dll_EndDialog]
mov edi, ebx
mov dword [esp + 0x20], ebx
mov ecx, ebx
mov dword [esp + 0x1c], ebx
mov eax, edi
mov esi, ebx
cdq
idiv ecx
mov ecx, edx
mov dword [esp + 0x18], ecx
mov edi, ebx
mov dword [esp + 0x14], 0x3ebb
mov eax, edi
and eax, ecx
lea ecx, [esp + 0x28]
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10020a37
mov eax, dword [eax]
push eax
call fcn.1004b9e4
pop ecx
push ebx
push 1
lea ecx, [esp + 0x30]
call fcn.10002062
mov ecx, dword [esp + 0x18]
add edi, esi
dec dword [esp + 0x14]
jne 0x10020a1d
inc esi
cmp esi, 0x4560
jl 0x10020a13
mov ecx, dword [esp + 0x1c]
mov edi, dword [esp + 0x20]
inc ecx
mov dword [esp + 0x1c], ecx
cmp ecx, 0x5b73
jl 0x10020a06
inc edi
mov dword [esp + 0x20], edi
cmp edi, 0x62c7
jl 0x10020a00
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov esi, dword [ebp + 0xc]
cmp byte [esp + 0xf], bl
je 0x10020ac7
push ecx
push 0x3c34
push 1
push 0x1f53
push 0x4e8b
push 0x2f27
push 1
push 0x699b
push ecx
push ebx
mov edx, 0x6633
mov ecx, 0xcfe
call fcn.1001ffa9
add esp, 0x28
cmp dword [esp + 0x24], 0x565a
jge 0x10020adc
push str.vaa_cwggxwxsh_wvfnrmeg_ycfp_icgn_gmp_ssmockm_uqhvtzxbv
call fcn.1004b9e4
pop ecx
inc dword [esi]
cmp dword [esi], 0x11
jle 0x100209c2
jmp 0x10020b03
xor ebx, ebx
push ebx
push 0x420
push ebx
push ebx
push 0x5fb
push 0xc55
call dword [sym.imp.USER32.dll_ToAsciiEx]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100214b2
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ecx
test cl, cl
je 0x100214bc
add dword [edx], 4
pop ecx
ret
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
pop ecx
ret
Function at 0x10026afc
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
cmp byte [ebp + 8], 0
je 0x10026b2a
mov dword [edx], 1
xor eax, eax
jmp 0x10026b24
mov dword [esp + 4], 0xbc50133e
cmp dword [esp + 4], eax
jne 0x10026b37
dec dword [edx]
cmp dword [edx], eax
jge 0x10026b14
jmp 0x10026b37
cmp byte [ecx], 0
je 0x10026b37
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov esp, ebp
pop ebp
ret
Function at 0x10026b3b
Capabilities:
Encode data using xor
Get disk information

Disassembly:
mov eax, 0x100649dc
call fcn.10063758
sub esp, 0x1c
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], edx
mov byte [ebp - 0x14], cl
je 0x10026d1e
mov dword [ebp - 0x24], 0x61b8
cmp dword [ebp - 0x24], 0x64f9
jle 0x10026bd3
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x20], esi
xor eax, eax
mov dword [ebp - 0x1c], 0x4a7d
mov dword [ebp + 0x18], eax
mov esi, dword [ebp + 0x18]
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov eax, esi
and eax, ecx
mov ecx, 0x10080d98
xor eax, ebx
cdq
push edx
push eax
call fcn.10001b47
mov ecx, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x586f
jl 0x10026b91
mov esi, dword [ebp - 0x20]
add dword [ebp + 0x18], esi
dec dword [ebp - 0x1c]
jne 0x10026b89
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x49c6
jl 0x10026b7d
inc ebx
cmp ebx, 0x2d0f
jl 0x10026b78
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x5fbe
jge 0x10026bef
mov edx, str.hpuntvvs_fhqvppj_llbimwl_boiiss_qsxez_tcjlmay_snjfrqud_dmxucv_akdrxshg_hjrzoz_jxy
mov ecx, 0x10080d98
call fcn.10003a21
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x10], 0
je 0x10026cf9
mov eax, dword [ebp - 0x28]
cmp byte [eax], 0
je 0x10026cc3
mov dword [ebp - 0x1c], 0x671
cmp dword [ebp - 0x1c], 0x734
jle 0x10026c82
push 0x112d
push 0x1312
call fcn.10044279
pop ecx
pop ecx
call eax
xor esi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp + 0x18], esi
mov dword [ebp - 0x24], 0x4786
xor ebx, ebx
xor ecx, ecx
mov dword [ebp + 0x18], ecx
mov eax, ebx
shl eax, cl
mov ecx, 0x10080d98
xor eax, esi
cdq
push edx
push eax
call fcn.10001b47
mov ecx, dword [ebp + 0x18]
inc ecx
mov dword [ebp + 0x18], ecx
cmp ecx, 0x40b2
jl 0x10026c42
inc ebx
cmp ebx, 0x671b
jl 0x10026c3d
dec esi
dec dword [ebp - 0x24]
jne 0x10026c3b
mov esi, dword [ebp - 0x20]
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x1151
jl 0x10026c31
push 0
push 0x56c3
push 1
push 0x1403
push 0x1fab
mov edx, 0x67e4
mov cl, 1
call fcn.10026b3b
add esp, 0x14
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x500
jge 0x10026cc3
mov edx, str.ebzm_ewxbvfs_wlf_kemeuxt_jhqvgjv_cytomodwo_qbfelv_uixhdedk_bhz_vposimlp_yscwa_mrpu
mov ecx, 0x10080d98
call fcn.10003a21
jmp 0x10026d2f
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x10026d2f
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 1
inc dword [edx]
cmp dword [edx], 1
jl 0x10026d0a
jmp 0x10026d2f
test cl, cl
je 0x10026d2a
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
jmp 0x10026d2f
mov eax, dword [ebp + 0x14]
dec dword [eax]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10026d40
Capabilities:
Get common file path

Disassembly:
mov eax, 0x100649e6
call fcn.10063758
sub esp, 0x34
push ebx
push esi
mov dword [ebp - 0x20], 0x43eb
cmp dword [ebp - 0x20], 0x445e
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edx
jle 0x10026dca
push 0
push 0x7d4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
xor edi, edi
xor esi, esi
mov dword [ebp - 0x1c], esi
mov ebx, esi
mov dword [ebp - 0x18], 0x2efd
mov dword [ebp - 0x14], ebx
mov esi, ebx
mov ebx, 0x6526
mov eax, esi
mov ecx, 0x10080d98
and eax, edi
cdq
push edx
push eax
call fcn.10001b47
dec esi
dec ebx
jne 0x10026d91
mov ebx, dword [ebp - 0x14]
dec ebx
dec dword [ebp - 0x18]
mov dword [ebp - 0x14], ebx
jne 0x10026d8a
mov esi, dword [ebp - 0x1c]
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x1d7d
jl 0x10026d7e
inc edi
cmp edi, 0x620a
jl 0x10026d79
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x4115
jge 0x10026de6
mov edx, str.fqgf_dhjpf_mcapxykve_kalrot_akhikz_uznlgq
mov ecx, 0x10080d98
call fcn.10003a21
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x20], 0x7cd7
cmp dword [ebp - 0x20], 0x7ef0
jle 0x10026e3e
xor esi, esi
xor edi, edi
mov ecx, edi
mov eax, esi
shl eax, cl
lea ecx, [ebp - 0x3c]
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10026e19
mov eax, dword [eax]
push eax
call fcn.1004b9e4
pop ecx
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.10002062
inc edi
cmp edi, 0x4761
jl 0x10026dfe
inc esi
cmp esi, 0x7b66
jl 0x10026dfc
cmp byte [ebp + 8], 0
je 0x10026e83
mov ecx, dword [ebp - 0x24]
mov edx, 0x144a
mov eax, dword [ebp + 0x20]
mov ecx, dword [ecx]
mov eax, dword [eax]
mov dword [eax + ecx*4], edx
xor ecx, ecx
mov eax, dword [ebp + 0x30]
mov eax, dword [eax]
cmp eax, edx
mov eax, dword [ebp + 0x24]
setle cl
mov dword [eax], ecx
jmp 0x10026e8c
mov eax, dword [ebp + 0x14]
mov dword [eax], 0xc1ed5297
cmp dword [ebp - 0x20], 0x7c93
jge 0x10026ea0
push str.ibcnyjiq_raw_ssgwpnbws_jwqhxyey_kikgat_nuon
call fcn.1004b9e4
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10026eb1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x100649f8
call fcn.10063758
sub esp, 0x38
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x18], cl
je 0x10026faa
cmp byte [ebp + 8], 0
je 0x10026ef2
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10026eed
push 0x753a
push 1
call fcn.1002682d
pop ecx
pop ecx
jmp 0x1002705e
xor ebx, ebx
mov byte [ebp + 0x13], bl
cmp byte [ebp + 0x13], bl
je 0x10026eed
mov dword [ebp - 0x20], 0x24d1
cmp dword [ebp - 0x20], 0x27f2
jle 0x10026f64
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x1c], ebx
mov ecx, ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ebp + 0x10], ecx
mov eax, ebx
cdq
idiv ecx
lea eax, [edi + esi]
mov ecx, edx
sar eax, cl
mov ecx, 0x10080d98
cdq
push edx
push eax
call fcn.10001b47
mov ecx, dword [ebp + 0x10]
inc ecx
mov dword [ebp + 0x10], ecx
cmp ecx, 0x64d0
jl 0x10026f1b
inc ebx
push 0
mov dword [ebp - 0x1c], ebx
cmp ebx, 0xa27
pop ebx
jl 0x10026f13
inc edi
cmp edi, 0x1c83
jl 0x10026f10
inc esi
cmp esi, 0x579a
jl 0x10026f0e
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x20], 0x24b7
jge 0x10026eed
mov edx, str.meoabl_hmymzsf_uxyrfx_qrttlm_anvpvhih_qilf_govlsdwrd_xcbld
mov ecx, 0x10080d98
call fcn.10003a21
jmp 0x10026eed
test cl, cl
je 0x1002703e
push dword [ebp + 0x10]
movdqa xmm0, xmmword [0x10072e50]
lea eax, [ebp - 0x34]
push eax
xor ebx, ebx
mov dword [ebp - 0x1c], 0xcec3d7d4
lea eax, [ebp - 0x44]
mov dword [ebp - 0x34], ebx
push eax
push ebx
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x30], ebx
movdqu xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x2c], ebx
call fcn.100043b1
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 2
push eax
mov dword [ebp - 0x28], ebx
push ecx
call fcn.1002717b
pop ecx
pop ecx
mov dword [ebp - 0x1c], ebx
jmp 0x1002702e
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], 0x5f0ed1ad
push eax
push ecx
push ecx
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x34]
push eax
push ecx
push ecx
push 0x6467
push ecx
push ecx
push 1
lea edx, [ebp - 0x1c]
call fcn.10026d40
add esp, 0x2c
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jle 0x10027000
lea ecx, [ebp - 0x34]
call fcn.10001d54
jmp 0x1002705e
mov dword [edx], 0
cmp dword [edx], 1
jge 0x1002705e
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x60a2fc53
inc dword [edx]
cmp dword [edx], 1
jl 0x1002704c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10029bc5
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov dword [0x10645b44], ecx
inc edx
mov esi, 0x270
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
mov dword [edx*4 + 0x10645b44], ecx
inc edx
cmp edx, esi
jl 0x10029bda
mov dword [0x10645b40], esi
pop esi
pop ebp
ret 8

Function at 0x10029c00
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x10645b44
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x10645ed0
jl 0x10029c0e
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x10646174
jl 0x10029c4e
mov ecx, dword [0x10646ec0]
xor ecx, dword [0x10645b44]
and ecx, edi
xor ecx, dword [0x10646ec0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x10645b40], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10646174]
mov dword [0x10646500], eax
pop esi
ret
Function at 0x1002bf8c
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
test dl, dl
je 0x1002bf9b
mov eax, dword [ebp + 0xc]
and dword [eax], 0
pop ebp
ret
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop ebp
ret
Function at 0x1002c773
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10064bb4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov byte [esp + 0x10], dl
mov esi, ecx
je 0x1002c7d3
cmp byte [ebp + 0xc], 0
je 0x1002c7b1
mov eax, dword [ebp + 0x18]
and dword [eax], 0
jmp 0x1002c88d
mov edx, dword [ebp + 0x20]
mov dword [edx], 0
jmp 0x1002c7c9
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x77862fd4
inc dword [edx]
cmp dword [edx], 3
jl 0x1002c7bc
jmp 0x1002c88d
mov dword [esp + 0x14], 0x193
cmp dword [esp + 0x14], 0x379
push 0
pop ebx
jle 0x1002c834
mov esi, ebx
mov edi, ebx
mov eax, edi
lea ecx, [esp + 0x18]
xor eax, esi
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002c806
mov eax, dword [eax]
push eax
call fcn.1004b9e4
pop ecx
push ebx
push 1
lea ecx, [esp + 0x20]
call fcn.10002062
inc edi
cmp edi, 0x6bee
jl 0x1002c7ec
inc esi
cmp esi, 0x1b93
jl 0x1002c7ea
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
cmp dword [esp + 0x14], 0x7e
jge 0x1002c846
push str.mnzmthae_dzmfbwlwz_szftztr_ikxlxxr_wbvh_rlwjqksyh_evqpty_krybm_fuz_banrxfj_khbmx
call fcn.1004b9e4
pop ecx
or dword [esp + 0x54], 0xffffffff
cmp byte [esp + 0x10], 0
je 0x1002c885
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x1c]
push 0xffffffffffffffff
push dword [eax]
lea eax, [esp + 0x38]
push eax
call fcn.1002e807
mov ecx, dword [ebp + 0x10]
push eax
mov dword [esp + 0x58], 2
call fcn.1002e8b5
push ebx
push 1
lea ecx, [esp + 0x38]
call fcn.100021ce
jmp 0x1002c88d
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002da39
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10064bb4
push eax
mov dword fs:[0], esp
sub esp, 0x48
push ebx
push esi
push edi
test cl, cl
je 0x1002db79
mov dword [esp + 0x1c], 0x130c
cmp dword [esp + 0x1c], 0x1538
push 0
pop ebx
jle 0x1002db04
push 1
push 0x1ff7
push 0xa81
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov esi, ebx
mov dword [esp + 0x18], ebx
mov eax, esi
mov dword [esp + 0x14], 0x4802
mov dword [esp + 0x10], eax
mov edi, ebx
mov esi, ebx
or eax, esi
lea ecx, [esp + 0x20]
or eax, edi
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002dabf
mov eax, dword [eax]
push eax
call fcn.1004b9e4
pop ecx
push ebx
push 1
lea ecx, [esp + 0x28]
call fcn.10002062
mov eax, dword [esp + 0x10]
inc esi
cmp esi, 0x58ab
jl 0x1002daa5
inc edi
cmp edi, 0x7b22
jl 0x1002daa3
dec eax
dec dword [esp + 0x14]
mov dword [esp + 0x10], eax
jne 0x1002daa1
mov esi, dword [esp + 0x18]
inc esi
mov dword [esp + 0x18], esi
cmp esi, 0x177e
jl 0x1002da93
cmp dword [esp + 0x1c], 0x106a
jge 0x1002db19
push str.izgcmy_ogllhhhhn_rmzmehzw_hwstakj_gvbabwgo_mbzrjnp_eiubghaak_rkl
call fcn.1004b9e4
pop ecx
or dword [esp + 0x5c], 0xffffffff
cmp byte [ebp + 0x10], 0
je 0x1002db53
push ecx
mov edx, 0x29cd
lea ecx, [esp + 0x3c]
call fcn.10001a9d
push ecx
mov ecx, dword [ebp + 0xc]
push eax
mov dword [esp + 0x68], 2
call fcn.1002ef1f
push ebx
push 1
lea ecx, [esp + 0x40]
call fcn.100021ce
jmp 0x1002db9a
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x1002db9a
push 0x384d
push ecx
push ebx
push 0x61b
mov ecx, 0x4ea5
call fcn.1002a3f9
add esp, 0x10
jmp 0x1002db9a
cmp byte [ebp + 8], 0
je 0x1002db84
and dword [edx], 0
jmp 0x1002db9a
push 0xc4f
xor ebx, ebx
push ebx
push ebx
push ebx
push 0x1dfb
push ebx
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
mov ecx, dword [esp + 0x54]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002dcaf
Capabilities:
Get file system object information

Disassembly:
mov eax, 0x10064e42
call fcn.10063758
sub esp, 0x20
push ebx
push esi
mov dword [ebp - 0x14], 0x659
cmp dword [ebp - 0x14], 0x697
push edi
mov dword [ebp - 0x10], esp
jle 0x1002dd12
push 0x1605
push 0x2610
push 0
push 0x16d7
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x10080d98
and eax, esi
cdq
push edx
push eax
call fcn.10001b47
inc edi
cmp edi, 0x1b53
jl 0x1002dcef
inc esi
cmp esi, 0x74d2
jl 0x1002dced
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x288
jge 0x1002dd2e
mov edx, str.sexyq_pcssnnzh_pternb_pswpsjq_oii_nzhd_fnwpjh_lmhjdvqk_jtao
mov ecx, 0x10080d98
call fcn.10003a21
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0xc], 0
je 0x1002dd67
mov eax, dword [ebp + 0x14]
push dword [ebp + 0x1c]
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
mov edx, dword [eax]
call fcn.100089ba
pop ecx
jmp 0x1002dd8f
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x20]
push 0xffffffffffffffff
push dword [eax]
lea eax, [ebp - 0x2c]
push eax
call fcn.1002e807
mov ecx, dword [ebp + 0x20]
push eax
call fcn.10001c97
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.100021ce
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002e3d2
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10064ea8
call fcn.10063758
sub esp, 0x1c
cmp byte [ebp + 0x20], 0
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x14], ebx
je 0x1002e52c
mov dword [ebp + 0x20], 0x48af
cmp dword [ebp + 0x20], 0x4ba2
jle 0x1002e43e
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x10080d98
xor eax, edi
xor eax, esi
cdq
push edx
push eax
call fcn.10001b47
inc ebx
cmp ebx, 0x1d6d
jl 0x1002e40d
inc edi
cmp edi, 0x32f3
jl 0x1002e40b
inc esi
cmp esi, 0x76f4
jl 0x1002e409
mov ebx, dword [ebp - 0x14]
cmp byte [ebp + 8], 0
je 0x1002e4c8
mov ebx, dword [ebp + 0x24]
xor edi, edi
push 0x18
pop ecx
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
cdq
idiv ecx
mov dword [ebp - 0x14], eax
test eax, eax
jle 0x1002e4f1
xor esi, esi
mov edx, dword [ebx]
mov ecx, dword [ebp - 0x18]
add edx, esi
call fcn.1002d738
test al, al
je 0x1002e4b3
mov eax, dword [ebp + 0x14]
sub esp, 0x18
mov ecx, esp
mov eax, dword [eax]
add eax, esi
push eax
call fcn.10001c5c
lea ecx, [ebp - 0x28]
call fcn.1002cea2
add esp, 0x18
and dword [ebp - 4], 0
lea ecx, [ebp - 0x28]
call fcn.1002e37b
test eax, eax
je 0x1002e4be
cmp eax, 2
je 0x1002e4be
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1000802a
inc edi
add esi, 0x18
cmp edi, dword [ebp - 0x14]
jl 0x1002e465
jmp 0x1002e4f1
lea ecx, [ebp - 0x28]
call fcn.1000802a
jmp 0x1002e4f1
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x1c]
mov eax, dword [edi + 4]
sub eax, dword [edi]
sar eax, 2
mov dword [esi], eax
jmp 0x1002e4ed
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, edi
call fcn.1002eb02
inc dword [esi]
mov eax, dword [esi]
cmp eax, dword [ebx]
jl 0x1002e4da
mov dword [ebp - 4], 1
cmp dword [ebp + 0x20], 0x4534
jge 0x1002e510
mov edx, str.bcnfv_qguzi_vhjjoptqx_oifpppdqr_djm_qmehiw_jmgixz_jxdvq_mwzflmkis_vgbvn_dcajcji
mov ecx, 0x10080d98
call fcn.10003a21
jmp 0x1002e562
cmp byte [ebp + 0x2c], 0
je 0x1002e557
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1002e562
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfe93046a
inc dword [edx]
cmp dword [edx], 2
jl 0x1002e543
jmp 0x1002e562
mov eax, dword [ebp + 0x28]
mov eax, dword [eax]
mov dword [eax], 0xcd4fe930
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret