joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100092bd
Capabilities:
Enumerate processes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x954
mov eax, dword [0x10032010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
push edi
push 0x7ff
xor edi, edi
lea eax, [ebp - 0x807]
push edi
push eax
mov byte [ebp - 0x808], 0
call fcn.1001c790
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
lea eax, [ebp - 0x954]
call fcn.10007b06
mov esi, eax
call fcn.10007b12
mov dword [ebp - 0x934], eax
lea eax, [ebp - 0x954]
push 0x8000
push eax
call fcn.1000176d
add esp, 0x14
cmp dword [ebp - 0x934], edi
jle 0x1000933a
push dword [ebp - 0x934]
lea esi, [ebp - 0x954]
call fcn.100017a0
pop ecx
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call fcn.100046c2
pop ecx
test eax, eax
je 0x10009357
mov dword [ebp - 0x938], 0x1002da40
jmp 0x10009374
call fcn.1000d47c
mov dword [ebp - 0x938], 0x1002da40
test eax, eax
jne 0x10009374
mov dword [ebp - 0x938], 0x1002da44
push edi
push 2
call sub.KERNEL32.dll_CreateToolhelp32Snapshot
mov esi, eax
mov dword [ebp - 0x944], esi
cmp esi, 0xffffffff
je 0x100094ea
lea eax, [ebp - 0x930]
push eax
push esi
mov dword [ebp - 0x930], 0x128
call sub.KERNEL32.dll_Process32First
test eax, eax
jne 0x100093b4
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
jmp 0x100094ea
mov ebx, dword [sym.imp.KERNEL32.dll_CloseHandle]
push dword [ebp - 0x928]
push edi
push 0x400
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov dword [ebp - 0x93c], eax
cmp eax, edi
jne 0x10009401
push dword [ebp - 0x928]
lea eax, [ebp - 0x90c]
push dword [ebp - 0x918]
lea esi, [ebp - 0x954]
push eax
push str._s_t_d_t_d_n
call fcn.100017f3
add esp, 0x10
jmp 0x10009487
push eax
lea edi, [ebp - 0x808]
call fcn.10009255
pop ecx
test eax, eax
jne 0x10009418
mov byte [ebp - 0x808], al
lea eax, [ebp - 0x940]
push eax
push dword [ebp - 0x928]
call dword [sym.imp.KERNEL32.dll_ProcessIdToSessionId]
test eax, eax
jne 0x10009436
or dword [ebp - 0x940], 0xffffffff
push dword [ebp - 0x93c]
call fcn.100046c2
test eax, eax
pop ecx
mov eax, 0x1002da44
jne 0x10009451
mov eax, dword [ebp - 0x938]
push dword [ebp - 0x940]
lea ecx, [ebp - 0x808]
push ecx
push eax
push dword [ebp - 0x928]
lea eax, [ebp - 0x90c]
push dword [ebp - 0x918]
lea esi, [ebp - 0x954]
push eax
push str._s_t_d_t_d_t_s_t_s_t_d_n
call fcn.100017f3
add esp, 0x1c
xor edi, edi
push dword [ebp - 0x93c]
call ebx
lea eax, [ebp - 0x930]
push eax
push dword [ebp - 0x944]
call sub.KERNEL32.dll_Process32Next
test eax, eax
jne 0x100093ba
push dword [ebp - 0x944]
call ebx
lea eax, [ebp - 0x954]
cmp dword [ebp - 0x934], edi
jne 0x100094c3
push 0x11
jmp 0x100094c5
push 0x16
call fcn.10007b6a
push eax
lea eax, [ebp - 0x954]
call fcn.10001846
push eax
call fcn.10001355
add esp, 0xc
lea eax, [ebp - 0x954]
call fcn.1000182d
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100148e0
leave
ret
Function at 0x10009536
Capabilities:
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov ebx, 0x8000
push ebx
call fcn.100149cc
push dword [ebp + 8]
mov edi, eax
push str._s
push ebx
push edi
call fcn.10014b26
mov esi, dword [ebp + 0xc]
add esp, 0x14
push esi
push edi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
push edi
mov dword [ebp - 4], eax
call fcn.100148ef
cmp dword [ebp - 4], 0xffffffff
pop ecx
je 0x100095f5
test byte [esi], 0x10
lea eax, [esi + 0x2c]
je 0x100095fa
push 2
mov edi, 0x1002da70
mov esi, eax
pop ecx
xor edx, edx
repe cmpsb byte [esi], byte es:[edi]
je 0x100095db
mov esi, eax
push 3
mov edi, 0x1002da74
pop ecx
xor eax, eax
repe cmpsb byte [esi], byte es:[edi]
je 0x100095db
push ebx
call fcn.100149cc
mov esi, dword [ebp + 0xc]
add esi, 0x2c
push esi
push 0x1002d590
mov edi, eax
push ebx
push edi
call fcn.10014b26
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push esi
push dword [ebp + 8]
call fcn.100094f9
push 1
push edi
push dword [ebp + 8]
call dword [ebp + 0x10]
push edi
call fcn.100148ef
add esp, 0x34
mov esi, dword [ebp + 0xc]
push esi
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10009577
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
leave
ret
push 0
push eax
push dword [ebp + 8]
call dword [ebp + 0x10]
add esp, 0xc
jmp 0x100095de
Function at 0x1000a589
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov esi, 0x200
push esi
mov dword [0x10041984], eax
call fcn.100149cc
push esi
push 0
push eax
mov dword [0x10041988], eax
call fcn.1001c790
add esp, 0x10
xor eax, eax
xor byte [eax + str.ihihikiaikihikaNijikimiiicimikimiyiiilihikiiioihiki], 0x69
inc eax
cmp eax, 0x1000
jl 0x1000a5b8
mov ecx, 0x1000
mov edx, str.ihihikiaikihikaNijikimiiicimikimiyiiilihikiiioihiki
lea eax, [esp + 0x10]
call fcn.10007b06
jmp 0x1000a669
lea esi, [esp + 0x10]
call fcn.10007b2e
movzx ebx, ax
call fcn.10007b2e
movsx edi, di
movzx ecx, ax
mov eax, dword [0x10041988]
shl edi, 3
mov dword [esp + 0xc], edi
add edi, eax
movsx eax, bx
dec eax
mov word [edi], bx
je 0x1000a651
dec eax
je 0x1000a638
dec eax
jne 0x1000a669
movsx esi, cx
push esi
call fcn.100149cc
pop ecx
push esi
lea edx, [esp + 0x14]
mov dword [edi + 4], eax
call fcn.10007b4f
push eax
push dword [edi + 4]
call fcn.1001b5b0
add esp, 0xc
jmp 0x1000a669
lea esi, [esp + 0x10]
call fcn.10007b12
mov ecx, dword [0x10041988]
mov edx, dword [esp + 0xc]
mov dword [edx + ecx + 4], eax
jmp 0x1000a669
lea esi, [esp + 0x10]
call fcn.10007b2e
mov ecx, dword [0x10041988]
mov edx, dword [esp + 0xc]
mov word [edx + ecx + 4], ax
lea esi, [esp + 0x10]
call fcn.10007b2e
movzx edi, ax
test di, di
jg 0x1000a5df
push 0x1000
push 0
push str.ihihikiaikihikaNijikimiiicimikimiyiiilihikiiioihiki
call fcn.1001c790
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a944
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
inc dword [0x1003e91c]
push 0x27
pop edx
call fcn.1000a521
cmp ax, 1
jne 0x1000a961
pop ebp
jmp fcn.1000a8ef
xor eax, eax
push eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret

Function at 0x1000a975
Capabilities:
Create thread
Terminate process

Disassembly:
push 0x27
pop edx
call fcn.1000a521
cmp ax, 1
jne 0x1000a9a0
push 0xffffffffffffffff
xor eax, eax
push eax
push eax
push eax
push dword [sym.imp.KERNEL32.dll_ExitProcess]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
ret
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]
Function at 0x1000ad3b
Capabilities:
Impersonate user

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
call fcn.1000a9ec
push 0x1003e924
push 3
push 9
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_LogonUserA]
test eax, eax
jne 0x1000ad77
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x18
call fcn.10001ad4
pop ecx
pop ecx
jmp 0x1000ae50
push dword [0x1003e924]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x1000ad92
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x19
jmp 0x1000ad6b
push 0x800
call fcn.10007a9f
mov ebx, 0x200
pop ecx
mov esi, ebx
mov edx, eax
mov dword [0x1003e934], eax
call fcn.10007b4f
mov edx, dword [0x1003e934]
mov dword [0x1003e928], eax
call fcn.10007b4f
mov edx, dword [0x1003e934]
mov edi, 0x400
mov esi, edi
mov dword [0x1003e92c], eax
call fcn.10007b4f
mov esi, 0x100
push esi
push dword [0x1003e92c]
mov dword [0x1003e930], eax
push dword [ebp + 0xc]
call fcn.100035bc
add esp, 0xc
push esi
push dword [0x1003e928]
push dword [ebp + 8]
call fcn.100035bc
add esp, 0xc
push ebx
push dword [0x1003e930]
push dword [ebp + 0x10]
call fcn.100035bc
add esp, 0xc
push edi
push dword [0x1003e924]
mov edi, dword [ebp + 0xc]
mov dword [0x1003e938], 1
call fcn.1000aa29
pop ecx
pop ecx
test eax, eax
je 0x1000ae50
mov eax, edi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1000ae3b
sub eax, ecx
push 0xf
push eax
push edi
call fcn.10001355
add esp, 0xc
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x1000aee8
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x10032010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
xor ebx, ebx
lea eax, [ebp - 0x14]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0xc]
push eax
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], bl
mov byte [ebp - 0xa], bl
mov byte [ebp - 9], bl
mov byte [ebp - 8], bl
mov byte [ebp - 7], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 0x10], eax
cmp eax, ebx
je 0x1000af50
lea eax, [ebp - 0x10]
push eax
push dword [ebp - 0x14]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x1000af47
mov dword [ebp - 0x10], ebx
push dword [ebp - 0x14]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x10]
xor ecx, ebp
pop ebx
call fcn.100148e0
leave
ret

Function at 0x1000aff9
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
push 0
push 1
lea eax, [esi + edi]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x1000b031
add esi, eax
cmp esi, 2
jb 0x1000b029
cmp byte [esi + edi - 1], 0xa
jne 0x1000b029
cmp byte [esi + edi - 2], 0xd
je 0x1000b037
cmp esi, 0x800
jb 0x1000afff
or eax, 0xffffffff
pop esi
pop ebp
ret
mov byte [esi + edi - 2], 0
mov eax, esi
jmp 0x1000b034
Function at 0x1000b0a4
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x10032010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov ebx, ecx
call fcn.1000229b
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000b0d7
push eax
call sub.WS2_32.dll_closesocket
jmp 0x1000b12c
push 2
pop eax
push dword [ebp + 8]
mov word [ebp - 0x14], ax
call sub.WS2_32.dll_htons
mov word [ebp - 0x12], ax
push 0x10
lea eax, [ebp - 0x14]
push eax
push esi
mov dword [ebp - 0x10], 0x100007f
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x1000b106
push esi
jmp 0x1000b0d0
push 0x78
push esi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x1000b103
push ebx
mov ebx, dword [ebp + 0xc]
push esi
call fcn.1000af60
push eax
push 0x1000b040
call fcn.1000a944
add esp, 0x10
mov ecx, dword [ebp - 4]
pop esi
xor ecx, ebp
pop ebx
call fcn.100148e0
leave
ret

Function at 0x1000b304
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, eax
xor edx, edx
push 3
lea eax, [edi + 2]
pop ebx
div ebx
mov ecx, dword [ebp + 0x10]
shl eax, 2
inc eax
cmp dword [ecx], eax
jae 0x1000b32e
push 6
mov dword [ecx], eax
pop eax
jmp 0x1000b410
xor edx, edx
push 3
mov eax, edi
pop ebx
div ebx
mov ecx, dword [ebp + 0xc]
xor edx, edx
imul eax, eax, 3
test eax, eax
jbe 0x1000b3ad
dec eax
push ebx
pop edi
div edi
mov edi, eax
inc edi
mov edx, edi
imul edx, edx, 3
movzx eax, byte [esi]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx eax, byte [esi + 1]
movzx ebx, byte [esi]
shr eax, 4
shl ebx, 4
add eax, ebx
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 2]
movzx ebx, byte [esi + 1]
shr eax, 6
lea eax, [eax + ebx*4]
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 2]
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
add esi, 3
dec edi
jne 0x1000b350
mov edi, dword [ebp + 8]
cmp edx, edi
jae 0x1000b403
movzx eax, byte [esi]
inc edx
cmp edx, edi
jae 0x1000b3bf
movzx esi, byte [esi + 1]
jmp 0x1000b3c1
xor esi, esi
mov ebx, eax
shr ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], bl
shl eax, 4
mov ebx, esi
shr ebx, 4
add ebx, eax
and ebx, 0x3f
mov al, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
cmp edx, edi
jae 0x1000b3f9
and esi, 0xf
movsx eax, byte [esi*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x1000b3fc
push 0x3d
pop eax
mov byte [ecx], al
inc ecx
mov byte [ecx], 0x3d
inc ecx
mov eax, dword [ebp + 0x10]
mov byte [ecx], 0
sub ecx, dword [ebp + 0xc]
mov dword [eax], ecx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1000cc85
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x28], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
xor eax, eax
pop ebp
ret

Function at 0x1000ceca
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [0x1003ad70]
mov ebx, eax
push edi
mov eax, esi
call fcn.1000dc7a
test eax, eax
jne 0x1000cfcc
mov ecx, dword [0x1003ad74]
cmp ecx, 1
jl 0x1000cfc9
cmp ecx, 0x80
jg 0x1000cfc9
mov eax, dword [ebp + 0xc]
xor edx, edx
div ecx
test edx, edx
jne 0x1000cfc9
test cl, 3
jne 0x1000cfc9
mov edx, esi
imul edx, edx, 0x60
mov edx, dword [edx + 0x1003e978]
test edx, edx
je 0x1000cf42
push 0x1003adf8
push 0x1003ad78
push eax
push ebx
push dword [ebp + 8]
call edx
add esp, 0x14
jmp 0x1000cfcc
cmp dword [ebp + 0xc], 0
je 0x1000cfc5
mov edi, 0x1003ad78
jmp 0x1000cf55
mov esi, dword [0x1003ad70]
xor edx, edx
test ecx, ecx
jle 0x1000cf7c
mov ecx, dword [ebp + 8]
sub ecx, edi
lea eax, [edx + 0x1003ad78]
mov esi, dword [ecx + eax]
xor dword [eax], esi
add edx, 4
cmp edx, dword [0x1003ad74]
jl 0x1000cf60
mov esi, dword [0x1003ad70]
imul esi, esi, 0x60
push 0x1003adf8
push ebx
push edi
call dword [esi + 0x1003e95c]
add esp, 0xc
test eax, eax
jne 0x1000cfcc
mov ecx, dword [0x1003ad74]
xor edx, edx
test ecx, ecx
jle 0x1000cfbb
mov esi, ebx
sub esi, edi
lea eax, [edx + 0x1003ad78]
mov ecx, dword [esi + eax]
mov dword [eax], ecx
mov ecx, dword [0x1003ad74]
add edx, 4
cmp edx, ecx
jl 0x1000cfa3
add dword [ebp + 8], ecx
add ebx, ecx
sub dword [ebp + 0xc], ecx
jne 0x1000cf4f
xor eax, eax
jmp 0x1000cfcc
push 0x10
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1000d30b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10032010]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x1003be98]
push edi
mov ebx, ecx
mov edi, edx
mov eax, esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edi
call fcn.1000dc7a
test eax, eax
jne 0x1000d418
mov ecx, dword [0x1003be9c]
cmp ecx, 1
jl 0x1000d415
cmp ecx, 0x80
jg 0x1000d415
mov eax, dword [ebp + 8]
xor edx, edx
div ecx
test edx, edx
jne 0x1000d415
test cl, 3
jne 0x1000d415
mov ecx, esi
imul ecx, ecx, 0x60
mov ecx, dword [ecx + 0x1003e97c]
test ecx, ecx
je 0x1000d396
push 0x1003bf20
push 0x1003bea0
push eax
push edi
push ebx
call ecx
add esp, 0x14
jmp 0x1000d418
cmp dword [ebp + 8], 0
je 0x1000d411
jmp 0x1000d3a4
mov esi, dword [0x1003be98]
imul esi, esi, 0x60
push 0x1003bf20
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [esi + 0x1003e960]
add esp, 0xc
test eax, eax
jne 0x1000d418
mov eax, dword [0x1003be9c]
xor edi, edi
test eax, eax
jle 0x1000d401
mov ecx, dword [ebp - 0x18]
lea esi, [ebp - 0x14]
mov eax, 0x1003bea0
sub esi, ebx
sub ebx, eax
sub ecx, eax
mov dword [ebp - 0x20], ecx
lea eax, [edi + 0x1003bea0]
lea edx, [ebx + eax]
mov ecx, dword [esi + edx]
xor ecx, dword [eax]
mov edx, dword [edx]
mov dword [eax], edx
mov edx, dword [ebp - 0x20]
mov dword [edx + eax], ecx
mov eax, dword [0x1003be9c]
add edi, 4
cmp edi, eax
jl 0x1000d3dd
mov ebx, dword [ebp - 0x1c]
add dword [ebp - 0x18], eax
add ebx, eax
sub dword [ebp + 8], eax
mov dword [ebp - 0x1c], ebx
jne 0x1000d39e
xor eax, eax
jmp 0x1000d418
push 0x10
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100148e0
leave
ret
Function at 0x1000e361
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebx + 0x70]
mov eax, esi
call fcn.1000e251
test eax, eax
jne 0x1000e4a1
imul esi, esi, 0x68
push edi
mov edi, dword [esi + 0x1003fa48]
push dword [esi + 0x1003fa4c]
mov dword [ebp - 8], edi
call fcn.100149cc
push edi
mov dword [ebp - 4], eax
call fcn.100149cc
cmp dword [ebp - 4], 0
pop ecx
mov edi, eax
pop ecx
mov dword [ebp - 0xc], edi
je 0x1000e492
test edi, edi
je 0x1000e489
push edi
push ebx
call dword [esi + 0x1003fa9c]
mov edi, eax
xor eax, eax
pop ecx
pop ecx
cmp edi, eax
jne 0x1000e467
cmp dword [esi + 0x1003fa4c], eax
jbe 0x1000e3ed
mov ecx, dword [ebx + 0xe8]
mov cl, byte [ecx + eax]
mov edx, dword [ebp - 4]
xor cl, 0x5c
mov byte [eax + edx], cl
inc eax
cmp eax, dword [esi + 0x1003fa4c]
jb 0x1000e3d2
push ebx
call dword [esi + 0x1003fa94]
mov edi, eax
pop ecx
test edi, edi
jne 0x1000e467
push dword [esi + 0x1003fa4c]
push dword [ebp - 4]
push ebx
call dword [esi + 0x1003fa98]
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x1000e467
push dword [ebp - 8]
push dword [ebp - 0xc]
push ebx
call dword [esi + 0x1003fa98]
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x1000e467
push dword [ebp - 4]
push ebx
call dword [esi + 0x1003fa9c]
pop ecx
pop ecx
mov edi, eax
xor ecx, ecx
cmp edi, ecx
jne 0x1000e467
cmp dword [ebp - 8], ecx
jbe 0x1000e460
mov esi, dword [ebp - 4]
sub esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp ecx, dword [eax]
jae 0x1000e460
mov eax, dword [ebp + 8]
add eax, ecx
mov dl, byte [esi + eax]
inc ecx
mov byte [eax], dl
cmp ecx, dword [ebp - 8]
jb 0x1000e449
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
xor edi, edi
push dword [ebx + 0xe8]
call fcn.100148ef
push dword [ebp - 0xc]
call fcn.100148ef
push dword [ebp - 4]
call fcn.100148ef
add esp, 0xc
mov eax, edi
jmp 0x1000e4a0
push dword [ebp - 4]
call fcn.100148ef
pop ecx
test edi, edi
je 0x1000e49d
push edi
call fcn.100148ef
pop ecx
push 0xd
pop eax
pop edi
pop esi
leave
ret
Function at 0x1000e4a4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, eax
call fcn.1000e251
test eax, eax
jne 0x1000e4df
push esi
mov esi, ebx
imul esi, esi, 0x68
mov dword [edi + 0x70], ebx
mov eax, dword [esi + 0x1003fa48]
push dword [esi + 0x1003fa4c]
mov dword [ebp - 4], eax
call fcn.100149cc
pop ecx
mov dword [ebp - 8], eax
test eax, eax
jne 0x1000e4e2
push 0xd
pop eax
pop esi
pop ebx
leave
ret
push dword [esi + 0x1003fa4c]
call fcn.100149cc
pop ecx
mov dword [edi + 0xe8], eax
test eax, eax
jne 0x1000e508
push 0xd
pop ebx
push dword [ebp - 8]
call fcn.100148ef
pop ecx
mov eax, ebx
jmp 0x1000e4de
mov ecx, dword [esi + 0x1003fa4c]
cmp ecx, 0x10
jae 0x1000e550
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0xc]
push ecx
push eax
push 0x10
push 0x1003e078
mov eax, ebx
call fcn.1000d567
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x1000e5d0
mov eax, dword [esi + 0x1003fa4c]
cmp dword [ebp - 4], eax
jae 0x1000e580
sub eax, dword [ebp - 4]
push eax
mov eax, dword [edi + 0xe8]
add eax, dword [ebp - 4]
jmp 0x1000e578
push 0x10
push 0x1003e078
push eax
call fcn.1001b5b0
mov eax, dword [esi + 0x1003fa4c]
add esp, 0xc
cmp eax, 0x10
jbe 0x1000e580
add eax, 0xfffffff0
push eax
mov eax, dword [edi + 0xe8]
add eax, 0x10
push eax
call fcn.1000e21e
pop ecx
pop ecx
xor eax, eax
cmp dword [esi + 0x1003fa4c], eax
jbe 0x1000e5a5
mov ecx, dword [edi + 0xe8]
mov cl, byte [ecx + eax]
mov edx, dword [ebp - 8]
xor cl, 0x36
mov byte [eax + edx], cl
inc eax
cmp eax, dword [esi + 0x1003fa4c]
jb 0x1000e58a
push edi
call dword [esi + 0x1003fa94]
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x1000e5d0
push dword [esi + 0x1003fa4c]
push dword [ebp - 8]
push edi
call dword [esi + 0x1003fa98]
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x1000e4fb
push dword [edi + 0xe8]
call fcn.100148ef
pop ecx
jmp 0x1000e4fb
Function at 0x100148e0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10032010]
jne 0x100148ea
repz ret
jmp fcn.10016613

Function at 0x1001d35a
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10018996
and dword [ebp - 4], 0
cmp dword [0x10034bfc], 0
mov ebx, eax
jne 0x1001d40b
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1001d4bc
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1001d4bc
push eax
call fcn.10018924
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x10034bfc], eax
call esi
push eax
call fcn.10018924
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x10034c00], eax
call esi
push eax
call fcn.10018924
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x10034c04], eax
call esi
push eax
call fcn.10018924
pop ecx
mov dword [0x10034c0c], eax
test eax, eax
je 0x1001d40b
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.10018924
pop ecx
mov dword [0x10034c08], eax
mov eax, dword [0x10034c08]
cmp eax, ebx
je 0x1001d463
cmp dword [0x10034c0c], ebx
je 0x1001d463
push eax
call fcn.1001899f
push dword [0x10034c0c]
mov esi, eax
call fcn.1001899f
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1001d463
test edi, edi
je 0x1001d463
call esi
test eax, eax
je 0x1001d45a
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1001d45a
test byte [ebp - 0xc], 1
jne 0x1001d463
or dword [ebp + 0x10], 0x200000
jmp 0x1001d49c
mov eax, dword [0x10034c00]
cmp eax, ebx
je 0x1001d49c
push eax
call fcn.1001899f
pop ecx
test eax, eax
je 0x1001d49c
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1001d49c
mov eax, dword [0x10034c04]
cmp eax, ebx
je 0x1001d49c
push eax
call fcn.1001899f
pop ecx
test eax, eax
je 0x1001d49c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x10034bfc]
call fcn.1001899f
pop ecx
test eax, eax
je 0x1001d4bc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1001d4be
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret