joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401000
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [0x4312a0], 0x24e1
mov eax, dword [0x4312a0]
sub eax, 0x24e1
mov dword [0x4312a0], eax
mov ecx, 1
test ecx, ecx
je 0x4010ab
mov edx, dword [0x4312a0]
cmp edx, dword [ebp + 0xc]
jb 0x401037
jmp 0x4010ab
cmp dword [0x4312a0], 0
jne 0x401055
push 0x263
push 0
call dword [sym.imp.USER32.dll_LoadIconW]
test eax, eax
je 0x401055
xor eax, eax
jmp 0x4010ab
mov eax, dword [ebp + 8]
add eax, dword [0x4312a0]
mov ecx, dword [eax]
add ecx, dword [0x4312a0]
mov edx, dword [ebp + 8]
add edx, dword [0x4312a0]
mov dword [edx], ecx
mov dword [ebp - 4], 0x263fa
mov eax, dword [0x4312a0]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax + 2]
push edx
mov eax, dword [ebp + 8]
add eax, dword [0x4312a0]
push eax
call fcn.00401270
add esp, 8
mov ecx, dword [0x4312a0]
add ecx, 4
mov dword [0x4312a0], ecx
jmp 0x40101d
mov esp, ebp
pop ebp
ret

Function at 0x401970
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
mov dword [ebp - 0x114], 0x4090a8
mov eax, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [ebp - 0x11c], eax
push 0x104
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edx, dword [ebp - 0x114]
push edx
lea eax, [ebp - 0x110]
push eax
call dword [ebp - 0x11c]
push 0
push 0x80
push 3
push 0
push 3
push 1
lea ecx, [ebp - 0x110]
push ecx
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [ebp - 0x118], eax
cmp dword [ebp - 0x118], 0xffffffff
je 0x4019ea
cmp dword [ebp - 0x118], 0
je 0x4019ea
jmp 0x401a4c
mov edx, dword [ebp + 8]
cmp dword [edx + 4], 0
je 0x401a4c
mov dword [ebp - 0x120], 0x7dc35
mov eax, dword [ebp + 8]
add eax, 8
mov dword [0x431294], eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
mov dword [0x4312b0], edx
mov dword [ebp - 0x120], 0x7dc35
mov dword [ebp - 0x120], 0x7dc35
call fcn.00401260
mov eax, dword [ebp + 8]
mov dword [0x4312ac], eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
push 1
call fcn.00401b30
add esp, 0xc
mov dword [ebp + 8], eax
jmp 0x4019ea
mov esp, ebp
pop ebp
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x402bf1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x402c00
pop dword [ebp - 0x40]
mov eax, 0x402c00
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x401aeea0
add dword [ebp - 0x50], 0xe3756ab
mov dword [ebp - 0x4c], 0x620ec1a4
add dword [ebp - 0x4c], 0xd0248aa1
mov dword [ebp - 0x48], 0x25a0bbee
add dword [ebp - 0x48], 0x26ab8840
mov dword [ebp - 0x44], 0x71b6e9be
add dword [ebp - 0x44], 0x8e491642
lea eax, [ebp - 0x50]
push eax
mov eax, 0x52c173e4
add eax, 0xad7f0ca8
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0xdb18dc1e
add dword [ebp - 0x50], 0x99598d38
mov dword [ebp - 0x4c], 0xa6a043ed
add dword [ebp - 0x4c], 0x9acc1d88
mov dword [ebp - 0x48], 0x8e0626cf
add dword [ebp - 0x48], 0xd569459d
mov dword [ebp - 0x44], 0xeb79464b
sub dword [ebp - 0x44], 0xeb79464b
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x39d0e
push 0
call eax
mov ecx, 0x960b120e
add ecx, 0x69f54274
xor edx, edx
add edx, eax
mov ebx, 0x300e3006
sub ebx, 0x2fcd2006
add ebx, dword [ebp - 0x40]
mov esi, 0x3c15b0ad
sub esi, 0x923e51e6
mov edi, dword [ebx]
xor dword [ebp - 0x30], 0x5f7063e6
add edi, esi
xor dword [ebp - 0x1c], 0xd5439aa0
mov dword [edx], edi
add edx, 0x1c6713f4
sub edx, 0x1c6713f0
add ebx, 0x4996baa6
add ebx, 0xb669455e
loop 0x402d1a
add eax, 0x88a3b51d
sub eax, 0x88a27042
mov ebx, eax
add eax, 5
mov ecx, 0xedf74ca0
add ecx, 0x1248b360
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x401ee2
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x411280]
jne 0x401eec
repz ret
jmp fcn.00404369

Function at 0x4025e7
Capabilities:
Accept command line arguments
Parse pe header

Disassembly:
push 0x14
push 0x40f530
call fcn.00403770
mov eax, 0x5a4d
cmp word [0x400000], ax
jne 0x4024e7
mov eax, dword [0x40003c]
cmp dword [eax + 0x400000], 0x4550
jne 0x4024e7
mov ecx, 0x10b
cmp word [eax + 0x400018], cx
jne 0x4024e7
cmp dword [eax + 0x400074], 0xe
jbe 0x4024e7
xor ecx, ecx
cmp dword [eax + 0x4000e8], ecx
setne cl
mov dword [ebp - 0x1c], ecx
jmp 0x4024eb
and dword [ebp - 0x1c], 0
push 1
call fcn.0040b1c2
pop ecx
test eax, eax
jne 0x4024ff
push 0x1c
call fcn.0040b1c2
pop ecx
call fcn.00405287
test eax, eax
jne 0x402510
push 0x10
call fcn.0040b1c2
pop ecx
call fcn.00405952
and dword [ebp - 4], 0
call fcn.004032ff
test eax, eax
jge 0x40252a
push 0x1b
call fcn.0040b1c2
pop ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x412ba0], eax
call fcn.0040b1c2
mov dword [0x41203c], eax
call fcn.0040b1c2
test eax, eax
jge 0x402550
push 8
call fcn.0040b1c2
pop ecx
call fcn.00405fde
test eax, eax
jge 0x402561
push 9
call fcn.0040b1c2
pop ecx
push 1
call fcn.0040b1c2
pop ecx
test eax, eax
je 0x402574
push eax
call fcn.0040b1c2
pop ecx
mov eax, dword [0x412018]
mov dword [0x41201c], eax
push eax
push dword [0x412010]
push dword [0x41200c]
call main
add esp, 0xc
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x1c], 0
jne 0x4025a2
push eax
call fcn.0040b1c2
call fcn.00402400
jmp 0x4025d7
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [ebp - 0x20]
call fcn.004037b5
ret
call fcn.0040b1c2
jmp 0x402495

Function at 0x40b1c2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x40b1d1
pop dword [ebp - 0x2c]
mov eax, 0x48ee4c8c
add eax, 0xb7526545
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x38567
push 0
mov eax, 0xbeb83e44
sub eax, 0xbe775d6c
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x286fb120
add ecx, 0xd79092f5
xor edx, edx
add edx, eax
mov esi, 0x4799f10e
sub esi, 0x4758b54a
add esi, dword [ebp - 0x2c]
mov ebx, 0x3388f357
sub dword [ebp - 0x10], ecx
mov edi, dword [esi]
xor dword [ebp - 0x28], 0x89f82c13
sub edi, ebx
add dword [ebp - 0x1c], ebx
mov dword [edx], edi
add edx, 0x16a35749
add edx, 0xe95ca8bb
add esi, 0x1e2aaf64
sub esi, 0x1e2aaf60
loop 0x40b22c
add eax, 0xd12e229a
sub eax, 0xd12d1f73
mov ebx, eax
add eax, 0xe53c8692
add eax, 0x1ac37973
mov ecx, 0xece4803a
sub ecx, 0xeca4803a
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x401aa0
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x401adf
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x401adf
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x401adf
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x401adf
cmp dword [ecx + 0x74], 0xe
jbe 0x401adf
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x40239f
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x4023da
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x4023c1
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x4023d2
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x4023dc
inc edi
add eax, 0x28
cmp edi, esi
jb 0x4023b7
xor eax, eax
pop edi
pop esi
ret

Function at 0x402420
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov esi, dword [edi + 0x3c]
add esi, edi
mov ebx, dword [esi + 0x78]
call fcn.0040235f
cmp bh, byte [ecx]
lock sub dword [esi + 0x53], edx
call fcn.0040239f
pop ecx
test eax, eax
pop ecx
je 0x4024f2
add byte [eax], al

Function at 0x4025b1
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [edi + 6]
cmp ax, bx
jbe 0x4025b9
lea ecx, [esi + 0xc]
movzx edx, ax
mov eax, dword [ecx + 4]
mov esi, dword [ecx]
add eax, esi
cmp dword [ebp - 8], eax
jae 0x4025b3
mov dword [ebp - 8], eax
add ecx, 0x28
dec edx
jne 0x4025a4
mov byte [ebp - 0x58], bl
mov byte [ebp - 0x57], bl
mov byte [ebp - 0x56], 0x58
mov byte [ebp - 0x55], bl
mov byte [ebp - 0x54], 0xe0
mov byte [ebp - 0x53], 0xc2
mov byte [ebp - 0x52], 0xd3
mov byte [ebp - 0x51], 0xf4
mov byte [ebp - 0x50], 0xde
mov byte [ebp - 0x4f], 0xd4
mov byte [ebp - 0x4e], 0xd3
mov byte [ebp - 0x4d], 0xc2
mov byte [ebp - 0x4c], 0xca
mov byte [ebp - 0x4b], 0xee
out dx, al
mov byte [ebp - 0x4a], 0xc9
mov byte [ebp - 0x49], 0xc1
mov byte [ebp - 0x48], 0xc8
mov byte [ebp - 0x47], 0xa7
call fcn.0040235f
call 0x8dfe9b99
inc ebp
test al, 0x50
call fcn.0040236f
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00402324
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x40264d
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.0040235f
and dword [esi + 0x458dd110], edx
rcl byte [eax - 0x18], 0xc5
cld
invalid
Function at 0x10004820
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x10004829
xor eax, esi
pop esi
pop ebp
ret 4

Function at 0x10004840
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x10004849
xor eax, esi
pop esi
pop ebp
ret 4

Function at 0x10005590
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x10005599
pop esi
pop ebp
ret 8

Function at 0x100055b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x100055b9
pop esi
pop ebp
ret 4

Function at 0x100055d0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov edx, eax
xor edx, esi
lock cmpxchg dword [ecx], edx
jne 0x100055d9
pop esi
pop ebp
ret 8

Function at 0x100184b0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
mov eax, dword [0x1017c928]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x1017f7a8]
push ebx
xor ebx, ebx
mov dword [ebp - 0x60], ebx
test eax, eax
jne 0x10018588
push esi
push 0x55
pop esi
push esi
push 0x1017f7b0
push 0x5c
push ebx
call dword [sym.imp.kernel32.dll_GetLocaleInfoEx]
test eax, eax
jle 0x10018572
push esi
lea eax, [ebp - 0x5c]
push ebx
push eax
call fcn.100a6450
add esp, 0xc
mov eax, ebx
cmp word [eax*2 + 0x1017f7b0], 0x5f
mov cl, 0x2d
je 0x10018512
mov cl, byte [eax*2 + 0x1017f7b0]
mov byte [ebp + eax - 0x5c], cl
test cl, cl
je 0x1001851f
inc eax
cmp eax, esi
jl 0x100184fe
cmp eax, esi
push 0x41
sbb al, al
and byte [ebp - 8], al
call sym.icucnv67.dll_utext_openConstUnicodeString_67
mov esi, eax
pop ecx
test esi, esi
je 0x10018572
lea eax, [ebp - 0x60]
push eax
push 0x40
lea eax, [ebp - 0x5c]
push esi
push eax
call sym.icucnv67.dll_utext_openConstUnicodeString_67
add esp, 0x10
cmp dword [ebp - 0x60], ebx
jg 0x1001856b
push 0x10017d70
push 0x15
mov byte [eax + esi], bl
mov dword [0x1017f7a8], esi
mov byte [0x1017f7ac], 1
call sym.icucnv67.dll_utext_openConstUnicodeString_67
pop ecx
jmp 0x10018571
push esi
call sym.icucnv67.dll_utext_openConstUnicodeString_67
pop ecx
mov ecx, dword [0x1017f7a8]
mov eax, 0x100fbd80
test ecx, ecx
pop esi
cmovne eax, ecx
mov dword [0x1017f7a8], eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.100814c9
leave
ret
Function at 0x1004fc10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
mov eax, dword [edi + 0xc]
cdq
sub eax, edx
sar eax, 1
mov dword [ebp - 8], eax
test eax, eax
jle 0x1004fc67
mov ebx, dword [edi + 4]
movzx edx, byte [ebp + 8]
mov ecx, dword [ebx + esi*8]
mov ebx, dword [ebx + esi*8 + 4]
movzx eax, cl
dec ebx
mov dword [ebp - 4], eax
mov eax, ebx
xor eax, ecx
test eax, 0xffffff00
jne 0x1004fc52
cmp dword [ebp - 4], edx
ja 0x1004fc5e
jmp 0x1004fc57
cmp dword [ebp - 4], edx
jbe 0x1004fcab
movzx eax, bl
cmp edx, eax
jbe 0x1004fcab
mov ebx, dword [edi + 4]
inc esi
cmp esi, dword [ebp - 8]
jl 0x1004fc32
lea ecx, [edi - 4]
call sym.icucnv67.dll_private:_signed_char___thiscall_icu_67::UnicodeSet::hasStrings_void_const
test al, al
je 0x1004fca2
mov eax, dword [edi + 0x28]
xor esi, esi
cmp dword [eax + 4], esi
jle 0x1004fca2
movzx ebx, byte [ebp + 8]
push esi
mov ecx, eax
call sym.icucnv67.dll_utext_openConstUnicodeString_67
push 0
mov ecx, eax
call sym.icucnv67.dll_utext_openConstUnicodeString_67
movzx eax, al
cmp eax, ebx
je 0x1004fcab
mov eax, dword [edi + 0x28]
inc esi
cmp esi, dword [eax + 4]
jl 0x1004fc81
xor al, al
pop edi
pop esi
pop ebx
leave
ret 4
mov al, 1
jmp 0x1004fca4
Function at 0x10001140
Capabilities:
Resolve function by parsing pe exports
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa8
mov eax, esp
mov dword [eax], 0x9c7be4
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
call eax
sub esp, 4
mov ecx, esp
mov dword [ecx + 4], 0x1ff
mov dword [ecx], 0x527f16
mov ecx, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esp + 0x6c], eax
call ecx
sub esp, 8
xor ecx, ecx
lea edx, [esp + 0x78]
mov dword [esp + 0x68], eax
mov dword [esp + 0x64], edx
mov dword [esp + 0x60], ecx
jmp 0x1000125d
mov eax, dword [esp + 0x5c]
add eax, 1
mov dword [esp + 0x58], eax
mov eax, dword [esp + 0x58]
cmp eax, 0xa1
mov dword [esp + 0x60], eax
je 0x10001356
jmp 0x1000125d
xor eax, eax
xor ecx, ecx
mov edx, dword [esp + 0x5c]
sub edx, 0x4b
mov dword [esp + 0x54], eax
mov dword [esp + 0x50], ecx
mov dword [esp + 0x4c], edx
je 0x100012ce
jmp 0x100011d7
mov eax, dword [esp + 0x5c]
sub eax, 0xe
mov ecx, dword [esp + 0x50]
mov dword [esp + 0x48], eax
mov dword [esp + 0x44], ecx
jne 0x1000131b
jmp 0x100011f2
mov eax, 0x7e0e7d
mov dword [esp + 0x74], eax
mov dword [esp + 0x70], 0xd0c
mov eax, esp
lea ecx, [esp + 0x70]
mov dword [eax + 0x10], ecx
lea ecx, [esp + 0x74]
mov dword [eax + 0xc], ecx
mov dword [eax + 8], 0x45b
mov dword [eax + 4], 0xa03
mov dword [eax], 0xa03
mov eax, dword [sym.imp.ole32.dll_CoWaitForMultipleHandles]
call eax
sub esp, 0x14
mov ecx, esp
mov dword [ecx], 0xe04
mov ecx, dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov dword [esp + 0x40], eax
call ecx
sub esp, 4
mov ecx, dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov dword [esp + 0x3c], eax
call ecx
mov dword [esp + 0x38], eax
jmp 0x10001193
mov eax, dword [esp + 0x60]
xor ecx, ecx
mov dword [esp + 0x5c], eax
mov dword [esp + 0x34], ecx
mov eax, dword [esp + 0x34]
mov ecx, 0x12
mov dword [esp + 0x30], eax
xor edx, edx
div ecx
cmp edx, 0
jne 0x1000129f
mov eax, esp
mov dword [eax + 4], 0xa72
mov dword [eax], 0xa72
mov eax, dword [sym.imp.USER32.dll_SetLastErrorEx]
call eax
sub esp, 8
jmp 0x1000129f
mov eax, dword [esp + 0x30]
add eax, 1
cmp eax, 0x7d
sete cl
mov dword [esp + 0x2c], eax
mov byte [esp + 0x2b], cl
mov al, byte [esp + 0x2b]
test al, 1
mov ecx, dword [esp + 0x2c]
mov dword [esp + 0x34], ecx
jne 0x100011b8
jmp 0x1000126b
xor eax, eax
mov ecx, 0x30
mov edx, dword [esp + 0x64]
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0x30
mov dword [esp + 0x24], eax
mov dword [esp + 0x20], ecx
call fcn.10001a40
mov eax, esp
lea ecx, [esp + 0x78]
mov dword [eax + 4], ecx
mov dword [eax], 0x5df
mov eax, dword [sym.imp.USER32.dll_GetGUIThreadInfo]
call eax
sub esp, 8
mov dword [esp + 0x1c], eax
jmp 0x100011f2
mov eax, dword [esp + 0x44]
mov ecx, esp
mov dword [ecx], 0xf9e689
mov ecx, dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [esp + 0x18], eax
call ecx
sub esp, 4
mov ecx, dword [esp + 0x18]
add ecx, 1
cmp ecx, 0xa
mov dword [esp + 0x14], eax
mov dword [esp + 0x44], ecx
je 0x10001193
jmp 0x1000131b
mov esp, ebp
pop ebp
ret

Function at 0x10001e7c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100d3410]
jne 0x10001e86
repz ret
jmp fcn.1000212d
Function at 0x10002730
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x10
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x100d33f4], 0
mov byte [0x100d33f8], 0
mov dword [0x100d33e8], 0x223a
mov dword [0x100d33f0], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [0x100d33e8], 0x23f6
mov eax, dword [0x100d33f0]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov eax, dword [0x100d33f0]
add eax, 1
mov dword [0x100d33f0], eax
cmp eax, 0x100
jl 0x10002770
mov dword [0x100d33f0], 0
mov eax, 0x100
mov dword [0x100d33fc], 0
mov ecx, dword [0x100d33f4]
mov edx, dword [0x100d33f0]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + edx]
add edi, ecx
mov dword [ebp - 0x1c], eax
mov eax, edx
xor edx, edx
mov ecx, dword [ebp - 0x10]
div ecx
mov ebx, dword [ebp - 0x14]
movzx edx, byte [ebx + edx]
add edi, edx
mov dword [0x100d33fc], edi
mov eax, edi
cdq
mov edi, dword [ebp - 0x1c]
idiv edi
mov dword [0x100d33f4], edx
mov dword [0x100d33e8], 0x9d4
mov edx, dword [0x100d33f0]
mov cl, byte [esi + edx]
mov byte [0x100d33f8], cl
mov dword [0x100d33e8], 0xfffff859
mov edx, dword [0x100d33f4]
mov cl, byte [esi + edx]
mov edx, dword [0x100d33f0]
mov byte [esi + edx], cl
mov dword [0x100d33e8], 0x1f37
mov cl, byte [0x100d33f8]
mov edx, dword [0x100d33f4]
mov byte [esi + edx], cl
mov edx, dword [0x100d33e8]
add edx, 0xfffffbe3
mov dword [0x100d33e8], edx
mov edx, dword [0x100d33f0]
add edx, 1
mov dword [0x100d33f0], edx
cmp edx, 0x100
jl 0x100027a9
add esp, 0x10
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100028b0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x64
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
call fcn.10002880
xor ecx, ecx
mov dword [0x100d33e8], 0x26c3
mov edx, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
lea edx, section..data
imul esi, eax, 0x64
mov edi, edx
add edi, esi
add edi, 0x60
mov esi, dword [edi]
imul edi, eax, 0x64
add edx, edi
add edx, 0x5c
movzx edx, word [edx]
xor edx, esi
add edx, ecx
add eax, 1
cmp eax, 0x33d
mov ecx, edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], eax
jne 0x100028db
lea eax, [0x100be5fc]
mov ecx, 0xe
lea edx, [ebp - 0x2c]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x44], edx
mov dword [ebp - 0x48], ecx
call fcn.100034a0
mov dword [0x100d33ec], 0x1da2
mov dword [0x100d33e8], 0xbcc
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call fcn.10002490
mov ecx, eax
mov dword [0x100d3408], eax
mov eax, esp
mov edx, dword [ebp - 0x40]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
lea edx, section..data
imul esi, eax, 0x64
mov edi, edx
add edi, esi
add edi, 0x60
mov esi, dword [edi]
imul edi, eax, 0x64
mov ebx, edx
add ebx, edi
add ebx, 0x58
mov edi, dword [ebx]
imul ebx, eax, 0x64
add edx, ebx
add edx, 0x5c
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x4c]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x60], edx
call fcn.10003390
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
add eax, ecx
mov edx, dword [ebp - 0x58]
add edx, 1
cmp edx, 0x33d
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], edx
jne 0x100029a1
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x40]
mov dword [esp + 8], ecx
call fcn.100032f0
xor eax, eax
mov dword [0x100d33ec], 0xe79
mov ecx, dword [ebp - 0x4c]
add ecx, 0x12a867
mov edx, dword [ebp - 0x30]
mov dword [edx], ecx
mov dword [edx + 4], 0x12b600
mov ecx, dword [ebp - 0x4c]
add ecx, 0x1286ff
mov dword [edx + 8], ecx
mov ecx, dword [0x100d33ec]
add ecx, 0x745
mov dword [0x100d33e8], ecx
mov dword [edx + 0xc], 0x2000
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret