joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40244e
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x4023bd
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae 0x4023b8
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x4023a2
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x4023aa
cmp edx, ebx
jne 0x4024f8
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
or byte [edx - 0x3f], dh
add eax, dword [eax + 4]
jmp 0x402366
mov dword [ebp + 0xc], ebx
jmp 0x4023c8
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x4023e0
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x4023fe
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
mov edi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp - 0x44]
ja 0x40245c
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x402443
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x40244c
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x402456
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x402438
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x4023c2
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x4024a9
dec eax
je 0x4024a0
sub eax, 3
je 0x402497
mov dword [ebp - 4], 0x40
jmp 0x4024c6
mov dword [ebp - 4], 4
jmp 0x4024ac
mov dword [ebp - 4], 0x20
jmp 0x4024ac
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x4024f8
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x402478
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.00401d09
daa
sbb al, 0xb8
xor al, 0xff
jne 0x402503
push 1
push esi
call edi
mov eax, esi
jmp 0x402504
push 0x8000
push ebx
push esi
call dword [ebp - 8]
xor eax, eax
rcr byte [edi + 0x5e], 0x5b
pop edi
pop esi
pop ebx
leave
ret
Function at 0x5b5660
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x7b000]
push edi
jmp 0x5b567a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x5b5681
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5b5670
mov eax, 1
add ebx, ebx
jne 0x5b5693
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x5b56a4
jne 0x5b56c3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5b56c3
dec eax
add ebx, ebx
jne 0x5b56b0
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x5b5688
add ebx, ebx
jne 0x5b56bf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x5b5715
xor ecx, ecx
sub eax, 3
jb 0x5b56db
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x5b574a
sar eax, 1
mov ebp, eax
jmp 0x5b56e6
add ebx, ebx
jne 0x5b56e6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5b56b4
inc ecx
add ebx, ebx
jne 0x5b56f4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x5b56b4
add ebx, ebx
jne 0x5b5701
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x5b56f6
jne 0x5b5712
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x5b56f6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x5b5734
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x5b5726
jmp 0x5b5676
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x5b5734
add edi, ecx
jmp 0x5b5676
pop esi
mov edi, esi
mov ecx, 0x3ecc
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x5b5752
cmp byte [edi], 0x15
jne 0x5b5752
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x5b5757
lea edi, [esi + 0x1a2000]
mov eax, dword [edi]
or eax, eax
je 0x5b57cf
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1bb4c8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1bb644]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x5b5784
mov ecx, edi
jns 0x5b57b3
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1bb648]
or eax, eax
je 0x5b57c9
mov dword [ebx], eax
add ebx, 4
jmp 0x5b57a1
call dword [esi + 0x1bb658]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x5b5800
cmp al, 0xef
ja 0x5b57f3
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x5b57d5
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x5b57e2
mov ebp, dword [esi + 0x1bb64c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x5b5834
sub esp, 0xffffff80
jmp 0x426d3d
Function at 0x31d6cc4
Capabilities:
Encode data using xor

Disassembly:
jmp 0x31d6cce
pushal
call 0x31d6cd4
pop ebp
sub ebp, 0x10
sub ebp, 0x2dd6cc4
jmp 0x31d6cea
mov eax, 0x2dd6cc4
add eax, ebp
add eax, 0x4c
mov ecx, 0x5d8
mov edx, 0xda05d009
xor byte [eax], dl
inc eax
dec ecx
jne 0x31d6d01
test esi, esi
invalid
jmp 0x31d6d14
add ah, 0x82
xor byte [0x88090909], 0xc8
int1
or dword [ecx], ecx
or dword [edx], ecx
les esi, [ecx + 0x909090f]
mov bl, 0x21
or dword [ecx], ecx
or esi, edi
jmp 0x31d6d3b
insd dword es:[edi], dx
sub eax, 0x2d0d80f5
test byte [ebp + 0x2d], ch
cmc
or byte [0x8a4d612d], 0x29
or dword [ecx - 0x77], esp
loopne 0x31d6d06
or ecx, dword [eax]
and eax, 0x122d612d
mov eax, 0x9090ce1
mov eax, 0x9090ce1
or eax, esp
cmp dword [ecx], ecx
or dword [ecx], ecx
pop esp
test byte [ebp + 0x2d], ah
or dword [edx + 0x909018c], eax
or dword [edx + 0x909059c], eax
or dword [edx + 0x9091984], eax
or eax, ecx
loopne 0x31d6d89
cmp byte [ebx], cl
mov cl, bl
or eax, 0xfd8c0640
div dh
test byte [edx + 0x6d842d25], 0x2d
or eax, 0x820905cb
test dword [0x909090d], ebp
popal
dec ebp
mov ch, byte [ecx]
or dword [ecx - 0x77], esp
loopne 0x31d6d59
or ecx, dword [eax]
and eax, 0x2d6d842d
cmc
add byte [0x90ce12d], 9
or eax, esp
push eax
or ecx, dword [ecx]
or dword [ebp + ebp*2 + 0x2580f52d], eax
sub eax, 0x92d6584
idiv byte [ebp + eax - 0xa]
jl 0x31d6dcb
loope 0x31d6d59
lea ecx, [ecx]
or dword [ecx], ecx
xor byte [ecx + eax - 0x77f6f6f7], 0xf8
mov bl, 0x84
xor eax, 0xb3f888ee
test byte [0x88c03aee], dh
or dword [ecx], ecx
or dword [edx + 0x90901b4], eax
or dword [eax + 0x3584b3f8], ecx
out dx, al
mov al, bh
mov bl, 0x84
xor eax, 0x88c03aee
sti
inc ecx
lcall 0x9a41, 0xfb88d0d7
xlatb
ror byte [eax - 0x2865be05], 1
sti
inc ecx
lcall 0xe18a, 0xdb3ad0d7
or al, 0x41
push es
sar byte [edx], 1
fisttp dword [edx + 0x6410ce1]
lea eax, [edi + 9]
or dword [ecx], ecx
push es
add dword [ecx + 9], 0x826f0909
adc eax, 0xe1f28930
push es
lea edx, [ebx]
or dword [ecx], ecx
or dword [ecx - 0x72f91f0e], ecx
sbb byte [ecx], cl
or dword [ecx], ecx
outsd dx, dword [esi]
mov dl, dh
imul byte [esi + eax]
lea ebx, [ecx + ecx]
or dword [ecx], ecx
dec eax
loopne 0x31d6dea
div dh
mul byte [eax]
inc ebp
xor byte [eax], cl
mov cl, al
or al, 0x8a
loope 0x31d6e3f
loopne 0x31d6de8
div dh
mul byte [eax]
pop ebp
xor byte [ebx], cl
mov cl, al
jp 0xe4a77c26
jecxz 0x31d6e4e
mov ah, cl
or al, 0xe0
mov byte [0x82f6f6f6], al
and eax, 0x2d6d842d
or eax, 0x5c0905cb
sub eax, 0x905cb0d
pop esp
and ch, 0x5f
pop esi
pop esp
cmp byte [ebp + eax - 0x7e], 0x74
add ebp, esi
mov ebx, 0x880f8389
iretd
Function at 0x603a8b
Capabilities:
Encode data using xor

Disassembly:
test al, 1
les edx, [ebx + 0x71a08bb8]
cmp esi, ebx
mov esp, 0x596b1285
or bh, byte [edx + 0x318f558f]
insb byte es:[edi], dx
invalid
cmc
mov edi, 0x930a165
lea edi, [edi - 0x67]
push 0x78
xchg edi, eax
mov byte [0x775be21d], al
rcl bh, 0x42
adc eax, 0x3fab8831
leave
pop es
or eax, 0xc762dede
jg 0x603a13
invalid
mov al, byte [0xcd72107b]
sub eax, 0x18434d28
stc
dec sp
dec esp
cdq
shl byte [edi + 0x646afee6], cl
mov eax, 0x151b32a7
loope 0x603a65
into
imul esp, dword [edx - 0x41], 0xd2fdedeb
push esp
cmp eax, 0x67164f1d
wait
mov cl, 0xa4
adc cl, byte [eax + 0x387be8bf]
cmp byte [esi - 0x3f521b64], bh
cmp byte [esi - 0x3f521b64], bh
jp 0x603a54
cmp eax, 0xb8f7d5a2
jle 0x603a35
mov bl, al
jb 0x603aad
mov bl, 0xf6
and dword [esi + 0x4d64290b], eax
enter 0x54d3, 0xffffffffffffffd2
dec ebp
arpl word [esi], sp
mov eax, dword es:[0xad379d81]
mov eax, dword [0xad379d81]
xlatb
or dword [edi], eax
popfd
mov byte [0xa1fd74eb], al
fiadd dword [edx + 0x41c8f0b1]
jns 0x603b2c
sbb al, 0xb7
salc
adc bl, byte [edx - 0x1a]
cmp bh, ch
pop ebp
int 0x24
in eax, 0xbf
sar dword [esi + edx*8 - 0x7bc8b8bb], 1
cmp byte [ecx - 0x6e04b088], al
lodsd eax, dword [esi]
push es
aaa
test byte [eax], bh
cmp dword [eax + 0x4f], 0x6ad91fb
inc ebp
jb 0x603aed
pop edi
jo 0x603af0
leave
xchg dword [edi + ecx*4], ebp
pop edi
loop 0x603a83
xchg ebp, eax
adc eax, 0xd0ba7e07
jnp 0x603ad5
jle 0x603aac
sar byte [ebx - 0x20], 1
stosd dword es:[edi], eax
nop
wait
loope 0x603afc
and edi, esp
mov al, byte [0x11f8c1eb]
mov ebp, 0x3bd71448
inc edi
jnp 0x603b34
movsd dword es:[edi], dword [esi]
aaa
insd dword es:[edi], dx
mov bh, 0x59
fist word [ebp - 0x67c06d98]
adc dword [eax], ebp
popfd
rcl byte [edx + 0x48c8a8bb], cl
invalid
sub eax, 0x589c7724
mov eax, 0xd809600b
or eax, ebx
cmc
sbb edi, dword [ebx - 0x4c875511]
mov ebp, gs
stosb byte es:[edi], al
ljmp 0x767b
Function at 0x10004347
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10004366
xor eax, eax
jmp 0x100043e1
push dword [ebp - 0x14]
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
jne 0x1000437c
xor eax, eax
jmp 0x100043e1
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
add eax, dword [ebp - 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
and eax, 0xf
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jbe 0x100043c4
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jae 0x100043c4
mov eax, dword [ebp - 4]
movzx eax, word [eax]
mov ecx, dword [ebp - 4]
lea eax, [ecx + eax*2 + 2]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x10]
dec eax
mov dword [ebp - 0x10], eax
jmp 0x1000439d
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 8]
jb 0x100043d0
xor eax, eax
jmp 0x100043e1
mov eax, dword [ebp - 4]
movzx eax, word [eax]
test eax, eax
jne 0x100043de
xor eax, eax
jmp 0x100043e1
mov eax, dword [ebp - 4]
leave
ret

Function at 0x10009b28
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
xor eax, eax
jne 0x10009b31
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
shl eax, 1
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
and dword [eax], 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 4]
push eax
push 0
push dword [ebp + 8]
mov eax, dword [ebp - 0x10]
push dword [eax]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0
je 0x10009b6e
mov eax, dword [ebp - 0xc]
jmp 0x10009bc4
cmp dword [ebp - 4], 1
je 0x10009b7f
cmp dword [ebp - 4], 2
je 0x10009b7f
push 0xd
pop eax
jmp 0x10009bc4
cmp dword [ebp + 0xc], 0
je 0x10009bb8
cmp dword [ebp - 8], 0
je 0x10009bb1
mov eax, dword [ebp - 8]
xor edx, edx
push 2
pop ecx
div ecx
test edx, edx
jne 0x10009baa
mov eax, dword [ebp - 8]
shr eax, 1
mov ecx, dword [ebp + 0xc]
movzx eax, word [ecx + eax*2 - 2]
test eax, eax
je 0x10009baf
push 0xd
pop eax
jmp 0x10009bc4
jmp 0x10009bb8
mov eax, dword [ebp + 0xc]
and word [eax], 0
mov eax, dword [ebp - 8]
shr eax, 1
mov ecx, dword [ebp + 0x10]
mov dword [ecx], eax
xor eax, eax
leave
ret 0xc
Function at 0x10009bef
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x228
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x228], ecx
lea ecx, [ebp - 0x10]
call fcn.1001daed
push 0x2001f
push dword [ebp + 8]
mov eax, dword [ebp - 0x228]
push dword [eax]
lea ecx, [ebp - 0x10]
call fcn.10009940
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10009c4d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x21c], eax
lea ecx, [ebp - 0x10]
call fcn.100099b2
mov eax, dword [ebp - 0x21c]
jmp 0x10009cdc
mov dword [ebp - 4], 0x100
lea eax, [ebp - 0xc]
push eax
push 0
push 0
push 0
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x218]
push eax
push 0
push dword [ebp - 0x10]
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
test eax, eax
jne 0x10009cb2
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x10]
call fcn.10009bef
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
je 0x10009ca9
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x220], eax
lea ecx, [ebp - 0x10]
call fcn.100099b2
mov eax, dword [ebp - 0x220]
jmp 0x10009cdc
mov dword [ebp - 4], 0x100
jmp 0x10009c54
lea ecx, [ebp - 0x10]
call fcn.10009985
push dword [ebp + 8]
mov ecx, dword [ebp - 0x228]
call fcn.10009a8e
mov dword [ebp - 0x224], eax
lea ecx, [ebp - 0x10]
call fcn.100099b2
mov eax, dword [ebp - 0x224]
mov ecx, dword [ebp - 0x18]
xor ecx, ebp
call fcn.1006f3c1
leave
ret 4
Function at 0x1000f505
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x218
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 4], eax
mov dword [ebp - 0x218], ecx
mov eax, dword [ebp - 0x218]
and dword [eax], 0
mov eax, dword [ebp - 0x218]
and dword [eax + 4], 0
mov eax, dword [ebp - 0x218]
and dword [eax + 8], 0
mov eax, dword [ebp - 0x218]
and dword [eax + 0xc], 0
mov eax, dword [ebp - 0x218]
and dword [eax + 0x10], 0
and word [ebp - 0x210], 0
push 0x206
push 0
lea eax, [ebp - 0x20e]
push eax
call fcn.10072040
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAddBackslashW]
push 0x100cbdf8
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathAppendW]
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov dword [ebp - 0x214], eax
cmp dword [ebp - 0x214], 0
jne 0x1000f5bc
jmp 0x1000f630
mov eax, dword [ebp - 0x218]
mov dword [eax], 1
push str.OpenThemeData
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x218]
mov dword [ecx + 4], eax
push str.CloseThemeData
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x218]
mov dword [ecx + 8], eax
push str.DrawThemeBackground
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x218]
mov dword [ecx + 0xc], eax
push str.SetWindowTheme
push dword [ebp - 0x214]
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
mov ecx, dword [ebp - 0x218]
mov dword [ecx + 0x10], eax
mov eax, dword [ebp - 0x218]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1006f3c1
leave
ret

Function at 0x10013515
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
mov dword [ebp - 4], ecx
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.1002080e
test eax, eax
je 0x1001357a
push 0x11
call dword [sym.imp.USER32.dll_GetKeyState]
movsx eax, ax
test eax, eax
jl 0x10013570
cmp dword [ebp + 8], 0x1b
jne 0x10013556
push 0
push 2
push 0x111
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.10020926
jmp 0x10013570
cmp dword [ebp + 8], 0xd
jne 0x10013570
push 0
push 1
push 0x111
mov ecx, dword [ebp - 4]
add ecx, 4
call fcn.10020926
push 0
mov ecx, dword [ebp - 4]
call fcn.10013624
leave
ret 0xc
Function at 0x1002901a
Capabilities:
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
call fcn.1000f6e1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0
je 0x1002904b
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x1002904b
push 0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_ShowWindow]
leave
ret

Function at 0x10032397
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x34], ecx
and dword [ebp - 0xc], 0
and dword [ebp - 4], 0
and dword [ebp - 8], 0
mov eax, dword [ebp - 0x34]
cmp dword [eax + 0x334], 0
je 0x100323c8
call dword [sym.imp.USER32.dll_ReleaseCapture]
mov eax, dword [ebp - 0x34]
and dword [eax + 0x334], 0
mov eax, dword [ebp - 0x34]
cmp dword [eax + 0x324], 0
je 0x100324a6
mov eax, dword [ebp - 0x34]
push dword [eax + 0x324]
call fcn.1000f3d2
pop ecx
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x1003249c
push 2
push 0
push dword [ebp - 8]
mov ecx, dword [ebp - 0x34]
call fcn.100317b8
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x34]
mov eax, dword [eax + 0x324]
cmp eax, dword [ecx + 0x320]
jne 0x1003249c
mov eax, dword [ebp + 0xc]
and eax, 0xffff
movzx eax, ax
mov ecx, dword [ebp + 0x10]
and ecx, 0xffff
movzx ecx, cx
shl ecx, 0x10
or eax, ecx
push eax
push dword [ebp + 8]
push 0x202
mov ecx, dword [ebp - 8]
call fcn.1000f458
mov ecx, dword [ebp - 8]
call fcn.10024fe5
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
je 0x1003247e
mov eax, dword [ebp - 0x10]
movzx eax, word [eax]
test eax, eax
je 0x1003247e
push 1
push 0
push 0
push dword [ebp - 0x10]
push str.open
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 0x14], eax
jmp 0x1003249c
mov ecx, dword [ebp - 8]
call fcn.10024f1a
test eax, eax
je 0x1003249c
mov dword [ebp - 0xc], 1
mov ecx, dword [ebp - 8]
call fcn.10024f1a
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x34]
and dword [eax + 0x324], 0
cmp dword [ebp - 0xc], 0
je 0x10032507
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x34]
mov eax, dword [eax + 4]
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x34]
add ecx, 4
call fcn.100341ef
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov ecx, dword [ebp - 8]
call dword [eax + 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x28]
push eax
push dword [ebp - 0x24]
push 0x4e
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp - 0x34]
add ecx, 4
call fcn.1003424e
mov ecx, eax
call fcn.10020899
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
mov dword [ebp - 0x2c], eax
leave
ret 0xc
Function at 0x100346db
Capabilities:
Check for time delay via gettickcount

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push edi
mov dword [ebp - 0x30], ecx
mov byte [ebp - 1], 0
cmp dword [ebp + 8], 0
je 0x100347a7
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov dword [ebp - 8], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x30]
cmp dword [eax + 4], 0
je 0x100347a5
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0xc], 0
je 0x100347a5
push 0x4ff
push 0x64
push 0
mov eax, dword [ebp - 0x30]
add eax, 0xc
push eax
push 1
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x10034743
mov byte [ebp - 1], 1
jmp 0x100347a5
cmp dword [ebp - 0x10], 0xffffffff
jne 0x1003474d
jmp 0x100347a5
and dword [ebp - 0x2c], 0
push 6
pop ecx
xor eax, eax
lea edi, [ebp - 0x28]
rep stosd dword es:[edi], eax
push 1
push 0
push 0
push 0
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_PeekMessageW]
test eax, eax
je 0x10034788
lea eax, [ebp - 0x2c]
push eax
call dword [sym.imp.USER32.dll_DispatchMessageW]
cmp dword [ebp - 0x28], 0x12
jne 0x10034788
mov dword [ebp - 0xc], 1
cmp dword [ebp - 0xc], 0
je 0x100347a0
call dword [sym.imp.KERNEL32.dll_GetTickCount]
sub eax, dword [ebp - 8]
cmp eax, 0x2710
jbe 0x100347a0
jmp 0x100347a5
jmp 0x10034700
jmp 0x100347c9
mov eax, dword [ebp - 0x30]
cmp dword [eax + 0xc], 0
je 0x100347c9
push 0xbb8
mov eax, dword [ebp - 0x30]
push dword [eax + 0xc]
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
neg eax
sbb eax, eax
inc eax
mov byte [ebp - 1], al
mov al, byte [ebp - 1]
pop edi
leave
ret 4
Function at 0x10036da9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x100e13e0]
xor eax, ebp
mov dword [ebp - 0x28], eax
push edi
cmp dword [0x100fd480], 0
jne 0x10036f41
mov word [ebp - 0x88], 0x47
mov word [ebp - 0x86], 0x6c
mov word [ebp - 0x84], 0x6f
mov word [ebp - 0x82], 0x62
mov word [ebp - 0x80], 0x61
mov word [ebp - 0x7e], 0x6c
mov word [ebp - 0x7c], 0x5c
mov word [ebp - 0x7a], 0x7b
mov word [ebp - 0x78], 0x45
mov word [ebp - 0x76], 0x43
mov word [ebp - 0x74], 0x33
mov word [ebp - 0x72], 0x32
mov word [ebp - 0x70], 0x39
mov word [ebp - 0x6e], 0x31
mov word [ebp - 0x6c], 0x41
mov word [ebp - 0x6a], 0x39
mov word [ebp - 0x68], 0x2d
mov word [ebp - 0x66], 0x32
mov word [ebp - 0x64], 0x38
mov word [ebp - 0x62], 0x45
mov word [ebp - 0x60], 0x37
mov word [ebp - 0x5e], 0x2d
mov word [ebp - 0x5c], 0x34
mov word [ebp - 0x5a], 0x30
mov word [ebp - 0x58], 0x33
mov word [ebp - 0x56], 0x36
mov word [ebp - 0x54], 0x2d
mov word [ebp - 0x52], 0x39
mov word [ebp - 0x50], 0x38
mov word [ebp - 0x4e], 0x44
mov word [ebp - 0x4c], 0x44
mov word [ebp - 0x4a], 0x2d
mov word [ebp - 0x48], 0x38
mov word [ebp - 0x46], 0x45
mov word [ebp - 0x44], 0x37
mov word [ebp - 0x42], 0x39
mov word [ebp - 0x40], 0x32
mov word [ebp - 0x3e], 0x41
mov word [ebp - 0x3c], 0x39
mov word [ebp - 0x3a], 0x34
mov word [ebp - 0x38], 0x35
mov word [ebp - 0x36], 0x30
mov word [ebp - 0x34], 0x30
mov word [ebp - 0x32], 0x34
mov word [ebp - 0x30], 0x7d
and word [ebp - 0x2e], 0
and dword [ebp - 0x24], 0
and dword [ebp - 0x20], 0
xor eax, eax
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
mov dword [ebp - 0x20], 0xc
mov byte [ebp - 0x14], 0
xor eax, eax
lea edi, [ebp - 0x13]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x20]
push eax
call fcn.10036f5a
pop ecx
pop ecx
test eax, eax
je 0x10036f28
lea eax, [ebp - 0x20]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x88]
push eax
push 0
push 0
push dword [ebp - 0x24]
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x100fd480], eax
xor eax, eax
cmp dword [0x100fd480], 0
setne al
pop edi
mov ecx, dword [ebp - 0x28]
xor ecx, ebp
call fcn.1006f3c1
leave
ret

Function at 0x10037065
Capabilities:
Delete file
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov dword [ebp - 0x10], ecx
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.10037b4c
mov dword [ebp - 4], eax
and dword [ebp - 8], 0
jmp 0x10037089
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 4]
jge 0x100370ca
push dword [ebp - 8]
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.10037b7d
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
call fcn.10004d5d
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x100370c8
push 4
push 0
mov ecx, dword [ebp - 0xc]
call fcn.10004d5d
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
jmp 0x10037082
mov ecx, dword [ebp - 0x10]
add ecx, 4
call fcn.10037c06
leave
ret