joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10086660
Capabilities:
Create new key via cryptacquirecontext
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
lea eax, [ebp - 0xc]
push 0xf0000040
push 0x18
push 0
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x10086695
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x800c
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
push dword [ebp + 0x10]
call fcn.1004f2d0
add esp, 4
push 0
push eax
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [ebp - 4], 0x20
jne 0x100866e3
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [ebp - 8]
test eax, eax
je 0x100866f1
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x10086701
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x10087c40
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, dword [ebp + 0xc]
xor esi, esi
test edi, edi
je 0x10087c8d
push ebx
mov ebx, dword [ebp + 8]
mov cl, byte [esi + ebx]
mov dl, cl
mov al, cl
shr dl, 1
and al, 0xfe
not dl
movzx eax, al
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
shr dl, 1
xor dl, cl
or cl, 1
test dl, 2
movzx ecx, cl
cmove ecx, eax
mov byte [esi + ebx], cl
inc esi
cmp esi, edi
jb 0x10087c52
pop ebx
pop edi
pop esi
pop ebp
ret

Function at 0x10087ca0
Capabilities:
Hash data using md4
Hash data via wincrypt
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push 0xf0000040
push 1
push 0
push 0
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], 0
push eax
mov dword [ebp - 8], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextA]
test eax, eax
je 0x10087ce3
lea eax, [ebp - 8]
push eax
push 0
push 0
push 0x8002
push dword [ebp - 0xc]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
push dword [ebp + 0x10]
call fcn.1004f2d0
add esp, 4
push 0
push eax
push dword [ebp + 0xc]
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptHashData]
push 0
lea eax, [ebp - 4]
mov dword [ebp - 4], 0
push eax
push 0
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
cmp dword [ebp - 4], 0x10
jne 0x10087d31
push 0
lea eax, [ebp - 4]
push eax
push dword [ebp + 8]
push 2
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_CryptGetHashParam]
mov eax, dword [ebp - 8]
test eax, eax
je 0x10087d3f
push eax
call dword [sym.imp.ADVAPI32.dll_CryptDestroyHash]
mov eax, dword [ebp - 0xc]
test eax, eax
je 0x10087d4f
push 0
push eax
call dword [sym.imp.ADVAPI32.dll_CryptReleaseContext]
mov esp, ebp
pop ebp
ret
Function at 0x10089980
Capabilities:
Compute adler32 checksum

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.10089990

Function at 0x10089c10
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
pop ebp
jmp fcn.10089c20

Function at 0x1008baa0
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push 2
lea eax, [ebp - 4]
push eax
push 0x20000001
push str._x_sys_default_locale
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoEx]
xor ecx, ecx
test eax, eax
jne 0x1008bac7
mov eax, ecx
mov dword [ebp - 4], eax
jmp 0x1008baca
mov eax, dword [ebp - 4]
push esi
mov esi, dword [ebp + 0xc]
push ecx
push ecx
push esi
push eax
push dword [ebp + 8]
push ecx
push 0x1300
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
push eax
push dword [esi]
call fcn.1008ba7c
pop esi
leave
ret 8

Function at 0x100aabf9
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100aaa6f

Function at 0x100add99
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.100ada16

Function at 0x100b5130
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100b515d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100b515d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x402540
Capabilities:
Access peb ldr_data
Get process heap flags

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x413a7b
mov eax, dword fs:[0]
push eax
push ecx
push ebx
push esi
push edi
mov eax, dword [0x41b1f0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea ecx, [esi + 4]
mov dword [esi], vtable.std::basic_streambuf_char__struct_std::char_traits_char__.0
call fcn.00403284
push 4
mov dword [ebp - 4], 0
call fcn.00403d20
mov edi, eax
add esp, 4
test edi, edi
je 0x4025bc
call fcn.00403038
mov dword [edi], eax
call fcn.00402df7
push 0
lea ecx, [ebp - 0x10]
mov ebx, eax
call fcn.00403245
mov eax, dword [ebx + 4]
cmp eax, 0xffffffff
jae 0x4025b2
inc eax
mov dword [ebx + 4], eax
lea ecx, [ebp - 0x10]
call fcn.0040326d
jmp 0x4025be
xor edi, edi
lea eax, [esi + 8]
mov dword [esi + 0x10], eax
lea ecx, [esi + 0x18]
mov dword [esi + 0x20], ecx
lea edx, [esi + 0x1c]
mov dword [esi + 0x24], edx
mov dword [esi + 0x38], edi
lea eax, [esi + 0xc]
mov dword [esi + 0x14], eax
lea ecx, [esi + 0x28]
mov dword [esi + 0x30], ecx
lea edx, [esi + 0x2c]
mov dword [esi + 0x34], edx
mov dword [eax], 0
mov eax, dword [esi + 0x24]
mov dword [eax], 0
mov ecx, dword [esi + 0x34]
mov dword [ecx], 0
mov edx, dword [esi + 0x10]
mov dword [edx], 0
mov eax, dword [esi + 0x20]
mov dword [eax], 0
mov ecx, dword [esi + 0x30]
mov dword [ecx], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x4035e3
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41b1f0]
jne 0x4035ed
repz ret
jmp fcn.00406060
Function at 0x40de4c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41b1f0]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.00406781
and dword [ebp - 0x14], 0
cmp dword [0x41d330], 0
mov dword [ebp - 0x18], eax
jne 0x40deff
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x40dfa7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x40dfa7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x41d330], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x41d334], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x41d338], eax
call edi
push eax
call esi
mov dword [0x41d340], eax
test eax, eax
je 0x40deff
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x41d33c], eax
mov eax, dword [0x41d33c]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x40df58
cmp dword [0x41d340], ecx
je 0x40df58
push eax
call esi
push dword [0x41d340]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x40df58
test ebx, ebx
je 0x40df58
call edi
test eax, eax
je 0x40df4f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x40df4f
test byte [ebp - 8], 1
jne 0x40df58
or dword [ebp + 0x10], 0x200000
jmp 0x40df8b
mov eax, dword [0x41d334]
cmp eax, dword [ebp - 0x18]
je 0x40df8b
push eax
call esi
test eax, eax
je 0x40df8b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x40df8b
mov eax, dword [0x41d338]
cmp eax, dword [ebp - 0x18]
je 0x40df8b
push eax
call esi
test eax, eax
je 0x40df8b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x41d330]
call esi
test eax, eax
je 0x40dfa7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x40dfa9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.004035e3
leave
ret

Function at 0x411ed0
Capabilities:
Create process on windows

Disassembly:
push esi
push 0
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellAboutW]
mov esi, dword [sym.imp.USER32.dll_LoadIconW]
push 0
push 0
call esi
push 0
push 0
call esi
push 0
push 0
push 0
push 0
call dword [sym.imp.WINHTTP.dll_WinHttpConnect]
mov esi, dword [sym.imp.USER32.dll_GetNextDlgGroupItem]
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_ShellExecuteA]
push 0
push 0
push 0
call esi
push 0
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_DragQueryFileA]
push 0
call dword [sym.imp.SHELL32.dll_DragFinish]
push 0
push 0
call dword [sym.imp.SHELL32.dll_DragAcceptFiles]
pop esi
jmp dword [sym.imp.USER32.dll_GetDialogBaseUnits]
Function at 0x411fa0
Capabilities:
Encode data using xor
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x804
mov eax, dword [0x41b1f0]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
xor esi, esi
push edi
mov edi, ecx
test ebx, ebx
jle 0x411ff4
lea ecx, [ecx]
call dword [sym.imp.KERNEL32.dll_GetLastError]
call dword [sym.imp.KERNEL32.dll_GetTickCount]
call fcn.00411f60
xor byte [edi + esi - 0x200], al
push 0
call dword [sym.imp.KERNEL32.dll_FindAtomA]
lea eax, [ebp - 0x804]
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
inc esi
cmp esi, ebx
jl 0x411fc0
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.004035e3
mov esp, ebp
pop ebp
ret
Function at 0x405cbf
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422ec4], 0
push esi
jne 0x405cf6
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405cd0
mov dword [ecx*4 + 0x422ec0], eax
inc ecx
cmp ecx, 0x100
jl 0x405ccb
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405d27
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422ec0]
xor eax, esi
inc ecx
dec edx
jne 0x405d09
pop edi
not eax
pop esi
ret 0xc

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
mov ebx, 0x407ef8
nop
mov ecx, 0x6fb57a37
nop
nop
nop
test eax, eax
nop
nop
je 0x42e04e
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x42e024
nop
nop
mov eax, section..tls
nop
mov ebx, 0x42cd70
nop
mov ecx, 0x1b53753b
nop
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x42e084
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
add eax, 4
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
jne 0x42e06c
nop
nop
nop
nop
nop
nop
popal
nop
nop
jmp 0x401219
Function at 0x1000450d
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov byte [ebp - 8], dl
test dl, dl
je 0x10004525
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x10004537
sub esp, 0x10
mov byte [ebp - 1], 0
lea ecx, [ebp - 1]
call fcn.100049ce
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10005b73
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x1005dbc1
call fcn.1005d550
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x24], edi
test dl, dl
je 0x10005d54
cmp byte [ebp + 0x28], 0
je 0x10005c8e
mov dword [ebp - 0x14], 0x63f8
cmp dword [ebp - 0x14], 0x6789
jle 0x10005bd6
xor esi, esi
xor edi, edi
mov ecx, edi
mov eax, esi
shl eax, cl
mov ecx, 0x10078ef8
cdq
push edx
push eax
call fcn.10001c59
inc edi
cmp edi, 0x566f
jl 0x10005bb1
inc esi
cmp esi, 0x37c6
jl 0x10005baf
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x14]
push dword [eax]
call fcn.10006b8e
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x613c
jge 0x10005bff
mov edx, str.epoveod_crxymdlre_aizbwpl_udq_yyj_smbu_hjujrkyjx_ubicgh_ran_abdkchy_fadjvfa_vyajtl_emnproqcz
mov ecx, 0x10078ef8
call fcn.10003ae1
jmp 0x10005d92
mov dword [ebp - 0x20], 0x2ee8
cmp dword [ebp - 0x20], 0x2fa1
jle 0x10005cf0
xor esi, esi
mov dword [ebp - 0x1c], esi
xor ebx, ebx
mov dword [ebp - 0x18], 0x528
mov edi, ebx
mov dword [ebp - 0x14], 0x3cf7
xor esi, esi
mov eax, edi
mov ecx, 0x10078ef8
and eax, esi
cdq
push edx
push eax
call fcn.10001c59
inc esi
cmp esi, 0x4761
jl 0x10005cb7
dec edi
dec dword [ebp - 0x14]
jne 0x10005cb5
mov esi, dword [ebp - 0x1c]
add ebx, esi
dec dword [ebp - 0x18]
jne 0x10005cac
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x6d55
jl 0x10005ca3
mov edi, dword [ebp - 0x24]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x2e38
jge 0x10005d2e
mov edx, str.xdblu_jrzhcm_euoulhgt_fefohsdb_cveezyie_rrmgxpsk_bwk_kdqfcpfha_uxzl
mov ecx, 0x10078ef8
call fcn.10003ae1
jmp 0x10005d2e
mov eax, dword [ebp + 0x24]
xor ecx, ecx
mov eax, dword [eax]
mov edx, dword [eax + 4]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov esi, dword [eax]
mov eax, esi
imul eax, edx
cmp edx, eax
setge cl
xor eax, eax
cmp esi, ecx
setne al
mov dword [edi], eax
jmp 0x10005d92
cmp byte [ebp + 0x10], 0
je 0x10005d7f
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10005d92
mov esi, dword [ebp + 0x20]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 1
inc dword [edx]
cmp dword [edx], 2
jl 0x10005d6b
jmp 0x10005d92
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0x10005d92
push 0x8f3
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10006ec9
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov dword [0x1007a0d4], ecx
inc edx
mov esi, 0x270
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
mov dword [edx*4 + 0x1007a0d4], ecx
inc edx
cmp edx, esi
jl 0x10006ede
mov dword [0x1007a0d0], esi
pop esi
pop ebp
ret 8
Function at 0x10006f04
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x1007a0d4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x1007a460
jl 0x10006f12
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x1007a704
jl 0x10006f52
mov ecx, dword [0x1007b450]
xor ecx, dword [0x1007a0d4]
and ecx, edi
xor ecx, dword [0x1007b450]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x1007a0d0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x1007a704]
mov dword [0x1007aa90], eax
pop esi
ret
Function at 0x1000a2c6
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005de87
call fcn.1005d550
sub esp, 0x18
push ebx
push esi
mov byte [ebp - 0x14], dl
mov dword [ebp - 0x20], 0x7b3
cmp dword [ebp - 0x20], 0x7e6
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], ecx
jle 0x1000a33a
xor esi, esi
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x1c], 0x6df
mov dword [ebp - 0x18], eax
xor eax, edi
mov ecx, 0x10078ef8
or eax, esi
cdq
push edx
push eax
call fcn.10001c59
mov eax, dword [ebp - 0x18]
add eax, ebx
dec dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
jne 0x1000a301
inc ebx
cmp ebx, 0x5c69
jl 0x1000a2f5
inc edi
cmp edi, 0x23e7
jl 0x1000a2f3
inc esi
cmp esi, 0x467f
jl 0x1000a2f1
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x7a2
jge 0x1000a356
mov edx, str.mkeotvb_vbiurup_lhquf_yjv_eodgpscd_liemlpgrf_wtn_ylezgszcs
mov ecx, 0x10078ef8
call fcn.10003ae1
cmp byte [ebp - 0x14], 0
je 0x1000a37e
mov eax, dword [ebp + 8]
and dword [eax], 0
jmp 0x1000a3a1
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x1000a3a1
mov esi, dword [ebp - 0x24]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 1
inc dword [edx]
cmp dword [edx], 3
jl 0x1000a38f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000ce31
Capabilities:
Encode data using xor
Log keystrokes via polling

Disassembly:
mov eax, 0x1005e084
call fcn.1005d550
sub esp, 0xc
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], dl
mov dword [ebp - 0x18], ebx
je 0x1000cf28
mov dword [ebp + 0x18], 0x5e73
cmp dword [ebp + 0x18], 0x60ea
jle 0x1000ce9c
xor esi, esi
xor edi, edi
xor ebx, ebx
lea eax, [edi + esi]
mov ecx, 0x10078ef8
xor eax, ebx
cdq
push edx
push eax
call fcn.10001c59
inc ebx
cmp ebx, 0x179e
jl 0x1000ce6c
inc edi
cmp edi, 0x5bd0
jl 0x1000ce6a
inc esi
cmp esi, 0x5e08
jl 0x1000ce68
mov ebx, dword [ebp - 0x18]
and dword [ebp - 4], 0
cmp dword [ebp + 0x18], 0x5b8f
jge 0x1000ced7
mov edx, str.mhd_zoteaai_etb_aanxo_ynsw
mov ecx, 0x10078ef8
call fcn.10003ae1
jmp 0x1000ced7
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x14], 0
je 0x1000cf21
mov edi, dword [ebp + 0x14]
mov ecx, dword [edi + 4]
cmp dword [edi], ecx
je 0x1000cf52
mov edx, dword [ebp + 0x10]
push 0x18
pop esi
sub ecx, dword [edi]
mov eax, dword [edx + 4]
sub eax, dword [edx]
cdq
idiv esi
push 0x18
mov esi, eax
mov eax, ecx
cdq
pop ecx
idiv ecx
cmp eax, esi
jne 0x1000cf52
push ebx
push ecx
push 0x3f8b
push ecx
mov ecx, dword [ebp + 0x10]
mov dl, 1
push edi
call fcn.1000ccc8
add esp, 0x14
jmp 0x1000cf52
mov eax, dword [ebp + 8]
dec dword [eax]
jmp 0x1000cf52
cmp byte [ebp + 0xc], 0
je 0x1000cf45
mov byte [ebp + 0x1b], 0
cmp byte [ebp + 0x1b], 0
je 0x1000cf52
push 0x8f3
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x1000cf52
push 0x1aa7
push 0
call dword [sym.imp.KERNEL32.dll_WaitNamedPipeA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000e47c
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
test cl, cl
je 0x1000e4d6
cmp byte [ebp + 0x14], 0
je 0x1000e4ad
mov eax, dword [ebp + 0x1c]
cmp byte [eax], 0
je 0x1000e5be
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x1000e5be
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1000e5be
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 1
inc dword [edx]
cmp dword [edx], 2
jl 0x1000e4bf
jmp 0x1000e5be
mov dword [esp + 0x10], 0x75dc
cmp dword [esp + 0x10], 0x76db
jle 0x1000e555
xor esi, esi
mov dword [esp + 0xc], esi
xor edi, edi
mov ecx, edi
mov dword [esp + 0x14], esi
xor ebx, ebx
shl esi, cl
mov ecx, ebx
mov eax, esi
shl eax, cl
lea ecx, [esp + 0x18]
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000e516
mov eax, dword [eax]
push eax
call fcn.10046d34
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.10002133
inc ebx
cmp ebx, 0x4440
jl 0x1000e4fa
mov esi, dword [esp + 0xc]
inc edi
cmp edi, 0x7781
jl 0x1000e4f0
inc esi
mov dword [esp + 0xc], esi
cmp esi, 0x58a4
jl 0x1000e4ee
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
cmp dword [esp + 0x10], 0x7315
jge 0x1000e56a
push str.ruplqevu_sxlvtqb_qus
call fcn.10046d34
pop ecx
cmp byte [ebp + 0x24], 0
je 0x1000e577
mov eax, dword [ebp + 0x10]
dec dword [eax]
jmp 0x1000e5be
mov ecx, dword [ebp + 0x20]
mov edi, dword [ebp + 0x18]
mov esi, dword [ebp + 8]
mov eax, dword [ecx]
mov eax, dword [ecx]
mov eax, dword [ecx]
mov eax, dword [ecx]
mov eax, dword [ecx]
xor ecx, ecx
mov eax, dword [esi]
mov edx, dword [edi]
cmp dword [edx + 0xc], eax
mov eax, dword [edi]
setle cl
xor edx, edx
cmp ecx, dword [eax]
mov eax, dword [esi]
mov ecx, dword [esi]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [edi]
setge bl
xor edx, edx
imul ecx, dword [eax]
mov eax, dword [ebp + 0x28]
imul ecx, ebx
test ecx, ecx
setle dl
mov dword [eax], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000e8e3
Capabilities:
Encode data using xor
Log keystrokes via polling

Disassembly:
mov eax, 0x1005e126
call fcn.1005d550
push ecx
push ecx
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
je 0x1000e99c
mov eax, dword [ebp + 0x1c]
cmp byte [eax], 0
je 0x1000e914
push 0x8f3
call dword [sym.imp.USER32.dll_GetKeyState]
mov dword [ebp - 0x14], 0xc6e
cmp dword [ebp - 0x14], 0xdb1
jle 0x1000e955
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
xor esi, esi
mov edi, esi
mov ebx, 0x2ca9
mov eax, edi
mov ecx, 0x10078ef8
cdq
push edx
push eax
call fcn.10001c59
dec edi
dec ebx
jne 0x1000e939
inc esi
cmp esi, 0x4ed4
jl 0x1000e932
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x904
jge 0x1000e971
mov edx, str.gdkis_ipjdeos_zromiatn_mfsdkowzo
mov ecx, 0x10078ef8
call fcn.10003ae1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x14], 0x1146
cmp dword [ebp - 0x14], 0x12ec
jle 0x1000e9d3
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x10078ef8
xor eax, edi
cdq
push edx
push eax
call fcn.10001c59
inc ebx
cmp ebx, 0x560c
jl 0x1000e9b0
inc edi
cmp edi, 0x517b
jl 0x1000e9ae
push 2
pop edi
mov dword [esi], 0
cmp dword [esi], edi
jge 0x1000e9f4
mov edx, dword [ebp + 0x14]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0x2a4f402e
inc dword [esi]
cmp dword [esi], edi
jl 0x1000e9e3
mov dword [ebp - 4], edi
cmp dword [ebp - 0x14], 0xec4
jge 0x1000e971
mov edx, str.nvukx_ecu_ctato_mpdqebelv_bcmoi_gwacfygm_tvldlv_tfhinycso_taf_cineousz
mov ecx, 0x10078ef8
call fcn.10003ae1
jmp 0x1000e971
Function at 0x10011e8b
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005e2d7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10011fb8
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x10011fae
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x10011ee8
push 0
push 0
push 0xae5
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov dword [ebp - 0x20], 0x665e
mov dword [ebp - 0x28], str.ytgsbwfey_hvz_gpfti_usfzrr_oyxrw_ikfknohnr_sautiau_ffbroeb_aqgkht_goo
cmp dword [ebp - 0x20], 0x672c
jle 0x10011f6c
push 0
push 0x11fa
push 0x23c9
push 0
push 0x16d7
push 0x1cb6
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
and dword [ebp - 0x18], 0
jmp 0x10011f2c
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x3041
jge 0x10011f6c
and dword [ebp - 0x1c], 0
jmp 0x10011f42
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x403e
jge 0x10011f6a
mov eax, dword [ebp - 0x18]
or eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
mov ecx, 0x10078ef8
call fcn.10001c59
jmp 0x10011f3b
jmp 0x10011f25
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x63e8
jge 0x10011f86
mov edx, dword [ebp - 0x28]
mov ecx, 0x10078ef8
call fcn.10003ae1
jmp 0x10011fa2
or dword [ebp - 4], 0xffffffff
jmp 0x10011fac
jmp 0x10011fb6
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
jmp 0x10011fbf
xor cl, cl
call fcn.10011cc6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret