joyce8/EMBER2024-capa huggingface dataset:
Function at 0x6c0590
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push 0xffffffffffffffff
push 0x6e1af0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov al, byte [esp + 0x3c]
push ebx
xor ebx, ebx
push esi
mov esi, ecx
mov byte [esp + 0x10], al
mov dword [esp + 0x14], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], ebx
mov ecx, dword [esp + 0x44]
push ebx
mov dword [esp + 0x40], ebx
mov byte [esp + 0x28], al
mov edx, dword [ecx]
lea ecx, [esp + 0x28]
mov dword [esp + 0x24], edx
call fcn.006b529b
mov eax, dword [0xbc3e88]
lea ecx, [esp + 0x10]
push eax
push ebx
push ecx
lea ecx, [esp + 0x30]
call fcn.006b51cd
lea edx, [esp + 0x20]
lea eax, [esp + 8]
push edx
push eax
mov ecx, esi
mov byte [esp + 0x44], 1
call fcn.006c1090
mov esi, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [esp + 0x28]
cmp eax, ebx
mov dword [esp + 0xc], ecx
je 0x6c0637
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x6c062e
cmp al, 0xff
je 0x6c062e
dec al
mov byte [ecx], al
jmp 0x6c0637
push ecx
call fcn.006cb05b
add esp, 4
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], ebx
cmp eax, ebx
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], ebx
je 0x6c0668
lea ecx, [eax - 1]
mov al, byte [eax - 1]
cmp al, bl
je 0x6c065f
cmp al, 0xff
je 0x6c065f
dec al
mov byte [ecx], al
jmp 0x6c0668
push ecx
call fcn.006cb05b
add esp, 4
mov ecx, dword [esp + 0x34]
lea eax, [esi + 0x10]
pop esi
pop ebx
mov dword fs:[0], ecx
add esp, 0x38
ret 4
Function at 0x6cd7bd
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x6cd7f5
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.006cb798
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.006cb770
jmp 0x6cd801
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x6cefb7
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x6ceff9
call fcn.006d57d6
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x6ceff9
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x6ceff0
xor eax, eax
jmp 0x6cf001
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.006cf007
pop edi
pop esi
pop ebx
ret 4

Function at 0x6d5d06
Capabilities:
Get thread local storage value

Disassembly:
push ebx
push esi
mov esi, ecx
lea ebx, [esi + 0x1c]
push ebx
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
cmp dword [esp + 0x10], 0
jne 0x6d5d34
push dword [esi]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
test eax, eax
je 0x6d5d52
push dword [esp + 0xc]
mov ecx, esi
push eax
call fcn.006d5c6c
jmp 0x6d5d52
mov eax, dword [esi + 0x14]
test eax, eax
je 0x6d5d52
push edi
push dword [esp + 0x10]
mov edi, dword [eax + 4]
mov ecx, esi
push eax
call fcn.006d5c6c
test edi, edi
mov eax, edi
jne 0x6d5d3c
pop edi
push ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
pop esi
pop ebx
ret 8

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x100012d5
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
je 0x100012f0
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x100012f8
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
pop ebp
ret
mov eax, dword [ebp + 0xc]
movzx ecx, byte [edx]
add dword [eax], ecx
pop ebp
ret
Function at 0x100066fd
Capabilities:
Delete registry key
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1000674b
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1000673f
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1000673d
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x10006749
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x10006763
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push 0
push 0x3b38
call fcn.10005d45
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10006e8a
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push esi
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10006fbc
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x10006ec9
push 0x2472
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x10006fba
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], eax
push 3
mov ecx, dword [ebp - 8]
call fcn.10001bf5
and dword [eax], 0
jmp 0x10006f08
push 3
mov ecx, dword [ebp - 8]
call fcn.10001bf5
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
push 3
mov ecx, dword [ebp - 8]
call fcn.10001bf5
cmp dword [eax], 3
jg 0x10006fba
mov dword [ebp - 0x34], 0x31d8b9db
mov dword [ebp - 0x38], 0x2bd42ca8
push 3
mov ecx, dword [ebp - 8]
call fcn.10001bf5
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10001bf5
mov esi, eax
push 3
mov ecx, dword [ebp - 8]
call fcn.10001bf5
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10001bf5
mov ecx, dword [esi]
sub ecx, dword [eax]
jne 0x10006f92
push 3
mov ecx, dword [ebp - 8]
call fcn.10001bf5
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.10001bf5
mov eax, dword [eax]
add eax, 0x74c7
cmp eax, dword [ebp - 0x34]
je 0x10006f82
mov dword [ebp - 0x18], 1
jmp 0x10006f86
and dword [ebp - 0x18], 0
cmp dword [ebp - 0x18], 9
jle 0x10006f92
and dword [ebp - 0x1c], 0
jmp 0x10006f99
mov dword [ebp - 0x1c], 1
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x38], eax
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10006fb5
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x10006ef0
jmp 0x10007039
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x10007025
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
jmp 0x10007006
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 4
jge 0x10007023
mov eax, dword [ebp - 0xc]
push dword [eax]
mov ecx, dword [ebp - 0x50]
call fcn.10001bf5
mov dword [eax], 4
jmp 0x10006ffb
jmp 0x10007039
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x10007039
push 0
call fcn.10004b41
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10008cc4
Capabilities:
Get memory capacity
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10053adf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10008d10
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
push 0x7002
push 1
push 0x7d8c
call fcn.10008e62
add esp, 0x10
jmp 0x10008e51
lea eax, [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10008e49
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x24], 0x64e2
mov dword [ebp - 0x40], str.vmo_ofcbc_bixk
cmp dword [ebp - 0x24], 0x6530
jle 0x10008df7
push 0
push 0x14c0
call dword [sym.imp.GDI32.dll_SelectObject]
and dword [ebp - 0x20], 0
jmp 0x10008d77
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x1d3e
jge 0x10008def
and dword [ebp - 0x14], 0
jmp 0x10008d8d
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x61c7
jge 0x10008ded
and dword [ebp - 0x18], 0
jmp 0x10008da3
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x8af
jge 0x10008deb
and dword [ebp - 0x1c], 0
jmp 0x10008db9
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x4b9d
jge 0x10008de9
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sar eax, cl
or eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
mov ecx, 0x1006de98
call fcn.1000bb28
jmp 0x10008db2
jmp 0x10008d9c
jmp 0x10008d86
jmp 0x10008d70
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x622b
jge 0x10008e17
mov edx, dword [ebp - 0x40]
mov ecx, 0x1006de98
call fcn.100102b0
jmp 0x10008e33
or dword [ebp - 4], 0xffffffff
jmp 0x10008e3d
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 0x48]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x10008e51
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100146d4
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001470d
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x100146fb
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
jmp 0x1001470b
push 0
push 0
push 0x3c
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
jmp 0x1001472a
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push 1
push 0x4dab
push 0x7d44
push dword [ebp - 8]
call fcn.1001375c
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1002140a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10054285
call fcn.10053340
sub esp, 0x24
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x30]
push ebx
push esi
push edi
push fcn.1000bc9d
push fcn.1000bc65
xor edi, edi
mov ebx, ecx
inc edi
mov dword [ebp - 0x14], ebx
push edi
push 0x18
push eax
mov esi, edx
call fcn.1003df90
push esi
push dword [ebp + 8]
lea eax, [ebp - 0x30]
mov dword [ebp - 4], edi
push eax
call fcn.10021781
mov dword [ebp - 0x10], 0x4b05
add esp, 0xc
cmp dword [ebp - 0x10], 0x4d3d
jle 0x100214a2
xor edi, edi
xor esi, esi
mov dword [ebp - 0x10], esi
mov ebx, esi
mov esi, 0x4586
mov eax, ebx
mov ecx, 0x1006de98
xor eax, edi
cdq
push edx
push eax
call fcn.1000bb28
dec ebx
dec esi
jne 0x1002146f
mov esi, dword [ebp - 0x10]
inc esi
mov dword [ebp - 0x10], esi
cmp esi, 0xa1d
jl 0x10021468
inc edi
cmp edi, 0x3c3f
jl 0x10021463
mov ebx, dword [ebp - 0x14]
xor edi, edi
inc edi
lea eax, [ebp - 0x30]
mov ecx, ebx
push eax
call fcn.1000bc3d
push fcn.1000bc9d
push edi
push 0x18
lea eax, [ebp - 0x30]
mov dword [ebp - 0x18], edi
push eax
mov byte [ebp - 4], 0
call fcn.1003da0d
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10021e01
Capabilities:
Delete registry key

Disassembly:
mov eax, 0x100542e9
call fcn.10053340
sub esp, 0x10
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x10021e2e
and dword [ecx], 0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [edx], 0
je 0x10021e1d
mov dword [ebp - 0x18], 0x636a
cmp dword [ebp - 0x18], 0x64c1
jle 0x10021e82
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
mov ebx, 0x47d2
xor esi, esi
mov eax, edi
mov ecx, 0x1006de98
cdq
idiv esi
mov eax, edx
cdq
push edx
push eax
call fcn.1000bb28
inc esi
cmp esi, 0x5fd2
jl 0x10021e51
mov esi, dword [ebp - 0x14]
add edi, esi
dec ebx
jne 0x10021e4f
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x141d
jl 0x10021e48
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x6123
jge 0x10021e1d
mov edx, str.vrxbeyrjx_llaherjz_mdwbs_gcvt_wwwgajg
mov ecx, 0x1006de98
call fcn.100102b0
jmp 0x10021e1d
Function at 0x100234d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005444b
call fcn.10053340
sub esp, 0x20
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
je 0x10023513
mov eax, dword [ebp + 0x14]
mov ecx, dword [edx]
mov esi, dword [eax]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov eax, dword [eax + esi*4]
cmp eax, dword [ecx + esi*4]
jge 0x10023502
or dword [edi], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
mov byte [ebp - 0x11], bl
mov dword [ebp - 0x20], 0x7133
cmp dword [ebp - 0x20], 0x7238
jle 0x10023596
push ebx
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
mov esi, ebx
mov dword [ebp - 0x1c], ebx
mov edi, ebx
mov eax, esi
mov ecx, ebx
cdq
idiv edi
mov dword [ebp - 0x18], ecx
mov esi, edx
mov dword [ebp - 0x28], esi
mov eax, esi
mov dword [ebp - 0x24], ebx
cdq
idiv ecx
mov esi, edx
mov eax, esi
mov ecx, 0x1006de98
xor eax, ebx
cdq
push edx
push eax
call fcn.1000bb28
inc ebx
cmp ebx, 0x3c28
jl 0x1002354f
mov ecx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x28]
inc ecx
mov dword [ebp - 0x18], ecx
push 0
pop ebx
cmp ecx, 0x724f
jl 0x10023545
mov esi, dword [ebp - 0x1c]
inc edi
cmp edi, 0x5488
jl 0x10023536
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x3e5f
jl 0x10023534
cmp byte [ebp - 0x11], 0
je 0x100235af
push ecx
push ebx
mov edx, 0x4821
mov ecx, 0x3386
call fcn.10021c11
pop ecx
pop ecx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x20], 0x7110
jge 0x10023502
mov edx, str.qkx_kjgrugw_oavepg_gsmmqg_engsaxae_yawm_pkbaah_jezksmon
mov ecx, 0x1006de98
call fcn.100102b0
jmp 0x10023502
Function at 0x10028329
Capabilities:
Start service

Disassembly:
mov eax, 0x100546aa
call fcn.10053340
sub esp, 0xc
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov byte [ebp - 0x14], dl
je 0x100283fa
test dl, dl
je 0x10028360
lea ecx, [ebp + 0x13]
mov byte [ebp + 0x13], 0
call fcn.100286fd
jmp 0x100284ba
mov dword [ebp - 0x18], 0x46e6
cmp dword [ebp - 0x18], 0x49c6
jle 0x10028397
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x1006de98
and eax, esi
cdq
push edx
push eax
call fcn.1000bb28
inc edi
cmp edi, 0x36d3
jl 0x10028374
inc esi
cmp esi, 0x1a2e
jl 0x10028372
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x43b8
jge 0x100283b3
mov edx, str.fha_ypqkfc_dhhd_xsoh_vvokl_yucdpfl_uorjcqob_erds_brkpfde_nrr_biyeatrp_khpukzjfr
mov ecx, 0x1006de98
call fcn.100102b0
mov eax, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
cmp byte [eax], 0
je 0x100284ba
push 0
push 0
push 0x3839
mov dl, 1
mov ecx, 0x32e0
call fcn.10028329
add esp, 0xc
jmp 0x100284ba
cmp byte [ebp + 0xc], 0
je 0x100284af
mov dword [ebp - 0x18], 0x2e5a
cmp dword [ebp - 0x18], 0x2f59
jle 0x10028467
push 0
push 0x1d1e
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
xor esi, esi
xor edi, edi
mov ecx, edi
mov eax, esi
sar eax, cl
mov ecx, 0x1006de98
cdq
push edx
push eax
call fcn.1000bb28
inc edi
cmp edi, 0x7378
jl 0x10028427
inc esi
cmp esi, 0x6ccd
jl 0x10028425
push 0x26a9
push 0
push 0
push 0x10de
push 0
push 0x24e7
call dword [sym.imp.GDI32.dll_CreateDIBitmap]
cmp byte [ebx], 0
je 0x10028474
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x18], 0x2b0b
jge 0x10028493
mov edx, str.icft_avx_pniusn_iwsnw_siamgmgmv_ntkzi_zpj_ovbpujxhu_nydoogri
mov ecx, 0x1006de98
call fcn.100102b0
jmp 0x100284ba
push 0x2570
call dword [sym.imp.USER32.dll_HideCaret]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002b2fe
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp byte [ebp + 8], 0
je 0x1002b319
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x1002b3a4
mov dword [ebp - 4], 0xd05
cmp dword [ebp - 4], 0x10e5
jle 0x1002b385
push ebx
push edi
push 0x4bf
push 0
push 0
push 0xa61
call dword [sym.imp.USER32.dll_MessageBoxW]
xor edi, edi
xor ebx, ebx
mov ecx, ebx
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0x1c]
cdq
push edx
push eax
call fcn.10002543
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002b35e
mov eax, dword [eax]
push eax
call fcn.1003de4c
pop ecx
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.1000c586
inc ebx
cmp ebx, 0x7df9
jl 0x1002b343
inc edi
cmp edi, 0x18b
jl 0x1002b341
pop edi
pop ebx
push 0x2504
call dword [sym.imp.KERNEL32.dll_SetLastError]
cmp dword [ebp - 4], 0x9f6
jge 0x1002b3a4
push str.avfgzgxet_edgqz_cyjq_pwc_tsxtjwu_gmflfk_uuvi_hrongsvg_muj_mbvpd_jkoru_slas_grcah
call fcn.1003de4c
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1002b49a
Capabilities:
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10054859
push eax
mov dword fs:[0], esp
sub esp, 0x3c
cmp byte [ebp + 8], 0
push ebx
push esi
mov esi, edx
je 0x1002b4eb
lea eax, [esp + 0xf]
mov byte [esp + 0xf], 0
push eax
push 1
push ecx
push 0x1e12
push 0x4554
mov edx, 0x2c13
call fcn.1002b262
add esp, 0x14
jmp 0x1002b71c
mov dword [esp + 0x10], 0xffffffff
xor ebx, ebx
mov dword [esp + 0x1c], 0xa421e0be
inc ebx
mov dword [esp + 0x14], 0xf4d39d98
mov dword [esp + 0x20], ebx
mov dword [esp + 0x24], 0xd52276c1
mov dword [esp + 0x10], 0
jmp 0x1002b61d
push 2
lea ecx, [esp + 0x38]
call fcn.10001b7c
and dword [esp + 0x4c], 0
lea eax, [esp + 0x30]
push 0x3a0b
push 0
push ecx
push eax
lea eax, [esp + 0x44]
mov dword [esp + 0x3c], 0xfffffffd
push eax
mov edx, 0x6fc3
call fcn.1002b262
mov edx, dword [esp + 0x48]
xor ecx, ecx
add esp, 0x14
mov eax, dword [edx + 4]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
cmp dword [edx + 4], eax
mov eax, dword [esp + 0x10]
setne cl
cmp ecx, 0x9b504dbf
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setl cl
cmp ecx, 0x11aa
jl 0x1002b599
push ecx
xor dl, dl
lea ecx, [esp + 0x20]
call fcn.1002b8ae
pop ecx
jmp 0x1002b60b
push 0x7150
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], 0xffffffff
push eax
push 0x46dd
push 0x1d25
push ebx
push 0x411
push 0
mov dl, bl
mov dword [esp + 0x44], 0
mov ecx, 0x3403
call fcn.1002cf94
add esp, 0x1c
lea eax, [esp + 0x20]
push 0x5c6c
push eax
push 0
lea eax, [esp + 0x24]
push eax
push ecx
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x40]
push eax
lea eax, [esp + 0x54]
push eax
lea eax, [esp + 0x4c]
push eax
lea ecx, [esp + 0x54]
call fcn.1002b113
add esp, 0x28
or dword [esp + 0x4c], 0xffffffff
lea ecx, [esp + 0x34]
call fcn.10001bd9
dec dword [esp + 0x10]
cmp dword [esp + 0x10], 0xffffffe3
jle 0x1002b51f
mov eax, dword [0x1006f978]
test al, 1
jne 0x1002b64a
or dword [0x10070d24], 0xffffffff
or eax, ebx
push ecx
push 0x1571
mov dword [0x1006f978], eax
call fcn.1002d252
push 0x1f80
mov edx, 0x79a6
mov dword [esp + 0x34], 6
xor cl, cl
call fcn.1002c8e6
mov dl, bl
mov ecx, 0x575a
call fcn.1002b8ae
cmp byte [0x1006eff5], 0
pop ecx
jne 0x1002b6bd
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
call fcn.1002d252
push 0x1006eff5
push 0x6a2a
push ebx
push 0x95f
push ecx
push 0x2e06
push 0x793b
push 0x3b33
push 0x83f
push 0xf33
mov ecx, 0x3dfc
call fcn.1002b113
add esp, 0x28
mov eax, dword [0x1006f9a0]
cmp eax, 0x270
jne 0x1002b6d0
call fcn.1002d34d
jmp 0x1002b6dc
cmp eax, 0x4e0
jb 0x1002b6e1
call fcn.1002d28d
mov eax, dword [0x1006f9a0]
mov ecx, dword [eax*4 + 0x1006f9a4]
inc eax
mov dword [0x1006f9a0], eax
mov eax, ecx
shr eax, 0xb
and eax, dword [0x10070d24]
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov dword [esi], eax
mov ecx, dword [esp + 0x44]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002d252
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov dword [0x1006f9a4], ecx
inc edx
mov esi, 0x270
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
mov dword [edx*4 + 0x1006f9a4], ecx
inc edx
cmp edx, esi
jl 0x1002d267
mov dword [0x1006f9a0], esi
pop esi
pop ebp
ret 8

Function at 0x1002d28d
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x1006f9a4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x1006fd30
jl 0x1002d29b
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x1006ffd4
jl 0x1002d2db
mov ecx, dword [0x10070d20]
xor ecx, dword [0x1006f9a4]
and ecx, edi
xor ecx, dword [0x10070d20]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x1006f9a0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x1006ffd4]
mov dword [0x10070360], eax
pop esi
ret

Function at 0x1002d34d
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, 0x1006f9a4
mov ecx, dword [esi + 4]
xor ecx, dword [esi]
and ecx, 0x7fffffff
xor ecx, dword [esi]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
add esi, 4
cmp esi, 0x10070364
jl 0x1002d353
pop esi
ret

Function at 0x1002e947
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100549e5
call fcn.10053340
sub esp, 0x10
mov byte [ebp - 0x14], cl
push ebx
push esi
mov esi, edx
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x1002e9f6
mov dword [ebp - 0x18], 0x64d1
cmp dword [ebp - 0x18], 0x67c4
jle 0x1002e99e
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x1006de98
xor eax, edi
cdq
push edx
push eax
call fcn.1000bb28
inc ebx
cmp ebx, 0x7bba
jl 0x1002e97b
inc edi
cmp edi, 0x5132
jl 0x1002e979
mov dword [esi], 0
cmp dword [esi], 2
jge 0x1002e9be
mov edx, dword [ebp + 8]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0xbc588e1b
inc dword [esi]
cmp dword [esi], 2
jl 0x1002e9ac
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x629b
jge 0x1002e9da
mov edx, str.piebul_mfcsaeawm_prtpqbzd_hxgzb_ydgrkppud_hmbgqpbs_fflv_lshiqt_iys_tudrvlko_doojjoi_our_duy_umrg
mov ecx, 0x1006de98
call fcn.100102b0
jmp 0x1002ea0b
push 0x21ab
push 0x1c87
push 0x10ea
call dword [sym.imp.USER32.dll_EnableScrollBar]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret