joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002d01d
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100656f9
call fcn.100641d4
sub esp, 0x2c
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], ecx
je 0x1002d12d
mov dword [ebp - 0x14], 0x365c
cmp dword [ebp - 0x14], 0x3693
jle 0x1002d088
xor esi, esi
xor edi, edi
xor ebx, ebx
mov ecx, ebx
mov eax, edi
shl eax, cl
mov ecx, 0x10080d38
xor eax, esi
cdq
push edx
push eax
call fcn.1000b7ed
inc ebx
cmp ebx, 0x194
jl 0x1002d058
inc edi
cmp edi, 0x54a9
jl 0x1002d056
inc esi
cmp esi, 0x64dc
jl 0x1002d054
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x3384
jge 0x1002d0a4
mov edx, str.pye_qtznbxjpt_icjd_kcyxsfpkp_qzcgttxs_jwdoe_bablqjlw_jtwbdhfl_dqxbjujpl_uuycakkoy_bteusrklr
mov ecx, 0x10080d38
call fcn.1000da64
mov edi, dword [ebp + 0xc]
or dword [ebp - 4], 0xffffffff
mov esi, dword [edi]
mov edi, dword [edi + 4]
cmp esi, edi
je 0x1002d1e6
mov ebx, dword [ebp - 0x20]
push esi
lea ecx, [ebp - 0x38]
call fcn.1000b902
push 0x21b8
push 1
push 0x4c09
push 1
push 1
push 0x68a3
lea eax, [ebp - 0x38]
mov dword [ebp - 4], 2
push eax
push ebx
mov edx, 0x1bdd
mov ecx, 0x182
call fcn.1002cdd8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
add esp, 0x20
push 0
push 1
call fcn.1000bfd2
add esi, 0x18
cmp esi, edi
jne 0x1002d0bb
jmp 0x1002d1e6
mov dword [ebp - 0x18], 0x6bc6
cmp dword [ebp - 0x18], 0x6eed
jle 0x1002d188
xor esi, esi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x14], 0x349b
mov ecx, ebx
mov eax, esi
sar eax, cl
mov ecx, 0x10080d38
cdq
push edx
push eax
call fcn.1000b7ed
add ebx, edi
dec dword [ebp - 0x14]
jne 0x1002d14a
inc edi
cmp edi, 0x44ea
jl 0x1002d141
inc esi
cmp esi, 0x48c2
jl 0x1002d13f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 4], 3
cmp dword [ebp - 0x18], 0x69d4
jge 0x1002d1c6
mov edx, str.bkcyw_qfijrsl_cgolpbm_yvbiqrq_awcesnpy_bbktvc_qbzi_qsywc_yivhdhbyd_mawylkj
mov ecx, 0x10080d38
call fcn.1000da64
jmp 0x1002d1c6
or dword [ebp - 4], 0xffffffff
cmp byte [ebx], 0
je 0x1002d1e6
push ecx
push 0
push 0x2e5c
push 0x5188
push ecx
push ecx
call fcn.1002bf49
add esp, 0x18
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002d721
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
je 0x1002d751
cmp byte [ebp + 0x10], 0
je 0x1002d73f
mov eax, dword [ebp + 0x14]
mov edx, dword [eax + 4]
sub edx, dword [eax]
sar edx, 2
mov dword [ecx], edx
pop ebp
ret
push 0x248a
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
pop ebp
ret
cmp byte [ebp + 0x18], 0
je 0x1002d769
mov eax, dword [ebp + 0x1c]
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
mov eax, dword [ebp + 0xc]
sar ecx, 2
mov dword [eax], ecx
pop ebp
ret
mov eax, dword [edx]
mov dword [eax], 0x462751c7
pop ebp
ret
Function at 0x1002dd36
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x100657f0
call fcn.100641d4
sub esp, 0x20
cmp byte [ebp + 0x1c], 0
push esi
push edi
mov edi, edx
mov esi, ecx
je 0x1002ded8
cmp byte [ebp + 0x24], 0
je 0x1002deb9
mov edx, dword [ebp + 0x10]
lea ecx, [ebp - 0x2c]
xor esi, esi
push ebx
mov dword [ebp - 0x14], esi
call fcn.1002d20f
mov edx, dword [ebp + 8]
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], esi
call fcn.1002d20f
xor ebx, ebx
inc ebx
mov byte [ebp - 4], bl
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x28]
sub ecx, dword [ebp - 0x20]
sub eax, dword [ebp - 0x2c]
sar ecx, 2
sar eax, 2
mov dword [ebp + 0x1c], esi
cmp eax, ecx
jbe 0x1002dddb
push 0x1f6f
push ebx
lea eax, [ebp - 0x2c]
mov edx, 0x5b46
push eax
push ebx
push 0x3232
push ebx
lea ecx, [ebp + 0x1c]
call fcn.1002d721
lea eax, [ebp - 0x10]
mov dl, bl
push eax
push ebx
lea eax, [ebp + 0x1c]
push eax
push 0x7096
push 0x2cad
lea ecx, [ebp - 0x20]
call fcn.1002d5da
add esp, 0x2c
jmp 0x1002de33
lea eax, [ebp - 0x20]
mov edx, 0xe19
push eax
push ebx
push 0x1fb2
push ebx
lea eax, [ebp + 0x1c]
mov ecx, 0x57e0
push eax
push esi
call fcn.1002d721
push 0x704e
push 0x466f
push ebx
push ebx
lea eax, [ebp + 0x1c]
mov edx, 0x7c31
push eax
push 0x67bb
push 0x42e7
push esi
push 0x154c
lea eax, [ebp - 0x2c]
push 0x5a17
push eax
lea ecx, [ebp - 0x10]
call fcn.1002f361
add esp, 0x44
cmp dword [ebp + 0x1c], 0
mov dword [ebp - 0x10], esi
jle 0x1002dea1
mov edx, dword [ebp - 0x14]
test edx, edx
jne 0x1002dea4
mov eax, dword [ebp - 0x2c]
push 0x1bab
push 0x3855
mov ecx, dword [eax + esi*4]
mov eax, dword [ebp - 0x20]
cmp ecx, dword [eax + esi*4]
lea eax, [ebp - 0x14]
push eax
push ebx
push 0x4894
push 0x5b06
push 0x35a7
push ebx
push 0x1976
cmovg edx, ebx
lea eax, [ebp - 0x20]
push 0x4eff
mov dword [ebp - 0x14], edx
lea ecx, [ebp - 0x2c]
push 0x5b62
push eax
lea edx, [ebp - 0x10]
call fcn.1002db6c
mov esi, dword [ebp - 0x10]
add esp, 0x30
inc esi
mov dword [ebp - 0x10], esi
cmp esi, dword [ebp + 0x1c]
jl 0x1002de3c
mov edx, dword [ebp - 0x14]
lea ecx, [ebp - 0x20]
mov dword [edi], edx
call fcn.1003066c
lea ecx, [ebp - 0x2c]
call fcn.1003066c
pop ebx
jmp 0x1002defd
mov edx, dword [ebp + 0x18]
mov dword [edx], 0
jmp 0x1002ded1
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xdd33a4a9
inc dword [edx]
cmp dword [edx], 2
jl 0x1002dec4
jmp 0x1002defd
cmp byte [ebp + 0x20], 0
je 0x1002def0
push 0x9f
xor esi, esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x1002defd
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10034de0
Capabilities:
Delete registry key
Get geographical location

Disassembly:
mov eax, 0x10065b1d
call fcn.100641d4
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x18], edx
mov edx, ecx
push edi
mov dword [ebp - 0x10], esp
cmp byte [ebp + 8], bl
je 0x10034ed3
cmp byte [ebp + 0x2c], bl
je 0x10034ec1
mov dword [ebp - 0x14], 0x3fae
cmp dword [ebp - 0x14], 0x40cc
jle 0x10034e5a
mov edi, ebx
mov esi, ebx
mov dword [ebp + 8], ebx
mov ebx, esi
mov esi, 0x6487
mov eax, ebx
mov ecx, 0x10080d38
and eax, edi
cdq
push edx
push eax
call fcn.1000b7ed
dec ebx
dec esi
jne 0x10034e2a
mov esi, dword [ebp + 8]
inc esi
mov dword [ebp + 8], esi
cmp esi, 0x515b
jl 0x10034e23
inc edi
push 0
pop ebx
cmp edi, 0x31e9
jl 0x10034e1e
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x14], 0x3f49
jge 0x10034e75
mov edx, str.qbcd_fyk_lgx_dnifge_dlhz_qjgdlum_mwdqrnn_ytebas_ukoopkqeq_htk_qxcjekjf
mov ecx, 0x10080d38
call fcn.1000da64
mov eax, dword [ebp + 0x14]
or dword [ebp - 4], 0xffffffff
push 0x1a
pop esi
mov ecx, dword [eax]
cmp ecx, esi
jge 0x10034ea9
mov eax, dword [ebp + 0x10]
movzx edx, word [eax]
add edx, ecx
jmp 0x10034eb6
mov eax, ecx
cdq
idiv esi
mov eax, dword [ebp + 0x1c]
movzx eax, word [eax]
add edx, eax
mov ecx, dword [ebp - 0x18]
push edx
call fcn.1000b98a
jmp 0x10034f2f
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], bl
je 0x10034f2f
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x10034f2f
cmp byte [ebp + 0x18], 0
je 0x10034ee9
push 0x248a
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x10034f2f
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov ecx, dword [eax]
xor eax, eax
inc eax
sub eax, ecx
imul eax, ecx
test eax, eax
je 0x10034f05
cmp dword [edx], ebx
je 0x10034f05
xor edx, edx
inc edx
jmp 0x10034f07
mov edx, ebx
mov eax, dword [ebp + 0x20]
xor ecx, ecx
mov eax, dword [eax]
cmp edx, eax
mov eax, dword [ebp + 0x24]
setge cl
cmp dword [eax], ecx
mov eax, dword [ebp + 0x28]
je 0x10034f21
cmp dword [eax], ebx
je 0x10034f24
xor ebx, ebx
inc ebx
mov ecx, dword [eax]
sub ecx, dword [eax]
mov eax, dword [esi]
imul ecx, ebx
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10036a54
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x10036a6b
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x10036a8d
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x10084124
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x100844b0
jl 0x10036a9b
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x10084754
jl 0x10036adb
mov ecx, dword [0x100854a0]
xor ecx, dword [0x10084124]
and ecx, edi
xor ecx, dword [0x100854a0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x10084120], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10084754]
mov dword [0x10084ae0], eax
pop esi
ret
Function at 0x1003ac9c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10065d5b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x5c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1003ae1d
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x20], 0x6b2e
mov dword [ebp - 0x44], str.iyomfg_lvvniyxe_ljrd_twkltgj_jyjwqcmbn_vfihdgdnj_itkq_ablabn_rosgcy_odoeohzn_swxfxubq_ydeavtl_hmo
cmp dword [ebp - 0x20], 0x6c89
jle 0x1003ad5a
and dword [ebp - 0x14], 0
jmp 0x1003ad00
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x6354
jge 0x1003ad5a
and dword [ebp - 0x18], 0
jmp 0x1003ad16
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x7a7d
jge 0x1003ad58
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], edx
push dword [ebp - 0x50]
push dword [ebp - 0x54]
lea ecx, [ebp - 0x6c]
call fcn.10001aa5
pop ecx
pop ecx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
call fcn.1000b7cd
push eax
call fcn.1004c12c
pop ecx
lea ecx, [ebp - 0x6c]
call fcn.1000b7c3
jmp 0x1003ad0f
jmp 0x1003acf9
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1003ad77
push 0x248a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x1003addf
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0xfffffffd
jmp 0x1003ada5
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov eax, dword [ebp - 0x1c]
cmp dword [eax], 0xc
jl 0x1003addf
mov dword [ebp - 0x40], 0
push 0x12a7
push dword [ebp - 0x3c]
push 1
lea eax, [ebp - 0x40]
push eax
push 0xb14
push 0x2487
push 0x1a64
push 0
push 1
call fcn.10039a55
add esp, 0x24
jmp 0x1003ad9a
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x682e
jge 0x1003adf5
push dword [ebp - 0x44]
call fcn.1004c12c
pop ecx
jmp 0x1003ae11
or dword [ebp - 4], 0xffffffff
jmp 0x1003ae1b
jmp 0x1003ae4d
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x48], eax
push dword [ebp - 0x48]
push 0x6851
push 0x382d
push 0x613
push 0
push 0x2aba
push dword [ebp - 0x4c]
call fcn.1003c1a8
add esp, 0x1c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003bc4d
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10065db9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1003bdd7
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1003bd9f
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [eax], 0xffffffe4
jmp 0x1003bcbd
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0xfffffff3
jne 0x1003bd9d
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x24], 0x198c
mov dword [ebp - 0x38], str.pzqmc_khmlllkjn_govylax
cmp dword [ebp - 0x24], 0x19a1
jle 0x1003bd4c
and dword [ebp - 0x1c], 0
jmp 0x1003bcf1
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x789a
jge 0x1003bd4c
and dword [ebp - 0x20], 0
jmp 0x1003bd07
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x684d
jge 0x1003bd4a
mov eax, dword [ebp - 0x1c]
imul eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
lea ecx, [ebp - 0x68]
call fcn.10001aa5
pop ecx
pop ecx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
call fcn.1000b7cd
push eax
call fcn.1004c12c
pop ecx
lea ecx, [ebp - 0x68]
call fcn.1000b7c3
jmp 0x1003bd00
jmp 0x1003bcea
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x1003bd5c
push 0
call fcn.100414c9
pop ecx
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x1836
jge 0x1003bd72
push dword [ebp - 0x38]
call fcn.1004c12c
pop ecx
jmp 0x1003bd8e
or dword [ebp - 4], 0xffffffff
jmp 0x1003bd98
jmp 0x1003bcb2
jmp 0x1003bdd5
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x1003bdd5
push 0x2529
push 1
push 0x2831
push 0x14a3
push 1
push 0x7a53
call fcn.1003ac9c
add esp, 0x18
jmp 0x1003be04
lea eax, [ebp + 0x14]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x1003bdf3
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x1003be04
mov byte [ebp - 0x12], 0
push 0
lea eax, [ebp - 0x12]
push eax
call fcn.1003b111
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003d444
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10065e38
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], 0x507c
mov dword [ebp - 0x2c], str.zjz_aqv_xfyxgju_tcsz_wpma_rqzfewbmp_bteb_zkpmvg_xpk_fyggjvv
cmp dword [ebp - 0x24], 0x5282
jle 0x1003d564
push 0x1e93
push 0x1fdb
push 0xe42
push 0x21ac
push 0x2173
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
and dword [ebp - 0x20], 0
jmp 0x1003d4bb
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x62e1
jge 0x1003d559
and dword [ebp - 0x14], 0
jmp 0x1003d4d5
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x2d30
jge 0x1003d554
and dword [ebp - 0x18], 0
jmp 0x1003d4eb
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1c2b
jge 0x1003d54f
and dword [ebp - 0x1c], 0
jmp 0x1003d501
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xff5
jge 0x1003d54d
mov eax, dword [ebp - 0x14]
cdq
idiv dword [ebp - 0x18]
imul edx, dword [ebp - 0x1c]
or edx, dword [ebp - 0x20]
mov eax, edx
cdq
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
push dword [ebp - 0x30]
push dword [ebp - 0x34]
lea ecx, [ebp - 0x4c]
call fcn.10001aa5
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
call fcn.1000b7cd
push eax
call fcn.1004c12c
pop ecx
lea ecx, [ebp - 0x4c]
call fcn.1000b7c3
jmp 0x1003d4fa
jmp 0x1003d4e4
jmp 0x1003d4ce
jmp 0x1003d4b4
push 0x1973
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
push 0x14b5
push dword [ebp + 0xc]
push 0x1104
push dword [ebp + 8]
push dword [ebp + 0x14]
push 1
push dword [ebp + 0x10]
push dword [ebp + 0x18]
call fcn.1003d5d4
add esp, 0x20
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x4eec
jge 0x1003d59d
push dword [ebp - 0x2c]
call fcn.1004c12c
pop ecx
jmp 0x1003d5b9
or dword [ebp - 4], 0xffffffff
jmp 0x1003d5c3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003f012
Capabilities:
Accept command line arguments
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1003f050
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.1003f092
add esp, 0x14
jmp 0x1003f08e
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1003f088
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1003f086
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x1003f08e
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esp, ebp
pop ebp
ret
Function at 0x10041735
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10065f43
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100418ae
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x10041897
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x100417b4
push 0
push 0x49a0
push 0xaa9
push 0x75f7
push 1
call fcn.10041662
add esp, 0x14
mov dword [ebp - 0x20], 0x278f
mov dword [ebp - 0x38], str.bnq_dixbfvuco_rhz_yeuk_bfiqiqh
cmp dword [ebp - 0x20], 0x2aca
jle 0x10041859
and dword [ebp - 0x1c], 0
jmp 0x100417dc
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x2951
jge 0x10041853
and dword [ebp - 0x14], 0
jmp 0x100417f2
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x5b54
jge 0x10041851
and dword [ebp - 0x18], 0
jmp 0x10041808
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x7ca6
jge 0x1004184f
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
shl eax, cl
or eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
lea ecx, [ebp - 0x68]
call fcn.10001aa5
pop ecx
pop ecx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
call fcn.1000b7cd
push eax
call fcn.1004c12c
pop ecx
lea ecx, [ebp - 0x68]
call fcn.1000b7c3
jmp 0x10041801
jmp 0x100417eb
jmp 0x100417d5
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x2541
jge 0x1004186f
push dword [ebp - 0x38]
call fcn.1004c12c
pop ecx
jmp 0x1004188b
or dword [ebp - 4], 0xffffffff
jmp 0x10041895
jmp 0x100418ac
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [eax], 0x39b642c
jmp 0x100418cb
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x48], eax
push 0x7c28
push 0x774f
push dword [ebp - 0x48]
push 1
call fcn.1003cf14
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x403018
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x468008], 0x8088405
inc edx
mov dword [ebx + 0x468008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x40874c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x4087dc
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x4087dc
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x40878f
test edx, 3
jne 0x40877e
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x408789
jmp 0x40878f
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x40878f
cmp dword [ecx - 8], 1
je 0x408799
mov edx, ebx
or edx, 3
call fcn.004053ec
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x7b7b7b7b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x4087ab
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.00404ca0

Function at 0x4087e8
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, eax
mov eax, edx
test esi, esi
je 0x408878
mov edx, dword [esi - 4]
mov edi, eax
test edx, edx
jle 0x408878
mov ecx, dword [eax]
mov ebx, edx
test ecx, ecx
je 0x40882b
test edx, 3
jne 0x40881a
xor edx, dword [ecx - 4]
cmp edx, 3
jbe 0x408825
jmp 0x40882b
or edx, 2
xor edx, dword [ecx - 4]
cmp edx, 1
ja 0x40882b
cmp dword [ecx - 8], 1
je 0x408835
mov edx, ebx
or edx, 3
call fcn.004053ec
mov edi, dword [edi]
mov dword [edi - 4], ebx
mov byte [edi + ebx], 0
add ebx, 0xffffffff
and ebx, 0xfffffffc
mov eax, dword [esi + ebx]
mov ecx, eax
or eax, 0x80808080
mov edx, eax
sub eax, 0x5b5b5b5b
xor edx, ecx
or eax, 0x80808080
sub eax, 0x66666666
and eax, edx
shr eax, 2
xor eax, ecx
mov dword [edi + ebx], eax
mov eax, dword [esi + ebx - 4]
sub ebx, 4
jge 0x408847
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
pop ebx
jmp fcn.00404ca0

Function at 0x41f658
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x41f65e
ret