joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000e091
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1000e132
lea eax, [ebp + 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1000e112
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1000e0f3
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1000e110
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.10002106
mov dword [eax], 0x5b97
jmp 0x1000e0e8
jmp 0x1000e130
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1000e130
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
jmp 0x1000e1a5
lea eax, [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1000e180
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x1000e17e
push 0
push 0x2ec4
push 0x6a87
call fcn.1000ccf7
add esp, 0xc
jmp 0x1000e1a5
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
push dword [eax]
mov ecx, dword [ebp - 0x50]
call fcn.10016043
mov esp, ebp
pop ebp
ret

Function at 0x1000e949
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1000e9a3
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1000e983
mov byte [ebp - 1], 0
push 0
lea eax, [ebp - 1]
push eax
push 1
call fcn.100116ef
add esp, 0xc
jmp 0x1000e9a1
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1000e9a1
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
jmp 0x1000e9ab
push 0
call fcn.1000f39c
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1001112b
Capabilities:
Delete registry key
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005b7fb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100112d1
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x100112a7
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x24], 0x3f28
mov dword [ebp - 0x38], str.hgnboimj_qkpbyry_potwznh
cmp dword [ebp - 0x24], 0x40de
jle 0x10011229
push 0
push 0x1adb
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
and dword [ebp - 0x18], 0
jmp 0x100111c0
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2ab4
jge 0x1001121f
and dword [ebp - 0x1c], 0
jmp 0x100111d6
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x4208
jge 0x1001121d
and dword [ebp - 0x20], 0
jmp 0x100111ec
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x7574
jge 0x1001121b
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
shl eax, cl
mov ecx, dword [ebp - 0x20]
sar eax, cl
cdq
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
push dword [ebp - 0x54]
push dword [ebp - 0x58]
mov ecx, 0x10075eb8
call fcn.10001edd
jmp 0x100111e5
jmp 0x100111cf
jmp 0x100111b9
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x14], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x3dca
jge 0x10011249
mov edx, dword [ebp - 0x38]
mov ecx, 0x10075eb8
call fcn.10003d9f
jmp 0x10011265
or dword [ebp - 4], 0xffffffff
jmp 0x1001126f
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x1001128b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 3
jge 0x100112a5
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x40]
call fcn.10002106
and dword [eax], 0
jmp 0x10011280
jmp 0x100112cf
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
movzx eax, byte [eax]
test eax, eax
je 0x100112cf
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x100112ee
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x50], eax
push 0x2636
push dword [ebp - 0x50]
push 0x280e
push 0
call fcn.1000e065
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10011aba
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10011b3b
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10011aee
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x10011b39
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10011b1c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10011b39
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.10002106
mov dword [eax], 5
jmp 0x10011b11
jmp 0x10011b54
push 0
push 0x4f77
push 0x6cd9
push 0x79d
call fcn.1001286f
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1001bebf
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1001bf09
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001bef3
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001bef1
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x1001bf07
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x1001bf07
push 0
call dword [sym.imp.KERNEL32.dll_LocalFree]
jmp 0x1001bf2a
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
push 0xf42
push 0
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.1001cde9
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x1001d07d
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001d0d5
lea eax, [ebp + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1001d0b1
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
jmp 0x1001d0d3
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x1001d0fb
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 0x5202
push 0x2abf
push 0
call fcn.1001dbd0
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x1001d840
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x1001d8eb
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001d8c1
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001d8a2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1001d8bf
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.10002106
mov dword [eax], 0xfffffffd
jmp 0x1001d897
jmp 0x1001d8e9
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1001d8e9
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x1001d939
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
push dword [ebp - 0x2c]
push 0x5130
push dword [ebp - 0x30]
push 0
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
push dword [ebp - 0x44]
call fcn.1001d7d3
add esp, 0x24
mov esp, ebp
pop ebp
ret
Function at 0x1002b88a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005c0ab
call fcn.1005ab18
sub esp, 0x14
push ebx
push esi
mov byte [ebp - 0x14], 1
mov dword [ebp - 0x1c], 0x1fc8
cmp dword [ebp - 0x1c], 0x1ff0
push edi
mov dword [ebp - 0x10], esp
jle 0x1002b8ed
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov ebx, 0x2e96
xor esi, esi
mov eax, edi
mov ecx, 0x10075eb8
xor eax, esi
cdq
push edx
push eax
call fcn.10001edd
inc esi
cmp esi, 0xf20
jl 0x1002b8bf
mov esi, dword [ebp - 0x18]
add edi, esi
dec ebx
jne 0x1002b8bd
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x1014
jl 0x1002b8b6
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x1ef7
jge 0x1002b909
mov edx, str.jkzs_bxvhzzqvd_lymti_aqmeztdt_axywfppdn
mov ecx, 0x10075eb8
call fcn.10003d9f
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
dec dword [eax]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x18]
neg ecx
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x1002bc7f
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005c107
call fcn.1005ab18
sub esp, 0x10
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x1002bcb7
mov eax, dword [ebp + 0x14]
dec dword [eax]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x10]
neg ecx
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1002bca6
mov dword [ebp - 0x18], 0x4d33
cmp dword [ebp - 0x18], 0x4d90
jle 0x1002bd05
mov esi, ebx
mov edi, ebx
mov eax, edi
mov ecx, 0x10075eb8
xor eax, esi
cdq
push edx
push eax
call fcn.10001edd
inc edi
cmp edi, 0x49ef
jl 0x1002bcd5
inc esi
cmp esi, 0x85b
jl 0x1002bcd3
push 0x557
push ebx
push ebx
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x4c75
jge 0x1002bca6
mov edx, str.rekqwio_emxt_gbp_mpw_rwfxyfd_fdll_ybt_utsfzoij_vbtkmd_ocuixyi_pliuyglzt_tfwrrbx_bjzkr
mov ecx, 0x10075eb8
call fcn.10003d9f
jmp 0x1002bca6
Function at 0x1002cf93
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x1005c155
call fcn.1005ab18
sub esp, 0x1c
mov byte [ebp - 0x14], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x1002d09f
mov dword [ebp - 0x20], 0x24ba
cmp dword [ebp - 0x20], 0x253c
jle 0x1002d033
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x18], edi
mov ecx, edi
mov dword [ebp - 0x24], esi
xor ebx, ebx
shl esi, cl
xor edi, edi
lea ecx, [edi + ebx]
mov eax, esi
sar eax, cl
mov ecx, 0x10075eb8
cdq
push edx
push eax
call fcn.10001edd
inc edi
cmp edi, 0x1fe6
jl 0x1002cfd6
inc ebx
cmp ebx, 0xacb
jl 0x1002cfd4
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x64b5
jl 0x1002cfcb
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x5e5
jl 0x1002cfc6
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp byte [ebp - 0x14], 0
je 0x1002d041
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x1002d064
mov edx, dword [ebp + 0x18]
mov dword [edx], 0
cmp dword [edx], 4
jge 0x1002d064
mov esi, dword [ebp + 0x20]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xf9af3922
inc dword [edx]
cmp dword [edx], 4
jl 0x1002d052
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x21af
jge 0x1002d080
mov edx, str.gjkmlx_viftuere_kfwzfuwpd_avfx_ixdm
mov ecx, 0x10075eb8
call fcn.10003d9f
jmp 0x1002d162
cmp byte [ebp + 0x14], 0
je 0x1002d140
mov dword [ebp - 0x20], 0x5d1e
cmp dword [ebp - 0x20], 0x5ea7
jle 0x1002d0e2
xor esi, esi
xor edi, edi
mov ecx, edi
mov eax, esi
shl eax, cl
mov ecx, 0x10075eb8
cdq
push edx
push eax
call fcn.10001edd
inc edi
cmp edi, 0x7c09
jl 0x1002d0bd
inc esi
cmp esi, 0x5796
jl 0x1002d0bb
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x5a93
jge 0x1002d101
mov edx, str.isys_mzbhgyn_xnea_asaajfck_lcrwzc_yoyhty_zexq_qxkhimy_vsuihjzxi
mov ecx, 0x10075eb8
call fcn.10003d9f
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1002d162
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xec0a
inc dword [edx]
cmp dword [edx], 2
jl 0x1002d112
jmp 0x1002d162
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
cmp dword [edx], 1
jg 0x1002d162
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
cmp dword [eax + ecx*4], 0
jne 0x1002d162
inc dword [edx]
cmp dword [edx], 1
jle 0x1002d151
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002d173
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005c15f
call fcn.1005ab18
sub esp, 0x10
push ebx
push esi
push edi
mov byte [ebp - 0x14], cl
mov edi, edx
mov dword [ebp - 0x18], 0x2a8c
cmp dword [ebp - 0x18], 0x2c03
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edi
jle 0x1002d1c8
xor ebx, ebx
xor edi, edi
mov eax, edi
mov ecx, 0x10075eb8
xor eax, ebx
cdq
push edx
push eax
call fcn.10001edd
inc edi
cmp edi, 0x14be
jl 0x1002d1a2
inc ebx
cmp ebx, 0x69cc
jl 0x1002d1a0
mov edi, dword [ebp - 0x1c]
cmp byte [ebp + 0xc], 0
je 0x1002d1f9
cmp byte [ebp + 0x18], 0
je 0x1002d1dc
mov eax, dword [ebp + 0x1c]
add dword [eax], 0xfffffffe
jmp 0x1002d244
push 0
push 0
push 0x1642
push 0x1870
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
jmp 0x1002d244
cmp byte [ebp - 0x14], 0
je 0x1002d224
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x1002d244
mov edi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [edi]
mov dword [eax + ecx*4], 0x84502e46
inc dword [edx]
cmp dword [edx], 3
jl 0x1002d210
jmp 0x1002d244
mov dword [edi], 0
cmp dword [edi], 3
jge 0x1002d244
mov edx, dword [ebp + 0x10]
mov ecx, dword [edi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0x7f825e7a
inc dword [edi]
cmp dword [edi], 3
jl 0x1002d232
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x2a65
jge 0x1002d260
mov edx, str.lga_brw_qhoumoui_tkf_mfdn
mov ecx, 0x10075eb8
call fcn.10003d9f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002d50f
Capabilities:
Log keystrokes via polling
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
push edi
test cl, cl
je 0x1002d55f
cmp byte [ebp + 8], 0
je 0x1002d549
xor ebx, ebx
mov byte [ebp - 5], bl
cmp byte [ebp - 5], bl
je 0x1002d601
push 0x1936
push 0x53c9
push ebx
push ecx
call fcn.1002bfb0
add esp, 0x10
jmp 0x1002d601
cmp byte [edx], 0
je 0x1002d601
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
jmp 0x1002d601
cmp byte [ebp + 0x10], 0
je 0x1002d5f8
mov dword [ebp - 0x14], 0x55d0
cmp dword [ebp - 0x14], 0x5925
push 0
pop ebx
jle 0x1002d5d6
mov esi, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0xc], 0x779a
mov edi, ebx
mov eax, esi
lea ecx, [ebp - 0x30]
or eax, edi
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002d5a6
mov eax, dword [eax]
push eax
call fcn.10042c54
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.100023f4
inc edi
cmp edi, 0x4aac
jl 0x1002d58d
dec esi
dec dword [ebp - 0xc]
jne 0x1002d58b
mov esi, dword [ebp - 0x10]
inc esi
mov dword [ebp - 0x10], esi
cmp esi, 0x789
jl 0x1002d581
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [ebp - 0x14], 0x534c
jge 0x1002d601
push str.axcvh_haz_hbnzsn_ejt
call fcn.10042c54
pop ecx
jmp 0x1002d601
mov eax, dword [ebp + 0xc]
mov dword [eax], 0xfffffff8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002e8e2
Capabilities:
Terminate process

Disassembly:
mov eax, 0x1005c209
call fcn.1005ab18
push ecx
push ecx
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x1002e918
push 0x13d5
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ecx], 0
je 0x1002e907
push ecx
push 0
push 0x761d
mov ecx, 0x6a7e
call fcn.1002d4c7
mov dword [ebp - 0x14], 0x781f
add esp, 0xc
cmp dword [ebp - 0x14], 0x7927
jle 0x1002e96c
xor esi, esi
xor edi, edi
mov eax, esi
mov ecx, 0x10075eb8
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001edd
inc edi
cmp edi, 0x17c8
jl 0x1002e946
inc esi
cmp esi, 0x4f0f
jl 0x1002e944
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x7719
jge 0x1002e907
mov edx, str.scisafut_hmn_oakncbs_irqb_bncisiuyo_kmoabkwv_lac_ftaohg_hnac
mov ecx, 0x10075eb8
call fcn.10003d9f
jmp 0x1002e907
Function at 0x10030698
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov edi, ecx
je 0x1003077e
cmp byte [ebp + 0x1c], 0
je 0x10030765
mov dword [ebp - 8], 0x5b83
cmp dword [ebp - 8], 0x5f35
push 0
pop esi
jle 0x10030730
push esi
push 0x1064
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ebx, esi
mov edi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0xc], edi
mov dword [ebp + 0x18], 0x2a98
mov eax, edi
lea ecx, [ebp - 0x24]
xor eax, ebx
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10030700
mov eax, dword [eax]
push eax
call fcn.10042c54
pop ecx
push esi
push 1
lea ecx, [ebp - 0x24]
call fcn.100023f4
dec edi
dec dword [ebp + 0x18]
jne 0x100306e7
mov edi, dword [ebp - 4]
inc edi
mov dword [ebp - 4], edi
cmp edi, 0x76bc
jl 0x100306dd
inc ebx
cmp ebx, 0x297a
jl 0x100306d8
cmp dword [ebp - 8], 0x5a0b
jge 0x10030744
push str.hchb_xjemtvemo_ieurigj_pjbx_rblgbdmgw_ohoa_gxlepwvfo_xtwouejl_puh_knih_ernsw_pmpqodw_bmi
call fcn.10042c54
pop ecx
mov edx, dword [ebp + 0x10]
mov dword [edx], esi
cmp dword [edx], 3
jge 0x1003079f
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x2e91a049
inc dword [edx]
cmp dword [edx], 3
jl 0x10030751
jmp 0x1003079f
mov edx, dword [ebp + 0x14]
xor esi, esi
mov dword [edx], esi
jmp 0x10030777
mov ecx, dword [edx]
mov eax, dword [edi]
mov dword [eax + ecx*4], esi
inc dword [edx]
cmp dword [edx], 2
jl 0x1003076e
jmp 0x1003079f
cmp byte [ebp + 8], 0
je 0x10030789
add dword [edx], 4
jmp 0x1003079f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10036520
Capabilities:
Delete file
Encode data using xor

Disassembly:
mov eax, 0x1005c60b
call fcn.1005ab18
sub esp, 0x10
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
je 0x10036610
cmp byte [ebp + 0x10], 0
je 0x100365ee
mov dword [ebp - 0x1c], 0x6500
cmp dword [ebp - 0x1c], 0x670e
jle 0x100365b0
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x14], 0x6b80
mov ebx, edi
mov dword [ebp + 0xc], 0x682d
xor esi, esi
mov eax, ebx
mov ecx, 0x10075eb8
xor eax, esi
cdq
push edx
push eax
call fcn.10001edd
inc esi
cmp esi, 0x5efc
jl 0x1003657a
inc ebx
dec dword [ebp + 0xc]
jne 0x10036578
mov esi, dword [ebp - 0x18]
add edi, esi
dec dword [ebp - 0x14]
jne 0x1003656f
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x37b7
jl 0x10036566
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x6155
jge 0x100365d2
mov edx, str.rquhgnmsa_xjvljnrz_cynobngud_zydtznvya_tep
mov ecx, 0x10075eb8
call fcn.10003d9f
jmp 0x10036653
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10036653
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 5
inc dword [edx]
cmp dword [edx], 2
jl 0x100365fc
jmp 0x10036653
cmp byte [ebp + 0x14], 0
je 0x10036636
mov eax, dword [ebp + 0x1c]
cmp byte [eax], 0
je 0x10036653
push 0x1b43
push ecx
push ecx
mov dl, 1
mov ecx, 0x36d3
call fcn.1003582a
add esp, 0xc
jmp 0x10036653
mov dword [esi], 0
cmp dword [esi], 4
jge 0x10036653
mov edx, dword [ebp + 0x18]
mov ecx, dword [esi]
mov eax, dword [edx]
and dword [eax + ecx*4], 0
inc dword [esi]
cmp dword [esi], 4
jl 0x10036644
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret