joyce8/EMBER2024-capa huggingface dataset:
Function at 0x404337
Capabilities:
Encode data using xor

Disassembly:
dec edx
cmp edx, 0x2b21
js 0x404348
mov ecx, ecx
lea ecx, [0x7c4e60de]
mov ebp, ebx
push 0xa922
pop eax
sub eax, 0x95d
xchg ebp, ecx
dec bl
test cl, 0x6b
dec dh
bswap eax
push 0x746
test dh, 0x89
pop ebp
mov edi, eax
xor ebp, 0xf5d
test ah, ch
xchg esi, esi
bswap esi
test esi, ebp
imul esi, ebp
sub edx, ecx
movzx edx, ch
mov edi, 0x993e8
je 0x40438a
mov edx, edx
sub edi, 0x99e5e
add edx, ecx
mov ecx, edi
add ecx, 0xa76
add ecx, ebp
imul esi, edx, 0x105e2af3
jbe 0x4043a7
imul esi, ebx
mov ebx, ecx
imul esi, edx, 0x3701e8f7
xor ebx, 0x81b
movzx edx, bp
neg ecx
mov ebp, 0x63
cmp ecx, 0xffda
jbe 0x4043c9
xchg ecx, edi
imul ebp, ebp, 3
mov ch, 0xdb
xadd ebx, ebp
test ecx, ecx
sub ebx, 0x128
inc ecx
cmp ebx, 0x188
jb 0x4043b5
cmp eax, 0xdf082739
imul esi, edx
call 0x4043f0
and al, 8
add esi, ecx
cmp ebp, 0x110b
js 0x4043ff
imul ecx, ecx
pop esi
movd mm1, esi
movd eax, mm1
sub edi, eax
bswap ebx
mov ebp, 0xdcfc791e
add eax, 0x88240
cmp edx, 0x4b3b
ja 0x404425
neg ch
mov ebp, 0x6ddd3bdb
neg ebp
sub eax, 0x82dd6
mov bl, ah
push 0x12ed63
mov bl, bh
push edi
push edx
dec edi
lea edi, [0xfcd72ae1]
movsx edi, si
push 0x1093
imul edx, edi
pop edx
cmp esi, 0xcfc1
je 0x404453
imul edi, edi
sub edx, 0xc9
mov ecx, 0xbb0658ba
imul edi, eax, 0x8a5a48dc
lea ebx, [0x5095d1d1]
sub edx, 0x235
xor ebp, edi
add edx, 0x234
movzx esi, bh
inc ebx
dec esi
cmp edx, 0x346
jae 0x404459
xchg edi, ecx
push edi
inc edi
push eax
adc ebp, edi
js 0x404498
lea ecx, [0x5f5c9572]
mov ch, al
cmp ebx, edx
or ecx, 0x1216e698
or dh, dh
xor bh, al
lea ebp, [0x285]
movsx edx, dx
imul ebp, ebp, 4
mov dh, 0x12
jmp 0x4044c1
cmp eax, 0x188a
ja 0x4044ca
sbb esi, edi
sub ebp, 0xec3
cmp esi, 0x628c
jae 0x4044e4
lea edx, [0x760a4a9d]
mov ecx, ecx
test ebp, ecx
mov dl, 0xd3
add ebp, 0xec2
mov edi, 0x79b3d2d0
mov dh, al
cmp ebp, 0x263
jae 0x4044b0
movzx ebx, ah
ret
Function at 0x10008000
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x1005a004
call fcn.10059860
sub esp, 0x10
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, edx
je 0x1000803d
push 0x2629
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edi], 0xffffffee
cmp dword [edi], 0xfffffff2
je 0x100080da
push 0xfffffffffffffff6
pop ebx
mov dword [ebp - 0x14], 0xaa9ac70c
mov dword [ebp - 0x1c], 0xb6084edc
mov dword [ebp - 0x14], 0
jmp 0x100080ca
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], 0xdad816f9
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
neg esi
mov eax, dword [edi]
sbb esi, esi
imul ecx, eax, 0x7863
mov eax, dword [ebp - 0x18]
xor edx, edx
neg esi
cmp ecx, eax
setg dl
imul eax, edx, 0xd3b0
inc eax
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xa05d
setne cl
xor eax, eax
cmp esi, ecx
sete al
cmp eax, 0x270e7ad5
je 0x100080bc
cmp dword [ebp - 0x14], 0
jne 0x100080bc
xor ecx, ecx
jmp 0x100080bf
xor ecx, ecx
inc ecx
mov eax, dword [ebp - 0x18]
add eax, ecx
mov dword [ebp - 0x1c], eax
dec dword [ebp - 0x14]
cmp dword [ebp - 0x14], ebx
jle 0x10008066
inc dword [edi]
cmp dword [edi], 0xfffffff2
jne 0x1000804f
mov dword [ebp - 0x18], 0x35fc
cmp dword [ebp - 0x18], 0x368f
jle 0x10008110
xor esi, esi
xor edi, edi
lea eax, [edi + esi]
mov ecx, 0x10075ef8
cdq
push edx
push eax
call fcn.10001a90
inc edi
cmp edi, 0x3b53
jl 0x100080ee
inc esi
cmp esi, 0x5a41
jl 0x100080ec
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x3429
jge 0x1000802c
mov edx, str.gzw_ybfn_oiry_cxch
mov ecx, 0x10075ef8
call fcn.1000350c
jmp 0x1000802c

Function at 0x10008514
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 8], cl
test cl, cl
je 0x10008537
lea eax, [ebp - 1]
mov byte [ebp - 1], 0
push eax
push ecx
push ecx
xor dl, dl
call fcn.1000814f
add esp, 0xc
jmp 0x10008544
cmp byte [edx], 0
je 0x10008544
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov esp, ebp
pop ebp
ret
Function at 0x1000856f
Capabilities:
Query environment variable
Terminate process

Disassembly:
mov eax, 0x1005a022
call fcn.10059860
sub esp, 0x14
push ebx
push esi
mov dword [ebp - 0x1c], 0x41cc
mov eax, ecx
cmp dword [ebp - 0x1c], 0x4597
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], eax
jle 0x100085eb
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov eax, ebx
sar eax, cl
lea ecx, [edi + esi]
or eax, ecx
mov ecx, 0x10075ef8
cdq
push edx
push eax
call fcn.10001a90
mov ecx, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x3246
jl 0x100085a2
inc ebx
cmp ebx, 0x4b16
jl 0x1000859d
inc edi
cmp edi, 0x44e9
jl 0x1000859b
inc esi
cmp esi, 0x3323
jl 0x10008599
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov eax, dword [ebp - 0x20]
cmp byte [ebp + 8], 0
je 0x10008609
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x1000861b
xor dl, dl
mov ecx, 0x2e34
call fcn.10008f24
jmp 0x1000861b
cmp byte [eax], 0
je 0x1000861b
push 0xcba
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x3dea
jge 0x10008637
mov edx, str.jdgusl_ibldl_ygfashfy_qsn
mov ecx, 0x10075ef8
call fcn.1000350c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000bde8
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov byte [ebp - 8], dl
push ebx
test cl, cl
je 0x1000be21
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1000be57
push 0x34fa
push 0x2d21
xor ebx, ebx
mov dl, 1
push ebx
push 0x46b1
push ebx
mov ecx, 0x2f2
call fcn.1000bc5c
add esp, 0x14
jmp 0x1000be57
test dl, dl
je 0x1000be2f
push 0
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
jmp 0x1000be57
push esi
mov esi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [esi], ebx
jmp 0x1000be51
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1000be4f
push 0x2629
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
inc dword [esi]
cmp dword [esi], 0x31
jne 0x1000be39
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000c751
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005a1c8
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], 0x2a68
mov dword [ebp - 0x40], str.jzvhhbj_isu_jlcvnp_pydpvgm_uzw_tpjndrk_ykezu_mjs_eenenti_pxltywx_atcqer_vjpr_ypffxu
cmp dword [ebp - 0x20], 0x2e0e
jle 0x1000c7fe
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
and dword [ebp - 0x18], 0
jmp 0x1000c79d
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x214e
jge 0x1000c7df
and dword [ebp - 0x1c], 0
jmp 0x1000c7b3
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x7fa0
jge 0x1000c7dd
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
shl eax, cl
cdq
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
push dword [ebp - 0x44]
push dword [ebp - 0x48]
mov ecx, 0x10075ef8
call fcn.10001a90
jmp 0x1000c7ac
jmp 0x1000c796
push 0
push 0
push 0x1b65
push 0
push 0x18
push 0
push 0x1f1b
push 0x2473
call dword [sym.imp.KERNEL32.dll_WideCharToMultiByte]
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1000c882
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1000c835
push 0x2629
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x1000c880
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x1000c863
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 4
jge 0x1000c880
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x38]
call fcn.10001c44
mov dword [eax], 0x24b13b10
jmp 0x1000c858
jmp 0x1000c89f
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
push 0x2e80
push dword [ebp - 0x3c]
push 0x1196
push 0
call fcn.1000e3d6
add esp, 0x10
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x2a51
jge 0x1000c8b9
mov edx, dword [ebp - 0x40]
mov ecx, 0x10075ef8
call fcn.1000350c
jmp 0x1000c8d5
or dword [ebp - 4], 0xffffffff
jmp 0x1000c8df
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000e69c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1000e733
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1000e6d4
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x1000e731
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
push 2
mov ecx, dword [ebp - 0x20]
call fcn.10001c44
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
cmp dword [ebp - 0x24], 0xcb8ce3e
je 0x1000e71e
mov dword [ebp - 8], 1
jmp 0x1000e722
and dword [ebp - 8], 0
push 0
mov ecx, dword [ebp - 0x28]
call fcn.10001c44
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
jmp 0x1000e767
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1000e75f
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov eax, dword [eax]
and dword [eax], 0
jmp 0x1000e767
push 0
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov esp, ebp
pop ebp
ret
Function at 0x1000eb34
Capabilities:
Enumerate gui resources
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005a25e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1000ec9d
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x28], 0x4f8d
mov dword [ebp - 0x30], str.nvmavsfn_zxuae_tdupdfh_hdfb
cmp dword [ebp - 0x28], 0x517a
jle 0x1000ec49
push 0x580
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
and dword [ebp - 0x18], 0
jmp 0x1000eb9f
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x363e
jge 0x1000ec3d
and dword [ebp - 0x1c], 0
jmp 0x1000ebb9
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x10e1
jge 0x1000ec38
and dword [ebp - 0x20], 0
jmp 0x1000ebcf
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x4b51
jge 0x1000ec33
and dword [ebp - 0x24], 0
jmp 0x1000ebe5
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x5927
jge 0x1000ec31
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
shl eax, cl
mov ecx, dword [ebp - 0x20]
sub ecx, dword [ebp - 0x24]
shl eax, cl
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
lea ecx, [ebp - 0x68]
call fcn.10003ca8
pop ecx
pop ecx
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
call fcn.10001a70
push eax
call fcn.100430bc
pop ecx
lea ecx, [ebp - 0x68]
call fcn.10001a66
jmp 0x1000ebde
jmp 0x1000ebc8
jmp 0x1000ebb2
jmp 0x1000eb98
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x4baa
jge 0x1000ec65
push dword [ebp - 0x30]
call fcn.100430bc
pop ecx
jmp 0x1000ec81
or dword [ebp - 4], 0xffffffff
jmp 0x1000ec8b
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push 1
call fcn.1000ed07
add esp, 0xc
jmp 0x1000ecf6
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x1000ecc9
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x1000ecc7
push 0
call fcn.1000fbc5
pop ecx
jmp 0x1000ecf6
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x1000ecf6
push 0
push 0x24e6
push 0xfb7
push 0xfcf
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10010938
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005a2b1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], 0x5b65
mov dword [ebp - 0x20], str.vqjcm_cdsdyt_ays_putwlk_ogsedh_ghurcxvuc_irdtym_xolfb_tstmwts_syhmkmb_zsv
cmp dword [ebp - 0x1c], 0x5cff
jle 0x100109d9
push 0
push 0xf58
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
and dword [ebp - 0x14], 0
jmp 0x1001098f
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1cfa
jge 0x100109d1
and dword [ebp - 0x18], 0
jmp 0x100109a5
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x26c1
jge 0x100109cf
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sar eax, cl
cdq
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
push dword [ebp - 0x24]
push dword [ebp - 0x28]
mov ecx, 0x10075ef8
call fcn.10001a90
jmp 0x1001099e
jmp 0x10010988
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
push dword [ebp + 8]
push 0x7bd2
push 1
push 0x6f3a
call fcn.10010a41
add esp, 0x10
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x59a5
jge 0x10010a0a
mov edx, dword [ebp - 0x20]
mov ecx, 0x10075ef8
call fcn.1000350c
jmp 0x10010a26
or dword [ebp - 4], 0xffffffff
jmp 0x10010a30
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100136d4
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005a35f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10013729
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
push 0x5504
push dword [ebp - 0x24]
push 0x77f3
push dword [ebp - 0x28]
push 1
call fcn.10013837
add esp, 0x14
jmp 0x10013826
lea eax, [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10013755
push 0x2629
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x10013826
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], 0xfee
mov dword [ebp - 0x3c], str.ofqa_gqw_qak
cmp dword [ebp - 0x20], 0x1266
jle 0x100137d9
and dword [ebp - 0x14], 0
jmp 0x1001377f
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x246c
jge 0x100137d9
and dword [ebp - 0x18], 0
jmp 0x10013795
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x4266
jge 0x100137d7
mov eax, dword [ebp - 0x14]
or eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
push dword [ebp - 0x40]
push dword [ebp - 0x44]
lea ecx, [ebp - 0x5c]
call fcn.10003ca8
pop ecx
pop ecx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
call fcn.10001a70
push eax
call fcn.100430bc
pop ecx
lea ecx, [ebp - 0x5c]
call fcn.10001a66
jmp 0x1001378e
jmp 0x10013778
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0xc19
jge 0x10013800
push dword [ebp - 0x3c]
call fcn.100430bc
pop ecx
jmp 0x1001381c
or dword [ebp - 4], 0xffffffff
jmp 0x10013826
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001cd79
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x1001ce31
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1001ce16
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1001cdfc
mov ecx, dword [ebp - 8]
call fcn.1001e063
movzx eax, al
test eax, eax
jne 0x1001ce14
push dword [ebp - 0x34]
mov ecx, dword [ebp - 8]
call fcn.1001dff2
mov ecx, dword [ebp - 0x38]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov byte [eax], 1
jmp 0x1001ce2f
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001ce2f
push 0xcba
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1001ce60
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x3c]
push 0x5fd4
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push 0x5b93
push 1
call fcn.1000ea23
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x1001d1d0
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005a57f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x5c
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x1001d370
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1001d346
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
mov eax, dword [0x1007b1bc]
and eax, 1
jne 0x1001d269
mov eax, dword [0x1007b1bc]
or eax, 1
mov dword [0x1007b1bc], eax
and dword [ebp - 4], 0
mov ecx, 0x1007b178
call fcn.1001df9e
push 0x1005b430
call fcn.10042cdc
pop ecx
or dword [ebp - 4], 0xffffffff
movzx eax, byte [0x1007703a]
test eax, eax
je 0x1001d2c9
mov ecx, 0x1007b178
call fcn.1001e063
movzx eax, al
test eax, eax
jne 0x1001d2c9
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x1007b178
call fcn.1001e06c
lea eax, [ebp - 0x50]
push eax
mov ecx, 0x1007b178
call fcn.1001e055
push eax
lea ecx, [ebp - 0x14]
call fcn.1001df8b
movzx eax, al
test eax, eax
je 0x1001d2c9
lea ecx, [ebp - 0x14]
call fcn.1001e081
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax + 4]
mov dword [ecx], eax
jmp 0x1001d39e
mov eax, dword [ebp - 0x10]
push dword [eax]
lea eax, [ebp - 0x68]
push eax
call fcn.10029bf4
pop ecx
pop ecx
mov dword [ebp - 4], 1
push 0
push 0
lea eax, [ebp - 0x68]
push eax
push dword [ebp - 0x30]
call fcn.100185dc
add esp, 0x10
mov dword [ebp - 0x1c], eax
push 1
push 0x1007b178
push 0xea5
push 0xd1b
push 0x1007703a
lea eax, [ebp - 0x1c]
push eax
push 1
push 0x4478
push dword [ebp - 0x10]
call fcn.1001cd79
add esp, 0x24
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x68]
call fcn.1001df2e
jmp 0x1001d39e
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x1001d36e
push 1
push 0x13f3
push 0x1a6a
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x1001d39e
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
push dword [ebp - 0x40]
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
push 1
call fcn.10010ef6
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10020d9c
Capabilities:
Log keystrokes

Disassembly:
mov eax, 0x1005a726
call fcn.10059860
sub esp, 0x1c
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edi
mov byte [ebp - 0x14], cl
je 0x10020e9b
test cl, cl
je 0x10020de8
push 1
push 0x13f3
push 0x1a6a
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x20], 0x42b5
cmp dword [ebp - 0x20], 0x4328
jle 0x10020e4c
xor esi, esi
mov dword [ebp - 0x1c], esi
mov edi, esi
mov dword [ebp - 0x18], 0x1d28
xor ebx, ebx
xor esi, esi
mov dword [ebp + 8], 0x398c
mov ecx, esi
mov eax, edi
shl eax, cl
mov ecx, 0x10075ef8
cdq
push edx
push eax
call fcn.10001a90
add esi, ebx
dec dword [ebp + 8]
jne 0x10020e11
inc ebx
cmp ebx, 0x2c60
jl 0x10020e08
dec edi
dec dword [ebp - 0x18]
jne 0x10020e06
mov esi, dword [ebp - 0x1c]
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0xf86
jl 0x10020dfd
mov edi, dword [ebp - 0x24]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x3ede
jge 0x10020e87
mov edx, str.bbxxspynq_lbbjwpadh_hinutm_cmfzb_azgzdvq_frkelqhfy_ixbk_gffqbbu_ngrzlmvs_hdiirk
mov ecx, 0x10075ef8
call fcn.1000350c
jmp 0x10020e87
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
mov ecx, edi
call fcn.10021d04
jmp 0x10020dd7
mov dword [ebp - 0x20], 0x70a1
cmp dword [ebp - 0x20], 0x73dc
jle 0x10020f07
xor esi, esi
mov dword [ebp + 8], esi
xor edi, edi
and dword [ebp - 0x1c], 0
mov ebx, esi
mov esi, dword [ebp - 0x1c]
mov ecx, edi
shl ebx, cl
mov eax, ebx
mov ecx, 0x10075ef8
or eax, esi
cdq
push edx
push eax
call fcn.10001a90
inc esi
cmp esi, 0x4d6a
jl 0x10020ebf
mov esi, dword [ebp + 8]
inc edi
cmp edi, 0x7880
jl 0x10020eb2
inc esi
mov dword [ebp + 8], esi
cmp esi, 0x1d79
jl 0x10020eb0
push 0
push 0
push 0xdef
push 0x258c
push 0
call dword [sym.imp.USER32.dll_InsertMenuW]
cmp byte [ebp + 0x10], 0
je 0x10020f20
push 1
push 0x1b1a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
jmp 0x10020f26
mov eax, dword [ebp + 0xc]
mov byte [eax], 1
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x6fc7
jge 0x10020dd7
mov edx, str.rcjuvukt_selddvwgn_ooj
mov ecx, 0x10075ef8
call fcn.1000350c
jmp 0x10020dd7