joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100227f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov ebx, dword [ebp + 8]
jmp 0x100228a0
je 0x10022832
mov ecx, eax
and eax, 1
shr ecx, 1
movzx ebx, word [ebx + ecx*2 + 0x204]
neg eax
sar eax, 4
shr ebx, 4
and eax, 0x7f
xor ebx, eax
add edi, dword [esi + ebx*4]
mov ebx, dword [ebp + 8]
mov eax, ecx
cmp eax, 1
jne 0x10022805
add edi, dword [ebp - 0x14]
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp - 8]
mov dword [ecx + edx*4], edi
inc edx
inc eax
mov dword [ebp - 8], eax
cmp edx, dword [ebp + 0x10]
jb 0x10022855
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 8], eax
or eax, 0x100
xor edi, edi
cmp eax, 1
jmp 0x100227ff
mov dword [ebp - 4], edi
cmp eax, 1
jne 0x100229d5
add edi, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp - 8]
mov dword [ecx + edx*4], edi
jmp 0x10022881
inc edx
inc eax
mov dword [ebp - 8], eax
cmp edx, 0x10
jb 0x100229b4
cmp edx, dword [ebp + 0x10]
jae 0x1002284c
lea eax, [edx - 0x10]
jmp 0x10022852
movzx eax, word [ebx]
mov ecx, eax
shr ecx, 4
mov edx, dword [esi + ecx*4]
movzx ecx, word [ebx + 2]
mov dword [ebp - 0xc], edx
mov edx, ecx
xor eax, 0x7f0
xor ecx, 0x7f0
shr edx, 4
mov edx, dword [esi + edx*4]
shr eax, 4
mov eax, dword [esi + eax*4]
shr ecx, 4
mov ecx, dword [esi + ecx*4]
add edx, eax
add ecx, eax
mov dword [ebp - 0x10], edx
lea esp, [esp - 4]
pushfd
push eax
not ax
push ebx
bswap ebx
aam 0xa
push edx
xchg dx, ax
daa
push ecx
rol ecx, 0
stc
cbw
bswap edx
bswap edx
shl ebx, 1
cdq
bt dx, 1
bsf ebx, eax
dec ecx
neg ch
mov ch, dh
sahf
sub ecx, edx
mov ecx, dword [esp]
mov edx, dword [esp + 4]
inc ah
clc
push ebx
test dx, 0x10
bswap ebx
mov ebx, dword [esp + 0xc]
inc al
mov eax, dword [esp + 0x14]
push eax
popfd
mov eax, dword [esp + 0x10]
lea esp, [esp + 0x18]
mov dword [esp], edi
mov dword [ebp - 0x14], ecx
xor edx, edx
jmp 0x10022941
cmp edx, dword [ebp + 0x10]
jae 0x1002284c
mov eax, edx
xor edi, edi
or eax, 8
mov dword [ebp - 4], edi
cmp eax, 1
je 0x10022992
mov edi, dword [ebp + 0xc]
mov ecx, eax
and eax, 1
shr ecx, 1
lea edi, [ecx + edi*8]
movzx edi, word [ebx + edi*2 + 4]
neg eax
sar eax, 4
shr edi, 4
and eax, 0x7f
xor edi, eax
mov eax, edi
mov edi, dword [ebp - 4]
add edi, dword [esi + eax*4]
mov eax, ecx
mov dword [ebp - 4], edi
cmp eax, 1
jne 0x1002295d
add edi, dword [ebp - 0xc]
mov ecx, dword [ebp + 0x14]
mov dword [ecx + edx*4], edi
inc edx
cmp edx, 8
jb 0x10022941
cmp edx, 0x10
jae 0x1002288f
lea eax, [edx - 8]
mov dword [ebp - 8], eax
cmp edx, dword [ebp + 0x10]
jae 0x1002284c
xor edi, edi
or eax, 8
mov dword [ebp - 4], edi
cmp eax, 1
je 0x10022870
lea esp, [esp]
mov edi, dword [ebp + 0xc]
mov ecx, eax
and eax, 1
shr ecx, 1
lea edi, [ecx + edi*8]
movzx edi, word [ebx + edi*2 + 0x104]
neg eax
sar eax, 4
shr edi, 4
and eax, 0x7f
xor edi, eax
mov eax, edi
mov edi, dword [ebp - 4]
add edi, dword [esi + eax*4]
mov eax, ecx
jmp 0x10022864
Function at 0x10025290
Capabilities:
Encode data using xor

Disassembly:
lea esp, [esp - 4]
pushfd
push edx
neg dh
push eax
mov al, dh
push ecx
xchg dx, cx
lahf
stc
push ebx
bsf eax, ebx
aas
ror cx, 3
bsf edx, eax
not bx
mov ebx, dword [esp]
bsf ax, cx
neg edx
cdq
push edx
nop
neg ch
aad 0xa
lahf
and cx, 0x18
mov eax, 0xcd69
mov ecx, 0xa333
mul ecx
mov ecx, dword [esp + 8]
dec dx
mov eax, dword [esp + 0x14]
push eax
popfd
mov edx, dword [esp + 0x10]
bswap eax
mov eax, dword [esp + 0xc]
lea esp, [esp + 0x18]
mov dword [esp], ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
lea eax, [edi + 0x323c8]
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
lea ebx, [ebx]
xor edx, edx
lea ecx, [edx + 1]
mov dword [ebp - 4], 4
lea esp, [esp]
movzx ebx, word [edi + ecx*2 + 0x32a4c]
mov eax, esi
and eax, 1
mov edi, eax
neg edi
sar edi, 4
and edi, 0x7f
shr ebx, 4
xor ebx, edi
mov edi, dword [ebp + 8]
add edx, dword [edi + ebx*4 + 0x30d34]
add ecx, ecx
shr esi, 1
or ecx, eax
dec dword [ebp - 4]
jne 0x1002531d
mov eax, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
inc esi
mov dword [eax], edx
add eax, 4
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
cmp esi, 0x10
jb 0x1002530d
jmp 0x10025376
mov esp, ebp
pop ebp
ret
mov dword [edi + 0x84], 0
pop edi
pop esi
pop ebx
jmp 0x10025372
Function at 0x1002a110
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push esi
mov dword [eax + 0x34], edx
mov byte [eax + 0x1f], dl
mov dword [eax + 0x24], edx
mov dword [eax + 0x30], 0x20
mov dword [eax + 0x48], 4
mov word [eax + 0x1d], 1
lea esi, [eax + 0x60]
jmp 0x1002a166
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
jmp 0x1002a1e2
lea esp, [esp]
mov eax, edx
and eax, 1
dec eax
not eax
jmp 0x1002a1cb
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
jmp 0x1002a1c2
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov eax, ecx
and eax, 1
dec eax
shr ecx, 1
not eax
and eax, 0xedb88320
xor eax, ecx
mov ecx, eax
jmp 0x1002a13e
and eax, 1
dec eax
jmp 0x1002a18d
and eax, 0xedb88320
mov ecx, edx
shr ecx, 1
xor eax, ecx
mov ecx, eax
and ecx, 1
dec ecx
jmp 0x1002a17a
ret
and ecx, 1
dec ecx
not ecx
and ecx, 0xedb88320
shr eax, 1
xor ecx, eax
mov dword [esi], ecx
inc edx
add esi, 4
cmp edx, 0x100
jb 0x1002a16d
mov esi, dword [esp]
pushfd
push eax
aam 0xa
push edx
cwd
push ecx
bswap ecx
mov ecx, dword [esp]
nop
push ebx
shl ebx, 1
aam 0xa
neg dx
inc al
not bl
bswap eax
clc
clc
das
cmc
inc eax
lea edx, [edx + 0x6fbc]
push ecx
aam 0xa
clc
inc eax
mov eax, dword [esp + 0x10]
xadd ebx, ebx
mov ebx, dword [esp + 4]
inc edx
mov edx, dword [esp + 0x14]
push edx
popfd
mov edx, dword [esp + 0xc]
lea esp, [esp + 0x18]
lea esp, [esp + 4]
pop ebp
jmp 0x1002a1e1
Function at 0x100358e0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
lea esp, [esp - 4]
pushfd
push eax
das
push ecx
add ecx, ecx
lahf
push ebx
not ebx
aam 0xa
not al
push edx
bswap edx
nop
nop
shl dx, 0
aad 0xa
bts eax, 6
bsf ebx, edx
aad 0xa
cdq
and bh, 0xf0
rol eax, 3
inc dl
cbw
mov eax, 0x8993
mov ecx, 0x5d45
mul ecx
bsf ax, cx
bswap ebx
mov ebx, dword [esp + 4]
shr dh, 4
mov ax, 0x18
mov cx, 0x28
mul cx
mov eax, dword [esp + 0x10]
push eax
popfd
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp]
lea esp, [esp + 0x14]
mov dword [esp], 0xffffffff
push 0x3017b98
mov eax, dword fs:[0]
lea esp, [esp - 4]
lea esp, [esp - 0x24]
push ecx
bswap ecx
pushfd
push ebx
neg bh
push edx
push eax
xor ax, 0xd9f1
nop
clc
mov eax, dword [esp]
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], edx
pop edx
cmc
or ecx, 0x67
cbw
not bx
aad 0xa
cdq
mov edx, dword [esp + 0x2c]
inc ebx
xchg cx, ax
shl cl, 1
daa
shl cl, 5
mov ecx, dword [esp + 0xc]
not eax
bswap eax
shr bx, 4
mov ebx, dword [esp + 4]
aad 0xa
mov eax, dword [esp + 8]
push eax
popfd
mov eax, dword [esp + 0x30]
lea esp, [esp + 0x34]
mov dword [esp], eax
sub esp, 0x14
push ebx
push esi
push edi
jmp 0x10035acd
jb 0x100359d1
mov eax, dword [eax]
cmp dword [esi + 0x14], ecx
jno 0x10035a59
push ebx
mov bx, 0xc4
pushfd
cmc
push eax
mov ax, 0x63
push ecx
mov cx, 0x53
push edx
mul cx
aad 0xa
inc al
bts ax, 3
xor dx, dx
mov ax, 0x6c58
mov cx, 0xbc8a
div cx
inc bx
neg ebx
not edx
neg ecx
aad 0xa
xadd ebx, ecx
shr cl, 3
bt bx, 5
aaa
clc
shl cl, 6
nop
push eax
and bx, dx
cmc
aas
push edx
not bl
mov ebx, dword [esp + 0x18]
test eax, ebx
dec dx
cmp ecx, 1
neg cx
mov ecx, dword [esp + 0xc]
aaa
shl ax, 1
mov eax, dword [esp + 0x14]
push eax
popfd
mov eax, dword [esp + 0x10]
pop edx
mov edx, dword [esp + 4]
lea esp, [esp + 0x18]
jo 0x10035a59
jb 0x10035a61
mov esi, dword [esi]
push eax
push esi
call dword [0x301d078]
test eax, eax
jne 0x10035a79
call dword [0x301d108]
mov ebx, eax
mov esi, dword [ebp - 0x20]
cmp esi, edi
je 0x10035aae
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x1c]
push ecx
lea edx, [ebp - 0x14]
push edx
jmp 0x10035a9b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push eax
push esi
call fcn.10015f20
mov ecx, dword [ebp - 0x20]
push ecx
call fcn.100645c0
add esp, 0x14
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
jmp 0x10035a94
mov ecx, 8
cmp dword [eax + 0x14], ecx
jmp 0x100359c9
mov eax, dword [0x3027864]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], edi
mov eax, dword [ecx + 0x14]
mov ecx, dword [ecx + 0x10]
dec eax
push eax
inc ecx
push ecx
lea edx, [ebp - 0x20]
push edx
mov dword [ebp - 4], edi
call fcn.10061580
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
sub ecx, esi
mov eax, 0x92492493
imul ecx
add edx, ecx
sar edx, 4
mov eax, edx
shr eax, 0x1f
add eax, edx
add esp, 0xc
cmp eax, 2
jb 0x10035a7c
lea eax, [esi + 0x1c]
jmp 0x10035ac0
Function at 0x1003e3a0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0x67452301
jmp 0x1003e3bf
mov dword [eax + 0xc], 0xefcdab89
mov dword [eax + 0x10], 0x98badcfe
mov dword [eax + 0x14], 0x10325476
pop ebp
ret
Function at 0x10052760
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
lea esp, [esp - 4]
push eax
nop
mov ax, 0xe7
push ecx
mov cx, 0x97
pushfd
push edx
mul cx
cwd
push ebx
sub cx, bx
rol dl, 2
aam 0xa
daa
and cx, bx
cwd
lea ebx, [eax + ecx - 0x6c16]
mov ebx, dword [esp]
not ax
cmc
stc
aas
mov dx, cx
stc
clc
and dl, cl
cmp eax, ecx
sub al, 0x88
xor edx, edx
mov eax, 0x346d
mov ecx, 0xebd3
div ecx
mov eax, dword [esp + 8]
push eax
popfd
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 4]
lea esp, [esp + 0x14]
mov dword [esp], ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
xor ecx, ecx
push edi
xor eax, eax
lea ecx, [ecx]
mov byte [eax + esi], al
inc eax
cmp eax, 0x100
jl 0x100527d6
mov edi, dword [ebp + 0x10]
mov word [esi + 0x100], cx
xor bl, bl
mov eax, ecx
cdq
idiv edi
mov eax, dword [ebp + 0xc]
inc ecx
movzx edx, byte [edx + eax]
add dl, byte [ecx + esi - 1]
add bl, dl
movzx edx, byte [ecx + esi - 1]
movzx eax, bl
mov byte [ebp + 0xb], dl
movzx edx, byte [eax + esi]
mov byte [ecx + esi - 1], dl
movzx edx, byte [ebp + 0xb]
mov byte [eax + esi], dl
cmp ecx, 0x100
jl 0x100527f1
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x10052830
Capabilities:
Encode data using xor
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
mov edx, dword [ebp + 0x14]
test edx, edx
jle 0x100528c9
mov ecx, dword [ebp + 0xc]
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov edi, dword [ebp + 0x10]
sub ecx, edi
mov dword [ebp - 4], ecx
mov dword [ebp + 0x14], edx
mov ecx, 1
jmp 0x10052863
add byte [eax + 0x100], cl
movzx esi, byte [eax + 0x100]
movzx edx, byte [esi + eax]
add byte [eax + 0x101], dl
movzx ecx, byte [eax + 0x101]
mov bl, byte [ecx + eax]
mov dl, byte [esi + eax]
mov byte [esi + eax], bl
mov byte [ecx + eax], dl
movzx ecx, byte [eax + 0x101]
movzx ecx, byte [ecx + eax]
movzx edx, byte [eax + 0x100]
add cl, byte [edx + eax]
movzx edx, cl
movzx ecx, byte [edx + eax]
mov edx, dword [ebp - 4]
xor cl, byte [edx + edi]
mov byte [edi], cl
mov ecx, 1
add edi, ecx
sub dword [ebp + 0x14], ecx
jne 0x10052863
pop edi
pop esi
jmp 0x100528c8
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100529f0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0xc]
not eax
test ecx, ecx
je 0x10052a25
push esi
movzx esi, byte [edx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x3027228]
inc edx
dec ecx
jne 0x10052a07
pop esi
not eax
pop ebp
ret
Function at 0x100560f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
lea esp, [esp - 4]
pushfd
push edx
neg dh
push eax
xadd eax, eax
daa
push ecx
xor al, cl
push ebx
shl ebx, 6
aaa
das
xor dh, 0x7f
bsf edx, edx
push ecx
shr dx, 0
das
shl dx, 0
mov eax, 0xc0a8
mov ecx, 0x465c
mul ecx
bt ax, 4
cmc
rol dl, 6
aad 0xa
cwd
mov edx, dword [esp + 0x10]
mov bh, cl
add bl, 0x6d
mov ebx, dword [esp + 4]
not cx
mov eax, dword [esp + 0x14]
push eax
popfd
mov ecx, dword [esp + 8]
cbw
mov eax, dword [esp + 0xc]
lea esp, [esp + 0x18]
mov dword [esp], 0x301a888
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
lea esp, [esp - 4]
lea esp, [esp - 0x1c]
push ebx
pushfd
clc
push edx
not dx
push eax
das
mov eax, dword [esp]
mov dword [esp + 0x28], eax
pop edx
mov eax, 0x5822
push ecx
mov ecx, 0x6e4c
mul ecx
cmc
cdq
nop
xor dx, dx
mov ax, 0x8950
mov cx, 0x848d
div cx
push ebx
not bx
mov ebx, dword [esp]
nop
not ax
inc edx
neg ecx
cdq
mov eax, dword [esp + 0x2c]
mov edx, dword [esp + 8]
cmc
mov ecx, dword [esp + 0xc]
push ecx
popfd
bswap ecx
mov ecx, dword [esp + 4]
lea esp, [esp + 0x30]
mov dword [esp], edi
mov eax, dword [0x3027864]
jmp 0x100561d6
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 0x10]
push eax
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
push ecx
mov ecx, dword [ebp + 8]
push edx
push eax
push ecx
mov dword [ebp - 4], 0
mov dword [ebp - 0x14], 0
mov dword [ebp - 0x10], 0
call fcn.10055af0
mov esi, dword [ebp - 0x14]
mov edi, eax
add esp, 0x14
test edi, edi
jne 0x10056329
cmp byte [ebp + 0x18], 0
jmp 0x10056240
push esi
push 0
call dword [0x301d098]
push eax
call dword [0x301d030]
test eax, eax
jmp 0x10056250
mov eax, dword [ebp + 0x14]
push 0
je 0x10056313
jmp 0x10056301
jne 0x1005625c
call dword [0x301d108]
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], 0xffffffff
test eax, eax
je 0x100562ee
mov ecx, dword [eax]
mov edx, dword [ecx + 8]
lea esp, [esp - 4]
push eax
push edx
lea edx, [eax + edx - 0x35cb]
mov ax, 0x8c
push ecx
mov cx, 0xab
pushfd
mul cx
aas
and ch, 0x61
dec eax
cmp eax, 0x179c
cwd
aas
mov cl, 0x82
xchg ah, cl
daa
aas
inc ax
push ebx
lea ebx, [ecx - 0x1c95]
cwd
sahf
inc edx
aas
cmc
rol ecx, 1
bsr cx, ax
cwd
neg dh
bswap ebx
dec ch
inc bl
not al
or cl, cl
shr bx, 5
mov ebx, dword [esp]
daa
cdq
mov eax, dword [esp + 0x10]
stc
dec edx
mov edx, dword [esp + 0xc]
inc cx
mov ecx, dword [esp + 8]
clc
push ecx
mov ecx, dword [esp + 8]
push ecx
popfd
pop ecx
lea esp, [esp + 0x14]
mov dword [esp], eax
call edx
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 0x10]
mov edx, dword [eax]
mov edx, dword [edx + 0x10]
push ecx
push esi
push eax
call edx
jmp 0x10056329
mov edx, dword [ebp - 0x10]
mov ecx, dword [eax]
add edx, 0xffffff80
push edx
lea edx, [esi + 0x80]
push edx
push eax
mov eax, dword [ecx + 0x10]
call eax
test esi, esi
je 0x1005625c
jmp 0x10056229
Function at 0x4019b1
Capabilities:
Clear file content
Get common file path
Get keyboard layout

Disassembly:
sub esp, 0x400
push esi
push edi
xor esi, esi
xor edi, edi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push esi
call dword [sym.imp.KERNEL32.dll_GlobalFindAtomA]
cmp edi, 0x58ced85
jg 0x4019de
inc edi
cmp edi, 0x1f6502b1
jl 0x4019bd
cmp dword [0x2be13bc], 0x400
jne 0x401a27
push str.sadahoziyofejonoh_niforapo_pihekezavokigubodatojup_rafepigojamulexiwodugaxexude_jam
push str.nelugidoneyari
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push esi
push esi
call dword [sym.imp.USER32.dll_DdeKeepStringHandle]
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayoutNameW]
push esi
push esi
call fcn.00401e21
push esi
push esi
call fcn.00401e21
push esi
call fcn.004020c4
push esi
call fcn.004020d3
add esp, 0x18
xor edi, edi
cmp edi, 0xd0fe
jge 0x401a38
push esi
call dword [sym.imp.USER32.dll_GetCaretPos]
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
push esi
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateJobObject]
cmp edi, 0xd2ce6e
jg 0x401a5f
inc edi
cmp edi, 0x26bcf
jl 0x401a29
mov eax, dword [0x422c24]
mov dword [0x2be13bc], eax
call fcn.00401728
mov edi, 0x3078f
cmp dword [0x2be13bc], 0x51f
jne 0x401a8b
push esi
lea eax, [esp + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
dec edi
jne 0x401a73
pop edi
xor eax, eax
pop esi
add esp, 0x400
ret 0x10

Function at 0x404dae
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x422940]
jne 0x404db8
repz ret
jmp fcn.004062dc
Function at 0x405c1c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x422940]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.0040310b
and dword [ebp - 0x14], 0
cmp dword [0x42d78c], 0
mov dword [ebp - 0x18], eax
jne 0x405ccf
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x405d77
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x405d77
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x42d78c], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x42d790], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x42d794], eax
call edi
push eax
call esi
mov dword [0x42d79c], eax
test eax, eax
je 0x405ccf
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x42d798], eax
mov eax, dword [0x42d798]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x405d28
cmp dword [0x42d79c], ecx
je 0x405d28
push eax
call esi
push dword [0x42d79c]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x405d28
test ebx, ebx
je 0x405d28
call edi
test eax, eax
je 0x405d1f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x405d1f
test byte [ebp - 8], 1
jne 0x405d28
or dword [ebp + 0x10], 0x200000
jmp 0x405d5b
mov eax, dword [0x42d790]
cmp eax, dword [ebp - 0x18]
je 0x405d5b
push eax
call esi
test eax, eax
je 0x405d5b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x405d5b
mov eax, dword [0x42d794]
cmp eax, dword [ebp - 0x18]
je 0x405d5b
push eax
call esi
test eax, eax
je 0x405d5b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x42d78c]
call esi
test eax, eax
je 0x405d77
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x405d79
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00404dae
leave
ret
Function at 0x10001040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
push ebx
push esi
mov esi, dword [ecx]
mov ecx, dword [ebp + 8]
push edi
mov edi, ecx
mov dword [ebp + 8], 0x10
lea esp, [esp]
xor eax, dword [edi]
mov ebx, eax
call fcn.10001000
xor eax, esi
add edi, 4
dec dword [ebp + 8]
mov esi, ebx
jne 0x10001060
mov edx, dword [ecx + 0x40]
xor edx, eax
mov eax, dword [ecx + 0x44]
mov ecx, dword [ebp + 0xc]
xor eax, esi
pop edi
mov dword [ecx], eax
mov eax, dword [ebp + 0x10]
pop esi
mov dword [eax], edx
pop ebx
pop ebp
ret

Function at 0x10001090
Capabilities:
Encrypt data using blowfish
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov eax, 0x1000a1b8
lea ecx, [ebx + 0x48]
mov edx, 0x100
lea esp, [esp]
mov esi, dword [eax]
mov dword [ecx], esi
add eax, 4
add ecx, 4
dec edx
jne 0x100010b0
cmp eax, 0x1000b1b8
jl 0x100010a4
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov ecx, 0x1000a170
xor eax, eax
sub ecx, ebx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 8], 0x12
lea ecx, [ecx]
movzx ecx, byte [eax + esi]
inc eax
cmp eax, edi
jl 0x100010eb
xor eax, eax
movzx edx, byte [eax + esi]
shl ecx, 8
inc eax
or edx, ecx
cmp eax, edi
jl 0x100010fb
xor eax, eax
movzx ecx, byte [eax + esi]
shl edx, 8
inc eax
or ecx, edx
cmp eax, edi
jl 0x1000110b
xor eax, eax
movzx edx, byte [eax + esi]
shl ecx, 8
inc eax
or edx, ecx
cmp eax, edi
jl 0x1000111b
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx + ebx]
xor ecx, edx
mov dword [ebx], ecx
add ebx, 4
dec dword [ebp - 8]
jne 0x100010e0
mov edi, dword [ebp + 8]
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 8], esi
lea edx, [ebp - 8]
push edx
lea eax, [ebp - 4]
push eax
push edi
call fcn.10001040
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov dword [edi + esi*4], ecx
mov dword [edi + esi*4 + 4], edx
add esi, 2
add esp, 0xc
cmp esi, 0x12
jl 0x10001138
lea esi, [edi + 0x4c]
mov dword [ebp - 0xc], 4
jmp 0x10001170
mov ebx, 0x80
lea eax, [ebp - 8]
push eax
lea ecx, [ebp - 4]
push ecx
push edi
call fcn.10001040
mov edx, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [esi - 4], edx
mov dword [esi], eax
add esp, 0xc
add esi, 8
dec ebx
jne 0x10001175
dec dword [ebp - 0xc]
jne 0x10001170
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100011d0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1000e004]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call fcn.10001f60
push esi
push 0x1000b1b8
lea ecx, [ebp - 0x108]
push 0x104
push ecx
call fcn.10001ea0
add esp, 0x1c
push 0
push 0x2710
push 0x1f4
push 0x1f4
push 0xff
push 6
push 3
lea edx, [ebp - 0x108]
push edx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
xor ecx, ecx
cmp eax, 0xffffffff
setne cl
mov dword [0x1000edec], eax
pop esi
mov eax, ecx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10001f4c
mov esp, ebp
pop ebp
ret
Function at 0x100012c0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x150
mov eax, dword [0x1000e004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push 0x1f4
call fcn.100020dd
add esp, 4
cmp dword [ebp + 8], 0
mov ebx, eax
mov word [ebp - 0x148], 3
mov byte [ebp - 0x146], 0
je 0x100013bf
push esi
push edi
push 0x1f5
call fcn.100020dd
push 0x1f5
mov esi, eax
push 0
push esi
mov dword [ebp - 0x14c], esi
call fcn.10001f60
mov ecx, dword [ebp + 8]
lea eax, [ebp + 0xc]
push eax
push ecx
push 0x1f4
push esi
call fcn.100020c0
push esi
lea edx, [ebp - 0x104]
push 0xff
push edx
call fcn.10001ea0
push 0x1f4
push 0
push ebx
call fcn.10001f60
mov ax, word [ebp - 0x148]
mov word [ebx], ax
xor al, al
add esp, 0x38
mov byte [ebx + 2], al
mov eax, dword [0x1000edec]
lea edi, [ebx + 3]
mov ecx, 0x50
lea esi, [ebp - 0x144]
rep movsd dword es:[edi], dword [esi]
pop edi
pop esi
test eax, eax
je 0x100013aa
cmp eax, 0xffffffff
je 0x100013aa
push 0
lea ecx, [ebp - 0x150]
push ecx
push 0x143
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov edx, dword [0x1000edec]
push edx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
call fcn.10001260
mov eax, dword [ebp - 0x14c]
push eax
call fcn.10001fda
push ebx
call fcn.10001fda
add esp, 8
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop ebx
call fcn.10001f4c
mov esp, ebp
pop ebp
ret