joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001e618
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
cmp byte [ebp + 0x24], 0
push ebx
push esi
mov ebx, edx
mov dword [esp + 0x18], ecx
push edi
mov dword [esp + 0x18], ebx
je 0x1001e742
mov dword [esp + 0x14], 0x7ee5
cmp dword [esp + 0x14], 0x8022
jle 0x1001e6c1
xor ebx, ebx
push ebx
push 0x197d
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov dword [esp + 0x10], ebx
mov edi, ebx
mov dword [esp + 0xc], 0x17f1
mov ebx, edi
mov esi, 0x4c39
mov eax, ebx
lea ecx, [esp + 0x20]
cdq
push edx
push eax
call fcn.10002394
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001e689
mov eax, dword [eax]
push eax
call fcn.10047752
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.10005baf
dec ebx
dec esi
jne 0x1001e671
mov esi, dword [esp + 0x10]
add edi, esi
dec dword [esp + 0xc]
jne 0x1001e66a
inc esi
mov dword [esp + 0x10], esi
push 0
pop ebx
cmp esi, 0x6b2e
jl 0x1001e660
mov ebx, dword [esp + 0x18]
cmp dword [esp + 0x14], 0x7c16
jge 0x1001e6d6
push str.mhcti_ephsw_ytdpilhwx_uahazck_uegqxlxqj_mnxmj_ohjz_petzkxy_afpmfcil_frmzi_ifyguq_sxenk_ylr
call fcn.10047752
pop ecx
mov esi, dword [ebp + 0x28]
mov ecx, 0x40f2fdad
mov edi, dword [ebp + 0x2c]
xor edx, edx
mov eax, dword [esi]
mov eax, dword [ebp + 0x30]
mov dword [edi], ecx
mov dword [eax], ecx
mov eax, dword [eax]
mov eax, dword [edi]
mov eax, dword [esi]
mov eax, dword [ebx]
mov ecx, dword [ebp + 0x14]
mov dword [edi], eax
mov eax, dword [edi]
test eax, eax
mov eax, dword [ebp + 0xc]
setne dl
mov dword [eax], 0xfffd
mov eax, dword [esi]
mov dword [ecx], eax
mov eax, dword [ecx]
xor ecx, ecx
cmp eax, edx
mov eax, dword [esi]
sete cl
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [esi]
setge dl
imul eax, edx
imul eax, eax, 0xfffd
cmp eax, dword [ebx]
je 0x1001e734
mov eax, dword [ebp + 0x30]
mov eax, dword [eax]
mov eax, dword [edi]
mov ecx, dword [esp + 0x1c]
mov dword [ebx], eax
mov eax, dword [ebx]
mov dword [ecx], eax
jmp 0x1001e747
mov eax, dword [ebp + 0x34]
inc dword [eax]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10025f15
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x10060863
call fcn.1005f648
sub esp, 0x40
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x10025fb9
push 2
lea ecx, [ebp - 0x3c]
call fcn.100017ce
xor ebx, ebx
lea edx, [ebp - 0x24]
push 0x7e0b
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x18], 0xdf2f4a8b
push ebx
call fcn.10026cdf
mov dword [ebp - 0x18], 1
pop ecx
pop ecx
cmp dword [ebp - 0x18], ebx
jl 0x10025fb1
push 0x37a6
push 0x3af5
lea eax, [ebp - 0x3c]
mov dword [ebp - 0x1c], 0xea6801fc
push eax
push 0xe70
push 1
push 0x3615
push 0x5980
push 0x2966
push 0x76d0
lea eax, [ebp - 0x1c]
mov dl, 1
push eax
push 1
mov ecx, 0x29ab
call fcn.1002537e
add esp, 0x2c
dec dword [ebp - 0x18]
jns 0x10025f67
lea ecx, [ebp - 0x3c]
jmp 0x100260fd
mov dword [ebp - 0x18], 0x9b5
xor ebx, ebx
cmp dword [ebp - 0x18], 0xbb8
jle 0x10025ffa
mov esi, ebx
mov edi, ebx
mov eax, edi
mov ecx, 0x1007ba38
or eax, esi
cdq
push edx
push eax
call fcn.10005547
inc edi
cmp edi, 0x1261
jl 0x10025fcf
inc esi
cmp esi, 0x29c
jl 0x10025fcd
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
push dword [ebp - 0x24]
movdqa xmm0, xmmword [0x1006e500]
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x30], ebx
push eax
push ebx
lea ecx, [ebp - 0x30]
mov dword [ebp - 0x2c], ebx
movdqu xmmword [ebp - 0x4c], xmm0
mov dword [ebp - 0x28], ebx
call fcn.100018ed
mov dword [ebp - 4], 1
mov byte [ebp - 4], 2
cmp dword [ebp - 0x18], 0x745
jge 0x10026065
mov edx, str.kamtpgshu_hvldj_ytezrrqz_unqr_ahsweu_mvjs_tyayr_sttmyg_hpljkqzf
mov ecx, 0x1007ba38
call fcn.100078f4
jmp 0x10026065
lea eax, [ebp - 0x30]
mov dword [ebp - 0x20], 0xcb50bf34
push eax
push 0x785d
push 1
lea eax, [ebp - 0x20]
mov edx, 0x4986
push eax
push 1
push 0x32c7
push 0x1d2d
push ebx
push 0x474e
push 0x1734
push 0x3758
push 0x5ed1
mov ecx, 0x3d25
call fcn.10025223
mov byte [ebp - 0x11], bl
add esp, 0x30
cmp byte [ebp - 0x11], 0
je 0x100260fa
push 0x2553
push 0x643f
push ebx
push 0x225c
push ebx
push 0x5f97
push 0x521a
push 1
push 0x1147
push 0x76b4
push 0x5261
push 0x6701
mov edx, 0x1979
mov ecx, 0x4722
call fcn.10025223
add esp, 0x30
lea ecx, [ebp - 0x30]
call fcn.10001830
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10026f6f
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100608ff
call fcn.1005f648
sub esp, 0x40
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, edx
je 0x10027047
mov dword [ebp - 0x18], 0x69a6
cmp dword [ebp - 0x18], 0x6d75
jle 0x10026fc5
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x1007ba38
xor eax, esi
cdq
push edx
push eax
call fcn.10005547
inc edi
cmp edi, 0x4713
jl 0x10026fa2
inc esi
cmp esi, 0x1357
jl 0x10026fa0
mov esi, dword [ebx]
mov edi, dword [ebx + 4]
jmp 0x10027005
push esi
lea ecx, [ebp - 0x34]
call fcn.100084aa
and dword [ebp - 4], 0
push ecx
lea ecx, [ebp - 0x34]
call fcn.1001a82b
pop ecx
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x1c]
push eax
call fcn.100296c2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
push 0
push 1
call fcn.10005c7b
add esi, 0x18
cmp esi, edi
jne 0x10026fcc
mov dword [ebp - 4], 1
cmp dword [ebp - 0x18], 0x67cd
jge 0x10027028
mov edx, str.fvm_gexhmeit_plrb_ewx_oqm_trhhcprx_kzde_xuh
mov ecx, 0x1007ba38
call fcn.100078f4
jmp 0x100270f4
mov dword [ebp - 0x18], 0x6501
cmp dword [ebp - 0x18], 0x6880
jle 0x100270a6
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
lea ecx, [ebp - 0x4c]
xor eax, edi
xor eax, esi
cdq
push edx
push eax
call fcn.10002394
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10027078
mov eax, dword [eax]
push eax
call fcn.10047752
pop ecx
push 0
push 1
lea ecx, [ebp - 0x4c]
call fcn.10005baf
inc ebx
cmp ebx, 0x72d1
jl 0x1002705d
inc edi
cmp edi, 0x5ac
jl 0x1002705b
inc esi
cmp esi, 0x5eeb
jl 0x10027059
mov esi, dword [ebp + 0x1c]
xor ecx, ecx
mov edx, dword [ebp + 0x24]
mov eax, dword [esi]
mov eax, dword [edx]
cmp eax, 1
setg cl
mov dword [edx], ecx
mov eax, dword [edx]
mov eax, dword [esi]
mov eax, dword [esi]
mov edx, dword [ebp + 0x20]
mov eax, dword [edx]
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
mov eax, dword [esi]
mov ecx, dword [ecx + 4]
sub ecx, eax
jne 0x100270d5
mov eax, dword [edx]
mov eax, dword [edx]
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
cmp dword [ebp - 0x18], 0x63d6
jge 0x100270f4
push str.xjtsmuqaf_jkwwtsqr_bhi_lqy_popkxxn_ewuv_kahbdt_rcpub_jkig_xaxutii_zlbnedbvu
call fcn.10047752
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10028148
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10060a05
call fcn.1005f648
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x18], 0x75c6
mov edi, edx
cmp dword [ebp - 0x18], 0x76cf
mov ebx, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], ebx
jle 0x100281d5
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
xor esi, esi
xor edi, edi
mov dword [ebp - 0x14], 0x13ba
xor ebx, ebx
mov eax, edi
mov ecx, 0x1007ba38
xor eax, ebx
cdq
push edx
push eax
call fcn.10005547
inc ebx
cmp ebx, 0x99c
jl 0x10028188
add edi, esi
dec dword [ebp - 0x14]
jne 0x10028186
inc esi
cmp esi, 0x4dac
jl 0x1002817d
push 0
push 0x93f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
mov edi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x20]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x7414
jge 0x10028213
mov edx, str.xrusi_ismhr_mawflv_jqftzaoqu
mov ecx, 0x1007ba38
call fcn.100078f4
jmp 0x10028213
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x10], 0
je 0x1002822e
mov eax, dword [ebp + 0xc]
movzx eax, word [eax]
push eax
push ecx
mov ecx, ebx
call fcn.1001a875
jmp 0x1002823a
push ecx
push ecx
push dword [ebp + 0x18]
mov ecx, edi
call fcn.10029a64
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100282f7
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10060a27
push eax
mov dword fs:[0], esp
sub esp, 0x44
cmp byte [ebp + 0x1c], 0
push ebx
push edi
mov edi, edx
mov ebx, ecx
je 0x1002836c
cmp byte [ebp + 0x18], 0
je 0x10028339
push ecx
push ecx
push dword [ebp + 8]
mov ecx, dword [ebp + 0x2c]
call fcn.10029a64
jmp 0x10028449
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
push dword [eax]
lea eax, [esp + 0x38]
push eax
call fcn.100293c7
and dword [esp + 0x54], 0
mov ecx, edi
push eax
call fcn.10029475
push 0
push 1
lea ecx, [esp + 0x38]
call fcn.10005c7b
jmp 0x10028449
cmp byte [ebp + 0x28], 0
je 0x10028387
mov eax, dword [ebp + 0x30]
movzx eax, word [eax]
push eax
push ecx
mov ecx, dword [ebp + 0xc]
call fcn.1001a875
jmp 0x10028449
mov edx, dword [ebp + 0x14]
lea ecx, [esp + 0x24]
and dword [esp + 0x10], 0
call fcn.10027115
xor edi, edi
lea ecx, [esp + 0x18]
inc edi
mov edx, ebx
mov dword [esp + 0x54], edi
call fcn.10027115
push 0x452
lea eax, [esp + 0x1c]
mov byte [esp + 0x58], 2
push eax
and dword [esp + 0x14], 0
lea eax, [esp + 0x1c]
push eax
push edi
push 0x3928
push 0x6eb2
push 0x58e5
push 0
push 0x5248
push 0x1c9f
push 0x24ad
push edi
lea edx, [esp + 0x54]
lea ecx, [esp + 0x3c]
call fcn.10028e0e
push edi
push 0xa45
lea eax, [esp + 0x48]
mov ecx, 0x7fc6
push eax
push 0xd2e
push 0x6faa
push edi
lea eax, [esp + 0x5c]
push eax
push edi
push 0x7166
lea eax, [esp + 0x78]
push eax
lea eax, [esp + 0x64]
push eax
lea edx, [esp + 0x74]
call fcn.10027954
mov ecx, dword [ebp + 0x24]
add esp, 0x5c
mov eax, dword [esp + 0x10]
mov dword [ecx], eax
lea ecx, [esp + 0x18]
call fcn.10029a0b
lea ecx, [esp + 0x24]
call fcn.10029a0b
mov ecx, dword [esp + 0x4c]
pop edi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10028637
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
cmp byte [ebp + 8], 0
je 0x10028654
mov eax, dword [ebp + 0xc]
mov edx, dword [eax + 4]
sub edx, dword [eax]
sar edx, 2
mov dword [ecx], edx
jmp 0x10028668
mov byte [esp + 7], 0
cmp byte [esp + 7], 0
je 0x10028668
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esp, ebp
pop ebp
ret
Function at 0x1002b7de
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov byte [esp], cl
push esi
test cl, cl
je 0x1002b7fc
cmp byte [edx], 0
je 0x1002b81f
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1002b81f
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1002b81f
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xb8c3
inc dword [edx]
cmp dword [edx], 2
jl 0x1002b80d
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1002d825
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060cac
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x5c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002d868
push 1
push 0x2633
push 0x7658
call fcn.1002da42
add esp, 0xc
jmp 0x1002da31
lea eax, [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x28], 0x7de
mov dword [ebp - 0x44], str.lfdqvq_iqj_nsrbybjl_atpvnyym
cmp dword [ebp - 0x28], 0x961
jle 0x1002d8ef
and dword [ebp - 0x14], 0
jmp 0x1002d898
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x24d3
jge 0x1002d8d8
and dword [ebp - 0x18], 0
jmp 0x1002d8ae
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x350a
jge 0x1002d8d6
mov eax, dword [ebp - 0x14]
xor eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
mov ecx, 0x1007ba38
call fcn.10005547
jmp 0x1002d8a7
jmp 0x1002d891
push 0x16d7
push 0x2675
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckDlgButton]
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1002d9e6
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x24], 0x6db4
mov dword [ebp - 0x40], str.linuhxxwa_wvpiw_rfzy_jpicmrs_yrqpcrucc_hrgg_jyf_wzdnf_ygoi
cmp dword [ebp - 0x24], 0x70ed
jle 0x1002d984
and dword [ebp - 0x1c], 0
jmp 0x1002d927
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x437a
jge 0x1002d984
and dword [ebp - 0x20], 0
jmp 0x1002d93d
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x6dca
jge 0x1002d982
mov eax, dword [ebp - 0x1c]
cdq
idiv dword [ebp - 0x20]
mov eax, edx
cdq
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], edx
push dword [ebp - 0x50]
push dword [ebp - 0x54]
lea ecx, [ebp - 0x6c]
call fcn.10002394
pop ecx
pop ecx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
call fcn.10005527
push eax
call fcn.10047752
pop ecx
lea ecx, [ebp - 0x6c]
call fcn.1000551d
jmp 0x1002d936
jmp 0x1002d920
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x1002d9a8
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x6b74
jge 0x1002d9be
push dword [ebp - 0x40]
call fcn.10047752
pop ecx
jmp 0x1002d9da
or dword [ebp - 4], 0xffffffff
jmp 0x1002d9e4
jmp 0x1002d9ee
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x28], 0x78a
jge 0x1002da0b
mov edx, dword [ebp - 0x44]
mov ecx, 0x1007ba38
call fcn.100078f4
jmp 0x1002da27
or dword [ebp - 4], 0xffffffff
jmp 0x1002da31
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002e4be
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002e527
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002e4fb
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
push 0x5c98
push 0
call fcn.100325e0
add esp, 0xc
jmp 0x1002e525
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1002e525
push 0x8b9
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x1002e545
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
push 0
push dword [ebp - 0x1c]
push 0x1f
call fcn.1002d7fb
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1002eb98
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002ebdf
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002ebd5
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002ebd3
push 1
push 0x7d2b
push 0
call fcn.1002e381
add esp, 0xc
jmp 0x1002ebdd
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1002ebf7
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
push 1
push dword [ebp - 0xc]
push 0xa70
call fcn.1002decb
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10032fde
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060dfc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], 0x64b3
mov dword [ebp - 0x24], str.vfkvn_hxxz_caxuie_mdokc
cmp dword [ebp - 0x20], 0x6546
jle 0x100330a3
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
and dword [ebp - 0x1c], 0
jmp 0x10033030
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x326f
jge 0x1003308d
and dword [ebp - 0x14], 0
jmp 0x10033046
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x5986
jge 0x1003308b
and dword [ebp - 0x18], 0
jmp 0x1003305c
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x5d81
jge 0x10033089
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
sar eax, cl
cdq
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], edx
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
mov ecx, 0x1007ba38
call fcn.10005547
jmp 0x10033055
jmp 0x1003303f
jmp 0x10033029
push 0
push 0
push 0x9c
push 0xff3
push 0
call dword [sym.imp.USER32.dll_InsertMenuW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x648e
jge 0x100330bd
mov edx, dword [ebp - 0x24]
mov ecx, 0x1007ba38
call fcn.100078f4
jmp 0x100330d9
or dword [ebp - 4], 0xffffffff
jmp 0x100330e3
push 0x26e3
push 0x2eaf
push 0x406c
push 0x2a27
push 0x3ace
push dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
push 1
push 0x611d
push 0x405
push 1
call fcn.10032ad3
add esp, 0x2c
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100401e2
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061198
call fcn.1005f648
sub esp, 0x20
push ebx
push esi
mov dword [ebp - 0x24], 0x2f44
mov ebx, ecx
cmp dword [ebp - 0x24], 0x3300
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], ebx
jle 0x10040269
xor esi, esi
mov dword [ebp - 0x20], esi
xor edi, edi
mov dword [ebp - 0x1c], 0x1703
mov ebx, edi
mov dword [ebp - 0x18], 0x769
xor esi, esi
mov eax, ebx
mov ecx, 0x1007ba38
xor eax, esi
cdq
push edx
push eax
call fcn.10005547
inc esi
cmp esi, 0x6feb
jl 0x10040223
dec ebx
dec dword [ebp - 0x18]
jne 0x10040221
mov esi, dword [ebp - 0x20]
add edi, esi
dec dword [ebp - 0x1c]
jne 0x10040218
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x6717
jl 0x1004020f
push 0xbec
push 0
call dword [sym.imp.USER32.dll_GetSubMenu]
mov ebx, dword [ebp - 0x28]
cmp byte [ebp + 0xc], 0
je 0x1004028e
call fcn.1003f466
push 0xa
pop ecx
xor edx, edx
div ecx
mov eax, dword [ebp + 0x14]
mov ecx, ebx
add dx, word [eax]
movzx eax, dx
push eax
call fcn.10016f8a
jmp 0x100402ba
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x100402ba
push 1
push 0xb62
push 0x5d07
push 0x3c71
push 0x4897
mov dl, 1
xor cl, cl
call fcn.1003fb4d
add esp, 0x14
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x2dbe
jge 0x100402d6
mov edx, str.aokicb_sxtqnx_vvfzukzk_trwccfo_hmkmukya_fuayplfeb_kusgsrlh_bfw_lahkbrzu_rpmsdmlma
mov ecx, 0x1007ba38
call fcn.100078f4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100413c9
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x100413e0
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x10041402
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x1007f674
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x1007fa00
jl 0x10041410
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x1007fca4
jl 0x10041450
mov ecx, dword [0x100809f0]
xor ecx, dword [0x1007f674]
and ecx, edi
xor ecx, dword [0x100809f0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x1007f670], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x1007fca4]
mov dword [0x10080030], eax
pop esi
ret

Function at 0x100414c2
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, 0x1007f674
mov ecx, dword [esi + 4]
xor ecx, dword [esi]
and ecx, 0x7fffffff
xor ecx, dword [esi]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
add esi, 4
cmp esi, 0x10080034
jl 0x100414c8
pop esi
ret
Function at 0x401000
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x41a008]
jne 0x40100a
repz ret
jmp fcn.00401aed

Function at 0x40557b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.00403271
and dword [ebp - 4], 0
cmp dword [0x41c13c], 0
mov ebx, eax
jne 0x40562c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x4056dd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x4056dd
push eax
call fcn.004031ff
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x41c13c], eax
call esi
push eax
call fcn.004031ff
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x41c140], eax
call esi
push eax
call fcn.004031ff
mov dword [esp], 0x41796c
push edi
mov dword [0x41c144], eax
call esi
push eax
call fcn.004031ff
pop ecx
mov dword [0x41c14c], eax
test eax, eax
je 0x40562c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.004031ff
pop ecx
mov dword [0x41c148], eax
mov eax, dword [0x41c148]
cmp eax, ebx
je 0x405684
cmp dword [0x41c14c], ebx
je 0x405684
push eax
call fcn.0040327a
push dword [0x41c14c]
mov esi, eax
call fcn.0040327a
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x405684
test edi, edi
je 0x405684
call esi
test eax, eax
je 0x40567b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x40567b
test byte [ebp - 0xc], 1
jne 0x405684
or dword [ebp + 0x10], 0x200000
jmp 0x4056bd
mov eax, dword [0x41c140]
cmp eax, ebx
je 0x4056bd
push eax
call fcn.0040327a
pop ecx
test eax, eax
je 0x4056bd
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x4056bd
mov eax, dword [0x41c144]
cmp eax, ebx
je 0x4056bd
push eax
call fcn.0040327a
pop ecx
test eax, eax
je 0x4056bd
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x41c13c]
call fcn.0040327a
pop ecx
test eax, eax
je 0x4056dd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x4056df
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret