joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005d50
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 0x1c]
push ebp
push esi
mov esi, dword [esp + 0x20]
add ebx, 0xffffff4a
push edi
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x28], ebx
lea edx, [esi + 0x2e3]
xor esi, 0xbb4
mov dword [esp + 0x1c], edx
lea ebp, [edi - 0x2985]
mov dword [esp + 0x24], esi
mov eax, ebp
xor edi, 0x2985
xor eax, 0x2e2f
cmp ebx, eax
jge 0x10005de4
lea eax, [ebp + 0x27f1]
cmp edx, eax
jl 0x10005de4
mov eax, edi
xor eax, 0x2b9b
push eax
mov eax, ebp
xor eax, 0x2c0e
push eax
lea eax, [edi + 0x27c7]
push eax
lea eax, [ebp + 0x2e55]
push eax
push dword [0x100f26ac]
lea eax, [edi + 0x2c45]
push eax
lea eax, [edi + 0x2888]
push eax
call fcn.10001af0
mov edx, dword [esp + 0x38]
add esp, 0x1c
xor dword [esp + 0x28], 0x16
mov ebx, eax
lea eax, [ebp + 0x2b9b]
cmp edi, eax
je 0x10005eb8
lea esi, [edi + 0x2e6a]
mov eax, ebp
xor edi, 0x2c0e
lea edx, [esi - 0x475]
xor eax, 0x2cd4
lea ecx, [edx + 0x219]
sub eax, 0x2b8
xor esi, 0x2a8
mov dword [esp + 0x28], eax
sub esi, 0x127
lea eax, [edi - 0x289]
cmp eax, esi
cmove ecx, edx
xor edi, 0x4b
sub edi, 0x229
cmp ecx, edi
je 0x10005e4d
mov eax, dword [0x100f26ac]
mov dword [eax + 0x94], 0x1df876
mov esi, dword [esp + 0x18]
lea eax, [ebp + 0x2c45]
push eax
mov eax, dword [esp + 0x28]
add eax, 0x210
push eax
mov eax, dword [esp + 0x30]
xor eax, 0x612
sub eax, 0x13a
push eax
mov eax, dword [esp + 0x28]
push esi
add eax, 0x2a4
push eax
lea eax, [ebx + 0x33c]
push eax
push ebx
call fcn.10005510
mov ecx, dword [0x100f26ac]
add esp, 0x1c
mov eax, dword [ecx + 0x74]
cmp eax, dword [ecx + 0x78]
je 0x10005f71
mov eax, dword [ecx + 0x11c]
sub eax, 0x136c4a
xor dword [esi], eax
xor ebx, 0x327
pop edi
pop esi
pop ebp
mov eax, ebx
pop ebx
ret
mov eax, dword [0x10141528]
and eax, ebp
sub eax, 0x27f1
cmp ebp, eax
ja 0x10005f71
mov ecx, dword [esp + 0x18]
mov eax, esi
or eax, 0x2cc2
and eax, dword [esp + 0x28]
mov ecx, dword [ecx + 0x30]
mov dword [esp + 0x24], ecx
cmp ecx, eax
jge 0x10005f71
and edx, 0x27f1
mov dword [esp + 0x1c], edx
nop dword [eax]
nop dword [eax + eax]
mov eax, dword [0x100f26ac]
mov edx, edi
mov ecx, dword [0x1014150c]
xor ecx, 0x2c0e
mov eax, dword [eax + 0x98]
xor eax, ebp
add ebx, eax
mov eax, dword [esp + 0x18]
sub edx, dword [eax + 4]
mov eax, dword [eax + 0x40]
sub eax, 0x132c
imul edx, edi
and eax, 0x2888
push eax
mov eax, dword [esp + 0x20]
push ecx
sub eax, ebx
push eax
lea eax, [esi - 0x2888]
xor eax, ebx
push eax
push edx
push 0x10141418
call fcn.1000b360
mov esi, eax
add esp, 0x18
mov eax, dword [esp + 0x24]
mov ecx, esi
or ecx, 0x2cc2
add eax, 4
and ecx, dword [esp + 0x28]
mov dword [esp + 0x24], eax
cmp eax, ecx
jl 0x10005f00
pop edi
pop esi
xor ebx, 0x327
pop ebp
mov eax, ebx
pop ebx
ret
Function at 0x10005f80
Capabilities:
Encode data using xor

Disassembly:
push ecx
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [esp + 0x1c]
add esi, 0x3b
push edi
mov edi, dword [esp + 0x1c]
lea ebx, [ebp - 0x413]
mov eax, esi
mov dword [esp + 0x10], ebx
lea edx, [ebp - 0x26b]
xor eax, 0x476
xor ebp, 0x7aa
add edi, 0x2d
mov dword [esp + 0x18], ebp
cmp ebx, eax
jne 0x1000616c
mov eax, esi
xor eax, 0x4be
cmp ebx, eax
jge 0x1000616c
mov eax, edx
xor eax, 0x706
cmp edi, eax
jle 0x100060fd
mov eax, dword [0x100f26ac]
sub esi, 0x475
push 0x10141418
push edi
or dword [eax + 0x11c], 0x107300
lea eax, [ebx + 0x2a6]
push eax
mov eax, esi
xor eax, 0xe32
push eax
mov eax, ebp
xor eax, 0x241
push edi
push eax
call fcn.10006540
lea ecx, [ebp + 0x3f3]
mov dword [esp + 0x38], eax
push ecx
lea ecx, [edi - 0x66b]
push ecx
lea ecx, [ebx - 0x255]
push ecx
mov ecx, esi
lea eax, [esi + 0x27]
xor ecx, 0x70
push ecx
push dword [0x100f26ac]
push eax
call fcn.10005d50
mov ebx, dword [esp + 0x5c]
add esp, 0x30
mov ecx, dword [0x101414b4]
mov dword [esp + 0x18], eax
cmp ecx, dword [ebx + 0x70]
jae 0x10006072
mov ecx, dword [0x10141418]
add ecx, 0xffefe8a6
add ecx, dword [0x1014148c]
mov dword [0x10141418], ecx
lea eax, [edi - 7]
push eax
lea eax, [ebp + 0x23f]
push eax
mov eax, dword [esp + 0x20]
xor eax, 0x1b3
push eax
lea eax, [ebp - 0x1be]
push eax
mov eax, dword [esp + 0x30]
xor eax, 0xc6a
push eax
push 0x10141418
call fcn.1000d1c0
push dword [esp + 0x34]
lea eax, [ebp + 0x33d]
push eax
mov eax, dword [esp + 0x38]
add eax, 0xffffffec
push esi
push eax
mov eax, edi
xor eax, 0x99b
push eax
lea eax, [edi - 0x5d4]
push ebx
push eax
call fcn.100102a0
lea ecx, [esi + 0x1ba]
sub eax, 0x16d
push ecx
mov ecx, esi
xor ecx, 0x231
push ecx
push ebx
lea ecx, [esi - 0x16d]
push ecx
push eax
call fcn.10008810
add esp, 0x48
lea eax, [ebp + 0x2c0]
pop edi
pop esi
pop ebp
pop ebx
pop ecx
ret
mov eax, dword [0x101414f0]
mov ebx, edi
sub eax, edi
xor eax, 0x2c0e
cmp edi, eax
je 0x1000616c
mov ecx, ebp
mov ebp, dword [esp + 0x10]
or ecx, edx
mov dword [esp + 0x1c], ecx
nop dword [eax + eax]
mov eax, dword [0x101414d4]
add eax, ebp
or eax, 0x2a1c
xor esi, eax
mov eax, dword [esp + 0x2c]
mov eax, dword [eax + 0x70]
or eax, edi
imul eax, dword [0x101414b8]
push eax
mov eax, esi
or eax, 0x2baf
push ecx
xor eax, 0x2e2f
push eax
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
mov eax, dword [0x101414f0]
inc ebx
mov ecx, dword [esp + 0x1c]
sub eax, edi
xor eax, 0x2c0e
cmp ebx, eax
jne 0x10006120
mov ebp, dword [esp + 0x18]
pop edi
pop esi
lea eax, [ebp + 0x2c0]
pop ebp
pop ebx
pop ecx
ret
Function at 0x10008810
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x10]
mov ecx, dword [esp + 8]
push ebp
push esi
mov esi, dword [esp + 0x1c]
push edi
lea edi, [eax - 0x3fd]
add esi, 0xfffffc18
add eax, 0xfffff660
lea ebp, [ecx - 0x2888]
cmp ecx, eax
je 0x100088cf
mov edx, dword [esp + 0x18]
xor edi, 0xd13
xor dword [edx + 0xec], 0xcc65c
mov eax, dword [0x100f26ac]
mov esi, dword [edx + 0x18]
cmp esi, dword [eax + 0x2c]
ja 0x10008914
mov eax, esi
imul eax, esi
inc esi
add dword [0x10141504], eax
mov eax, dword [edx + 0xf0]
add eax, dword [0x1014148c]
xor eax, dword [edx + 0x120]
xor eax, 0x101d69
mov dword [edx + 0x120], eax
mov ecx, dword [0x100f26ac]
mov eax, dword [0x10141518]
add eax, 0x197521
imul eax, dword [ecx + 0x84]
mov dword [ecx + 0x84], eax
mov eax, dword [0x100f26ac]
mov eax, dword [eax + 0x70]
xor eax, 0xc38aa
or dword [edx + 0x74], eax
mov eax, dword [0x100f26ac]
cmp esi, dword [eax + 0x2c]
jbe 0x10008863
xor edi, 0x691
mov eax, edi
pop edi
pop esi
pop ebp
ret
sub esi, edi
cmp ebp, esi
jg 0x10008914
mov ecx, dword [0x100f26ac]
sub esi, ebp
shr esi, 1
push ebx
mov ebx, dword [esp + 0x1c]
inc esi
mov eax, dword [ecx + 0x84]
sub eax, edi
cmp dword [ecx + 4], eax
ja 0x1000890e
mov eax, dword [ebx + 0x100]
or eax, dword [ebx + 0xc0]
imul eax, ebp
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentActCtx]
mov ecx, dword [0x100f26ac]
sub esi, 1
jne 0x100088e5
pop ebx
xor edi, 0x691
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x1000b360
Capabilities:
Create thread
Encode data using xor

Disassembly:
mov eax, dword [esp + 0x18]
push ebx
mov ebx, dword [esp + 0xc]
push ebp
lea ecx, [eax - 0x2a]
xor ebx, 9
lea ebp, [eax + 0x664]
mov eax, dword [esp + 0x1c]
push esi
mov esi, dword [esp + 0x18]
push edi
lea edx, [eax - 0x2baf]
mov dword [esp + 0x1c], edx
mov edx, eax
mov eax, ebx
lea edi, [esi - 0x2bc4]
xor eax, 9
xor edx, 0x2baf
cmp ecx, eax
je 0x1000b57d
mov eax, dword [esp + 0x14]
xor edi, 0x2e6a
xor esi, 0x2bc4
cmp esi, edi
jg 0x1000b3f9
add ecx, 0x3fd
cmp ebx, ecx
jl 0x1000b3f9
xor ebp, 0x449
cmp dword [eax + 0xc0], 0xa40d
ja 0x1000b3e1
mov dword [eax + 0xa8], 0x100f26b0
jmp 0x1000b3f9
mov ecx, dword [eax + 0xa0]
add ecx, 0xffff15c6
add ecx, dword [eax + 0xf8]
or dword [eax + 0x10c], ecx
xor edi, edi
nop dword [eax + eax]
mov ecx, dword [eax + 0x110]
sub ecx, dword [0x10141508]
sub ecx, 0x1ab8ee
imul ecx, dword [eax + 0x84]
mov dword [eax + 0x84], ecx
mov ecx, dword [0x100f26ac]
mov ecx, dword [ecx + 0x10c]
sub ecx, 0x1cd5dd
imul ecx, dword [eax + 0xe4]
mov dword [eax + 0xe4], ecx
mov edx, dword [0x100f26ac]
mov ecx, dword [edx + 0xa8]
mov ebx, dword [edi + ecx]
add edi, 4
mov ecx, dword [eax + 0x110]
sub ecx, dword [edx + 0xf0]
sub ecx, 0x1ab8ef
xor dword [edx + 0x10c], ecx
mov ecx, dword [eax + 0xc0]
sub ecx, 8
xor dword [eax + 0xd8], ecx
mov ecx, dword [eax + 0xb8]
xor ecx, dword [0x10141528]
mov edx, dword [0x100f26ac]
sub ecx, 0x1ab8ee
imul ecx, dword [edx + 0xc0]
mov dword [edx + 0xc0], ecx
movzx ecx, bl
movzx ebx, byte [0x10141478]
imul ebx, ecx
mov ecx, dword [0x100f26ac]
mov edx, dword [ecx + 0x7c]
mov ecx, dword [eax + 0xac]
mov byte [edx + ecx], bl
mov edx, 0x1a55da
mov ecx, dword [0x100f26ac]
inc dword [ecx + 0x7c]
mov esi, dword [0x100f26ac]
mov ecx, dword [esi + 0x94]
xor ecx, dword [eax + 0x100]
add ecx, 0x48d6a
xor dword [0x1014142c], ecx
mov ecx, dword [0x10141518]
add ecx, 0x197520
xor dword [0x10141450], ecx
mov ecx, dword [0x101414f0]
add ecx, 0xfff085d2
add ecx, dword [eax + 0x40]
xor dword [esi + 4], ecx
mov ecx, dword [0x10141488]
add ecx, 0xfff3c756
xor dword [eax + 0x120], ecx
mov ecx, dword [0x1014143c]
sub ecx, dword [eax + 0x9c]
add ecx, 0x93efd99
add dword [eax + 0xa0], ecx
mov ecx, dword [0x100f26ac]
sub edx, dword [ecx + 0x90]
sub edx, dword [eax + 0x120]
add dword [eax + 0xd8], edx
mov ecx, dword [0x10141518]
add ecx, 0x197521
imul ecx, dword [0x10141490]
mov dword [0x10141490], ecx
cmp edi, 0x33180
jl 0x1000b400
pop edi
pop esi
lea eax, [ebp + 0x413]
pop ebp
pop ebx
ret
mov eax, dword [0x10141508]
mov ebx, dword [esp + 0x1c]
or eax, 0x2e6a
add eax, edx
or ebx, 0x2cc2
push eax
mov eax, dword [esp + 0x28]
and edx, ecx
add eax, 0x2bb
xor ecx, 0x2d78
add eax, ebx
push eax
mov eax, dword [0x101414d4]
or eax, 0x2985
imul eax, eax, 0x2baf
push edx
push eax
mov eax, dword [0x100f26ac]
mov eax, dword [eax + 0x94]
xor eax, edi
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
lea eax, [ebp + 0x413]
pop ebp
pop ebx
ret
Function at 0x1000d1c0
Capabilities:
Create pipe
Get common file path

Disassembly:
push ecx
mov ecx, dword [esp + 0x14]
push ebx
mov ebx, dword [esp + 0x14]
add ecx, 0xfffffdab
push ebp
mov ebp, dword [esp + 0x14]
add ebx, 0xffffd839
push esi
push edi
mov edi, dword [esp + 0x2c]
lea edx, [ebp + 0x41d]
mov dword [esp + 0x1c], ecx
xor ebp, 0xd25
mov dword [esp + 0x10], edx
lea esi, [edi - 0x2e55]
xor edi, 0x2e55
mov dword [esp + 0x2c], esi
lea eax, [edi + 0x2bc4]
cmp esi, eax
mov esi, dword [esp + 0x18]
je 0x1000d35c
mov eax, ebx
xor eax, 0x2ad4
cmp ecx, eax
je 0x1000d35c
lea eax, [ebx + 0x2c0e]
cmp ecx, eax
jge 0x1000d29f
mov eax, dword [esp + 0x2c]
xor edi, 0x2c0e
push 0x10141418
add eax, 0x2e2f
push eax
lea eax, [edx - 0x73]
push eax
lea eax, [ebx + 0x2cc2]
push eax
lea eax, [ebx + 0x2e2f]
push eax
push edi
call fcn.1000b5e0
mov eax, dword [esi + 0x84]
add esp, 0x18
cmp eax, dword [esi + 0x5c]
jb 0x1000d293
mov eax, dword [0x100f26ac]
mov eax, dword [eax + 0x110]
xor eax, dword [esi + 0x100]
sub eax, 0x7aa0
imul eax, dword [esi + 0x94]
mov dword [esi + 0x94], eax
jmp 0x1000d35c
mov dword [esi + 0x18], 0x2c4
jmp 0x1000d35c
mov eax, dword [0x100f26ac]
lea ecx, [ebp - 0x2985]
cmp dword [eax + 0x124], ecx
jbe 0x1000d35c
mov ecx, dword [0x101414b8]
lea eax, [ecx + edi]
imul eax, dword [esi + 0x50]
cmp dword [esi + 0xb0], eax
jb 0x1000d35c
mov eax, dword [esi + 0x100]
xor ecx, edx
or ecx, 0x2bc4
and eax, 0x2e6a
push ecx
xor eax, ebx
push eax
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov eax, dword [esi + 4]
sub eax, dword [esp + 0x1c]
add eax, edi
push eax
imul eax, ebx, 0x2d78
sub eax, 0x2bc4
push eax
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [esp + 0x10]
or ebx, 0x27f1
push ebx
mov eax, ecx
and eax, dword [esp + 0x30]
or eax, 0x2b9b
push eax
lea eax, [edi + 0x2d78]
push eax
mov eax, dword [esi + 0xa0]
and eax, dword [esi + 0x14]
push eax
mov eax, ecx
or eax, 0x2bc4
push eax
mov eax, ecx
or eax, 0x2985
push eax
mov eax, dword [0x100f26ac]
mov eax, dword [eax + 0x14]
sub eax, 0x2bc4
push eax
mov eax, dword [0x1014148c]
or eax, ecx
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov eax, dword [0x100f26ac]
pop edi
mov dword [eax + 0x2c], 0x4146cfa4
mov eax, dword [0x10141538]
xor eax, 0x1d0a5a
add dword [esi + 0x40], eax
lea eax, [ebp + 0x396]
pop esi
pop ebp
pop ebx
pop ecx
ret
Function at 0x100102a0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0xc]
push ebp
mov ebp, dword [esp + 0x18]
add ebp, 0xfffffdd2
push esi
push edi
mov edi, dword [esp + 0x28]
lea edx, [ecx + 0x255]
mov esi, ecx
mov dword [esp + 0x18], ebp
lea eax, [ebp + 0x50d]
mov dword [esp + 0x20], edx
xor esi, 0xddb
add edi, 0xfffff998
cmp edx, eax
jge 0x10010429
lea eax, [esi + 0xb8]
cmp ebp, eax
jge 0x10010406
mov eax, edx
xor ecx, 0x27c7
xor eax, 0x764
cmp ecx, eax
jge 0x10010339
mov ecx, dword [esp + 0x14]
cmp dword [ecx + 0xa0], 0x1693a
jbe 0x1001031d
add dword [ecx + 0x110], 0xffff9dc4
jmp 0x10010406
mov ecx, dword [ecx + 0x9c]
mov eax, dword [0x100f26ac]
add ecx, 0x6a35e
mov dword [eax + 0xec], ecx
jmp 0x10010406
push ebx
mov ebx, dword [esp + 0x18]
mov eax, dword [ebx + 0x100]
sub eax, ebp
or eax, 0x27c7
cmp esi, eax
je 0x10010405
mov eax, dword [0x10141518]
or eax, edi
xor eax, 0x27c7
cmp esi, eax
jne 0x10010405
mov ebp, esi
nop dword [eax]
mov eax, dword [0x100f26ac]
mov eax, dword [eax + 0x10c]
and eax, dword [ebx + 4]
or eax, dword [ebx + 0xf4]
push eax
mov eax, dword [0x101414cc]
add eax, esi
push eax
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
mov eax, dword [ebx + 4]
xor eax, dword [ebx + 0x50]
mov ecx, dword [0x100f26ac]
sub eax, edi
push eax
mov eax, dword [ecx + 0x70]
or eax, dword [0x10141448]
and eax, 0x2888
push eax
mov eax, dword [0x10141440]
imul eax, esi
add eax, 0x2e6a
push eax
mov eax, dword [ecx + 0xf0]
xor eax, esi
push eax
mov eax, dword [0x1014153c]
add eax, 0xffffd60b
push ecx
push eax
mov eax, dword [ebx + 0x14]
sub eax, dword [0x101414ac]
push eax
call fcn.100018e0
mov eax, dword [0x10141518]
add ebp, 4
or eax, edi
add esp, 0x1c
xor eax, 0x27c7
cmp ebp, eax
je 0x10010370
mov ebp, dword [esp + 0x1c]
mov edx, dword [esp + 0x24]
pop ebx
lea eax, [edx - 0x194]
cmp ebp, eax
jge 0x10010429
mov edx, dword [0x100f26ac]
mov eax, dword [0x10141490]
add eax, 0xa64c6
add eax, dword [edx + 0x44]
xor dword [edx + 0xec], eax
lea eax, [edi + 0x22e]
pop edi
pop esi
pop ebp
ret
Function at 0xae843d
Capabilities:
Encode data using xor

Disassembly:
xor al, al
mov al, byte [edi]
xor al, bl
mov byte [edi], al
inc edi
cmp edi, ecx
jne fcn.00ae843d
ret
Function at 0x312329d8
Capabilities:
Hide graphical window

Disassembly:
push ebx
mov ebx, eax
call fcn.3123296c
push 4
push 0x1000
push 0x13fff0
push 0
call sub.user32.dll_ShowWindow
test eax, eax
je 0x31232a44
mov edx, dword [0x31440a30]
mov ecx, eax
mov dword [ecx], 0x31440a2c
mov dword [0x31440a30], eax
mov dword [ecx + 4], edx
mov dword [edx], eax
mov edx, eax
add edx, 0x13fff0
mov ecx, edx
sub ecx, 4
mov dword [ecx], 2
mov ecx, 0x13ffe0
sub ecx, ebx
mov dword [0x31440a44], ecx
sub edx, ebx
mov eax, edx
mov dword [0x31440a40], eax
or ebx, 2
mov edx, eax
sub edx, 4
mov dword [edx], ebx
pop ebx
ret
xor eax, eax
mov dword [0x31440a44], eax
xor eax, eax
pop ebx
ret
Function at 0x312338e0
Capabilities:
Hide graphical window

Disassembly:
cmp byte [0x31440055], 0
je 0x31233926
jmp 0x31233914
cmp byte [0x314408dd], 0
jne 0x31233914
push 0
call sub.user32.dll_TrackPopupMenu
mov ecx, 0x31442ae4
mov dl, 1
xor eax, eax
call fcn.31232740
test al, al
je 0x31233926
push 0xa
call sub.user32.dll_TrackPopupMenu
mov ecx, 0x31442ae4
mov dl, 1
xor eax, eax
call fcn.31232740
test al, al
jne 0x312338eb
cmp dword [0x31442ae0], 0
jne 0x31233947
push 4
push 0x1000
push 0x10000
push 0
call sub.user32.dll_ShowWindow
mov dword [0x31442ae0], eax
cmp dword [0x31442ae0], 0
setne al
ret

Function at 0x31234654
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
push ebx
xor ebx, ebx
imul edx, dword [ebx + 0x31434008], 0x8088405
inc edx
mov dword [ebx + 0x31434008], edx
mul edx
mov eax, edx
pop ebx
ret

Function at 0x312361ac
Capabilities:
Write clipboard data

Disassembly:
push ebx
push esi
push edi
push ebp
mov ebx, 0x31442aec
mov edi, 0x31440050
cmp dword [0x31434004], 0
je 0x312361d4
call fcn.31236084
call fcn.3123611c
xor eax, eax
mov dword [0x31434004], eax
cmp dword [0x31442b20], 0
je 0x312361fe
call sub.user32.dll_SetWindowTextW
cmp eax, dword [0x31442b48]
jne 0x312361fe
mov eax, 0x31442b1c
call fcn.31235e00
mov eax, 0x31442b1c
call fcn.312360f0
cmp byte [ebx + 0x28], 0
jne 0x31236218
cmp dword [edi], 0
je 0x31236218
mov eax, dword [edi]
mov esi, eax
xor eax, eax
mov dword [edi], eax
call esi
cmp dword [edi], 0
jne 0x31236209
cmp byte [ebx + 0x28], 2
jne 0x3123622c
cmp dword [section..data], 0
jne 0x3123622c
xor eax, eax
mov dword [ebx + 0xc], eax
call fcn.31235e28
cmp byte [ebx + 0x28], 1
jbe 0x31236240
cmp dword [section..data], 0
je 0x31236263
mov edi, dword [ebx + 0x10]
test edi, edi
je 0x31236263
mov eax, edi
call fcn.31239aec
mov ebp, dword [ebx + 0x10]
mov esi, dword [ebp + 0x10]
cmp esi, dword [ebp + 4]
je 0x31236263
test esi, esi
je 0x31236263
push esi
call sub.user32.dll_SetClipboardData
mov eax, ebx
call fcn.31235e00
cmp byte [ebx + 0x28], 1
jne 0x31236273
call dword [ebx + 0x24]
cmp byte [ebx + 0x28], 0
je 0x31236280
mov eax, ebx
call fcn.312360f0
cmp dword [ebx], 0
jne 0x3123629f
cmp dword [0x31440030], 0
je 0x31236294
call dword [0x31440030]
mov eax, dword [section..data]
push eax
call sub.user32.dll_SetActiveWindow
mov eax, dword [ebx]
mov esi, eax
mov edi, ebx
mov ecx, 0xc
rep movsd dword es:[edi], dword [esi]
jmp 0x31236218

Function at 0x3123a4c7
Capabilities:
Write clipboard data

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
test ebx, ebx
je 0x3123a50b
mov eax, dword [ebx + 4]
cmp dword [eax + 0x18], 0
je 0x3123a50b
mov esi, ebx
mov esi, dword [esi + 4]
mov edi, esi
mov edi, dword [edi + 8]
push dword [esi + 0x18]
push dword [esi + 0xc]
call fcn.3123a25b
push edi
call sub.user32.dll_SetClipboardData
xor eax, eax
mov dword [esi + 8], eax
push ebx
call fcn.3123a1fa
pop ecx
mov eax, 1
jmp 0x3123a50d
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x312431e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x31243289
test eax, edx
je 0x3124328c
push 0
push 0
cmp word [eax - 0xa], 2
je 0x31243209
push edx
mov edx, eax
mov eax, esp
call fcn.3123701c
pop edx
mov eax, dword [esp]
cmp word [edx - 0xa], 2
je 0x3124321f
push eax
lea eax, [esp + 8]
call fcn.3123701c
pop eax
mov edx, dword [esp + 4]
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x3124322e
movzx eax, word [eax]
sub eax, ecx
jmp 0x31243255
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x3124326f
add ecx, 4
js 0x31243246
pop eax
pop ebx
mov ecx, esp
mov edx, dword [ecx]
or edx, dword [ecx + 4]
je 0x3124326c
push eax
mov eax, ecx
mov edx, 2
call fcn.312363c8
pop eax
pop edx
pop edx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x31243253
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x31243255
xor eax, eax
ret
test eax, eax
je 0x3124329c
test edx, edx
jne 0x312431f0
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x312490d4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x312491f9
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.31248ee4
mov esi, eax
mov eax, dword [0x3143fcec]
cmp byte [eax], 0
je 0x312491a1
mov eax, dword [0x3143f794]
call fcn.312347cc
call fcn.31234360
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call fcn.3123be10
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x312490ac]
call fcn.312387c4
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call fcn.3123be10
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call fcn.3123bc80
push eax
call fcn.3123be20
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x31249214
push 0xfffffffffffffff4
call fcn.3123bc80
push eax
call fcn.3123be20
jmp 0x312491dd
push pe_nt_image_headers32
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x3143f6d8]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x31442c40]
call fcn.312388b8
push eax
call sub.user32.dll_GetIconInfo
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_GetKeyboardLayoutList
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x31249200
lea eax, [ebp - 4]
mov edx, dword [0x312490ac]
call fcn.312387d0
ret
Function at 0x3124a3d8
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 4], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x3124a4ae
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 8], 0xffffffff
lea eax, [ebp - 4]
mov edx, ebx
call fcn.31236e44
lea eax, [ebp - 4]
call fcn.31237804
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.31236e7c
push eax
call sub.version.dll_GetFileVersionInfoSizeW
mov ebx, eax
test ebx, ebx
je 0x3124a498
mov eax, ebx
call fcn.312341f8
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x3124a491
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 4]
call fcn.31236e7c
push eax
call sub.version.dll_GetFileVersionInfoW
test eax, eax
je 0x3124a47b
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x3124a4c0
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueW
test eax, eax
je 0x3124a47b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 8], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3124a498
mov eax, dword [ebp - 0x10]
call fcn.31234214
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x3124a4b5
lea eax, [ebp - 4]
call fcn.31236de0
ret

Function at 0x3124b647
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.31236728
mov ebp, eax
push 0
push 0
push ebp
push ebx
push 0
push 0xfde9
call fcn.3123bd28
mov edi, eax
cmp edi, 0x104
jbe 0x3124b66a
mov eax, edi
add eax, eax
call fcn.312341f8
mov esi, eax
jmp 0x3124b66c
mov esi, esp
push edi
push esi
push ebp
push ebx
push 0
push 0xfde9
call fcn.3123bd28
push edi
push esi
call fcn.3123c1d0
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x3124b6a5
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x3124b68f
mov eax, esp
cmp esi, eax
je 0x3124b6b2
mov eax, esi
call fcn.31234214
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x3124b6ec
cmp bl, 0
je 0x3124b6e8
cmp bl, 0x41
jl 0x3124b6e3
cmp bl, 0x5a
jg 0x3124b6e3
or bl, 0x20
xor al, bl
inc esi
jmp 0x3124b6c7
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x3124b62c