joyce8/EMBER2024-capa huggingface dataset:
Function at 0x407820
Capabilities:
Enumerate pe sections
Parse pe header

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff0
sub esp, 0x188
mov eax, dword [0x291014]
xor eax, esp
mov dword [esp + 0x184], eax
push esi
push edi
push 0x104
lea eax, [esp + 0x84]
mov esi, ecx
push eax
push 0
call dword [0x27f0a4]
mov eax, 0x5a4d
cmp word [esi], ax
jne 0x407a09
mov edi, dword [esi + 0x3c]
add edi, esi
cmp dword [edi], 0x4550
jne 0x407a09
push 0x44
lea eax, [esp + 0x3c]
push 0
push eax
call fcn.00433bd0
add esp, 0xc
lea eax, [esp + 0x20]
xorps xmm0, xmm0
movaps xmmword [esp + 0x20], xmm0
push eax
lea eax, [esp + 0x3c]
push eax
push 0
push 0
push 4
push 0
push 0
push 0
push 0
lea eax, [esp + 0xa4]
push eax
call dword [0x27f04c]
test eax, eax
je 0x407a09
push 4
push 0x1000
push 4
push 0
call dword [0x27f094]
push eax
mov dword [esp + 0x1c], eax
mov dword [eax], 0x10007
push dword [esp + 0x28]
call dword [0x27f038]
test eax, eax
je 0x407a09
push 0
push 4
lea eax, [esp + 0x24]
push eax
push 0x287cec
push dword [esp + 0x30]
call dword [0x27f0a8]
mov eax, dword [edi + 0x34]
cmp dword [esp + 0x1c], eax
jne 0x40792c
push 0x287cf0
push 0x287d08
call dword [0x27f07c]
push eax
call dword [0x27f03c]
push dword [esp + 0x1c]
push dword [esp + 0x24]
call eax
mov eax, dword [edi + 0x34]
push 0x40
push 0x3000
push dword [edi + 0x50]
push eax
push dword [esp + 0x30]
call dword [0x27f040]
mov dword [esp + 0x14], eax
test eax, eax
je 0x407a09
push 0
push dword [edi + 0x54]
push esi
push eax
push dword [esp + 0x30]
call dword [0x27f0a0]
xor eax, eax
mov dword [esp + 0x10], 0
cmp ax, word [edi + 6]
jae 0x4079c3
mov dword [esp + 0xc], eax
call fcn.00407670
push eax
call dword [0x27f078]
mov ecx, dword [esp + 0xc]
add ecx, esi
add ecx, dword [esi + 0x3c]
push 0
push dword [ecx + 0x108]
mov eax, dword [ecx + 0x10c]
add eax, esi
push eax
mov eax, dword [ecx + 0x104]
add eax, dword [esp + 0x20]
push eax
push dword [esp + 0x30]
call dword [0x27f0a0]
mov ecx, dword [esp + 0x10]
movzx eax, word [edi + 6]
inc ecx
add dword [esp + 0xc], 0x28
mov dword [esp + 0x10], ecx
cmp ecx, eax
jl 0x407972
push 0
push 4
lea eax, [edi + 0x34]
push eax
mov eax, dword [esp + 0x24]
mov eax, dword [eax + 0xa4]
add eax, 8
push eax
push dword [esp + 0x30]
call dword [0x27f0a0]
mov ecx, dword [esp + 0x18]
mov eax, dword [edi + 0x28]
add eax, dword [esp + 0x14]
push ecx
mov dword [ecx + 0xb0], eax
push dword [esp + 0x28]
call dword [0x27f054]
push dword [esp + 0x24]
call dword [0x27f084]
push 0x8000
push 0
push esi
call dword [0x27f09c]
mov ecx, dword [esp + 0x18c]
mov al, 1
pop edi
pop esi
xor ecx, esp
call fcn.0041cad1
mov esp, ebp
pop ebp
ret
Function at 0x10004156
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060b25
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100041ce
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x100041b0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
and dword [eax], 0
jmp 0x100041c9
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov edx, 0x259277ea
mov ecx, dword [ebp - 0x40]
call fcn.10002cf0
jmp 0x10004338
lea eax, [ebp + 0x18]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x10004207
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
test eax, eax
je 0x10004202
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
jmp 0x10004338
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x18], 0xffffffe5
jmp 0x1000421e
mov eax, dword [ebp - 0x18]
dec eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xffffffe3
jge 0x1000422e
cmp dword [ebp - 0x18], 0
je 0x1000422c
jmp 0x1000422e
jmp 0x10004217
mov dword [ebp - 0x24], 0x1033
mov dword [ebp - 0x58], str.qdcexdsei_gwdhufvd_bnd_rshm_adibhf_ksc_ekqizqwka_arrhsujlf_vpwyme
cmp dword [ebp - 0x24], 0x1166
jle 0x100042b6
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
and dword [ebp - 0x1c], 0
jmp 0x1000425c
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x26bf
jge 0x100042b6
and dword [ebp - 0x20], 0
jmp 0x10004272
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x52fc
jge 0x100042b4
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], edx
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
lea ecx, [ebp - 0x78]
call fcn.10002b6b
pop ecx
pop ecx
mov dword [ebp - 0x54], eax
mov ecx, dword [ebp - 0x54]
call fcn.1001661e
push eax
call fcn.10049d9f
pop ecx
lea ecx, [ebp - 0x78]
call fcn.10016614
jmp 0x1000426b
jmp 0x10004255
mov byte [ebp - 0x11], 0
push 1
push 0x600b
push 0x57b5
push 0xfce
push 0x59bd
push 0
push 0x93
lea eax, [ebp - 0x11]
push eax
push 0x1421
push 0x7ff2
push 0x3e85
push 0x973
push 0x1fd
call fcn.10003057
add esp, 0x34
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0xe68
jge 0x10004312
push dword [ebp - 0x58]
call fcn.10049d9f
pop ecx
jmp 0x1000432e
or dword [ebp - 4], 0xffffffff
jmp 0x10004338
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001bfcd
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100611c1
call fcn.10060610
sub esp, 0x38
mov byte [ebp - 0x18], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x1001c08d
mov dword [ebp - 0x28], 0x6157
cmp dword [ebp - 0x28], 0x6488
jle 0x1001c068
xor esi, esi
mov dword [ebp - 0x24], esi
mov ebx, esi
mov dword [ebp - 0x20], 0x4184
mov dword [ebp - 0x1c], ebx
xor edi, edi
mov esi, ebx
mov ebx, 0x1bef
mov eax, esi
lea ecx, [ebp - 0x40]
cdq
push edx
push eax
call fcn.10002b6b
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001c02c
mov eax, dword [eax]
push eax
call fcn.10049d9f
pop ecx
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.10017003
add esi, edi
dec ebx
jne 0x1001c015
mov ebx, dword [ebp - 0x1c]
dec edi
cmp edi, 0xffff8992
jg 0x1001c00e
dec ebx
dec dword [ebp - 0x20]
mov dword [ebp - 0x1c], ebx
jne 0x1001c00c
mov esi, dword [ebp - 0x24]
inc esi
mov dword [ebp - 0x24], esi
cmp esi, 0x55b
jl 0x1001c000
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
cmp dword [ebp - 0x28], 0x614c
jge 0x1001c1b0
push str.xpcfado_pmwngkso_tvhnvmwpf_uhayuvah_nav_qvxwj_tbcyowrua_bfhhqm_ebbmcpl_kggy_mmfamhvqy_jnxg_ogn
call fcn.10049d9f
pop ecx
jmp 0x1001c1b0
mov dword [ebp - 0x1c], 0x564f
cmp dword [ebp - 0x1c], 0x585c
jle 0x1001c0f1
xor esi, esi
mov dword [ebp - 0x20], esi
xor ebx, ebx
mov dword [ebp - 0x24], 0x2863
xor edi, edi
mov dword [ebp - 0x28], edi
mov esi, edi
mov edi, 0x34ec
mov eax, ebx
mov ecx, 0x1007bf78
xor eax, esi
cdq
push edx
push eax
call fcn.100168d8
dec esi
dec edi
jne 0x1001c0b7
mov edi, dword [ebp - 0x28]
inc edi
mov dword [ebp - 0x28], edi
cmp edi, 0x1955
jl 0x1001c0b0
mov esi, dword [ebp - 0x20]
add ebx, esi
dec dword [ebp - 0x24]
jne 0x1001c0ab
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x757a
jl 0x1001c0a2
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x5453
jge 0x1001c110
mov edx, str.yrkygg_ijwqjp_ujxyux_ivqdti_nvp_fbdi_xvghsn_euf_jzfg_nusgo_vke_dloa_ajdxdr_sjxxhcp
mov ecx, 0x1007bf78
call fcn.1001ac5a
mov esi, dword [ebp + 0x10]
mov dword [esi], 0
cmp dword [esi], 0
jl 0x1001c1b0
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x28], 0x123d4a1c
cmp dword [esi], 0
jne 0x1001c13f
mov eax, dword [edi]
cmp dword [eax], 0
je 0x1001c164
cmp dword [ebp - 0x1c], 0
je 0x1001c164
xor edx, edx
inc edx
jmp 0x1001c166
xor edx, edx
mov eax, dword [esi]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x1c]
setg cl
xor edx, edx
cmp ecx, 0x5358
setle dl
xor ecx, ecx
cmp edx, eax
setl cl
xor edx, edx
sub ecx, dword [esi]
mov eax, dword [ebp - 0x1c]
cmp ecx, 0xaa08ecb3
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
test ecx, ecx
sets al
mov dword [ebp - 0x28], eax
dec dword [esi]
cmp dword [esi], 0
jge 0x1001c125
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001c1e0
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x100611f7
call fcn.10060610
sub esp, 0x24
and dword [ebp - 0x18], 0
lea eax, [ebp - 0x30]
push ebx
push esi
push edi
push fcn.10016a3a
push fcn.10024369
xor edi, edi
mov ebx, ecx
inc edi
mov dword [ebp - 0x14], ebx
push edi
push 0x18
push eax
mov esi, edx
call fcn.1004a06e
push esi
push ecx
mov ecx, dword [ebp + 8]
lea edx, [ebp - 0x30]
mov dword [ebp - 4], edi
call fcn.1001d4e7
mov dword [ebp - 0x10], 0x57e2
cmp dword [ebp - 0x10], 0x5a48
pop ecx
pop ecx
jle 0x1001c292
push 0x191e
call dword [sym.imp.GDI32.dll_GetBkColor]
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, edi
cdq
idiv ebx
mov eax, esi
mov ecx, edx
sar eax, cl
mov ecx, 0x1007bf78
cdq
push edx
push eax
call fcn.100168d8
inc ebx
cmp ebx, 0x6cec
jl 0x1001c247
inc edi
cmp edi, 0xb4b
jl 0x1001c245
inc esi
cmp esi, 0x21bf
jl 0x1001c243
push 0x222a
push 0
push 0x69e
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ebx, dword [ebp - 0x14]
xor edi, edi
inc edi
lea eax, [ebp - 0x30]
mov ecx, ebx
push eax
call fcn.100169ed
push fcn.10016a3a
push edi
push 0x18
lea eax, [ebp - 0x30]
mov dword [ebp - 0x18], edi
push eax
mov byte [ebp - 4], 0
call fcn.10049fa1
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001e408
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100612b4
call fcn.10060610
sub esp, 0x1c
mov byte [ebp - 0x14], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x1001e4ea
mov dword [ebp - 0x20], 0x38ef
cmp dword [ebp - 0x20], 0x3a0c
jle 0x1001e49e
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x18], edi
mov eax, edi
xor ebx, ebx
and eax, esi
mov dword [ebp - 0x24], eax
mov esi, eax
xor edi, edi
mov eax, ebx
mov ecx, 0x1007bf78
cdq
idiv edi
xor edx, esi
mov eax, edx
cdq
push edx
push eax
call fcn.100168d8
inc edi
cmp edi, 0x6f1b
jl 0x1001e44d
inc ebx
cmp ebx, 0x4317
jl 0x1001e44b
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0xa2f
jl 0x1001e440
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x1693
jl 0x1001e43b
push 0x2293
call dword [sym.imp.GDI32.dll_RealizePalette]
push 0
push 0
push 0x1261
push 0x1948
call dword [sym.imp.USER32.dll_PostMessageW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x37e5
jge 0x1001e4ce
mov edx, str.xgczjm_xmjdwc_nyhnnyds
mov ecx, 0x1007bf78
call fcn.1001ac5a
jmp 0x1001e4ec
dec dword [edx]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001e7d4
Capabilities:
Encode data using xor
Query service status

Disassembly:
mov eax, 0x100612c8
call fcn.10060610
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x20], 0x44da
mov edi, edx
xor esi, esi
mov dword [ebp - 0x10], esp
cmp dword [ebp - 0x20], 0x4828
mov ebx, 0x1007bf78
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], ecx
jle 0x1001e86a
mov edi, esi
mov dword [ebp - 0x1c], edi
mov eax, esi
mov dword [ebp - 0x14], esi
mov ecx, esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
mov esi, eax
sar esi, cl
and esi, edi
mov edi, dword [ebp - 0x24]
mov eax, esi
mov ecx, ebx
xor eax, edi
cdq
push edx
push eax
call fcn.100168d8
inc edi
cmp edi, 0x14cf
jl 0x1001e821
mov ecx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
inc ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
push 0
pop esi
cmp ecx, 0x26b8
jl 0x1001e815
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x6583
jl 0x1001e810
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x3c32
jl 0x1001e80b
mov edi, dword [ebp - 0x28]
cmp byte [ebp + 8], 0
je 0x1001e8e2
mov eax, dword [edi]
mov dword [eax + 8], esi
mov eax, dword [edi]
cmp dword [eax + 8], 0x1a
jne 0x1001e8b5
mov ebx, dword [ebp - 0x2c]
push dword [ebp + 0x14]
mov dword [ebp - 0x30], 0xa87fce6b
push dword [ebp + 0x18]
push esi
push 0x1666
push ebx
push dword [ebp + 0x1c]
push ecx
lea ecx, [ebp - 0x30]
call fcn.1001eaf1
mov eax, dword [edi]
add esp, 0x1c
inc dword [eax + 8]
mov eax, dword [edi]
cmp dword [eax + 8], 0x1a
je 0x1001e880
mov ebx, 0x1007bf78
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x446c
jge 0x1001e8d1
mov edx, str.nwjeyn_zbpzncl_dhtftur
mov ecx, ebx
call fcn.1001ac5a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1001e8b5
push esi
push 0x4b11
push 0x4ecf
push esi
mov dl, 1
mov ecx, 0x64c2
call fcn.1001f9c2
mov dword [ebp - 0x14], 0x254b
add esp, 0x10
cmp dword [ebp - 0x14], 0x263c
jle 0x1001e969
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov edi, esi
mov dword [ebp - 0x18], esi
mov ecx, esi
mov dword [ebp - 0x1c], esi
mov eax, edi
mov dword [ebp - 0x30], esi
cdq
idiv ecx
mov edi, edx
mov eax, edi
mov ecx, ebx
and eax, esi
cdq
push edx
push eax
call fcn.100168d8
inc esi
cmp esi, 0xc5f
jl 0x1001e931
mov ecx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x1c], ecx
push 0
pop esi
cmp ecx, 0x2eb3
jl 0x1001e927
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x7f5b
jl 0x1001e922
mov dword [ebp - 4], esi
cmp dword [ebp - 0x14], 0x22c1
jge 0x1001e8b5
mov edx, str.qmzwgow_fnaagghuk_ostwwov
mov ecx, ebx
call fcn.1001ac5a
jmp 0x1001e8b5
Function at 0x10020689
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061330
call fcn.10060610
sub esp, 0x18
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov byte [ebp - 0x14], dl
je 0x1002080b
test dl, dl
je 0x100206d4
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x100206c3
mov dl, 1
push 1
mov cl, dl
call fcn.1001e218
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x24], 0x1e78
cmp dword [ebp - 0x24], 0x2185
jle 0x1002070b
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x1007bf78
xor eax, esi
cdq
push edx
push eax
call fcn.100168d8
inc edi
cmp edi, 0x2e9f
jl 0x100206e8
inc esi
cmp esi, 0x6893
jl 0x100206e6
mov dword [ebp - 0x20], 0xcbf
cmp dword [ebp - 0x20], 0xeac
jle 0x10020770
xor esi, esi
mov dword [ebp - 0x1c], esi
mov ebx, esi
mov dword [ebp - 0x18], 0x23af
xor edi, edi
mov dword [ebp + 0x14], edi
mov esi, edi
mov edi, 0x1a6e
mov ecx, esi
mov eax, ebx
sar eax, cl
mov ecx, 0x1007bf78
cdq
push edx
push eax
call fcn.100168d8
dec esi
dec edi
jne 0x10020735
mov edi, dword [ebp + 0x14]
inc edi
mov dword [ebp + 0x14], edi
cmp edi, 0xd56
jl 0x1002072e
dec ebx
dec dword [ebp - 0x18]
jne 0x10020729
mov esi, dword [ebp - 0x1c]
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x5b9c
jl 0x10020720
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0xc3e
jge 0x1002078c
mov edx, str.enxszkdaw_gtznyf_enlzeal
mov ecx, 0x1007bf78
call fcn.1001ac5a
mov edx, dword [ebp + 0x18]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x100207af
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 9
inc dword [edx]
cmp dword [edx], 3
jl 0x1002079d
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0x1e01
jge 0x100206c3
mov edx, str.svcqkt_gvtnlcm_fiu_uwrouejr_nkayyny_hictjs
mov ecx, 0x1007bf78
call fcn.1001ac5a
jmp 0x100206c3
mov dword [ebp + 0x14], 0x2917
cmp dword [ebp + 0x14], 0x2a0f
jle 0x10020845
xor esi, esi
xor edi, edi
mov eax, esi
mov ecx, 0x1007bf78
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.100168d8
inc edi
cmp edi, 0x4877
jl 0x1002081f
inc esi
cmp esi, 0xb85
jl 0x1002081d
cmp byte [ebp + 0xc], 0
je 0x10020855
mov eax, dword [ebp + 0x24]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x1c]
jmp 0x1002085c
mov eax, dword [ebp + 0x20]
mov ecx, dword [eax]
mov eax, dword [ebx]
mov dword [ebp - 4], 4
cmp dword [ebp + 0x14], 0x2677
mov dword [eax], ecx
jge 0x100206c3
mov edx, str.swtrqbd_pvdvykn_ivym_vygmpr_wpjuthg_vwp
mov ecx, 0x1007bf78
call fcn.1001ac5a
jmp 0x100206c3
Function at 0x1002520f
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100614f3
call fcn.10060610
sub esp, 0x14
push ebx
push esi
mov esi, edx
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x10025381
mov dword [ebp - 0x1c], 0x56
cmp dword [ebp - 0x1c], 0x2c1
jle 0x1002529b
push 0
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
xor edi, edi
mov esi, 0x1007bf78
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov dword [ebp - 0x18], ecx
cdq
idiv ecx
mov ecx, esi
and edx, ebx
xor edx, edi
mov eax, edx
cdq
push edx
push eax
call fcn.100168d8
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x6593
jl 0x10025257
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x19bb
jl 0x10025252
inc ebx
cmp ebx, 0x62e2
jl 0x1002524d
inc edi
cmp edi, 0x8029
jl 0x1002524b
jmp 0x100252a0
mov esi, 0x1007bf78
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0xfffffd80
jge 0x100252da
mov edx, str.isxqih_qqyzxfxet_dvtk_tpeauhlg_ejqqtpmr_fwm_yqms_sjibojdz_erzmecpi_zei_mcbbpx
mov ecx, esi
call fcn.1001ac5a
jmp 0x100252da
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 8], 0
je 0x100252f9
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x20]
and dword [ebp - 0x20], 0
push eax
call fcn.10028971
jmp 0x100253c6
mov dword [ebp - 0x18], 0x2a19
cmp dword [ebp - 0x18], 0x2a64
jle 0x10025343
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
lea ecx, [eax + ebx]
mov eax, edi
sar eax, cl
mov ecx, esi
cdq
push edx
push eax
call fcn.100168d8
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x312c
jl 0x10025312
inc ebx
cmp ebx, 0x74c3
jl 0x1002530d
inc edi
cmp edi, 0xcc3
jl 0x1002530b
call dword [sym.imp.USER32.dll_GetCapture]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x18], 0x28cf
jge 0x100252f4
mov edx, str.dojw_gpdqtns_tjxnhh_tiovt_acckseir_jgnwetuwc_tlzgqvcua
mov ecx, esi
call fcn.1001ac5a
jmp 0x100252f4
cmp byte [ebp + 0xc], 0
je 0x100253a6
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
jmp 0x1002539f
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xd7006986
inc dword [edx]
cmp dword [edx], 3
jl 0x10025392
jmp 0x100253c6
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0x100253c6
push 0
push 0x2414
push 0
push 0x1b80
push 0
push 0x16
call dword [sym.imp.USER32.dll_DrawTextExW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100258f3
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006151b
call fcn.10060610
sub esp, 0x20
push ebx
push esi
mov dword [ebp - 0x20], 0x8b6
xor esi, esi
cmp dword [ebp - 0x20], 0x938
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], ecx
jle 0x1002597c
mov edi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], 0x1bc6
mov ebx, esi
mov dword [ebp - 0x24], esi
mov ecx, ebx
mov esi, edi
mov edi, dword [ebp - 0x24]
shl esi, cl
mov eax, esi
mov ecx, 0x1007bf78
xor eax, edi
cdq
push edx
push eax
call fcn.100168d8
inc edi
cmp edi, 0x162c
jl 0x1002593b
mov edi, dword [ebp - 0x14]
inc ebx
push 0
pop esi
cmp ebx, 0x8059
jl 0x1002592f
dec edi
dec dword [ebp - 0x18]
mov dword [ebp - 0x14], edi
jne 0x1002592d
mov edi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x4b8f
jl 0x10025923
mov dword [ebp - 4], esi
cmp dword [ebp - 0x20], 0x51f
jge 0x10025997
mov edx, str.tumki_hizkpkdr_avxumlcxx
mov ecx, 0x1007bf78
call fcn.1001ac5a
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x24], 0
je 0x100259e1
mov edi, dword [ebp + 0x20]
mov dword [edi], esi
jmp 0x100259da
push dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
xor dl, dl
call fcn.10025cc2
inc dword [edi]
pop ecx
cmp dword [edi], 2
jle 0x100259ca
jmp 0x10025a41
mov ebx, dword [ebp - 0x28]
cmp dword [ebx], esi
jne 0x100259f6
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp dword [eax], esi
jne 0x100259f6
mov edi, dword [ebp + 0x14]
jmp 0x10025a00
mov edi, dword [ebp + 0x14]
cmp dword [edi], esi
je 0x10025a00
xor esi, esi
inc esi
mov eax, dword [ebx]
xor ecx, ecx
cmp eax, esi
mov eax, dword [edi]
setg cl
xor edx, edx
cmp ecx, 0x5358
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebx]
setl cl
xor edx, edx
sub ecx, eax
mov eax, dword [edi]
cmp ecx, 0xaa08ecb3
setne dl
xor ecx, ecx
cmp edx, eax
setne cl
xor eax, eax
test ecx, ecx
mov ecx, dword [ebp - 0x2c]
sets al
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100299d1
Capabilities:
Connect pipe

Disassembly:
mov eax, 0x1006172f
call fcn.10060610
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x14], 0xbfb
mov edi, ecx
cmp dword [ebp - 0x14], 0xfaf
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], edi
jle 0x10029a39
push 0x1148
push 0x5ed
call dword [sym.imp.GDI32.dll_SetTextAlign]
xor esi, esi
mov ebx, esi
mov edi, 0x2b95
mov eax, ebx
mov ecx, 0x1007bf78
cdq
push edx
push eax
call fcn.100168d8
dec ebx
dec edi
jne 0x10029a12
inc esi
cmp esi, 0x6807
jl 0x10029a0b
push edi
push edi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov edi, dword [ebp - 0x18]
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x9ae
jge 0x10029a74
mov edx, str.ozwuvxbgp_ljs_osnczkfv_aggf
mov ecx, 0x1007bf78
call fcn.1001ac5a
jmp 0x10029a74
cmp byte [ebp + 8], 0
je 0x10029a93
push 0
push 0x185b
push 0x218e
push 0x1c8b
call dword [sym.imp.GDI32.dll_GetSystemPaletteEntries]
jmp 0x10029ab0
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
jmp 0x10029aab
mov ecx, dword [edx]
mov eax, dword [edi]
mov dword [eax + ecx*4], 0xd7006986
inc dword [edx]
cmp dword [edx], 3
jl 0x10029a9e
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002a950
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x100617a7
call fcn.10060610
sub esp, 0x14
cmp byte [ebp + 0x1c], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, edx
mov dword [ebp - 0x1c], ecx
je 0x1002aa20
mov dword [ebp - 0x18], 0x544f
xor esi, esi
cmp dword [ebp - 0x18], 0x55ca
jle 0x1002a9dd
mov edi, esi
mov dword [ebp - 0x14], esi
mov ebx, esi
mov eax, edi
mov dword [ebp - 0x1c], esi
cdq
idiv ebx
mov edi, edx
mov ecx, esi
mov eax, edi
shl eax, cl
mov ecx, 0x1007bf78
cdq
push edx
push eax
call fcn.100168d8
inc esi
cmp esi, 0x739d
jl 0x1002a995
mov edi, dword [ebp - 0x14]
inc ebx
push 0
pop esi
cmp ebx, 0x2069
jl 0x1002a98b
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x4160
jl 0x1002a989
push 0x222a
push esi
push 0x69e
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0xffffffff
mov dword [ebp - 4], esi
cmp dword [ebp - 0x18], 0x5300
jge 0x1002aa01
mov edx, str.iwatcy_qwhczdp_jftw_kfprld_prcja_xjeadjb_tgcwxeth_qfxastqii_vpv_ewgwf_skvva_pno_dpigs_ejs
mov ecx, 0x1007bf78
call fcn.1001ac5a
jmp 0x1002aa94
mov eax, dword [ebp + 8]
xor edx, edx
mov ebx, dword [ebp + 0xc]
mov eax, dword [eax]
cmp eax, 0xdef9
mov eax, dword [edi]
sete dl
xor ecx, ecx
cmp eax, edx
setg cl
xor esi, esi
cmp ecx, dword [ebx]
jle 0x1002aa4c
cmp dword [edi], esi
je 0x1002aa4c
xor edi, edi
inc edi
mov esi, edi
jmp 0x1002aa4f
xor edi, edi
inc edi
mov eax, dword [ebp + 8]
xor edx, edx
mov eax, dword [eax]
cmp eax, esi
mov eax, dword [ebp + 0x10]
setge dl
xor ecx, ecx
mov dword [eax], edx
mov eax, dword [ebx]
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0x4204
setg al
cmp eax, 4
mov eax, dword [ebx]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
sete cl
cmp edi, ecx
mov ecx, dword [ebp - 0x1c]
sbb eax, eax
neg eax
sub eax, 0x7a6af303
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret