joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100092fe
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push edi
mov byte [ebp - 0x30], 0x6b
mov byte [ebp - 0x2f], 0x65
mov byte [ebp - 0x2e], 0x72
mov byte [ebp - 0x2d], 0x6e
mov byte [ebp - 0x2c], 0x65
mov byte [ebp - 0x2b], 0x6c
mov byte [ebp - 0x2a], 0x33
mov byte [ebp - 0x29], 0x32
mov byte [ebp - 0x28], 0
mov byte [ebp - 0x24], 0x4c
mov byte [ebp - 0x23], 0x6f
mov byte [ebp - 0x22], 0x61
mov byte [ebp - 0x21], 0x64
mov byte [ebp - 0x20], 0x4c
mov byte [ebp - 0x1f], 0x69
mov byte [ebp - 0x1e], 0x62
mov byte [ebp - 0x1d], 0x72
mov byte [ebp - 0x1c], 0x61
mov byte [ebp - 0x1b], 0x72
mov byte [ebp - 0x1a], 0x79
mov byte [ebp - 0x19], 0x41
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x14], 0x4c
mov byte [ebp - 0x13], 0x6f
mov byte [ebp - 0x12], 0x61
mov byte [ebp - 0x11], 0x64
mov byte [ebp - 0x10], 0x4c
mov byte [ebp - 0xf], 0x69
mov byte [ebp - 0xe], 0x62
mov byte [ebp - 0xd], 0x72
mov byte [ebp - 0xc], 0x61
mov byte [ebp - 0xb], 0x72
mov byte [ebp - 0xa], 0x79
mov byte [ebp - 9], 0x45
mov byte [ebp - 8], 0x78
mov byte [ebp - 7], 0x41
mov byte [ebp - 6], 0
mov byte [ebp - 0x50], 0x56
mov byte [ebp - 0x4f], 0x69
mov byte [ebp - 0x4e], 0x72
mov byte [ebp - 0x4d], 0x74
mov byte [ebp - 0x4c], 0x75
mov byte [ebp - 0x4b], 0x61
mov byte [ebp - 0x4a], 0x6c
mov byte [ebp - 0x49], 0x41
mov byte [ebp - 0x48], 0x6c
mov byte [ebp - 0x47], 0x6c
mov byte [ebp - 0x46], 0x6f
mov byte [ebp - 0x45], 0x63
mov byte [ebp - 0x44], 0
mov byte [ebp - 0x40], 0x56
mov byte [ebp - 0x3f], 0x69
mov byte [ebp - 0x3e], 0x72
mov byte [ebp - 0x3d], 0x74
mov byte [ebp - 0x3c], 0x75
mov byte [ebp - 0x3b], 0x61
mov byte [ebp - 0x3a], 0x6c
mov byte [ebp - 0x39], 0x50
mov byte [ebp - 0x38], 0x72
mov byte [ebp - 0x37], 0x6f
mov byte [ebp - 0x36], 0x74
mov byte [ebp - 0x35], 0x65
mov byte [ebp - 0x34], 0x63
mov byte [ebp - 0x33], 0x74
mov byte [ebp - 0x32], 0
lea eax, [ebp - 0x30]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx]
call edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 4]
push ecx
mov edx, dword [ebp + 8]
mov eax, dword [edx + 4]
call eax
mov ecx, dword [ebp + 8]
mov dword [ecx + 8], eax
lea edx, [ebp - 0x14]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
call edx
mov ecx, dword [ebp + 8]
mov dword [ecx + 0xc], eax
lea edx, [ebp - 0x50]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
call edx
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x10], eax
lea edx, [ebp - 0x40]
push edx
mov eax, dword [ebp - 4]
push eax
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 4]
call edx
mov ecx, dword [ebp + 8]
mov dword [ecx + 0x14], eax
lea edi, [ebp - 0x30]
xor al, al
mov ecx, 9
rep stosb byte es:[edi], al
lea edi, [ebp - 0x24]
xor al, al
mov ecx, 0xd
rep stosb byte es:[edi], al
lea edi, [ebp - 0x14]
xor al, al
mov ecx, 0xf
rep stosb byte es:[edi], al
lea edi, [ebp - 0x50]
xor al, al
mov ecx, 0xd
rep stosb byte es:[edi], al
lea edi, [ebp - 0x40]
xor al, al
mov ecx, 0xf
rep stosb byte es:[edi], al
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1000981e
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
call fcn.10009f3e
mov dword [ebp - 8], eax
mov eax, 1
test eax, eax
je 0x1000987c
mov ecx, dword [ebp - 8]
movzx edx, word [ecx]
cmp edx, 0x5a4d
jne 0x10009871
mov eax, dword [ebp - 8]
mov ecx, dword [eax + 0x3c]
mov dword [ebp - 4], ecx
cmp dword [ebp - 4], 0x40
jb 0x10009871
cmp dword [ebp - 4], 0x400
jae 0x10009871
mov edx, dword [ebp - 4]
add edx, dword [ebp - 8]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
cmp dword [eax], 0x4550
jne 0x10009871
jmp 0x1000987c
mov ecx, dword [ebp - 8]
sub ecx, 1
mov dword [ebp - 8], ecx
jmp 0x1000982c
mov eax, dword [ebp - 8]
mov esp, ebp
pop ebp
ret
Function at 0x10009b5e
Capabilities:
Enumerate pe sections

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
push edi
mov eax, dword [ebp + 0xc]
movzx ecx, word [eax + 0x14]
mov edx, dword [ebp + 0xc]
lea eax, [edx + ecx + 0x18]
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 0xc]
movzx edx, word [ecx + 6]
mov dword [ebp - 0xc], edx
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0xc]
sub ecx, 1
mov dword [ebp - 0xc], ecx
test eax, eax
je 0x10009be5
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp + 8]
add eax, dword [edx + 0xc]
mov dword [ebp - 0x14], eax
mov ecx, dword [ebp - 0x10]
mov edx, dword [ebp + 0x10]
add edx, dword [ecx + 0x14]
mov dword [ebp - 4], edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x10]
mov dword [ebp - 8], ecx
mov ecx, dword [ebp - 8]
mov esi, dword [ebp - 4]
mov edi, dword [ebp - 0x14]
rep movsb byte es:[edi], byte [esi]
mov edx, dword [ebp - 0x10]
mov eax, dword [edx + 0x24]
and eax, 0x20000000
je 0x10009bda
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp - 0x14]
mov dword [ecx], edx
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov edx, dword [ebp - 0x10]
add edx, 0x28
mov dword [ebp - 0x10], edx
jmp 0x10009b81
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000a09c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov esi, 0x400
push esi
mov dword [0x1003aee4], eax
call fcn.10014955
push esi
push 0
push eax
mov dword [0x1003aee8], eax
call fcn.1001c320
add esp, 0x10
xor eax, eax
xor byte [eax + str.._._._..._._.__], 0x2e
inc eax
cmp eax, 0x1000
jl 0x1000a0cb
push 0x1000
lea eax, [esp + 0x14]
push str.._._._..._._.__
push eax
call fcn.100068ca
lea eax, [esp + 0x1c]
push eax
call fcn.10006926
add esp, 0x10
jmp 0x1000a19a
lea eax, [esp + 0x10]
push eax
call fcn.10006926
movzx edi, ax
lea eax, [esp + 0x14]
push eax
call fcn.10006926
movsx ebx, si
pop ecx
pop ecx
movzx ecx, ax
mov eax, dword [0x1003aee8]
shl ebx, 3
lea esi, [ebx + eax]
movsx eax, di
dec eax
mov word [esi], di
je 0x1000a179
dec eax
je 0x1000a162
dec eax
jne 0x1000a18f
movsx edi, cx
push edi
call fcn.10014955
pop ecx
push edi
mov dword [esi + 4], eax
lea eax, [esp + 0x14]
push edi
push eax
invalid

Function at 0x1000a870
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
inc dword [0x10037e88]
push 0x27
pop edx
call fcn.1000a050
cmp ax, 1
jne 0x1000a88d
pop ebp
jmp fcn.1000a81b
xor eax, eax
push eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 8]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x1000a8a1
Capabilities:
Create thread
Terminate process

Disassembly:
push 0x37
pop edx
call fcn.1000a050
push 0x27
pop edx
cmp ax, 1
jne 0x1000a8d2
call fcn.1000a050
cmp ax, 1
jne 0x1000a8ca
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1000a8bd
push 0
call dword [sym.imp.KERNEL32.dll_ExitThread]
call fcn.1000a050
cmp ax, 1
jne 0x1000a8fa
push 0xffffffffffffffff
xor eax, eax
push eax
push eax
push eax
push dword [sym.imp.KERNEL32.dll_ExitProcess]
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
ret
push 0
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x1000ac5c
Capabilities:
Impersonate user

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
push edi
call fcn.1000a946
push 0x10037e90
push 3
push 9
push dword [ebp + 0x10]
push dword [ebp + 8]
push dword [ebp + 0xc]
call dword [sym.imp.ADVAPI32.dll_LogonUserA]
test eax, eax
jne 0x1000ac98
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x18
call fcn.10001ea6
pop ecx
pop ecx
jmp 0x1000ad75
push dword [0x10037e90]
call dword [sym.imp.ADVAPI32.dll_ImpersonateLoggedOnUser]
test eax, eax
jne 0x1000acb3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push 0x19
jmp 0x1000ac8c
push 0x800
call fcn.10006863
pop ecx
mov esi, 0x200
push esi
push eax
mov dword [0x10037ea0], eax
call fcn.10006951
push esi
push dword [0x10037ea0]
mov dword [0x10037e94], eax
call fcn.10006951
push 0x400
push dword [0x10037ea0]
mov dword [0x10037e98], eax
call fcn.10006951
mov edi, 0x100
push edi
push dword [0x10037e98]
mov dword [0x10037e9c], eax
push dword [ebp + 0xc]
call fcn.100028ec
add esp, 0x24
push edi
push dword [0x10037e94]
push dword [ebp + 8]
call fcn.100028ec
add esp, 0xc
push esi
push dword [0x10037e9c]
push dword [ebp + 0x10]
call fcn.100028ec
add esp, 0xc
push dword [ebp + 0xc]
mov edi, 0x400
push dword [0x10037e90]
mov dword [0x10037ea4], 1
call fcn.1000a983
pop ecx
pop ecx
test eax, eax
je 0x1000ad75
mov eax, dword [ebp + 0xc]
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
test dl, dl
jne 0x1000ad5e
sub eax, ecx
push 0xf
push eax
push dword [ebp + 0xc]
call fcn.100012cf
add esp, 0xc
pop edi
pop esi
pop ecx
pop ebp
ret

Function at 0x1000ae16
Capabilities:
Get token membership

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
lea eax, [ebp - 8]
push eax
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x220
push 0x20
push 2
lea eax, [ebp - 0x10]
push eax
mov byte [ebp - 0x10], bl
mov byte [ebp - 0xf], bl
mov byte [ebp - 0xe], bl
mov byte [ebp - 0xd], bl
mov byte [ebp - 0xc], bl
mov byte [ebp - 0xb], 5
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov dword [ebp - 4], eax
cmp eax, ebx
je 0x1000ae74
lea eax, [ebp - 4]
push eax
push dword [ebp - 8]
push ebx
call dword [sym.imp.ADVAPI32.dll_CheckTokenMembership]
test eax, eax
jne 0x1000ae6b
mov dword [ebp - 4], ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_FreeSid]
mov eax, dword [ebp - 4]
pop ebx
leave
ret
Function at 0x1000af96
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
push esi
xor esi, esi
push 0
push 1
lea eax, [esi + edi]
push eax
push dword [ebp + 8]
call dword [sym.imp.WS2_32.dll_recv]
test eax, eax
jle 0x1000afce
add esi, eax
cmp esi, 2
jb 0x1000afc6
cmp byte [esi + edi - 1], 0xa
jne 0x1000afc6
cmp byte [esi + edi - 2], 0xd
je 0x1000afd4
cmp esi, 0x800
jb 0x1000af9c
or eax, 0xffffffff
pop esi
pop ebp
ret
mov byte [esi + edi - 2], 0
mov eax, esi
jmp 0x1000afd1

Function at 0x1000b041
Capabilities:
Create tcp socket
Create udp socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push esi
call fcn.100025b5
push 0
push 1
push 2
call sub.WS2_32.dll_socket
mov esi, eax
cmp esi, 0xffffffff
jne 0x1000b067
push eax
call sub.WS2_32.dll_closesocket
jmp 0x1000b0bb
push 2
pop eax
push dword [ebp + 8]
mov word [ebp - 0x10], ax
call sub.WS2_32.dll_htons
mov word [ebp - 0xe], ax
push 0x10
lea eax, [ebp - 0x10]
push eax
push esi
mov dword [ebp - 0xc], 0x100007f
call dword [sym.imp.WS2_32.dll_bind]
cmp eax, 0xffffffff
jne 0x1000b096
push esi
jmp 0x1000b060
push 0x78
push esi
call dword [sym.imp.WS2_32.dll_listen]
cmp eax, 0xffffffff
je 0x1000b093
push dword [ebp + 0xc]
push esi
call fcn.1000aefd
push eax
push 0x1000afdd
call fcn.1000a870
add esp, 0x10
pop esi
leave
ret
Function at 0x1000b29b
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, dword [ebp + 8]
mov esi, eax
xor edx, edx
push 3
lea eax, [edi + 2]
pop ebx
div ebx
mov ecx, dword [ebp + 0x10]
shl eax, 2
inc eax
cmp dword [ecx], eax
jae 0x1000b2c5
push 6
mov dword [ecx], eax
pop eax
jmp 0x1000b3a7
xor edx, edx
push 3
mov eax, edi
pop ebx
div ebx
mov ecx, dword [ebp + 0xc]
xor edx, edx
imul eax, eax, 3
test eax, eax
jbe 0x1000b344
dec eax
push ebx
pop edi
div edi
mov edi, eax
inc edi
mov edx, edi
imul edx, edx, 3
movzx eax, byte [esi]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], al
movzx eax, byte [esi + 1]
movzx ebx, byte [esi]
shr eax, 4
shl ebx, 4
add eax, ebx
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 2]
movzx ebx, byte [esi + 1]
shr eax, 6
lea eax, [eax + ebx*4]
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
movzx eax, byte [esi + 2]
and eax, 0x3f
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
add esi, 3
dec edi
jne 0x1000b2e7
mov edi, dword [ebp + 8]
cmp edx, edi
jae 0x1000b39a
movzx eax, byte [esi]
inc edx
cmp edx, edi
jae 0x1000b356
movzx esi, byte [esi + 1]
jmp 0x1000b358
xor esi, esi
mov ebx, eax
shr ebx, 2
and ebx, 0x3f
mov bl, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [ecx], bl
shl eax, 4
mov ebx, esi
shr ebx, 4
add ebx, eax
and ebx, 0x3f
mov al, byte [ebx + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
inc ecx
mov byte [ecx], al
inc ecx
cmp edx, edi
jae 0x1000b390
and esi, 0xf
movsx eax, byte [esi*4 + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
jmp 0x1000b393
push 0x3d
pop eax
mov byte [ecx], al
inc ecx
mov byte [ecx], 0x3d
inc ecx
mov eax, dword [ebp + 0x10]
mov byte [ecx], 0
sub ecx, dword [ebp + 0xc]
mov dword [eax], ecx
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1000cc1c
Capabilities:
Hash data using sha256

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor ecx, ecx
mov dword [eax + 0x28], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
mov dword [eax + 8], 0x6a09e667
mov dword [eax + 0xc], 0xbb67ae85
mov dword [eax + 0x10], 0x3c6ef372
mov dword [eax + 0x14], 0xa54ff53a
mov dword [eax + 0x18], 0x510e527f
mov dword [eax + 0x1c], 0x9b05688c
mov dword [eax + 0x20], 0x1f83d9ab
mov dword [eax + 0x24], 0x5be0cd19
xor eax, eax
pop ebp
ret

Function at 0x1000ce61
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [0x10033c78]
mov ebx, eax
push edi
mov eax, esi
call fcn.1000dc11
test eax, eax
jne 0x1000cf63
mov ecx, dword [0x10033c7c]
cmp ecx, 1
jl 0x1000cf60
cmp ecx, 0x80
jg 0x1000cf60
mov eax, dword [ebp + 0xc]
xor edx, edx
div ecx
test edx, edx
jne 0x1000cf60
test cl, 3
jne 0x1000cf60
mov edx, esi
imul edx, edx, 0x60
mov edx, dword [edx + 0x10037ee0]
test edx, edx
je 0x1000ced9
push 0x10033d00
push 0x10033c80
push eax
push ebx
push dword [ebp + 8]
call edx
add esp, 0x14
jmp 0x1000cf63
cmp dword [ebp + 0xc], 0
je 0x1000cf5c
mov edi, 0x10033c80
jmp 0x1000ceec
mov esi, dword [0x10033c78]
xor edx, edx
test ecx, ecx
jle 0x1000cf13
mov ecx, dword [ebp + 8]
sub ecx, edi
lea eax, [edx + 0x10033c80]
mov esi, dword [ecx + eax]
xor dword [eax], esi
add edx, 4
cmp edx, dword [0x10033c7c]
jl 0x1000cef7
mov esi, dword [0x10033c78]
imul esi, esi, 0x60
push 0x10033d00
push ebx
push edi
call dword [esi + 0x10037ec4]
add esp, 0xc
test eax, eax
jne 0x1000cf63
mov ecx, dword [0x10033c7c]
xor edx, edx
test ecx, ecx
jle 0x1000cf52
mov esi, ebx
sub esi, edi
lea eax, [edx + 0x10033c80]
mov ecx, dword [esi + eax]
mov dword [eax], ecx
mov ecx, dword [0x10033c7c]
add edx, 4
cmp edx, ecx
jl 0x1000cf3a
add dword [ebp + 8], ecx
add ebx, ecx
sub dword [ebp + 0xc], ecx
jne 0x1000cee6
xor eax, eax
jmp 0x1000cf63
push 0x10
pop eax
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1000d2a2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x10031628]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [0x10034da0]
push edi
mov ebx, ecx
mov edi, edx
mov eax, esi
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x18], edi
call fcn.1000dc11
test eax, eax
jne 0x1000d3af
mov ecx, dword [0x10034da4]
cmp ecx, 1
jl 0x1000d3ac
cmp ecx, 0x80
jg 0x1000d3ac
mov eax, dword [ebp + 8]
xor edx, edx
div ecx
test edx, edx
jne 0x1000d3ac
test cl, 3
jne 0x1000d3ac
mov ecx, esi
imul ecx, ecx, 0x60
mov ecx, dword [ecx + 0x10037ee4]
test ecx, ecx
je 0x1000d32d
push 0x10034e28
push 0x10034da8
push eax
push edi
push ebx
call ecx
add esp, 0x14
jmp 0x1000d3af
cmp dword [ebp + 8], 0
je 0x1000d3a8
jmp 0x1000d33b
mov esi, dword [0x10034da0]
imul esi, esi, 0x60
push 0x10034e28
lea eax, [ebp - 0x14]
push eax
push ebx
call dword [esi + 0x10037ec8]
add esp, 0xc
test eax, eax
jne 0x1000d3af
mov eax, dword [0x10034da4]
xor edi, edi
test eax, eax
jle 0x1000d398
mov ecx, dword [ebp - 0x18]
lea esi, [ebp - 0x14]
mov eax, 0x10034da8
sub esi, ebx
sub ebx, eax
sub ecx, eax
mov dword [ebp - 0x20], ecx
lea eax, [edi + 0x10034da8]
lea edx, [ebx + eax]
mov ecx, dword [esi + edx]
xor ecx, dword [eax]
mov edx, dword [edx]
mov dword [eax], edx
mov edx, dword [ebp - 0x20]
mov dword [edx + eax], ecx
mov eax, dword [0x10034da4]
add edi, 4
cmp edi, eax
jl 0x1000d374
mov ebx, dword [ebp - 0x1c]
add dword [ebp - 0x18], eax
add ebx, eax
sub dword [ebp + 8], eax
mov dword [ebp - 0x1c], ebx
jne 0x1000d335
xor eax, eax
jmp 0x1000d3af
push 0x10
pop eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001c12e
leave
ret
Function at 0x1000e2f8
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, dword [ebx + 0x70]
mov eax, esi
call fcn.1000e1e8
test eax, eax
jne 0x1000e438
imul esi, esi, 0x68
push edi
mov edi, dword [esi + 0x10038fb0]
push dword [esi + 0x10038fb4]
mov dword [ebp - 8], edi
call fcn.10014955
push edi
mov dword [ebp - 4], eax
call fcn.10014955
cmp dword [ebp - 4], 0
pop ecx
mov edi, eax
pop ecx
mov dword [ebp - 0xc], edi
je 0x1000e429
test edi, edi
je 0x1000e420
push edi
push ebx
call dword [esi + 0x10039004]
mov edi, eax
xor eax, eax
pop ecx
pop ecx
cmp edi, eax
jne 0x1000e3fe
cmp dword [esi + 0x10038fb4], eax
jbe 0x1000e384
mov ecx, dword [ebx + 0xe8]
mov cl, byte [ecx + eax]
mov edx, dword [ebp - 4]
xor cl, 0x5c
mov byte [eax + edx], cl
inc eax
cmp eax, dword [esi + 0x10038fb4]
jb 0x1000e369
push ebx
call dword [esi + 0x10038ffc]
mov edi, eax
pop ecx
test edi, edi
jne 0x1000e3fe
push dword [esi + 0x10038fb4]
push dword [ebp - 4]
push ebx
call dword [esi + 0x10039000]
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x1000e3fe
push dword [ebp - 8]
push dword [ebp - 0xc]
push ebx
call dword [esi + 0x10039000]
mov edi, eax
add esp, 0xc
test edi, edi
jne 0x1000e3fe
push dword [ebp - 4]
push ebx
call dword [esi + 0x10039004]
pop ecx
pop ecx
mov edi, eax
xor ecx, ecx
cmp edi, ecx
jne 0x1000e3fe
cmp dword [ebp - 8], ecx
jbe 0x1000e3f7
mov esi, dword [ebp - 4]
sub esi, dword [ebp + 8]
mov eax, dword [ebp + 0xc]
cmp ecx, dword [eax]
jae 0x1000e3f7
mov eax, dword [ebp + 8]
add eax, ecx
mov dl, byte [esi + eax]
inc ecx
mov byte [eax], dl
cmp ecx, dword [ebp - 8]
jb 0x1000e3e0
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
xor edi, edi
push dword [ebx + 0xe8]
call fcn.10014878
push dword [ebp - 0xc]
call fcn.10014878
push dword [ebp - 4]
call fcn.10014878
add esp, 0xc
mov eax, edi
jmp 0x1000e437
push dword [ebp - 4]
call fcn.10014878
pop ecx
test edi, edi
je 0x1000e434
push edi
call fcn.10014878
pop ecx
push 0xd
pop eax
pop edi
pop esi
leave
ret
Function at 0x1000e43b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov ebx, eax
call fcn.1000e1e8
test eax, eax
jne 0x1000e476
push esi
mov esi, ebx
imul esi, esi, 0x68
mov dword [edi + 0x70], ebx
mov eax, dword [esi + 0x10038fb0]
push dword [esi + 0x10038fb4]
mov dword [ebp - 4], eax
call fcn.10014955
pop ecx
mov dword [ebp - 8], eax
test eax, eax
jne 0x1000e479
push 0xd
pop eax
pop esi
pop ebx
leave
ret
push dword [esi + 0x10038fb4]
call fcn.10014955
pop ecx
mov dword [edi + 0xe8], eax
test eax, eax
jne 0x1000e49f
push 0xd
pop ebx
push dword [ebp - 8]
call fcn.10014878
pop ecx
mov eax, ebx
jmp 0x1000e475
mov ecx, dword [esi + 0x10038fb4]
cmp ecx, 0x10
jae 0x1000e4e7
mov dword [ebp - 0xc], ecx
lea ecx, [ebp - 0xc]
push ecx
push eax
push 0x10
push 0x10036f80
mov eax, ebx
call fcn.1000d4fe
mov ebx, eax
add esp, 0x10
test ebx, ebx
jne 0x1000e567
mov eax, dword [esi + 0x10038fb4]
cmp dword [ebp - 4], eax
jae 0x1000e517
sub eax, dword [ebp - 4]
push eax
mov eax, dword [edi + 0xe8]
add eax, dword [ebp - 4]
jmp 0x1000e50f
push 0x10
push 0x10036f80
push eax
call fcn.1001b130
mov eax, dword [esi + 0x10038fb4]
add esp, 0xc
cmp eax, 0x10
jbe 0x1000e517
add eax, 0xfffffff0
push eax
mov eax, dword [edi + 0xe8]
add eax, 0x10
push eax
call fcn.1000e1b5
pop ecx
pop ecx
xor eax, eax
cmp dword [esi + 0x10038fb4], eax
jbe 0x1000e53c
mov ecx, dword [edi + 0xe8]
mov cl, byte [ecx + eax]
mov edx, dword [ebp - 8]
xor cl, 0x36
mov byte [eax + edx], cl
inc eax
cmp eax, dword [esi + 0x10038fb4]
jb 0x1000e521
push edi
call dword [esi + 0x10038ffc]
mov ebx, eax
pop ecx
test ebx, ebx
jne 0x1000e567
push dword [esi + 0x10038fb4]
push dword [ebp - 8]
push edi
call dword [esi + 0x10039000]
mov ebx, eax
add esp, 0xc
test ebx, ebx
je 0x1000e492
push dword [edi + 0xe8]
call fcn.10014878
pop ecx
jmp 0x1000e492
Function at 0x1001c12e
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10031628]
jne 0x1001c138
repz ret
jmp fcn.1001fb12

Function at 0x1001d095
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.10019340
and dword [ebp - 4], 0
cmp dword [0x100337dc], 0
mov ebx, eax
jne 0x1001d146
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x1001d1f7
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x1001d1f7
push eax
call fcn.100192ce
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x100337dc], eax
call esi
push eax
call fcn.100192ce
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x100337e0], eax
call esi
push eax
call fcn.100192ce
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x100337e4], eax
call esi
push eax
call fcn.100192ce
pop ecx
mov dword [0x100337ec], eax
test eax, eax
je 0x1001d146
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.100192ce
pop ecx
mov dword [0x100337e8], eax
mov eax, dword [0x100337e8]
cmp eax, ebx
je 0x1001d19e
cmp dword [0x100337ec], ebx
je 0x1001d19e
push eax
call fcn.10019349
push dword [0x100337ec]
mov esi, eax
call fcn.10019349
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1001d19e
test edi, edi
je 0x1001d19e
call esi
test eax, eax
je 0x1001d195
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1001d195
test byte [ebp - 0xc], 1
jne 0x1001d19e
or dword [ebp + 0x10], 0x200000
jmp 0x1001d1d7
mov eax, dword [0x100337e0]
cmp eax, ebx
je 0x1001d1d7
push eax
call fcn.10019349
pop ecx
test eax, eax
je 0x1001d1d7
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1001d1d7
mov eax, dword [0x100337e4]
cmp eax, ebx
je 0x1001d1d7
push eax
call fcn.10019349
pop ecx
test eax, eax
je 0x1001d1d7
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x100337dc]
call fcn.10019349
pop ecx
test eax, eax
je 0x1001d1f7
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x1001d1f9
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4021f0
Capabilities:
Change the wallpaper

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x42282d
mov eax, dword fs:[0]
push eax
sub esp, 8
push esi
push edi
mov eax, dword [0x431014]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
push 3
push str.C:wal.bmp
push 0
push 0x14
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
test eax, eax
jne 0x4022bd
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
push ecx
call fcn.00404320
add esp, 4
mov ecx, eax
call fcn.004022f0
mov esi, eax
mov ecx, dword [esi]
mov ecx, dword [ecx + 4]
mov ecx, dword [ecx + esi + 0x30]
mov ecx, dword [ecx + 4]
mov dword [ebp - 0x10], ecx
mov edx, dword [ecx]
call dword [edx + 4]
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 0
push eax
call fcn.00404a00
add esp, 4
mov ecx, eax
mov edx, dword [eax]
push 0xa
call dword [edx + 0x30]
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
movzx edi, ax
test ecx, ecx
je 0x40229b
mov eax, dword [ecx]
call dword [eax + 8]
test eax, eax
je 0x40229b
mov edx, dword [eax]
mov ecx, eax
push 1
call dword [edx]
push edi
mov ecx, esi
call fcn.00404fa0
mov ecx, esi
call fcn.00403f60
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
push 0x40
push str.Message
push str.DEATH
push 0
call dword [sym.imp.USER32.dll_MessageBoxW]
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret