joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10031ce4
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x10031cfb
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x10031d1d
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x100743f4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x10074780
jl 0x10031d2b
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x10074a24
jl 0x10031d6b
mov ecx, dword [0x10075770]
xor ecx, dword [0x100743f4]
and ecx, edi
xor ecx, dword [0x10075770]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x100743f0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10074a24]
mov dword [0x10074db0], eax
pop esi
ret
Function at 0x10038644
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10058d84
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1003880d
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x28], 0x1eed
mov dword [ebp - 0x54], str.gukcy_whjbjo_ljzpoxccf_oecwn_pafob_wha_ninjxyz_ffgirqwrp_qhqe
cmp dword [ebp - 0x28], 0x20d7
jle 0x10038751
and dword [ebp - 0x20], 0
jmp 0x100386b2
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x3593
jge 0x10038751
and dword [ebp - 0x18], 0
jmp 0x100386cc
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x336f
jge 0x1003874c
and dword [ebp - 0x1c], 0
jmp 0x100386e2
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x56a3
jge 0x10038747
and dword [ebp - 0x24], 0
jmp 0x100386f8
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x6061
jge 0x10038745
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
sub ecx, eax
add ecx, dword [ebp - 0x24]
mov eax, ecx
cdq
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], edx
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
lea ecx, [ebp - 0x78]
call fcn.10002548
pop ecx
pop ecx
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
call fcn.1000aa46
push eax
call fcn.10040f4c
pop ecx
lea ecx, [ebp - 0x78]
call fcn.1000aa3c
jmp 0x100386f1
jmp 0x100386db
jmp 0x100386c5
jmp 0x100386ab
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x10038784
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x10038782
push 0x1070
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x100387cf
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x100387b2
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 1
jge 0x100387cf
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x50]
call fcn.10001c3d
mov dword [eax], 2
jmp 0x100387a7
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x1eb3
jge 0x100387e5
push dword [ebp - 0x54]
call fcn.10040f4c
pop ecx
jmp 0x10038801
or dword [ebp - 4], 0xffffffff
jmp 0x1003880b
jmp 0x1003881f
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x58], eax
push 1
push dword [ebp - 0x58]
call fcn.1003469d
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42e003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
cmp ebx, ecx
nop
jl 0x42e030
nop
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x42e01e
nop
nop
nop
nop
nop
popal
nop
nop
jmp loc.00401219

Function at 0x2e012dfb
Capabilities:
Encode data using xor

Disassembly:
mov ebx, dword [esp + 0x14]
mov eax, dword [esp + 0x34]
mov ecx, dword [esp + 0x38]
sub dword [esp + 0x28], 0x80000
add ebx, 0x80000
and eax, ecx
mov dword [esp + 0x14], ebx
cmp eax, 0xffffffff
je 0x2e012d9d
mov eax, ebx
cdq
cmp edx, ecx
jl 0x2e012d9d
jg 0x2e012d95
cmp eax, dword [esp + 0x34]
jbe 0x2e012d9d
mov ecx, dword [esp + 0x28]
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
push 0
lea edx, [esp + 0x1c]
push edx
push eax
push ebp
push edi
call dword [0x4127a0]
mov ebx, dword [esp + 0x18]
mov eax, ebp
mov edx, ebx
cmp ebx, 8
jb 0x2e012e9c
mov edi, ebx
shr edi, 3
jmp 0x2e012dd0
movzx ecx, byte [eax]
xor ecx, esi
and ecx, 0xff
mov dword [esp + 0x1c], ecx
mov ecx, esi
mov esi, dword [esp + 0x1c]
shr ecx, 8
xor ecx, dword [esi*4 + 0x411550]
adc eax, 0xb60f0041
jo 0x2e012df4
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x411550]
movzx esi, byte [eax + 2]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x411550]
movzx esi, byte [eax + 3]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x411550]
movzx esi, byte [eax + 4]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x411550]
movzx esi, byte [eax + 5]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x411550]
movzx esi, byte [eax + 6]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x411550]
movzx esi, byte [eax + 7]
xor esi, ecx
and esi, 0xff
shr ecx, 8
xor ecx, dword [esi*4 + 0x411550]
add eax, 8
sub edx, 8
dec edi
mov esi, ecx
jne 0x2e012dd0
mov edi, dword [esp + 0x20]
test edx, edx
je 0x2e012eb9
movzx ecx, byte [eax]
xor ecx, esi
and ecx, 0xff
shr esi, 8
xor esi, dword [ecx*4 + 0x411550]
inc eax
dec edx
jne 0x2e012ea0
cmp ebx, 0x80000
je 0x2e012d61
mov edx, dword [0x41343c]
push ebp
push 0
push edx
call dword [0x41276c]
push edi
call dword [0x412788]
pop ebp
pop edi
mov eax, esi
pop esi
not eax
pop ebx
add esp, 0x14
ret 0x14
Function at 0x100010c0
Capabilities:
Encode data using xor

Disassembly:
or eax, 0xffffffff
xor ecx, ecx
test edx, edx
jbe 0x100010ee
push ebx
push ebp
push esi
mov esi, dword [0x101d12a8]
movzx ebx, byte [ecx + edi]
mov ebp, eax
and ebp, 0xff
xor ebx, ebp
shr eax, 8
xor eax, dword [esi + ebx*4]
inc ecx
cmp ecx, edx
jb 0x100010d2
pop esi
pop ebp
pop ebx
not eax
ret
Function at 0x1012bc90
Capabilities:
Encode data using xor

Disassembly:
mov dl, byte [esp + 8]
push ebp
mov ebp, dword [esp + 0x10]
xor eax, eax
test ebp, ebp
jbe 0x1012bcbc
push ebx
push esi
push edi
mov edi, dword [esp + 0x14]
sub edi, ecx
lea esi, [eax + ecx]
mov bl, byte [edi + esi]
xor bl, dl
xor bl, al
inc eax
mov byte [esi], bl
cmp eax, ebp
jb 0x1012bca8
pop edi
pop esi
pop ebx
mov eax, 1
pop ebp
ret
Function at 0x1012e7d0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
test ecx, ecx
jne 0x1012e7d7
xor eax, eax
ret
push esi
not eax
cmp edx, 8
jb 0x1012e8b4
mov esi, edx
shr esi, 3
push edi
lea esp, [esp]
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x10144c58]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x10144c58]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
inc ecx
shr eax, 8
xor eax, dword [edi*4 + 0x10144c58]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x10144c58]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x10144c58]
movzx edi, byte [ecx + 1]
xor edi, eax
inc ecx
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x10144c58]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x10144c58]
movzx edi, byte [ecx + 1]
inc ecx
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x10144c58]
inc ecx
sub edx, 8
sub esi, 1
jne 0x1012e7f0
pop edi
test edx, edx
je 0x1012e8db
jmp 0x1012e8c0
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x10144c58]
inc ecx
sub edx, 1
jne 0x1012e8c0
not eax
pop esi
ret

Function at 0x1012e8e0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
mov eax, dword [edx]
movsx ecx, cl
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x10144c58]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x10144c58]
mov dword [edx + 8], ecx
ret
Function at 0x1012ea80
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x4c
push ebx
push ebp
mov ebp, dword [esp + 0x60]
push esi
mov esi, eax
push edi
lea eax, [esp + 0x28]
push eax
push esi
call dword [0x1014206c]
test eax, eax
jne 0x1012eaaa
mov eax, 0x200
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x4c
ret
mov eax, dword [esp + 0x28]
mov edx, eax
xor edi, edi
and edx, 1
je 0x1012eac3
mov dword [esp + 0x14], 1
mov edi, dword [esp + 0x14]
test al, 2
je 0x1012eaca
or edi, 2
test al, 4
je 0x1012ead1
or edi, 4
mov ecx, eax
and ecx, 0x10
je 0x1012eadb
or edi, 0x10
test al, 0x20
je 0x1012eae2
or edi, 0x20
test ecx, ecx
je 0x1012eaee
or edi, 0x40000000
jmp 0x1012eaf4
or edi, 0x80000000
or edi, 0x1000000
mov dword [esp + 0x14], edi
test edx, edx
jne 0x1012eb0c
or edi, 0x800000
mov dword [esp + 0x14], edi
push 0
push esi
call dword [0x10142098]
mov dword [esp + 0x1c], eax
cmp eax, 0x28
jbe 0x1012ebc0
mov edi, dword [0x10142094]
push 0
push 0
push 0
push esi
call edi
mov ebx, dword [0x1014203c]
push 0
lea ecx, [esp + 0x1c]
push ecx
push 2
lea edx, [esp + 0x1c]
push edx
push esi
call ebx
push 0
push 0
push 0x24
push esi
call edi
push 0
lea eax, [esp + 0x1c]
push eax
push 4
lea ecx, [esp + 0x2c]
push ecx
push esi
call ebx
mov edx, 0x54ad
cmp word [esp + 0x10], dx
jne 0x1012ebbc
mov eax, dword [esp + 0x20]
lea ecx, [eax + 0x34]
cmp dword [esp + 0x1c], ecx
jbe 0x1012ebbc
push 0
push 0
push eax
push esi
call edi
push 0
lea edx, [esp + 0x1c]
push edx
push 4
lea eax, [esp + 0x30]
push eax
push esi
call ebx
mov eax, dword [esp + 0x24]
cmp eax, 0x5a4d
je 0x1012ebb4
cmp eax, 0x454e
je 0x1012ebb4
cmp eax, 0x454c
je 0x1012ebb4
cmp eax, 0x4550
jne 0x1012ebbc
or dword [esp + 0x14], 0x400000
mov edi, dword [esp + 0x14]
mov eax, dword [esp + 0x60]
test eax, eax
je 0x1012ebca
mov dword [eax], edi
mov eax, dword [esp + 0x64]
test eax, eax
je 0x1012ebd8
mov ecx, dword [esp + 0x1c]
mov dword [eax], ecx
mov esi, dword [esp + 0x40]
mov edi, dword [esp + 0x3c]
test ebp, ebp
je 0x1012ec56
mov edx, dword [esp + 0x34]
mov eax, dword [esp + 0x38]
push 0
sub edx, 0xd53e8000
push 0x989680
sbb eax, 0x19db1de
push eax
push edx
call fcn.1013a150
mov dword [ebp + 4], edx
push 0
mov ecx, edi
sub ecx, 0xd53e8000
mov edx, esi
push 0x989680
sbb edx, 0x19db1de
push edx
push ecx
mov dword [ebp], eax
call fcn.1013a150
mov ecx, dword [esp + 0x30]
mov dword [ebp + 8], eax
mov eax, dword [esp + 0x2c]
push 0
sub eax, 0xd53e8000
push 0x989680
sbb ecx, 0x19db1de
push ecx
push eax
mov dword [ebp + 0xc], edx
call fcn.1013a150
mov dword [ebp + 0x10], eax
mov dword [ebp + 0x14], edx
mov ebx, dword [esp + 0x6c]
test ebx, ebx
je 0x1012ec83
push esi
push edi
lea edx, [esp + 0x1c]
push edx
lea eax, [esp + 0x1c]
push eax
call fcn.1012ea10
movzx ecx, word [esp + 0x20]
movzx edx, word [esp + 0x24]
shl ecx, 0x10
add esp, 0x10
or ecx, edx
mov dword [ebx], ecx
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x4c
ret
Function at 0x1012ed30
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
push edi
mov edi, dword [esp + 0x14]
mov eax, ebx
je 0x1012ee0b
mov eax, dword [esi + 0x3c]
push ebp
xor ebp, ebp
cmp eax, ebp
je 0x1012ed64
cmp dword [esi + 0x40], edi
jae 0x1012ed64
push eax
call fcn.1012fde1
add esp, 4
mov dword [esi + 0x3c], ebp
cmp dword [esi + 0x3c], ebp
jne 0x1012ed7b
lea eax, [edi + edi]
push eax
call fcn.1012fe56
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov ecx, dword [esi + 0x3c]
push edi
push ebx
push ecx
call fcn.10137ed0
add esp, 0xc
cmp edi, ebp
jbe 0x1012ee07
lea ecx, [ecx]
mov edx, dword [esi + 0x3c]
mov bl, byte [edx + ebp]
mov edi, dword [esi + 0x30]
mov eax, dword [esi + 0x38]
movsx ecx, bl
xor ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x10144c58]
shr edi, 8
xor ecx, edi
mov dword [esi + 0x30], ecx
movzx ecx, cl
add ecx, dword [esi + 0x34]
mov edx, eax
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 0x34], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x10144c58]
and edx, 0xfffd
mov dword [esi + 0x38], eax
mov ecx, dword [esi + 0x3c]
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
shr eax, 8
xor al, bl
mov byte [ecx + ebp], al
inc ebp
cmp ebp, dword [esp + 0x18]
jb 0x1012ed90
mov edi, dword [esp + 0x18]
mov eax, dword [esi + 0x3c]
pop ebp
mov edx, dword [esi + 0x20]
test edx, edx
je 0x1012ee44
mov ecx, dword [esi + 0x24]
lea ebx, [ecx + edi]
cmp ebx, dword [esi + 0x28]
jb 0x1012ee2c
pop edi
mov dword [esi + 0x14], 0x30000
pop esi
xor eax, eax
pop ebx
ret 8
push edi
push eax
add ecx, edx
push ecx
call fcn.10137ed0
add esp, 0xc
add dword [esi + 0x24], edi
mov eax, edi
pop edi
pop esi
pop ebx
ret 8
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x1012ee65
push 0
lea edx, [esp + 0x18]
push edx
push edi
push eax
push ecx
call dword [0x1014205c]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
pop esi
xor eax, eax
pop ebx
ret 8
Function at 0x1001a052
Capabilities:
Create pipe
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001a090
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001a08e
push 0x20e9
push 0x8e4
push 0
push 0x76e
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x1001a0a1
push 0x172c
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
mov esp, ebp
pop ebp
ret
Function at 0x1001b25b
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001b35e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001b2b4
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jg 0x1001b35c
mov dword [ebp - 0x28], 1
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0xc]
call fcn.1001b8b2
cmp dword [eax], 0
je 0x1001b2eb
mov eax, 0xfff6
test eax, eax
je 0x1001b2eb
mov dword [ebp - 0x24], 1
jmp 0x1001b2ef
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 8]
cmp dword [eax], 1
je 0x1001b300
mov dword [ebp - 0x10], 1
jmp 0x1001b304
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0xc]
call fcn.1001b8b2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0xc]
call fcn.1001b8b2
mov esi, eax
push 0
mov ecx, dword [ebp - 0xc]
call fcn.1001b8b2
mov ecx, dword [esi]
sub ecx, dword [eax]
cmp dword [ebp - 0x10], ecx
jle 0x1001b34a
mov dword [ebp - 0x2c], 1
jmp 0x1001b34e
and dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x30]
mov dword [eax], 0x426a7609
jmp 0x1001b2a9
jmp 0x1001b377
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1878
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10020c65
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x10020c80
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x10020dcd
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x5c], eax
mov eax, 0x369029ef
test eax, eax
je 0x10020da3
push 1
mov ecx, dword [ebp - 0x18]
call fcn.1001b8b2
mov eax, dword [eax]
add eax, 0x5dda
mov ecx, dword [ebp - 4]
imul eax, dword [ecx]
test eax, eax
jne 0x10020d25
push 0
mov ecx, dword [ebp - 0x44]
call fcn.1001b8b2
cmp dword [eax], 0
jne 0x10020d25
and dword [ebp - 8], 0
jmp 0x10020d2c
mov dword [ebp - 8], 1
push 0
mov ecx, dword [ebp - 0x14]
call fcn.1001b8b2
mov ecx, dword [ebp - 8]
cmp ecx, dword [eax]
je 0x10020d46
mov dword [ebp - 0xc], 1
jmp 0x10020d4a
and dword [ebp - 0xc], 0
cmp dword [ebp - 0xc], 0
je 0x10020d59
mov dword [ebp - 0x10], 1
jmp 0x10020d5d
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
cmp dword [ebp - 0x10], eax
jne 0x10020d70
mov dword [ebp - 0x4c], 1
jmp 0x10020d74
and dword [ebp - 0x4c], 0
push 0
mov ecx, dword [ebp - 0x14]
call fcn.1001b8b2
mov eax, dword [ebp - 0x50]
mov eax, dword [eax]
mov dword [ebp - 0x60], eax
push 2
mov ecx, dword [ebp - 0x54]
call fcn.1001b8b2
imul eax, dword [eax], 0xffff
test eax, eax
je 0x10020da3
mov dword [ebp - 0x1c], 1
jmp 0x10020da7
and dword [ebp - 0x1c], 0
push 1
mov ecx, dword [ebp - 0x18]
call fcn.1001b8b2
mov ecx, dword [ebp - 0x1c]
cmp ecx, dword [eax]
jne 0x10020dc1
mov dword [ebp - 0x20], 1
jmp 0x10020dc5
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x58]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10020e53
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10020f63
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0
jmp 0x10020e7c
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 2
jge 0x10020e8f
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x44], 0x40874b28
jmp 0x10020e75
mov dword [ebp - 8], 0xffffffff
jmp 0x10020e9f
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 2
je 0x10020f61
mov dword [ebp - 0x24], 0xfff7
mov dword [ebp - 0x38], 0xffffffff
cmp dword [ebp - 8], 0xef7d6512
jae 0x10020ec9
mov dword [ebp - 0x18], 1
jmp 0x10020ecd
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x18], eax
jl 0x10020ede
mov dword [ebp - 0x20], 1
jmp 0x10020ee2
and dword [ebp - 0x20], 0
cmp dword [ebp - 8], 0x29d06
jge 0x10020ef4
mov dword [ebp - 0x1c], 1
jmp 0x10020ef8
and dword [ebp - 0x1c], 0
mov eax, dword [ebp - 0x38]
cmp dword [ebp - 0x1c], eax
jne 0x10020f09
mov dword [ebp - 0x28], 1
jmp 0x10020f0d
and dword [ebp - 0x28], 0
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
cmp eax, dword [ebp - 0x28]
jg 0x10020f24
mov dword [ebp - 0x2c], 1
jmp 0x10020f28
and dword [ebp - 0x2c], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x2c], eax
je 0x10020f39
mov dword [ebp - 0x30], 1
jmp 0x10020f3d
and dword [ebp - 0x30], 0
push 4
pop eax
shl eax, 0
mov ecx, dword [ebp - 0x30]
mov dword [ebp + eax - 0x44], ecx
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10020f5c
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x10020e98
jmp 0x10020fbc
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [eax], 0xf
jmp 0x10020f85
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 8
jle 0x10020fbc
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x14], 0
jmp 0x10020fa4
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x12
je 0x10020fba
mov dword [ebp - 0x34], 1
mov eax, dword [ebp - 0x34]
dec eax
mov dword [ebp - 0x34], eax
jmp 0x10020f9d
jmp 0x10020f7a
mov esp, ebp
pop ebp
ret
Function at 0x10026b48
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10026ba3
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10026b84
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10026ba1
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x10]
call fcn.1001b8b2
mov dword [eax], 1
jmp 0x10026b79
jmp 0x10026bcb
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10026bcb
push 1
push 0x1b30
push 0x8fb
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov esp, ebp
pop ebp
ret
Function at 0x1002c2a0
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002c2ba
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x1002c325
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 8], eax
push 0
mov ecx, dword [ebp - 8]
call fcn.1001b8b2
and dword [eax], 0
jmp 0x1002c2ed
push 0
mov ecx, dword [ebp - 8]
call fcn.1001b8b2
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
push 0
mov ecx, dword [ebp - 8]
call fcn.1001b8b2
cmp dword [eax], 2
jg 0x1002c325
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002c323
push 0x1804
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
jmp 0x1002c2d5
mov esp, ebp
pop ebp
ret