joyce8/EMBER2024-capa huggingface dataset:
Function at 0x423a44
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffff778
push ebx
push esi
xor ecx, ecx
mov dword [ebp - 4], ecx
xor ecx, ecx
push ebp
push 0x423b69
push dword fs:[ecx]
mov dword fs:[ecx], esp
push 0x400
lea ecx, [ebp - 0x888]
call fcn.0042384c
mov esi, eax
mov eax, dword [0x4dc95c]
cmp byte [eax], 0
je 0x423b11
mov eax, dword [0x4dc7d8]
call fcn.0040718c
call fcn.00406518
push 0
push 0
push 0
push 0
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
mov ebx, eax
push ebx
lea eax, [ebp - 4]
mov ecx, 1
mov edx, dword [0x423a14]
call fcn.0040b308
add esp, 4
push 0
push 0
push ebx
mov eax, dword [ebp - 4]
push eax
push esi
lea eax, [ebp - 0x888]
push eax
push 0
push 1
call sub.kernel32.dll_WideCharToMultiByte_1
push 0
lea eax, [ebp - 8]
push eax
push ebx
mov eax, dword [ebp - 4]
push eax
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
push 0
lea eax, [ebp - 8]
push eax
push 2
push 0x423b84
push 0xfffffffffffffff4
call sub.kernel32.dll_GetStdHandle_1
push eax
call sub.kernel32.dll_WriteFile_1
jmp 0x423b4d
push 0x40
lea eax, [ebp - 0x88]
push eax
mov eax, dword [0x4dc798]
mov eax, dword [eax + 4]
push eax
mov eax, dword [0x4dfc48]
call fcn.0040b4ec
push eax
call sub.user32.dll_LoadStringW_1
push 0x2010
lea eax, [ebp - 0x88]
push eax
lea eax, [ebp - 0x888]
push eax
push 0
call sub.user32.dll_MessageBoxW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x423b70
lea eax, [ebp - 4]
mov edx, dword [0x423a14]
call fcn.0040b42c
ret

Function at 0x42538c
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00409910
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040cddc
mov edi, eax
cmp edi, 0x104
jbe 0x425333
mov eax, edi
add eax, eax
call fcn.004063c4
mov esi, eax
jmp 0x425335
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.0040cddc
mov eax, esi
push eax
call sub.user32.dll_CharUpperW
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x425370
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x42535a
mov eax, esp
cmp esi, eax
je 0x42537d
mov eax, esi
call fcn.004063e0
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x4253b8
cmp bl, 0
je 0x4253b4
cmp bl, 0x41
jl 0x4253af
cmp bl, 0x5a
jg 0x4253af
or bl, 0x20
xor al, bl
inc esi
jmp 0x425393
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x4252f4

Function at 0x425c14
Capabilities:
Get geographical location

Disassembly:
push ebx
add esp, 0xfffff800
mov ebx, ecx
mov word [esp], 0
push 0x400
lea ecx, [esp + 4]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoW_1
mov eax, ebx
mov edx, esp
mov ecx, 0x400
call fcn.0040a028
add esp, 0x800
pop ebx
ret
Function at 0x4338b4
Capabilities:
Encrypt data using rc4 prga

Disassembly:
cmp eax, edx
je 0x433906
test eax, edx
je 0x433909
movzx ecx, byte [edx]
cmp cl, byte [eax]
je 0x4338c9
movzx eax, byte [eax]
sub eax, ecx
ret
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x4338ef
add ecx, 4
js 0x4338df
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 3
add ecx, ebx
jns 0x4338ec
movzx eax, byte [ecx + eax]
movzx edx, byte [ecx + edx]
sub eax, edx
pop ebx
pop ebx
ret
xor eax, eax
ret
test eax, eax
je 0x433915
test edx, edx
jne 0x4338bc
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret
Function at 0x4d3018
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffddc
push ebx
push esi
push edi
xor edx, edx
mov dword [ebp - 0x21c], edx
mov dword [ebp - 0x220], edx
mov dword [ebp - 0x224], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d312e
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, ebx
call fcn.00409434
xor edx, edx
push ebp
push 0x4d30fb
push dword fs:[edx]
mov dword fs:[edx], esp
lea eax, [ebp - 4]
push eax
push 0x23
push 0
call sub.shell32.dll_SHGetSpecialFolderLocation
test eax, 0x80000000
sete al
test al, al
je 0x4d30f1
lea eax, [ebp - 0x20e]
push eax
mov eax, dword [ebp - 4]
push eax
call sub.shell32.dll_SHGetPathFromIDListW
test eax, eax
je 0x4d30e8
push ebx
lea eax, [ebp - 0x224]
lea edx, [ebp - 0x20e]
mov ecx, 0x105
call fcn.00409db4
mov edx, dword [ebp - 0x224]
lea eax, [ebp - 0x220]
call fcn.0040a064
mov eax, dword [ebp - 0x220]
lea edx, [ebp - 0x21c]
call fcn.00424f24
mov eax, dword [ebp - 0x21c]
mov dword [ebp - 0x218], eax
mov byte [ebp - 0x214], 0x11
lea edx, [ebp - 0x218]
xor ecx, ecx
mov eax, 0x4d3148
call fcn.0041f778
mov eax, dword [ebp - 4]
push eax
call sub.ole32.dll_CoTaskMemFree
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
jmp 0x4d3105
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d3135
lea eax, [ebp - 0x224]
call fcn.0040947c
lea eax, [ebp - 0x220]
mov edx, 2
call fcn.00409494
ret

Function at 0x4d33c8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0xc], ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
test eax, eax
je 0x4d33ea
xor edx, edx
mov dword [eax], edx
mov eax, dword [ebp - 8]
test eax, eax
je 0x4d33f5
xor edx, edx
mov dword [eax], edx
xor eax, eax
push ebp
push 0x4d34c0
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 4]
mov edx, 0x209
call fcn.0040a100
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00409f84
push eax
push 0x208
call sub.kernel32.dll_GetTempPathW
mov edx, eax
mov eax, dword [ebp - 4]
call fcn.0040a100
lea eax, [ebp - 0xc]
push eax
lea edx, [ebp - 0x18]
mov eax, dword [ebp - 4]
mov eax, dword [eax]
call fcn.00424f24
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
mov byte [ebp - 0x10], 0x11
lea edx, [ebp - 0x14]
xor ecx, ecx
mov eax, 0x4d34d8
call fcn.0041f778
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
call fcn.00409814
lea eax, [ebp - 0x1c]
push eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 0x28], 0x11
mov eax, 0x4d3508
mov dword [ebp - 0x24], eax
mov byte [ebp - 0x20], 0x11
lea edx, [ebp - 0x2c]
mov ecx, 1
mov eax, 0x4d3530
call fcn.0041f778
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
call fcn.00409814
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d34c7
lea eax, [ebp - 0x1c]
mov edx, 2
call fcn.00409494
lea eax, [ebp - 0xc]
call fcn.00409434
ret
Function at 0x4d364c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0
push 0
push ebx
push esi
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x4d36cf
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
call fcn.00409434
push eax
lea eax, [ebp - 8]
call fcn.00409434
pop edx
call fcn.004d33c8
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 8]
mov eax, ebx
call fcn.004d3544
test al, al
je 0x4d36b4
push 5
mov eax, dword [ebp - 8]
call fcn.00409f84
push eax
mov eax, esi
call fcn.00409f84
push eax
mov eax, dword [ebp - 4]
call fcn.00409f84
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteW
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x4d36d6
lea eax, [ebp - 8]
mov edx, 2
call fcn.00409494
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x13fc1f0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xfa4000]
push edi
jmp 0x13fc20a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x13fc211
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x13fc200
mov eax, 1
add ebx, ebx
jne 0x13fc223
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x13fc234
jne 0x13fc253
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x13fc253
dec eax
add ebx, ebx
jne 0x13fc240
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x13fc218
add ebx, ebx
jne 0x13fc24f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x13fc2a5
xor ecx, ecx
sub eax, 3
jb 0x13fc26b
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x13fc2da
sar eax, 1
mov ebp, eax
jmp 0x13fc276
add ebx, ebx
jne 0x13fc276
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x13fc244
inc ecx
add ebx, ebx
jne 0x13fc284
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x13fc244
add ebx, ebx
jne 0x13fc291
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x13fc286
jne 0x13fc2a2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x13fc286
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x13fc2c4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x13fc2b6
jmp 0x13fc206
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x13fc2c4
add edi, ecx
jmp 0x13fc206
pop esi
mov edi, esi
mov ecx, 0x3ee5
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x13fc2e2
cmp byte [edi], 0x11
jne 0x13fc2e2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x13fc2e7
lea edi, [esi + 0xff5000]
mov eax, dword [edi]
or eax, eax
je 0x13fc35f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x1f20a6c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x1f20be8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x13fc314
mov ecx, edi
jns 0x13fc343
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x1f20bec]
or eax, eax
je 0x13fc359
mov dword [ebx], eax
add ebx, 4
jmp 0x13fc331
call dword [esi + 0x1f20bfc]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x13fc390
cmp al, 0xef
ja 0x13fc383
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x13fc365
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x13fc372
mov ebp, dword [esi + 0x1f20bf0]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x22f]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x13fc3c4
sub esp, 0xffffff80
jmp 0x427f4a
Function at 0x87c985
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
je 0x85bd17
sub eax, eax
pop esi
jmp 0x8a057f
mov dword [ebp - 0xc], eax
jmp 0x952616
pop ebp
jmp 0xc9d4ef
mov eax, dword [ecx + 0x3c]
cmp dword [eax + ecx], 0x4550
jmp 0x8fef7c
call fcn.00929673
add esp, 4
test eax, eax
jmp 0x95f6d5
jae 0x7c5192
mov esi, dword [edx + ecx + 0x1c]
cmp ax, sp
cmp bl, 0xc3
test esp, 0xd6c322e
lea eax, [esi + eax*4]
mov eax, dword [eax + ecx]
jmp 0xd15fce
push ebp
mov ebp, esp
bts ecx, ecx
mov ecx, dword [ebp + 8]
stc
sub esp, 0x114
clc
push esi
test ecx, ecx
je 0x774839
mov esi, dword [ebp + 0xc]
test esi, esi
jmp 0x8f28c8
mov esp, ebp
movsx ebp, di
xchg bp, bp
jmp 0x846016
je 0x774839
mov eax, 0x5a4d
cmp word [ecx], ax
jmp 0x774833
jne 0x774839
mov edx, dword [eax + ecx + 0x78]
cmp dl, bl
mov dword [ebp - 4], edx
test bp, 0x563f
test edx, edx
je 0x774839
mov eax, dword [eax + ecx + 0x7c]
push ebx
clc
push edi
mov dword [ebp - 0x10], eax
cmc
test ax, ax
mov dword [ebp - 8], 0xffffffff
cmp esi, 0xffff
ja 0xcdb76c
mov eax, esi
sub eax, dword [edx + ecx + 0x10]
jmp 0x9206a5
add eax, ecx
jmp 0x86e96f
mov dword [ebp - 8], eax
jmp 0x96bdaa
mov eax, dword [ebp + 8]
bts dx, bx
mov ecx, dword [ebp - 4]
mov edx, dword [ecx + eax + 0x24]
shr cl, 0x67
jmp 0xcd90f9
js 0xcd9115
jmp 0xca4a69
jns 0xcbe56c
lea edi, [esi - 1]
jmp 0x9890a0
jmp 0xcd9115
je 0x7c5192
cmp eax, edx
jmp 0xcf0336
jmp 0xcbe57b
ret
mov eax, dword [ebp - 0xc]
mov edx, dword [ebp + 0x10]
lea esi, [edi + ebx]
cmc
clc
sar esi, 1
test bp, 0x4666
stc
mov eax, dword [eax + esi*4]
cmp sp, sp
push edx
mov edx, dword [ebp + 0xc]
test esp, 0x6b91378f
jmp 0x90538c
jle 0x94340d
lea ebx, [esi + 1]
adc ch, ch
or ch, 0x2b
dec ecx
mov ecx, dword [ebp + 8]
cmp bx, si
cmp ebx, edi
jmp 0xd022c2
lea ecx, [edx + esi*2]
movzx edx, word [ecx + eax]
mov dword [ebp - 8], edx
mov ecx, eax
not edx
shl ax, 0x17
mov edx, dword [ebp - 4]
dec al
shrd ax, di, 0xd1
mov eax, dword [ebp - 8]
clc
test cx, sp
cmp eax, dword [edx + ecx + 0x14]
jmp 0x878347
mov edi, dword [edx + ecx + 0x18]
cmp esi, 0x69617cd
test edi, edi
je 0xcd9115
mov eax, dword [edx + ecx + 0x20]
stc
cmp si, 0x543
add eax, ecx
sub ebx, ebx
jmp 0xd3a914
jle 0xca4a66
jmp 0xcd910b
test eax, eax
jmp 0x976102
dec edi
jmp 0x7bbd83
Function at 0xcd40b0
Capabilities:
Decompress data using aplib

Disassembly:
call 0xcd4200
push ebx
mov ebx, esp
push ebx
mov esi, dword [ebx + 8]
mov edi, dword [ebx + 0x10]
cld
mov dl, pe_nt_image_headers32
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
mov ebx, 2
add dl, dl
jne 0xcd40d6
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xcd40c2
add dl, dl
jne 0xcd40e1
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xcd4134
xor eax, eax
add dl, dl
jne 0xcd40ee
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0xcd41d5
add dl, dl
jne 0xcd40fd
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcd4108
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcd4113
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcd411e
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0xcd412a
push edi
mov eax, eax
sub edi, eax
mov al, byte [edi]
pop edi
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0xcd40cd
mov eax, 1
add dl, dl
jne 0xcd4142
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0xcd414d
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xcd4139
sub eax, ebx
mov ebx, 1
jne 0xcd4180
mov ecx, 1
add dl, dl
jne 0xcd4166
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xcd4171
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xcd415d
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xcd40cd
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0xcd4197
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0xcd41a2
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0xcd418e
cmp eax, 0x7d00
jae 0xcd41c5
cmp eax, 0x500
jb 0xcd41c0
inc ecx
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xcd40cd
cmp eax, 0x7f
ja 0xcd41c8
add ecx, 2
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0xcd40cd
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0xcd41f6
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0xcd40cd
pop ebx
sub edi, dword [ebx + 0x10]
mov eax, edi
pop ebx
ret 0x10
Function at 0x10003113
Capabilities:
Start service

Disassembly:
mov eax, 0x10062ccb
call fcn.10062638
sub esp, 0xc
mov byte [ebp - 0x14], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x100031c3
mov dword [ebp - 0x18], 0x65c6
cmp dword [ebp - 0x18], 0x6730
jle 0x10003168
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x1007e2d8
and eax, esi
cdq
push edx
push eax
call fcn.10004c4e
inc edi
cmp edi, 0x1170
jl 0x10003145
inc esi
cmp esi, 0x52ce
jl 0x10003143
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1000318b
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 9
inc dword [edx]
cmp dword [edx], 2
jl 0x10003179
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x6206
jge 0x100031a7
mov edx, str.zvmefib_rstejtvz_vbnq_kasvnbl_neaierj_itq_colfaqf
mov ecx, 0x1007e2d8
call fcn.1000714a
jmp 0x100031da
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0x100031da
push 0
push 0x2680
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100055e4
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x100055fb
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x1000561d
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x100e10b4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x100e1440
jl 0x1000562b
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x100e16e4
jl 0x1000566b
mov ecx, dword [0x100e2430]
xor ecx, dword [0x100e10b4]
and ecx, edi
xor ecx, dword [0x100e2430]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x100e10b0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x100e16e4]
mov dword [0x100e1a70], eax
pop esi
ret

Function at 0x1000803a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10062f8f
call fcn.10062638
sub esp, 0x20
mov byte [ebp - 0x18], dl
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x28], esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x1000806e
lea eax, [ebp - 0x11]
mov byte [ebp - 0x11], 0
push eax
xor cl, cl
call fcn.10007d7d
pop ecx
jmp 0x10008136
mov dword [ebp - 0x24], 0x6885
cmp dword [ebp - 0x24], 0x690d
jle 0x100080db
xor edi, edi
mov dword [ebp - 0x20], edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov eax, ebx
xor esi, esi
xor eax, edi
mov dword [ebp - 0x2c], eax
mov edi, eax
xor ebx, ebx
mov eax, ebx
mov ecx, 0x1007e2d8
xor eax, esi
or eax, edi
cdq
push edx
push eax
call fcn.10004c4e
inc ebx
cmp ebx, 0x8a4
jl 0x10008095
inc esi
cmp esi, 0x4f4
jl 0x10008093
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
inc ebx
mov dword [ebp - 0x1c], ebx
cmp ebx, 0x40ec
jl 0x10008088
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x526a
jl 0x10008083
mov esi, dword [ebp - 0x28]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x6711
jge 0x10008116
mov edx, str.zfnxv_nzt_qhlicy_mju_hkdacwbpj_wpxu_rjvguaih_ockltthcv_uyishc_fhb_gln_adkzpudk_hvtjv_pbpiztw
mov ecx, 0x1007e2d8
call fcn.1000714a
jmp 0x10008116
mov dword [esi], 0
cmp dword [esi], 3
jge 0x10008136
mov edx, dword [ebp + 0xc]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0xb4743079
inc dword [esi]
cmp dword [esi], 3
jl 0x10008124
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000fc86
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006340b
call fcn.10062638
sub esp, 0x18
mov byte [ebp - 0x14], dl
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x1000fd48
mov dword [ebp - 0x1c], 0x7705
cmp dword [ebp - 0x1c], 0x786b
jle 0x1000fcfc
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
and dword [ebp - 0x20], 0
mov ebx, esi
mov esi, dword [ebp - 0x20]
mov ecx, edi
shl ebx, cl
mov eax, ebx
mov ecx, 0x1007e2d8
xor eax, esi
cdq
push edx
push eax
call fcn.10004c4e
inc esi
cmp esi, 0x63fc
jl 0x1000fcca
mov esi, dword [ebp - 0x18]
inc edi
cmp edi, 0x6377
jl 0x1000fcbd
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x3f44
jl 0x1000fcbb
push 0
push 0x5c0
push 0x2c
push 0x1ddd
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatA]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x73a1
jge 0x1000fd2c
mov edx, str.gaf_ybmtlm_jbjjldoml
mov ecx, 0x1007e2d8
call fcn.1000714a
jmp 0x1000fd68
mov dword [esi], 0
cmp dword [esi], 1
jge 0x1000fd68
mov edx, dword [ebp + 0xc]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0xd5befa1e
inc dword [esi]
cmp dword [esi], 1
jl 0x1000fd56
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100109c6
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, edx
test cl, cl
je 0x10010a38
cmp byte [ebp + 0xc], 0
je 0x100109fe
lea eax, [ebp - 1]
mov byte [ebp - 1], 0
push eax
push 0x37c9
push 1
push 1
mov edx, 0xc92
xor cl, cl
call fcn.100109c6
add esp, 0x10
jmp 0x10010a98
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 8], 0
jmp 0x10010a30
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov byte [ebp - 2], 0
cmp byte [ebp - 2], 0
je 0x10010a2d
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
dec dword [ebp - 8]
cmp dword [ebp - 8], 0xfffffffd
jle 0x10010a0e
jmp 0x10010a98
cmp byte [ebp + 8], 0
je 0x10010a7b
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x10010a98
push 0x11fc
push 0xb40
push 0x1d0
push 0xab5
push 0x98b
push 0x21a1
push 0x26c6
push 0x9a6
push 0x2148
call dword [sym.imp.GDI32.dll_BitBlt]
jmp 0x10010a98
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
jmp 0x10010a93
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x9dbe4fcd
inc dword [edx]
cmp dword [edx], 1
jl 0x10010a86
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10010a9d
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x10063478
call fcn.10062638
sub esp, 0x14
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x10010b9e
cmp byte [ebp + 0xc], 0
je 0x10010ad6
cmp byte [edx], 0
je 0x10010ad1
mov edx, 0x3a31
xor cl, cl
call fcn.10010d55
jmp 0x10010bf5
cmp byte [ecx], 0
je 0x10010ad1
xor ebx, ebx
push ebx
push ecx
mov ecx, 0x11e7
call fcn.100103cd
mov dword [ebp - 0x1c], 0xc5f
cmp dword [ebp - 0x1c], 0xf9d
pop ecx
pop ecx
jle 0x10010b60
push 0x12c2
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov dword [ebp - 0x18], ebx
mov dword [ebp + 8], ebx
mov dword [ebp - 0x14], 0x2a19
mov edi, ebx
mov esi, ebx
mov ebx, dword [ebp + 8]
mov eax, edi
cdq
idiv esi
mov eax, ebx
mov ecx, edx
sar eax, cl
mov ecx, 0x1007e2d8
cdq
push edx
push eax
call fcn.10004c4e
inc esi
cmp esi, 0x31eb
jl 0x10010b1c
inc edi
push 0
pop ebx
cmp edi, 0x1b8f
jl 0x10010b17
mov esi, dword [ebp - 0x18]
add dword [ebp + 8], esi
dec dword [ebp - 0x14]
jne 0x10010b15
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x602d
jl 0x10010b0b
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1c], 0xa0b
jge 0x10010ad1
mov edx, str.azzhp_dmcf_ymvh_cnyyrxxd_pgp_lbwnxlglr_pfpzsdpk_cgpqibz
mov ecx, 0x1007e2d8
call fcn.1000714a
jmp 0x10010ad1
xor ebx, ebx
cmp byte [ebp + 0x10], bl
mov byte [ebp + 0xb], bl
je 0x10010bc3
cmp byte [ebp + 0xb], bl
je 0x10010bf5
push ecx
push ebx
push 0x175f
mov edx, 0x6251
call fcn.100102e0
add esp, 0xc
jmp 0x10010bf5
cmp byte [ebp + 0xb], bl
je 0x10010bf5
push 0x16a0
push ebx
push 0x6dee
push 0x355b
push 0x6f19
push 0x4b4b
push ebx
mov edx, 0xef7
mov ecx, 0x260b
call fcn.100106b6
add esp, 0x1c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret