joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000fa30
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100596ff
call fcn.10058c78
sub esp, 0x38
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], ecx
je 0x1000fa76
mov eax, dword [ebp + 0x1c]
cmp byte [eax], 0
je 0x1000fa65
push ecx
push ecx
push 1
mov edx, 0x131c
call fcn.1000e8b2
add esp, 0xc
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x20], 0x2bbb
cmp dword [ebp - 0x20], 0x2cff
jle 0x1000fb00
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov eax, edi
and dword [ebp - 0x24], 0
cdq
mov edi, esi
idiv ebx
mov esi, dword [ebp - 0x24]
mov ecx, edx
sar edi, cl
mov eax, edi
lea ecx, [ebp - 0x40]
or eax, esi
cdq
push edx
push eax
call fcn.10001335
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000fabd
mov eax, dword [eax]
push eax
call fcn.100420be
pop ecx
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.100015c8
inc esi
cmp esi, 0x1d3f
jl 0x1000faa4
mov esi, dword [ebp - 0x1c]
inc ebx
mov edi, dword [ebp - 0x18]
cmp ebx, 0x6659
jl 0x1000fa92
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x2a6b
jl 0x1000fa90
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x2f3
jl 0x1000fa8b
cmp dword [ebp - 0x20], 0x287e
jge 0x1000fb14
push str.bouxwlg_fphspsjm_pthe_gwvcobzdd_poomudcr_zkjg_jzci_yswxywc_ujubucrt_byikc_mhkp_zdcrgv_mqutshs_dhr
call fcn.100420be
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], 0x6435
cmp dword [ebp - 0x1c], 0x6774
jle 0x1000fb5f
xor esi, esi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x20], 0x1729
mov eax, ebx
mov ecx, 0x10074f78
xor eax, esi
cdq
push edx
push eax
call fcn.10009792
add ebx, edi
dec dword [ebp - 0x20]
jne 0x1000fb35
inc edi
cmp edi, 0x6435
jl 0x1000fb2c
inc esi
cmp esi, 0x749
jl 0x1000fb2a
mov eax, dword [ebp + 0x14]
push 0x1a
pop esi
mov ecx, dword [eax]
cmp ecx, esi
jge 0x1000fb75
mov eax, dword [ebp + 0x18]
movzx edx, word [eax]
add edx, ecx
jmp 0x1000fb82
mov eax, ecx
cdq
idiv esi
mov eax, dword [ebp - 0x28]
movzx eax, word [eax]
add edx, eax
mov ecx, dword [ebp + 8]
push edx
call fcn.100098ea
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x63a8
jge 0x1000fa65
mov edx, str.stbyh_vedr_moage_wzfkfljwl_rhtmuj_jpugetaq
mov ecx, 0x10074f78
call fcn.1000cd04
jmp 0x1000fa65
Function at 0x1000fd17
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov byte [esp + 8], cl
push esi
test dl, dl
je 0x1000fd66
test cl, cl
je 0x1000fd52
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1000fda5
push 1
push 0x39e4
push 1
mov edx, 0x25b
mov ecx, 0x2a5f
call fcn.1000ee2c
add esp, 0xc
jmp 0x1000fda5
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1000fda5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x1000fda5
cmp byte [ebp + 0x14], 0
je 0x1000fd91
mov edx, dword [ebp + 0x18]
mov dword [edx], 0
cmp dword [edx], 4
jge 0x1000fda5
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [edx]
cmp dword [edx], 4
jl 0x1000fd7d
jmp 0x1000fda5
push ecx
lea eax, [esp + 0xf]
mov byte [esp + 0xf], 0
push eax
mov cl, 1
call fcn.1000dd37
pop ecx
pop ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100113c4
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x100113db
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x100113fd
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x10151d34
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x101520c0
jl 0x1001140b
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x10152364
jl 0x1001144b
mov ecx, dword [0x101530b0]
xor ecx, dword [0x10151d34]
and ecx, edi
xor ecx, dword [0x101530b0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x10151d30], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10152364]
mov dword [0x101526f0], eax
pop esi
ret
Function at 0x10011bb6
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
push ebx
push esi
push edi
push 0
pop edi
mov dword [esp + 0x18], 0x3394
mov esi, ecx
cmp dword [esp + 0x18], 0x35eb
push 1
mov dword [esp + 0x20], edx
mov dword [esp + 0x28], esi
pop ebx
jle 0x10011c5f
mov esi, edi
mov dword [esp + 0x14], edi
mov dword [esp + 0x10], edi
and dword [esp + 0x20], 0
mov eax, esi
cdq
idiv edi
mov esi, dword [esp + 0x20]
mov edi, edx
mov ecx, esi
mov eax, edi
sar eax, cl
lea ecx, [esp + 0x28]
cdq
push edx
push eax
call fcn.10001335
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10011c1a
mov eax, dword [eax]
push eax
call fcn.100420be
pop ecx
push 0
push ebx
lea ecx, [esp + 0x30]
call fcn.100015c8
inc esi
cmp esi, 0x6e4b
jl 0x10011bfe
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
inc edi
mov dword [esp + 0x10], edi
cmp edi, 0x5896
jl 0x10011bee
inc esi
mov dword [esp + 0x14], esi
push 0
pop edi
cmp esi, 0x30e9
jl 0x10011bea
mov esi, dword [esp + 0x24]
cmp dword [esp + 0x18], 0x335d
jge 0x10011c74
push str.fowbyr_psmbuya_vmmhb_bwiaojm_oluqccz_ksiqkf
call fcn.100420be
pop ecx
cmp byte [ebp + 8], 0
je 0x10011c81
mov dword [esi], edi
jmp 0x10011d8c
mov dword [esp + 0x10], 0x708b
cmp dword [esp + 0x10], 0x7265
jle 0x10011d05
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
xor esi, esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x18], 0x5f94
mov ecx, esi
mov eax, edi
shl eax, cl
lea ecx, [esp + 0x40]
cdq
push edx
push eax
call fcn.10001335
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10011cd1
mov eax, dword [eax]
push eax
call fcn.100420be
pop ecx
push 0
push ebx
lea ecx, [esp + 0x48]
call fcn.100015c8
dec esi
dec dword [esp + 0x18]
jne 0x10011cb5
mov esi, dword [esp + 0x14]
inc esi
mov dword [esp + 0x14], esi
cmp esi, 0x2913
jl 0x10011ca9
inc edi
cmp edi, 0x1ad7
jl 0x10011ca3
cmp dword [esp + 0x10], 0x6dad
jge 0x10011d1a
push str.njkl_gfzdzegbv_nolfci_wkbfuf_myheryvt
call fcn.100420be
pop ecx
mov esi, dword [ebp + 0x1c]
xor edx, edx
mov edi, dword [ebp + 0x14]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [edi]
mov dword [eax], ebx
mov ecx, dword [esi]
mov eax, dword [esp + 0x1c]
mov eax, dword [eax]
cmp dword [eax + ecx*4], ebx
mov eax, dword [ebp + 0x10]
mov ebx, dword [esp + 0x1c]
setge dl
mov dword [eax], edx
mov edx, dword [esi]
mov ecx, dword [ebx]
mov eax, dword [eax]
cmp dword [ecx + edx*4], eax
jle 0x10011d63
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x10011d63
xor edi, edi
inc edi
jmp 0x10011d65
xor edi, edi
mov eax, dword [esi]
mov ecx, dword [esi]
mov edx, dword [ebx]
xor ebx, ebx
mov eax, dword [edx + eax*4]
cmp eax, dword [edx + ecx*4]
setle bl
xor eax, eax
cmp edi, dword [edx]
setne al
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp + 0x18]
setle cl
mov eax, dword [eax]
mov dword [eax + 0xc], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10011de4
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100597e2
call fcn.10058c78
sub esp, 0x10
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
je 0x10011eaf
cmp byte [edx], 0
je 0x10011e2c
push 0x3a83
xor ecx, ecx
inc ecx
push 0x3843
push ecx
push 0x1159
mov dl, cl
xor cl, cl
push 0x76ba
call fcn.10011ae1
add esp, 0x14
mov dword [ebp - 0x14], 0x5b95
xor esi, esi
cmp dword [ebp - 0x14], 0x5cbb
jle 0x10011e78
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x18], esi
mov ecx, esi
mov eax, ebx
sar eax, cl
mov ecx, 0x10074f78
xor eax, edi
cdq
push edx
push eax
call fcn.10009792
inc esi
cmp esi, 0x58fa
jl 0x10011e45
inc ebx
push 0
pop esi
cmp ebx, 0x7f95
jl 0x10011e42
inc edi
cmp edi, 0x4737
jl 0x10011e40
mov dword [ebp - 4], esi
cmp dword [ebp - 0x14], 0x5b33
jge 0x10011e93
mov edx, str.vsjoct_vxfd_mpfs_qbmyd_mzneqa_rala_nwlitoq_bxcgc_gaguzw_nghyn_tpavcemoa_winjhlb_khgmqa_xdnhpj
mov ecx, 0x10074f78
call fcn.1000cd04
jmp 0x10011f08
mov eax, dword [edi]
xor ecx, ecx
mov eax, dword [edi]
inc ecx
mov eax, dword [edi]
xor esi, esi
mov eax, dword [edi]
mov eax, dword [edi]
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x1c]
mov dword [eax], ecx
mov dword [edx], ecx
mov eax, dword [edi]
mov eax, dword [edi]
mov eax, dword [edi]
cmp dword [edx], esi
je 0x10011ed4
mov esi, ecx
mov eax, dword [edi]
xor edx, edx
imul ecx, esi, 0x8ed7
cmp ecx, eax
mov eax, dword [edi]
setle dl
cmp edx, 0xc9d94031
sbb ecx, ecx
xor ebx, ebx
neg ecx
cmp eax, ecx
mov ecx, dword [edi]
mov eax, dword [edi]
setge bl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp + 0x10]
setg dl
sub edx, ebx
mov dword [eax], edx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100121ac
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
push ebx
push esi
mov dword [esp + 0xc], 0x315c
mov esi, edx
cmp dword [esp + 0xc], 0x33ce
mov ebx, ecx
push edi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x24], ebx
jle 0x10012221
xor esi, esi
xor edi, edi
mov eax, esi
lea ecx, [esp + 0x28]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001335
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100121f7
mov eax, dword [eax]
push eax
call fcn.100420be
pop ecx
push 0
push 1
lea ecx, [esp + 0x30]
call fcn.100015c8
inc edi
cmp edi, 0x4313
jl 0x100121da
inc esi
cmp esi, 0x7031
jl 0x100121d8
mov esi, dword [esp + 0x1c]
cmp dword [esp + 0x10], 0x2f0a
jge 0x10012236
push str.gpoqvxuol_iej_xolqiucem_mcf_sikx_rse_secan_csagbo_oufrjgx_gnih_xketini_egwdnnv_azl_ribvsm
call fcn.100420be
pop ecx
cmp byte [ebp + 0x10], 0
je 0x100122f8
mov dword [esp + 0x1c], 0x1621
cmp dword [esp + 0x1c], 0x181f
jle 0x100122df
xor esi, esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], 0x1135
xor edi, edi
lea eax, [esi + edi]
xor ebx, ebx
mov dword [esp + 0x20], eax
mov esi, eax
mov eax, esi
lea ecx, [esp + 0x40]
or eax, ebx
cdq
push edx
push eax
call fcn.10001335
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001228f
mov eax, dword [eax]
push eax
call fcn.100420be
pop ecx
push 0
push 1
lea ecx, [esp + 0x48]
call fcn.100015c8
inc ebx
cmp ebx, 0x67e
jl 0x10012275
mov esi, dword [esp + 0x10]
inc edi
cmp edi, 0x77f8
jl 0x1001226a
dec esi
dec dword [esp + 0x14]
mov dword [esp + 0x10], esi
jne 0x10012268
mov esi, dword [esp + 0x18]
inc esi
mov dword [esp + 0x18], esi
cmp esi, 0x442b
jl 0x1001225c
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
mov ebx, dword [esp + 0x24]
cmp dword [esp + 0x1c], 0x12df
jge 0x100122f4
push str.vftlzjv_cozzvax_evuuuuuh_ndwc_jltdu_onqxbsrbb_hvc_mjnv_noknode_bxo_vrisrk_delk_cmk_ddqp
call fcn.100420be
pop ecx
dec dword [ebx]
jmp 0x100122fb
and dword [esi], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10019f19
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10059a87
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10019f94
lea eax, [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10019f83
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x10019f81
push 1
push 0x19d6
push 0x25d
push 0
push 0xbf4
push 1
push 0x1d8
call fcn.1001977a
add esp, 0x1c
jmp 0x10019f8f
push 1
push 0
push 0
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x1001a0cb
mov dword [ebp - 0x28], 0x16a4
mov dword [ebp - 0x34], str.kterh_ycaj_nqryseaj_yrjsb_gethr_vcszrclgg_dfh_srak_mzcbqiju
cmp dword [ebp - 0x28], 0x16c2
jle 0x1001a058
and dword [ebp - 0x18], 0
jmp 0x10019fbc
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xc71
jge 0x1001a058
and dword [ebp - 0x1c], 0
jmp 0x10019fd6
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x6071
jge 0x1001a053
and dword [ebp - 0x20], 0
jmp 0x10019fec
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x7679
jge 0x1001a04e
and dword [ebp - 0x24], 0
jmp 0x1001a002
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x1933
jge 0x1001a04c
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sar eax, cl
and eax, dword [ebp - 0x20]
xor eax, dword [ebp - 0x24]
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
lea ecx, [ebp - 0x58]
call fcn.10001335
pop ecx
pop ecx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
call fcn.10001437
push eax
call fcn.100420be
pop ecx
lea ecx, [ebp - 0x58]
call fcn.1000142d
jmp 0x10019ffb
jmp 0x10019fe5
jmp 0x10019fcf
jmp 0x10019fb5
lea eax, [ebp + 8]
mov dword [ebp - 0x38], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x152a
jge 0x1001a074
push dword [ebp - 0x34]
call fcn.100420be
pop ecx
jmp 0x1001a090
or dword [ebp - 4], 0xffffffff
jmp 0x1001a09a
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x1001a0bd
push 0x1efa
push 0x2148
push 0
push 0x16e0
call dword [sym.imp.USER32.dll_DrawFrameControl]
jmp 0x1001a0cb
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001a584
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1001a5d8
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1001a5b4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x1001a5d6
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1001a5d6
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_UnionRect]
jmp 0x1001a603
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
push 0x7243
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0
push 0x41bb
push 0x4e6f
call fcn.10024c78
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x10025ba3
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10059da1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
cmp dword [ebp + 8], 0
jne 0x10025bd3
mov eax, dword [ebp + 8]
jmp 0x10025d60
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
cmp dword [ebp + 0xc], 0
jne 0x10025d33
mov eax, dword [ebp + 0x10]
shr eax, 2
mov dword [ebp - 0x30], eax
and dword [ebp - 0x28], 0
jmp 0x10025bf9
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
cmp eax, dword [ebp - 0x30]
jae 0x10025d00
mov dword [ebp - 0x34], 0x3918
mov dword [ebp - 0x38], str.xadn_rmmwlruuz_agfjomd
cmp dword [ebp - 0x34], 0x3cbf
jle 0x10025cac
push 0x1e89
push 0x1b57
push 0xe06
call dword [sym.imp.GDI32.dll_GetPixel]
and dword [ebp - 0x24], 0
jmp 0x10025c42
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x7e35
jge 0x10025ca0
and dword [ebp - 0x1c], 0
jmp 0x10025c58
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x2ac7
jge 0x10025c9e
and dword [ebp - 0x20], 0
jmp 0x10025c6e
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x7773
jge 0x10025c9c
mov eax, dword [ebp - 0x1c]
cdq
idiv dword [ebp - 0x20]
and edx, dword [ebp - 0x24]
mov eax, edx
cdq
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
push dword [ebp - 0x40]
push dword [ebp - 0x44]
mov ecx, 0x10074f78
call fcn.10009792
jmp 0x10025c67
jmp 0x10025c51
jmp 0x10025c3b
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
mov eax, dword [ebp - 0x18]
and dword [eax], 0
and dword [ebp - 4], 0
cmp dword [ebp - 0x34], 0x3637
jge 0x10025ccc
mov edx, dword [ebp - 0x38]
mov ecx, 0x10074f78
call fcn.1000cd04
jmp 0x10025ce8
or dword [ebp - 4], 0xffffffff
jmp 0x10025cf2
mov eax, dword [ebp - 0x18]
add eax, 4
mov dword [ebp - 0x18], eax
jmp 0x10025bf2
mov eax, dword [ebp + 0x10]
xor edx, edx
push 4
pop ecx
div ecx
mov dword [ebp - 0x30], edx
and dword [ebp - 0x2c], 0
jmp 0x10025d1a
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, dword [ebp - 0x30]
jae 0x10025d31
mov eax, dword [ebp - 0x18]
mov byte [eax], 0
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
jmp 0x10025d13
jmp 0x10025d5d
mov al, byte [ebp + 0xc]
mov byte [ebp - 0x11], al
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x10]
dec eax
mov dword [ebp + 0x10], eax
cmp dword [ebp - 0x3c], 0
je 0x10025d5d
mov eax, dword [ebp - 0x18]
mov cl, byte [ebp - 0x11]
mov byte [eax], cl
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
jmp 0x10025d39
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10029af7
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10059eb3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10029b72
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x10029b43
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x10029b6d
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x10029b6d
push 0
push 0x35ba
push 0x45f4
call fcn.1002bed0
add esp, 0xc
jmp 0x10029c50
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], 0x5d03
mov dword [ebp - 0x3c], str.jmmtmiqth_rgsjgmfzv_roxgaojx_iwcm_zvjjg_wppaj_oduzkjtir_wxzkqa_olhw_jtthma_ximfcw_dqxdbv_djlf
cmp dword [ebp - 0x20], 0x5eff
jle 0x10029c00
and dword [ebp - 0x1c], 0
jmp 0x10029ba2
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x28fb
jge 0x10029c00
and dword [ebp - 0x14], 0
jmp 0x10029bb8
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x4e5f
jge 0x10029bfe
and dword [ebp - 0x18], 0
jmp 0x10029bce
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x77df
jge 0x10029bfc
mov eax, dword [ebp - 0x14]
cdq
idiv dword [ebp - 0x18]
and edx, dword [ebp - 0x1c]
mov eax, edx
cdq
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
push dword [ebp - 0x40]
push dword [ebp - 0x44]
mov ecx, 0x10074f78
call fcn.10009792
jmp 0x10029bc7
jmp 0x10029bb1
jmp 0x10029b9b
push dword [ebp - 0x34]
push 0
push dword [ebp - 0x38]
call fcn.10029c76
add esp, 0xc
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x5b47
jge 0x10029c2a
mov edx, dword [ebp - 0x3c]
mov ecx, 0x10074f78
call fcn.1000cd04
jmp 0x10029c46
or dword [ebp - 4], 0xffffffff
jmp 0x10029c50
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10029c98
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10059ebd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10029cdb
push 0x765f
push 0
push 0x239b
call fcn.1002b292
add esp, 0xc
jmp 0x10029e0a
lea eax, [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10029e02
mov dword [ebp - 0x24], 0x5369
mov dword [ebp - 0x30], str.glcfkmpg_bdjzk_gmdnh_ptp_fwlkhtmpc_huk_czcja
cmp dword [ebp - 0x24], 0x56c2
jle 0x10029db5
call dword [sym.imp.KERNEL32.dll_GetThreadLocale]
and dword [ebp - 0x14], 0
jmp 0x10029d1d
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x356
jge 0x10029db5
and dword [ebp - 0x18], 0
jmp 0x10029d37
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x68b0
jge 0x10029db0
and dword [ebp - 0x1c], 0
jmp 0x10029d4d
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x7df3
jge 0x10029dae
and dword [ebp - 0x20], 0
jmp 0x10029d63
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x6d23
jge 0x10029dac
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x18]
and eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
push dword [ebp - 0x34]
push dword [ebp - 0x38]
lea ecx, [ebp - 0x50]
call fcn.10001335
pop ecx
pop ecx
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
call fcn.10001437
push eax
call fcn.100420be
pop ecx
lea ecx, [ebp - 0x50]
call fcn.1000142d
jmp 0x10029d5c
jmp 0x10029d46
jmp 0x10029d30
jmp 0x10029d16
push 0
push 0
push 0x9d1
call dword [sym.imp.USER32.dll_SetPropA]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x4fc9
jge 0x10029dda
push dword [ebp - 0x30]
call fcn.100420be
pop ecx
jmp 0x10029df6
or dword [ebp - 4], 0xffffffff
jmp 0x10029e00
jmp 0x10029e0a
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret