joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10021297
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x1005a73a
call fcn.10059860
sub esp, 0x40
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x1c], cl
mov esi, edx
test cl, cl
je 0x1002140b
mov dword [ebp - 0x20], 0x2db0
cmp dword [ebp - 0x20], 0x3117
jle 0x100212f0
mov esi, ebx
mov edi, ebx
mov eax, edi
mov ecx, 0x10075ef8
or eax, esi
cdq
push edx
push eax
call fcn.10001a90
inc edi
cmp edi, 0x77d6
jl 0x100212cd
inc esi
cmp esi, 0x782c
jl 0x100212cb
mov byte [ebp - 0x15], bl
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x20], 0x2a79
jge 0x1002130e
mov edx, str.rdllsb_uppbjtdro_byn_ydpbmhy_vfeper_zau_qzqlhbp
mov ecx, 0x10075ef8
call fcn.1000350c
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x15], 0
je 0x10021464
mov dword [ebp - 0x30], 0x61b5
cmp dword [ebp - 0x30], 0x61f8
jle 0x100213b4
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov esi, ebx
mov dword [ebp - 0x2c], ebx
mov edi, ebx
mov dword [ebp - 0x28], ebx
mov ecx, edi
mov eax, ebx
and ecx, esi
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x20], ecx
mov esi, ecx
mov edi, eax
mov dword [ebp - 0x20], 0x60e2
mov eax, edi
lea ecx, [ebp - 0x48]
or eax, esi
cdq
push edx
push eax
call fcn.10003ca8
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10021370
mov eax, dword [eax]
push eax
call fcn.100430bc
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.10001f32
dec edi
dec dword [ebp - 0x20]
jne 0x10021357
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x7bf9
jl 0x1002134e
mov edi, dword [ebp - 0x28]
mov esi, dword [ebp - 0x2c]
inc edi
mov dword [ebp - 0x28], edi
cmp edi, 0x659b
jl 0x10021340
inc esi
mov dword [ebp - 0x2c], esi
cmp esi, 0x2d75
jl 0x1002133b
push 1
push 0x6caa
push 1
mov edx, 0x2abb
mov cl, 1
call fcn.10020d9c
add esp, 0xc
cmp dword [ebp - 0x30], 0x5ff2
jge 0x10021464
push str.dnxgjqqwc_lqdhrzm_fgtg_rqnceda
call fcn.100430bc
pop ecx
jmp 0x10021464
mov edi, dword [ebp + 0x10]
mov eax, dword [edi]
test eax, eax
mov eax, dword [ebp + 8]
setne bl
xor edx, edx
mov eax, dword [eax]
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax]
imul ecx, eax, 0x7863
mov eax, dword [edi]
cmp ecx, eax
setg dl
imul eax, edx, 0xd3b0
inc eax
neg eax
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0xa05d
setne cl
xor eax, eax
cmp ebx, ecx
sete al
cmp eax, 0x270e7ad5
je 0x10021458
xor ebx, ebx
cmp dword [esi], ebx
je 0x1002145b
xor ebx, ebx
inc ebx
mov ecx, dword [edi]
mov eax, dword [ebp + 0x14]
add ecx, ebx
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10021b0e
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1005a786
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x20
cmp byte [ebp + 0x14], 0
push ebx
mov dword [esp + 4], ecx
je 0x10021c04
xor ebx, ebx
mov dword [esp + 0x1c], 0xf
mov dword [esp + 0x18], ebx
mov byte [esp + 8], bl
lea eax, [esp + 8]
mov dword [esp + 0x2c], ebx
push eax
push 0x6eb3
push ecx
push 1
lea eax, [esp + 0x14]
push 0x45c8
push eax
call fcn.10021a64
mov eax, dword [0x1007c564]
add esp, 0x18
test al, 1
jne 0x10021b9f
or eax, 1
mov dword [0x1007c564], eax
push 0x8f9a
mov byte [esp + 0x30], 1
call fcn.10029e9b
mov byte [0x1007b1c2], al
mov byte [esp + 0x30], bl
mov eax, dword [0x1007c564]
pop ecx
test al, 2
jne 0x10021bc4
or eax, 2
mov dword [0x1007c564], eax
push 0x7daa
mov byte [esp + 0x30], 2
call fcn.10029e9b
pop ecx
mov byte [0x1007b1c3], al
mov byte [esp + 0x2c], bl
push ecx
push 0x1007b1c3
lea eax, [esp + 0x10]
mov dl, 1
push 0x1007b1c2
push eax
lea ecx, [esp + 0x14]
call fcn.1002164d
mov ecx, dword [ebp + 0x10]
lea eax, [esp + 0x18]
add esp, 0x10
cmp ecx, eax
je 0x10021bf6
push 0xffffffffffffffff
push ebx
push eax
call fcn.1001e396
push ebx
push 1
lea ecx, [esp + 0x10]
call fcn.1001e213
jmp 0x10021c34
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0x10021c34
xor ebx, ebx
push ebx
push 0x2057
push 0x1a12
push 0xfb6
push 0x2165
push 0x2663
push 0x1a3a
push ebx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov ecx, dword [esp + 0x24]
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10021d04
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x10021d1b
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x10021d3d
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x1007b1d4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x1007b560
jl 0x10021d4b
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x1007b804
jl 0x10021d8b
mov ecx, dword [0x1007c550]
xor ecx, dword [0x1007b1d4]
and ecx, edi
xor ecx, dword [0x1007c550]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x1007b1d0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x1007b804]
mov dword [0x1007bb90], eax
pop esi
ret
Function at 0x10022071
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 4], 0x2d77
cmp dword [ebp - 4], 0x2f66
push ebx
mov ebx, ecx
jle 0x100220d8
push esi
push edi
xor esi, esi
xor edi, edi
mov eax, edi
lea ecx, [ebp - 0x20]
and eax, esi
cdq
push edx
push eax
call fcn.10003ca8
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100220a9
mov eax, dword [eax]
push eax
call fcn.100430bc
pop ecx
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.10001f32
inc edi
cmp edi, 0x2b1d
jl 0x10022090
inc esi
cmp esi, 0x55c6
jl 0x1002208e
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
pop edi
pop esi
cmp dword [ebp - 4], 0x2c09
jge 0x100220ec
push str.jjmzphc_cxxzw_sdv_bjolwtq_jib
call fcn.100430bc
pop ecx
cmp byte [ebp + 0xc], 0
je 0x10022111
mov edx, dword [ebp + 8]
mov dword [edx], 0
jmp 0x1002210a
mov ecx, dword [edx]
mov eax, dword [ebx]
mov dword [eax + ecx*4], 0x6c9cd49f
inc dword [edx]
cmp dword [edx], 4
jl 0x100220fd
jmp 0x10022140
mov dword [ebp - 4], 0xb26bdde0
mov dword [ebp - 8], 0x318d5816
mov dword [ebp - 4], 0x12
jmp 0x1002213a
mov dword [ebp - 8], 0x23ed15de
call fcn.100228a7
inc dword [ebp - 8]
dec dword [ebp - 4]
cmp dword [ebp - 4], 0xfffffffb
jg 0x10022128
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10022443
Capabilities:
Log keystrokes

Disassembly:
mov eax, 0x1005a806
call fcn.10059860
sub esp, 0x30
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], ebx
je 0x10022489
cmp byte [edx], 0
je 0x10022478
push 1
push 0x13f3
push 0x1a6a
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x2c], esi
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x34], edi
mov dword [esi], 0
cmp dword [esi], 0xfffffff6
jg 0x10022478
mov dword [ebp - 0x3c], 0xfffffff6
mov dword [ebp - 0x1c], 0x5976
mov dword [ebp - 0x18], 0x1b4b
cmp dword [ebp - 0x18], 0x5c4
jge 0x10022509
lea eax, [ebp - 0x14]
push eax
push 0x10065804
call fcn.1004351b
pop ecx
pop ecx
jmp 0x100224fe
dec eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
push str._ld__ld
call fcn.1004351b
push dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
dec eax
push eax
push str._ld__ld_n
call fcn.100430bc
add esp, 0x18
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x100224d3
dec eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x1c], 0x5c9e
jle 0x10022551
xor edi, edi
mov ebx, edi
mov dword [ebp - 0x18], 0x2bc
xor esi, esi
mov eax, ebx
mov ecx, 0x10075ef8
xor eax, esi
cdq
push edx
push eax
call fcn.10001a90
inc esi
cmp esi, 0x7cb8
jl 0x1002251f
dec ebx
dec dword [ebp - 0x18]
jne 0x1002251d
inc edi
cmp edi, 0x31b3
jl 0x10022514
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp - 0x20]
mov edi, dword [ebp + 0x18]
mov dword [ebp - 0x38], 0xdad816f9
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x55b1
jge 0x100225a2
mov edx, str.asesrrgw_mipouuefw_ntbiaheai_rfgbnihj_gvdm_pevxfw_caks_zjkbdvxtc_ybsix_iopz_ziwkap_fddoo
mov ecx, 0x10075ef8
call fcn.1000350c
jmp 0x100225a2
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x38]
push edi
push ecx
push esi
push ecx
push eax
push ecx
lea eax, [ebp - 0x3c]
mov edx, ebx
push eax
call fcn.100260ba
add esp, 0x1c
dec dword [esi]
jmp 0x1002249e
Function at 0x100225c4
Capabilities:
Terminate process

Disassembly:
mov eax, 0x1005a818
call fcn.10059860
sub esp, 0x44
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x18], dl
mov byte [ebp - 0x14], cl
je 0x10022629
test dl, dl
je 0x10022617
mov byte [ebp + 0x13], 0
cmp byte [ebp + 0x13], 0
je 0x1002276a
push 0x4878
push 1
push 0x5cdf
push 0x3d09
xor dl, dl
mov cl, 1
call fcn.100225c4
add esp, 0x10
jmp 0x1002276a
push 0xcba
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1002276a
mov dword [ebp - 0x1c], 0x5b9
xor esi, esi
cmp dword [ebp - 0x1c], 0x8d1
jle 0x10022675
mov edi, esi
mov ebx, edi
mov dword [ebp + 0x10], 0x6fb5
mov dword [ebp - 0x20], esi
mov eax, ebx
mov ecx, 0x10075ef8
or eax, esi
cdq
push edx
push eax
call fcn.10001a90
inc esi
cmp esi, 0x491a
jl 0x10022649
dec ebx
dec dword [ebp + 0x10]
push 0
pop esi
jne 0x10022646
inc edi
cmp edi, 0x801c
jl 0x1002263d
mov dword [ebp - 4], esi
cmp dword [ebp - 0x1c], 0x48e
jge 0x10022690
mov edx, str.ixohi_hcmrzw_amgndndsj_abypghi_kfdue_mmpfri_hwyy_jwofzb_rnzcy_mwbukhq_nbvyi_rdzzrbtn
mov ecx, 0x10075ef8
call fcn.1000350c
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x14], 0
je 0x1002275f
mov dword [ebp - 0x1c], 0x10b5
cmp dword [ebp - 0x1c], 0x13d1
jle 0x100226f2
mov edi, esi
mov ebx, esi
mov dword [ebp + 0x10], 0x6c34
mov eax, ebx
lea ecx, [ebp - 0x38]
cdq
push edx
push eax
call fcn.10003ca8
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100226d0
mov eax, dword [eax]
push eax
call fcn.100430bc
pop ecx
push esi
push 1
lea ecx, [ebp - 0x38]
call fcn.10001f32
add ebx, edi
dec dword [ebp + 0x10]
jne 0x100226b9
inc edi
cmp edi, 0x7bcc
jl 0x100226b0
cmp dword [ebp - 0x1c], 0x1074
jge 0x10022706
push str.tiysv_gvph_lymy_pju_rhtzglip_orj_urj
call fcn.100430bc
pop ecx
mov eax, dword [ebp + 0x14]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push dword [eax]
lea eax, [ebp - 0x50]
push eax
call fcn.100264cb
mov ecx, dword [ebp + 0xc]
push eax
mov dword [ebp - 4], 4
call fcn.10026579
push esi
push 1
lea ecx, [ebp - 0x50]
call fcn.10005bc7
jmp 0x1002276a
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002279a
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1005a822
call fcn.10059860
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x10022879
mov dword [ebp - 0x14], 0x5760
cmp dword [ebp - 0x14], 0x58c2
jle 0x100227ec
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x10075ef8
or eax, esi
cdq
push edx
push eax
call fcn.10001a90
inc edi
cmp edi, 0x69a5
jl 0x100227c9
inc esi
cmp esi, 0x6572
jl 0x100227c7
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x555e
jge 0x10022808
mov edx, str.osiki_uhhiz_zdqokhy_ujx
mov ecx, 0x10075ef8
call fcn.1000350c
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x14], 0
je 0x10022867
mov esi, dword [ebp + 8]
mov dword [esi], 0
jmp 0x10022860
push ecx
push 0x5857
lea eax, [ebp - 0x18]
mov dword [ebp - 0x14], 0x8876
push eax
mov dword [ebp - 0x18], 0xfffffffe
mov ecx, 0x7a7a
push 1
call fcn.100221c4
add esp, 0x10
inc dword [esi]
cmp dword [esi], 0
jle 0x10022837
jmp 0x10022896
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10022896
push 0
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
jmp 0x10022896
cmp byte [ebp + 0x10], 0
je 0x10022889
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x10022896
cmp byte [edx], 0
je 0x10022896
push 0
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002a4bc
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005ac0b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x64
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002a508
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
push 0x751b
push dword [ebp - 0x2c]
push 1
push 0x49fe
call fcn.1002a68b
add esp, 0x10
jmp 0x1002a67a
lea eax, [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x24], 0x2922
mov dword [ebp - 0x34], str.fyxjstfb_xaiamskwb_vgg_vhrkp_awz_yxae_ievvjtxjo
cmp dword [ebp - 0x24], 0x29d9
jle 0x1002a5be
and dword [ebp - 0x18], 0
jmp 0x1002a536
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x301
jge 0x1002a5af
and dword [ebp - 0x1c], 0
jmp 0x1002a54c
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3dfc
jge 0x1002a5ad
and dword [ebp - 0x20], 0
jmp 0x1002a562
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x5878
jge 0x1002a5ab
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
shl eax, cl
mov ecx, dword [ebp - 0x20]
sar eax, cl
cdq
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edx
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x74]
call fcn.10003ca8
pop ecx
pop ecx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
call fcn.10001a70
push eax
call fcn.100430bc
pop ecx
lea ecx, [ebp - 0x74]
call fcn.10001a66
jmp 0x1002a55b
jmp 0x1002a545
jmp 0x1002a52f
push 0x227a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x50], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x28e5
jge 0x1002a5da
push dword [ebp - 0x34]
call fcn.100430bc
pop ecx
jmp 0x1002a5f6
or dword [ebp - 4], 0xffffffff
jmp 0x1002a600
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x1002a663
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x1002a644
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 4
jge 0x1002a661
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x4c]
call fcn.10001c44
mov dword [eax], 0x6c9cd49f
jmp 0x1002a639
jmp 0x1002a67a
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002eb4c
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002ebc6
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1002eb9c
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1002eb9a
push 1
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
jmp 0x1002ebc4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1002ebc4
push 1
push 0x13f3
push 0x1a6a
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x1002ebda
push 0
push 0x49c4
push 0x182f
call fcn.1002d9b2
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x1002f5ff
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002f6a4
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002f67a
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1002f65b
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x1002f678
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.10001c44
mov dword [eax], 0xb9b55bb2
jmp 0x1002f650
jmp 0x1002f6a2
push 0
push 0x2057
push 0x1a12
push 0xfb6
push 0x2165
push 0x2663
push 0x1a3a
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x1002f6b8
push 0x1ce2
push 0
push 0x3c98
call fcn.1002ebde
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10031bf4
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10031c7b
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10031c55
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10031c53
push 0x41c2
push 1
push 0x7307
push 0x1fb
push 1
push 0x2fb2
push 1
push 0x7113
push 0x24db
push 0x5bee
push 0x4663
call fcn.1002ecba
add esp, 0x2c
jmp 0x10031c79
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x10031c79
push 0
push 0x2406
push 0
push 0
push 0x2585
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x10031c94
push 0x656f
push 0x3727
push 0x4b5f
push 0
call fcn.1002f6bc
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10034a4f
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005af1a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x4c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10034a9a
lea eax, [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
push 0x5870
push dword [ebp - 0x2c]
mov eax, dword [ebp - 0x30]
push dword [eax]
push 1
call fcn.10034bdb
add esp, 0x10
jmp 0x10034bcd
lea eax, [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x10034adc
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x10034ad7
push 0x2629
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x10034bcd
mov dword [ebp - 0x10], 0x666a756a
mov dword [ebp - 0x14], 0xffffffff
mov dword [ebp - 0x28], 0x9ba095a9
mov dword [ebp - 0x44], 0
push 4
lea ecx, [ebp - 0x58]
call fcn.10001ba5
and dword [ebp - 4], 0
mov dword [ebp - 0x48], 0
push 0x6508
lea eax, [ebp - 0x4c]
push eax
push 1
push 0x3367
lea eax, [ebp - 0x58]
push eax
push 0x237e
push 0x38c9
push 0
call fcn.100295cb
add esp, 0x20
cmp dword [ebp - 0x10], 0
jne 0x10034b47
cmp dword [ebp - 0x10], 0
jne 0x10034b47
and dword [ebp - 0x18], 0
jmp 0x10034b4e
mov dword [ebp - 0x18], 1
cmp dword [ebp - 0x18], 1
jbe 0x10034b5d
mov dword [ebp - 0x1c], 1
jmp 0x10034b61
and dword [ebp - 0x1c], 0
mov eax, 0x7c20
sub eax, dword [ebp - 0x1c]
jne 0x10034b7d
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0
jne 0x10034b7d
and dword [ebp - 0x20], 0
jmp 0x10034b84
mov dword [ebp - 0x20], 1
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x20], eax
jle 0x10034b95
mov dword [ebp - 0x24], 1
jmp 0x10034b99
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x14]
push eax
lea eax, [ebp - 0x10]
push eax
lea eax, [ebp - 0x28]
push eax
call fcn.1002ec8a
add esp, 0x1c
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x58]
call fcn.10001c28
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10036114
Capabilities:
Create thread

Disassembly:
mov eax, 0x1005afcc
call fcn.10059860
sub esp, 0x40
push ebx
push esi
xor ebx, ebx
mov byte [ebp - 0x1c], dl
mov byte [ebp - 0x15], bl
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10036263
mov dword [ebp - 0x34], 0x34b1
cmp dword [ebp - 0x34], 0x3827
jle 0x100361bd
mov edi, ebx
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x2c], 0x7ecf
mov esi, dword [ebp - 0x20]
mov ecx, ebx
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x28], 0x4a0a
mov eax, edi
shl eax, cl
lea ecx, [ebp - 0x4c]
cdq
push edx
push eax
call fcn.10003ca8
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003617e
mov eax, dword [eax]
push eax
call fcn.100430bc
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x4c]
call fcn.10001f32
mov ecx, dword [ebp - 0x24]
add ecx, esi
dec dword [ebp - 0x28]
mov dword [ebp - 0x24], ecx
jne 0x10036165
mov esi, dword [ebp - 0x30]
add dword [ebp - 0x20], esi
dec dword [ebp - 0x2c]
jne 0x10036156
inc esi
mov dword [ebp - 0x30], esi
cmp esi, 0x6c46
jl 0x1003614c
inc edi
cmp edi, 0x5878
jl 0x10036149
cmp byte [ebp - 0x15], bl
je 0x100361d6
push ebx
push 0x2406
push ebx
push ebx
push 0x2585
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [ebp - 0x34], 0x3327
jge 0x100361ea
push str.mgecl_fnkbekun_maqpbvkdv_psnztajg_rmgc_kqb_kygrbvw_fspdxc_yrzmdbrt
call fcn.100430bc
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x34], 0x7d21
cmp dword [ebp - 0x34], 0x80d7
jle 0x10036228
mov esi, ebx
mov edi, ebx
mov eax, esi
mov ecx, 0x10075ef8
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001a90
inc edi
cmp edi, 0x3eec
jl 0x10036202
inc esi
cmp esi, 0x5277
jl 0x10036200
mov dword [ebp - 4], 2
cmp dword [ebp - 0x34], 0x7a8f
jge 0x10036247
mov edx, str.xbsvx_tfnwjmvt_bud_olazxqkp_iqkjtwue_aqy_xjtcmxxc_xvciyjwx_ihwqsvv
mov ecx, 0x10075ef8
call fcn.1000350c
jmp 0x10036279
cmp byte [ebp - 0x15], bl
je 0x10036279
push 0x735
push 0x236d
push ebx
call dword [sym.imp.USER32.dll_CheckMenuItem]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret