joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10014258
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
sub esp, 0x3c
mov dword [ebp - 0xc], 0
mov dword [0x1027c560], 0x840
mov eax, dword fs:[0x30]
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov ecx, dword [ecx + 0x10]
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
xor eax, eax
mov ecx, dword [ebp - 0x14]
mov edx, dword [ecx + 0x3c]
mov esi, dword [0x1027c55c]
mov edi, esi
add edi, 0x1f19
mov dword [0x1027c560], edi
mov edi, esi
add edi, 0x12e0
add esi, 0x883
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], eax
jmp 0x1001433d
mov eax, dword [ebp - 0x28]
add eax, 1
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
cmp eax, 0x104
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x30], ecx
mov dword [ebp - 0x34], edx
jl 0x1001433d
jmp 0x1001435d
xor eax, eax
mov dword [0x1027c55c], 0x23d9
mov dword [ebp - 0x38], eax
jmp 0x10014404
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x3c]
cmp word [eax + ecx*2 - 0x12], 0x64
sete dl
mov byte [ebp - 0x3d], dl
mov al, byte [ebp - 0x3d]
test al, 1
jne 0x100143c2
jmp 0x100142e4
mov dword [0x1027c560], 0x342
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x3c]
mov dx, word [eax + ecx*2 - 0x18]
mov word [ebp - 0x40], dx
mov ax, word [ebp - 0x40]
cmp ax, 0x6f
je 0x10014383
jmp 0x100142e4
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x1c]
cmp word [ecx + eax*2], 0
mov edx, dword [ebp - 0x20]
mov esi, eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x34], esi
jne 0x100142be
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x30]
add ecx, 0xfffff257
mov dword [0x1027c55c], ecx
mov ecx, dword [ebp - 0x1c]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x3c], eax
je 0x10014318
jmp 0x100142e4
mov dword [0x1027c55c], 0x5f4
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x3c]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x100142e4
mov dword [0x1027c560], 0x100a
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x3c]
cmp word [eax + ecx*2 - 0x14], 0x64
je 0x100142f8
jmp 0x100142e4
mov dword [0x1027c55c], 0x1fa3
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x3c]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x100142e4
mov eax, dword [ebp - 0x3c]
add eax, 0xfffffff9
mov dword [ebp - 0x44], eax
mov eax, 1
mov ecx, dword [ebp - 0x1c]
mov edx, dword [ebp - 0x44]
cmp word [ecx + edx*2], 0x6c
mov dword [ebp - 0x38], eax
jne 0x100142e4
mov eax, dword [ebp - 0x38]
add esp, 0x3c
pop esi
pop edi
pop ebp
ret
Function at 0x1001440e
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x28
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x1027c560], 0x2149
mov dword [0x1027c564], 0
mov dword [0x1027c568], 0
mov dword [0x1027c574], 0
mov dword [0x1027c55c], 0x202b
cmp eax, 0
mov ebx, edi
mov dword [ebp - 0x10], eax
mov eax, edi
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], edi
jne 0x100144a0
mov dword [0x1027c55c], 0x900
add esp, 0x28
pop esi
pop edi
pop ebx
pop ebp
ret
mov eax, dword [0x1027c568]
mov ecx, dword [0x1027c564]
mov edx, dword [ebp - 0x2c]
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
mov esi, 0x100
mov edi, eax
add edi, 1
mov dword [0x1027c55c], 0x204a
add edx, 1
mov dword [ebp - 0x30], eax
mov eax, edx
cdq
idiv esi
mov dword [0x1027c564], edx
mov ebx, dword [ebp - 0x20]
movzx ebx, byte [ebx + edx]
add ebx, ecx
mov eax, ebx
mov dword [ebp - 0x34], edx
cdq
idiv esi
mov dword [0x1027c568], edx
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x34]
mov cl, byte [ecx + esi]
mov byte [0x1027c56c], cl
mov dword [0x1027c55c], 0x42b7
mov ebx, dword [ebp - 0x20]
mov cl, byte [ebx + edx]
mov byte [ebx + esi], cl
mov cl, byte [0x1027c56c]
mov edx, dword [0x1027c568]
mov byte [ebx + edx], cl
mov dword [0x1027c560], 0x1159
mov edx, dword [0x1027c564]
movzx edx, byte [ebx + edx]
mov ecx, dword [0x1027c568]
movzx ecx, byte [ebx + ecx]
add ecx, edx
mov dword [0x1027c55c], 0x1178
and ecx, 0xff
mov dword [0x1027c574], ecx
mov dword [0x1027c560], 0x63f
mov cl, byte [ebx + ecx]
mov edx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x30]
mov ch, byte [edx + esi]
mov dword [0x1027c560], 0x1eeb
xor ch, cl
mov edx, dword [ebp - 0x1c]
mov byte [edx + esi], ch
mov edx, dword [ebp - 0x10]
cmp edi, edx
mov dword [ebp - 0x2c], edi
je 0x10014477
jmp 0x10014489
Function at 0x100028f1
Capabilities:
Log keystrokes

Disassembly:
mov eax, 0x1005914b
call fcn.10058c78
sub esp, 0x58
push ebx
push esi
mov dword [ebp - 0x28], 0x6640
xor esi, esi
cmp dword [ebp - 0x28], 0x69d4
push edi
mov dword [ebp - 0x10], esp
jle 0x1000296d
mov edi, esi
mov ebx, esi
mov ecx, esi
mov dword [ebp - 0x18], esi
mov eax, ebx
sar eax, cl
lea ecx, [ebp - 0x48]
and eax, edi
cdq
push edx
push eax
call fcn.10001335
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000293a
mov eax, dword [eax]
push eax
call fcn.100420be
pop ecx
push esi
push 1
lea ecx, [ebp - 0x48]
call fcn.100015c8
mov ecx, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x7981
jl 0x1000291f
inc ebx
cmp ebx, 0x54df
jl 0x1000291a
inc edi
cmp edi, 0x5bd8
jl 0x10002918
cmp byte [ebp + 0xc], 0
je 0x10002ab8
mov dword [ebp - 0x24], 0x737e
cmp dword [ebp - 0x24], 0x7498
jle 0x100029cc
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x20], esi
mov ecx, esi
mov eax, ebx
sar eax, cl
mov ecx, 0x10074f78
and eax, edi
cdq
push edx
push eax
call fcn.10009792
inc esi
cmp esi, 0x2ef2
jl 0x1000298e
inc ebx
push 0
pop esi
cmp ebx, 0x723b
jl 0x1000298b
inc edi
cmp edi, 0x4520
jl 0x10002989
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10002a7d
mov dword [ebp - 0x20], 0x1613
cmp dword [ebp - 0x20], 0x18a0
jle 0x10002a5f
mov edi, esi
mov dword [ebp - 0x1c], esi
mov ebx, esi
mov dword [ebp - 0x18], esi
mov ecx, ebx
mov dword [ebp - 0x2c], edi
mov ebx, edi
mov dword [ebp - 0x30], esi
shl ebx, cl
mov edi, esi
mov eax, ebx
lea ecx, [ebp - 0x60]
or eax, edi
cdq
push edx
push eax
call fcn.10001335
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10002a19
mov eax, dword [eax]
push eax
call fcn.100420be
pop ecx
push esi
push 1
lea ecx, [ebp - 0x60]
call fcn.100015c8
inc edi
cmp edi, 0x3ce3
jl 0x10002a00
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 0x18], ebx
cmp ebx, 0x4910
jl 0x100029f2
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x70f7
jl 0x100029ed
push 0x82c
push esi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
push 1
push esi
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
cmp dword [ebp - 0x20], 0x14df
jge 0x10002a7d
push str.ngvgvko_replk_pask_avkqqapr_ckxrd_ajch_hxpp_aittyt_iurgs_blbab
call fcn.100420be
pop ecx
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0x6fe9
jge 0x10002a9c
mov edx, str.lwvgryk_dwknox_dcnckvx
mov ecx, 0x10074f78
call fcn.1000cd04
jmp 0x10002ad4
push 1
push 0xcec
push 0xe99
push 0x2f0
push 0x1287
call dword [sym.imp.USER32.dll_SetScrollRange]
cmp dword [ebp - 0x28], 0x643d
jge 0x10002ae8
push str.oiubzw_nkobfl_zfystry_irvhmh
call fcn.100420be
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000363f
Capabilities:
Encode data using xor
Log keystrokes via polling

Disassembly:
mov eax, 0x10059188
call fcn.10058c78
sub esp, 0x18
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], esi
je 0x1000370e
mov dword [ebp - 0x1c], 0x6f63
cmp dword [ebp - 0x1c], 0x701e
jle 0x100036ce
xor edi, edi
mov dword [ebp - 0x18], edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
and dword [ebp - 0x24], 0
lea esi, [ebx + edi]
mov edi, dword [ebp - 0x24]
mov ecx, eax
shl esi, cl
mov eax, esi
mov ecx, 0x10074f78
xor eax, edi
cdq
push edx
push eax
call fcn.10009792
inc edi
cmp edi, 0x7eba
jl 0x1000368b
mov eax, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x1b41
jl 0x1000367d
inc ebx
cmp ebx, 0x3d6b
jl 0x10003678
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x3726
jl 0x10003676
mov esi, dword [ebp - 0x20]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x6c0a
jge 0x10003709
mov edx, str.lwmdt_bdflpao_yfizgq_cetve_ndnenxzt_epgvyd_ewgixlkjx_uiki_szdtwbyz
mov ecx, 0x10074f78
call fcn.1000cd04
jmp 0x10003709
add dword [esi], 4
jmp 0x1000371b
cmp byte [ecx], 0
je 0x1000371b
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100039b1
Capabilities:
Connect pipe

Disassembly:
mov eax, 0x100591a6
call fcn.10058c78
sub esp, 0x14
cmp byte [ebp + 0x10], 0
mov eax, edx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], eax
je 0x100039ea
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x18], 0x466e
cmp dword [ebp - 0x18], 0x475c
jle 0x10003a45
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
and dword [ebp - 0x1c], 0
mov ebx, esi
mov esi, dword [ebp - 0x1c]
mov ecx, edi
sar ebx, cl
mov ecx, esi
mov eax, ebx
shl eax, cl
mov ecx, 0x10074f78
cdq
push edx
push eax
call fcn.10009792
inc esi
cmp esi, 0x25bf
jl 0x10003a0e
mov esi, dword [ebp - 0x14]
inc edi
cmp edi, 0x8063
jl 0x10003a01
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x4dad
jl 0x100039ff
mov eax, dword [ebp - 0x20]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x443d
mov byte [eax], 1
jge 0x100039d9
mov edx, str.zpsbmr_wtiqaub_dsvvi_ielks_omz_qcuwmfmf
mov ecx, 0x10074f78
call fcn.1000cd04
jmp 0x100039d9
Function at 0x10003d2b
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0xc], 0
push esi
mov byte [ebp - 4], dl
mov esi, ecx
je 0x10003d6d
cmp byte [ebp + 0x14], 0
je 0x10003d48
mov eax, dword [ebp + 0x10]
dec dword [eax]
jmp 0x10003da2
mov edx, dword [ebp + 0x18]
mov dword [edx], 0
cmp dword [edx], 4
jge 0x10003da2
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xa2910a83
inc dword [edx]
cmp dword [edx], 4
jl 0x10003d59
jmp 0x10003da2
test dl, dl
je 0x10003d85
xor eax, eax
mov byte [ebp + 0xf], al
cmp byte [ebp + 0xf], al
je 0x10003da2
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x10003da2
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0
jmp 0x10003d9d
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xc493a780
inc dword [edx]
cmp dword [edx], 2
jl 0x10003d90
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100045d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100591ba
call fcn.10058c78
sub esp, 0x34
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], esi
je 0x100046dd
mov dword [ebp - 0x20], 0x33e7
cmp dword [ebp - 0x20], 0x3699
jle 0x1000463c
xor edi, edi
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x1c], 0x607b
mov eax, esi
mov ecx, 0x10074f78
xor eax, edi
cdq
push edx
push eax
call fcn.10009792
add esi, ebx
dec dword [ebp - 0x1c]
jne 0x1000460f
inc ebx
cmp ebx, 0x1239
jl 0x10004606
inc edi
cmp edi, 0x5c2a
jl 0x10004604
mov esi, dword [ebp - 0x24]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x3347
jge 0x10004677
mov edx, str.eqi_dlve_fxpkmegez_mcc_audpyho_hem_cfus_cmwrzr_ezg_fpp_abpsd
mov ecx, 0x10074f78
call fcn.1000cd04
jmp 0x10004677
or dword [ebp - 4], 0xffffffff
push 3
pop edi
mov dword [esi], edi
jmp 0x100046d3
mov dword [ebp - 0x18], 1
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x1000469a
xor dl, dl
call fcn.10002dc5
mov dword [ebp - 0x18], 0
jmp 0x100046cc
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x1c], edi
cmp dword [ebp - 0x1c], 0
jl 0x100046c9
push dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
lea eax, [ebp - 0x18]
push eax
call fcn.100047ba
dec dword [ebp - 0x1c]
pop ecx
pop ecx
jns 0x100046b3
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jle 0x100046a3
dec dword [esi]
cmp dword [esi], 0
jge 0x10004682
jmp 0x1000479b
mov dword [ebp - 0x28], 0x5be1
cmp dword [ebp - 0x28], 0x5f9f
jle 0x10004764
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov eax, esi
mov dword [ebp - 0x20], 0x5dac
cdq
idiv edi
mov esi, edx
xor ebx, ebx
mov eax, esi
lea ecx, [ebp - 0x40]
xor eax, ebx
cdq
push edx
push eax
call fcn.10001335
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000471d
mov eax, dword [eax]
push eax
call fcn.100420be
pop ecx
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.100015c8
inc ebx
cmp ebx, 0x2f5c
jl 0x10004704
dec esi
dec dword [ebp - 0x20]
jne 0x10004702
mov esi, dword [ebp - 0x1c]
inc edi
cmp edi, 0x7997
jl 0x100046f4
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x14d0
jl 0x100046f2
push 0
push 0x4e9
call dword [sym.imp.GDI32.dll_RectVisible]
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0
cmp dword [edx], 4
jge 0x10004787
mov esi, dword [ebp + 0x20]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffb
inc dword [edx]
cmp dword [edx], 4
jl 0x10004775
cmp dword [ebp - 0x28], 0x59fe
jge 0x1000479b
push str.jpgkgaaex_fam_ptp_wzwxix_zguek_kwedo_ovoeirg
call fcn.100420be
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100047d9
Capabilities:
Query service status

Disassembly:
mov eax, 0x100591c4
call fcn.10058c78
sub esp, 0xc
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x100048b2
cmp byte [ebp + 0x18], 0
je 0x100048a4
xor ebx, ebx
mov byte [ebp + 0xf], bl
mov dword [ebp - 0x14], 0x4748
cmp dword [ebp - 0x14], 0x4ae3
jle 0x10004845
push ebx
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
sar eax, cl
mov ecx, 0x10074f78
cdq
push edx
push eax
call fcn.10009792
inc edi
cmp edi, 0x5a52
jl 0x10004820
inc esi
cmp esi, 0x7733
jl 0x1000481e
push ecx
push ecx
push ebx
lea eax, [ebp + 0xf]
mov ecx, 0x4d5a
push 0x74da
push eax
call fcn.10004b1c
add esp, 0x14
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x14], 0x44eb
jge 0x10004879
mov edx, str.pqzlfbnr_xaogqoc_ovxo_wyetv_whh_yuw_mcsjbqlu_zsjeekaf_iodaxyyvd_pali
mov ecx, 0x10074f78
call fcn.1000cd04
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ecx]
mov eax, dword [edx]
mov ecx, dword [eax + ecx*4]
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
jmp 0x10004879
cmp byte [ebp + 0x14], 0
je 0x100048c5
push 0x2703
call dword [sym.imp.USER32.dll_GetSysColor]
jmp 0x10004879
mov dword [ebp - 0x14], 0x716e
xor ebx, ebx
cmp dword [ebp - 0x14], 0x7266
jle 0x10004908
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
shl eax, cl
mov ecx, 0x10074f78
cdq
push edx
push eax
call fcn.10009792
inc edi
cmp edi, 0x7557
jl 0x100048db
inc esi
cmp esi, 0x2e0a
jl 0x100048d9
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10004918
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_Beep]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x14], 0x7152
jge 0x10004879
mov edx, str.iguric_pxmb_ndmyny_tlsyrd_tunfh_ojk_bdbatjyfh_qpwogyms
mov ecx, 0x10074f78
call fcn.1000cd04
jmp 0x10004879
Function at 0x100054c4
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100591ec
call fcn.10058c78
sub esp, 0x18
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x1000550e
mov dword [edx], 0
cmp dword [edx], 4
jge 0x100054fd
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffb
inc dword [edx]
cmp dword [edx], 4
jl 0x100054eb
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x20], 0x53e2
xor esi, esi
cmp dword [ebp - 0x20], 0x5537
jle 0x10005582
mov edi, esi
mov dword [ebp - 0x1c], esi
mov ebx, esi
mov dword [ebp - 0x18], esi
mov ecx, ebx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x14], esi
shl edi, cl
mov ebx, esi
mov esi, dword [ebp - 0x14]
mov eax, ebx
mov ecx, 0x10074f78
xor eax, esi
or eax, edi
cdq
push edx
push eax
call fcn.10009792
inc ebx
cmp ebx, 0x3c96
jl 0x10005539
inc esi
push 0
mov dword [ebp - 0x14], esi
cmp esi, 0x169c
pop esi
jl 0x10005534
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 0x18], ebx
cmp ebx, 0x3e41
jl 0x1000552a
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x69b8
jl 0x10005525
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10005594
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x20], 0x511d
jge 0x100054fd
mov edx, str.eda_xwti_luqxtdco_nzdnbm_xfn
mov ecx, 0x10074f78
call fcn.1000cd04
jmp 0x100054fd
Function at 0x1000e6bf
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
cmp byte [ebp + 8], 0
push ebx
push esi
mov ebx, ecx
mov dword [esp + 0x20], edx
push edi
mov dword [esp + 0x2c], ebx
je 0x1000e880
mov dword [ebx], 3
jmp 0x1000e875
mov dword [esp + 0x14], 0x248
cmp dword [esp + 0x14], 0x411
jle 0x1000e751
push 0x16dd
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
xor esi, esi
xor edi, edi
mov eax, edi
lea ecx, [esp + 0x30]
or eax, esi
cdq
push edx
push eax
call fcn.10001335
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000e72b
mov eax, dword [eax]
push eax
call fcn.100420be
pop ecx
push 0
push 1
lea ecx, [esp + 0x38]
call fcn.100015c8
inc edi
cmp edi, 0x75d8
jl 0x1000e711
inc esi
cmp esi, 0x2d60
jl 0x1000e70f
mov dword [esp + 0x10], 1
cmp dword [esp + 0x14], 0xffffffb9
jge 0x1000e76b
push str.juskjfbis_jbal_grnc_kbi_xihtcfm_ustbz_ymnqhwxol_bsnbgftkr_xiwcb_eyhgd_bbcelo_jht
call fcn.100420be
pop ecx
mov byte [esp + 0xf], 0
cmp byte [esp + 0xf], 0
je 0x1000e77e
push ecx
call fcn.1000e88f
pop ecx
mov dword [esp + 0x10], 0
cmp dword [esp + 0x10], 3
jg 0x1000e873
mov dword [esp + 0x28], 0xffffffff
mov dword [esp + 0x20], 0x268c
cmp dword [esp + 0x20], 0x2a5b
jle 0x1000e830
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
xor edi, edi
xor esi, esi
mov eax, edi
mov dword [esp + 0x1c], 0x372b
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], eax
mov ebx, 0x497b
cdq
lea ecx, [esp + 0x48]
push edx
push eax
call fcn.10001335
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000e7ee
mov eax, dword [eax]
push eax
call fcn.100420be
pop ecx
push 0
push 1
lea ecx, [esp + 0x50]
call fcn.100015c8
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
dec ebx
jne 0x1000e7d8
mov eax, dword [esp + 0x18]
add eax, esi
dec dword [esp + 0x1c]
mov dword [esp + 0x18], eax
jne 0x1000e7cf
dec esi
cmp esi, 0xffff9e5d
jg 0x1000e7c1
inc edi
cmp edi, 0x33e5
jl 0x1000e7bf
push ecx
push ecx
push dword [esp + 0x2c]
mov ecx, dword [ebp + 0x10]
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x38]
push eax
call fcn.1000efd7
add esp, 0x14
cmp dword [esp + 0x20], 0x24f9
jge 0x1000e860
push str.hybkz_yybxkvgv_bqmovtaw_mteno_iwvjjtr_zzx_vsybajgx_aetdztee_ihvkv_dqxkoia_qhlewnkmk_ptdreqi_zmkwxeuys
call fcn.100420be
pop ecx
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jle 0x1000e791
mov ebx, dword [esp + 0x2c]
dec dword [ebx]
cmp dword [ebx], 0
jge 0x1000e6ea
jmp 0x1000e888
push 0
call dword [sym.imp.USER32.dll_SetKeyboardState]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000ea54
Capabilities:
Get geographical location
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
cmp byte [ebp + 0x10], 0
mov eax, ecx
push ebx
push esi
push edi
mov ebx, edx
mov dword [esp + 0x24], eax
je 0x1000eb99
cmp byte [ebp + 0x20], 0
je 0x1000ea95
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1000ebe6
push 1
xor esi, esi
push esi
push esi
call dword [sym.imp.USER32.dll_AttachThreadInput]
jmp 0x1000ebe6
mov dword [esp + 0x18], 0x184a
cmp dword [esp + 0x18], 0x18f8
jle 0x1000eb51
xor esi, esi
mov dword [esp + 0xc], esi
mov edi, esi
mov dword [esp + 0x14], esi
mov ebx, esi
mov dword [esp + 0x10], esi
mov eax, edi
mov ecx, ebx
mov edi, dword [esp + 0xc]
mov ebx, esi
sar eax, cl
mov dword [esp + 0x20], eax
mov ecx, ebx
shl eax, cl
lea ecx, [esp + 0x28]
and eax, edi
cdq
push edx
push eax
call fcn.10001335
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000eae9
mov eax, dword [eax]
push eax
call fcn.100420be
pop ecx
push esi
push 1
lea ecx, [esp + 0x30]
call fcn.100015c8
mov eax, dword [esp + 0x20]
inc ebx
cmp ebx, 0x59c0
jl 0x1000eacd
mov ebx, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
inc ebx
mov dword [esp + 0x10], ebx
cmp ebx, 0x6c80
jl 0x1000eabd
inc edi
mov dword [esp + 0x14], edi
cmp edi, 0x806
jl 0x1000eab7
mov eax, dword [esp + 0xc]
inc eax
mov dword [esp + 0xc], eax
cmp eax, 0x3404
jl 0x1000eab1
push 0x16dd
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov eax, dword [esp + 0x24]
cmp byte [eax], 0
je 0x1000eb82
push 1
push 0x73e7
push 0x7c48
push 0x15d3
push 1
push 0x718c
push 0x53c9
xor dl, dl
mov ecx, 0x3147
call fcn.1000effe
add esp, 0x1c
cmp dword [esp + 0x18], 0x1808
jge 0x1000ebe6
push str.wapw_kej_affnvizxf_coeqq_wyzim_fgicbqt_nygw_jyw_lanag_ojwdtmbt
call fcn.100420be
pop ecx
jmp 0x1000ebe6
cmp byte [ebp + 0x14], 0
je 0x1000ebdf
mov edi, dword [ebp + 0x1c]
xor esi, esi
cmp dword [edi], esi
jbe 0x1000ebe6
call fcn.1000dcd1
push 0x34
pop ecx
xor edx, edx
div ecx
push 0x1a
mov eax, edx
pop ecx
cmp eax, ecx
jge 0x1000ebc5
mov ecx, dword [ebp + 0x24]
movzx edx, word [ecx]
jmp 0x1000ebce
cdq
idiv ecx
mov eax, dword [ebp + 0x18]
movzx eax, word [eax]
add edx, eax
mov ecx, ebx
push edx
call fcn.100098ea
inc esi
cmp esi, dword [edi]
jb 0x1000eba8
jmp 0x1000ebe6
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov dword [ecx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000ebed
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005967e
call fcn.10058c78
sub esp, 0xc
push ebx
push esi
mov dword [ebp - 0x14], 0x5501
mov eax, ecx
cmp dword [ebp - 0x14], 0x5648
mov ebx, edx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], eax
jle 0x1000ec41
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x10074f78
xor eax, esi
cdq
push edx
push eax
call fcn.10009792
inc edi
cmp edi, 0xc63
jl 0x1000ec1b
inc esi
cmp esi, 0x2c0c
jl 0x1000ec19
mov eax, dword [ebp - 0x18]
push dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
xor cl, cl
push eax
push ebx
sub esp, 0xc
call fcn.1000ec9d
and dword [ebp - 4], 0
add esp, 0x18
cmp dword [ebp - 0x14], 0x5494
jge 0x1000ec72
mov edx, str.euatwcsi_owlck_bnvjsqgoh_dcp_koppb_sjmxlkubg_gby
mov ecx, 0x10074f78
call fcn.1000cd04
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret