joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006ff6
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100652c8
call fcn.10064c08
sub esp, 0x14
push ebx
push esi
mov byte [ebp - 0x14], 1
mov eax, edx
mov dword [ebp - 0x1c], 0x1685
cmp dword [ebp - 0x1c], 0x17b7
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], eax
jle 0x10007061
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov ebx, 0x4f6d
xor esi, esi
mov eax, edi
mov ecx, 0x10081dd8
xor eax, esi
cdq
push edx
push eax
call fcn.1000c947
inc esi
cmp esi, 0x705a
jl 0x10007030
mov esi, dword [ebp - 0x18]
add edi, esi
dec ebx
jne 0x1000702e
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x5dd1
jl 0x10007027
mov eax, dword [ebp - 0x20]
cmp byte [eax], 0
je 0x10007075
push ecx
push 0xfd3
mov cl, 1
call fcn.10004853
pop ecx
pop ecx
mov dword [ebp - 4], 9
cmp dword [ebp - 0x1c], 0x12e7
jge 0x10007094
mov edx, str.higrpndyy_rsugksbq_vjqecne_fjzb_ucapznsof_nblqvpmzx_als_zqgprxi_uaasjphb_ijaapskn_btbxy
mov ecx, 0x10081dd8
call fcn.1000fdbf
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008117
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10065342
call fcn.10064c08
sub esp, 0x24
push ebx
push esi
mov dword [ebp - 0x1c], 0x6589
mov esi, 0x10081dd8
cmp dword [ebp - 0x1c], 0x6594
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x28], ecx
jle 0x10008195
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov dword [ebp - 0x18], ecx
cdq
idiv ecx
mov eax, ebx
mov ecx, esi
sub eax, edx
xor eax, edi
cdq
push edx
push eax
call fcn.1000c947
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x6c49
jl 0x10008153
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x5523
jl 0x1000814e
inc ebx
cmp ebx, 0x3921
jl 0x10008149
inc edi
cmp edi, 0x7e29
jl 0x10008147
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x640c
jge 0x100081cf
mov edx, str.wfpxtg_fbhxnuiv_kbe
mov ecx, esi
call fcn.1000fdbf
jmp 0x100081cf
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x18], 0
je 0x10008205
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x100082f6
mov esi, dword [ebp + 0x28]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 1
inc dword [edx]
cmp dword [edx], 3
jl 0x100081ee
jmp 0x100082f6
mov dword [ebp - 0x24], 0x4564
cmp dword [ebp - 0x24], 0x4832
jle 0x1000826c
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x20], edi
xor eax, eax
mov dword [ebp - 0x14], 0x19d4
mov dword [ebp - 0x18], eax
mov edi, eax
mov dword [ebp - 0x1c], 0xf35
mov ecx, edi
mov eax, ebx
sar eax, cl
mov ecx, esi
cdq
push edx
push eax
call fcn.1000c947
dec edi
dec dword [ebp - 0x1c]
jne 0x10008231
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0x20]
add eax, edi
dec dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
jne 0x10008228
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x25b3
jl 0x1000821c
inc ebx
cmp ebx, 0x1379
jl 0x10008217
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0x4434
jge 0x10008288
mov edx, str.vngbgnbfi_kmqqf_yflr_xjnu_bamp_lkankfn_qjqaz_demigj_waglnor_ukbjr_jvmkflq_othvify
mov ecx, esi
call fcn.1000fdbf
mov ebx, dword [ebp + 0x14]
xor ecx, ecx
mov esi, dword [ebp - 0x28]
mov eax, dword [ebx]
mov eax, dword [ebx]
cmp eax, 0x4f23
mov eax, dword [esi]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esi]
setg dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [ebp + 0x24]
setg cl
cmp ecx, dword [edx]
je 0x100082bc
cmp dword [edx], 0
jne 0x100082bc
mov eax, dword [ebx]
mov eax, dword [ebx]
mov eax, dword [ebx]
mov eax, dword [ebx]
mov eax, dword [ebp + 0x20]
mov edi, dword [ebp + 0x1c]
mov esi, dword [ebp + 8]
mov eax, dword [eax]
sub eax, dword [edx]
mov dword [edi], eax
mov ecx, dword [edx]
xor edx, edx
mov ebx, dword [ebx]
mov eax, dword [esi]
cmp dword [eax + ecx*4], 0xa7fe
mov ecx, dword [edi]
mov eax, dword [esi]
sete dl
add ecx, edx
xor edx, edx
cmp ecx, dword [eax + ebx*4]
mov eax, dword [ebp - 0x2c]
setne dl
mov dword [eax], edx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10018318
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100183ec
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x28]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1001839c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x10018380
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 3
jge 0x1001839a
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x28]
call fcn.1000155c
or dword [eax], 0xffffffff
jmp 0x10018375
jmp 0x100183e7
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
jmp 0x100183ca
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 2
jge 0x100183e7
mov eax, dword [ebp - 0xc]
push dword [eax]
mov ecx, dword [ebp - 0x3c]
call fcn.1000155c
mov dword [eax], 8
jmp 0x100183bf
jmp 0x1001846c
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x44], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x10018455
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
jmp 0x10018436
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 4
jge 0x10018453
mov eax, dword [ebp - 0x10]
push dword [eax]
mov ecx, dword [ebp - 0x54]
call fcn.1000155c
mov dword [eax], 0x2b57e8b7
jmp 0x1001842b
jmp 0x1001846c
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001846c
push 0x334
call dword [sym.imp.USER32.dll_GetKeyState]
mov esp, ebp
pop ebp
ret
Function at 0x10019865
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1001989b
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
push 0x226b
push dword [ebp - 4]
push 0x7501
push dword [ebp - 8]
push 1
call fcn.100198e2
add esp, 0x14
jmp 0x100198de
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x100198be
push 0x334
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x100198de
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x100198de
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetCommState]
mov esp, ebp
pop ebp
ret
Function at 0x100202f4
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0xc], 0
je 0x1002030b
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
shr eax, 2
inc eax
mov dword [ecx], eax
jmp 0x10020320
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x10020320
push 0x334
call dword [sym.imp.USER32.dll_GetKeyState]
mov esp, ebp
pop ebp
ret

Function at 0x10020578
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x10], 0
push esi
mov esi, ecx
je 0x100205a6
mov dword [esi], 0
cmp dword [esi], 1
jge 0x100205b3
mov edx, dword [ebp + 8]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0x60df3928
inc dword [esi]
cmp dword [esi], 1
jl 0x10020592
jmp 0x100205b3
cmp byte [edx], 0
je 0x100205b3
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop esi
pop ebp
ret

Function at 0x10021b87
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
je 0x10021c81
push 3
pop esi
mov dword [ebp - 4], 0xc7c8a6b9
lea ecx, [ebp - 0x20]
push esi
call fcn.100014bd
mov dword [ebp - 0xc], 0xfffffff6
xor edx, edx
mov dword [ebp - 0x10], 0xffffffff
xor edi, edi
mov dword [ebp - 0x14], 0xffffffff
inc edi
mov dword [ebp - 4], 0xe8a28d88
mov dword [ebp - 4], edx
jmp 0x10021bdd
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 8], esi
inc dword [ebp - 4]
cmp dword [ebp - 4], edi
jl 0x10021bd3
mov dword [ebp - 4], edx
jmp 0x10021bf3
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
mov dword [eax + ecx*4], edi
inc dword [ebp - 4]
cmp dword [ebp - 4], esi
jl 0x10021be7
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 8]
mov ebx, dword [ebp - 0x20]
xor eax, eax
mov dword [ebp - 4], edx
mov ecx, dword [ebx + 8]
mov esi, ecx
cmp dword [ebx], ecx
setl al
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 8]
setle dl
xor ecx, ecx
sub edx, 0xf49d
cmp edx, eax
mov eax, dword [ebp - 0x20]
setle cl
xor edx, edx
sub ecx, esi
cmp ecx, dword [eax]
mov eax, dword [ebp - 8]
setl dl
add edx, esi
add eax, edx
jne 0x10021c45
cmp dword [ebx + 8], eax
jne 0x10021c45
xor ecx, ecx
jmp 0x10021c47
mov ecx, edi
mov eax, dword [ebp - 0x10]
add eax, ecx
jne 0x10021c56
cmp dword [ebp - 8], eax
jne 0x10021c56
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 4]
mov eax, dword [ebp - 0x20]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
dec dword [ebp - 0xc]
cmp eax, ecx
jle 0x10021c6a
xor edi, edi
mov eax, dword [ebp - 8]
xor ecx, ecx
cmp eax, edi
setge cl
mov dword [ebp - 4], ecx
lea ecx, [ebp - 0x20]
call fcn.10001540
jmp 0x10021c91
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10021c91
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100238c6
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x5c
cmp byte [ebp + 0xc], 0
push ebx
push esi
mov ebx, edx
push edi
mov dword [esp + 0x18], ebx
je 0x10023a51
cmp byte [ebp + 0x1c], 0
je 0x10023a25
mov dword [esp + 0x14], 0x6285
cmp dword [esp + 0x14], 0x6373
jle 0x10023975
xor esi, esi
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x10], eax
lea ecx, [eax + ebx]
lea eax, [edi + esi]
sar eax, cl
lea ecx, [esp + 0x20]
cdq
push edx
push eax
call fcn.10001301
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10023928
mov eax, dword [eax]
push eax
call fcn.1004c2d0
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.1000168f
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
cmp eax, 0x60c4
jl 0x1002390a
inc ebx
cmp ebx, 0x4ba4
jl 0x10023904
inc edi
cmp edi, 0x614d
jl 0x10023902
inc esi
cmp esi, 0xb5b
jl 0x10023900
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x10], 0x1f80
cmp dword [esp + 0x10], 0x21fe
jle 0x100239ce
xor esi, esi
xor edi, edi
mov eax, esi
lea ecx, [esp + 0x38]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001301
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100239a8
mov eax, dword [eax]
push eax
call fcn.1004c2d0
pop ecx
push 0
push 1
lea ecx, [esp + 0x40]
call fcn.1000168f
inc edi
cmp edi, 0xc9b
jl 0x1002398b
inc esi
cmp esi, 0x2f14
jl 0x10023989
cmp dword [esp + 0x10], 0x1cbd
jge 0x100239e3
push str.sepvnuoo_pmzljnqu_btbg_rymbu_hedochgm_xdyiic_fisdrjf_xlpzxhwge
call fcn.1004c2d0
pop ecx
mov esi, dword [ebp + 0x24]
mov edi, dword [ebp + 8]
mov eax, dword [esi + 4]
sub eax, dword [esi]
sar eax, 2
mov dword [ebx], eax
jmp 0x10023a0a
and dword [esp + 0x1c], 0
lea eax, [esp + 0x1c]
push eax
mov ecx, esi
call fcn.100267ef
inc dword [ebx]
mov eax, dword [ebx]
cmp eax, dword [edi]
jl 0x100239f5
cmp dword [esp + 0x14], 0x6117
jge 0x10023a78
push str.fiuqt_rxse_glwtegjaj_kyt_osqy_oij_rjjnawiz_kkveffle
call fcn.1004c2d0
pop ecx
jmp 0x10023a78
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
push dword [eax]
lea eax, [esp + 0x58]
push eax
call fcn.100264ef
mov ecx, dword [ebp + 0x10]
push eax
call fcn.10001dfe
push 0
push 1
lea ecx, [esp + 0x58]
call fcn.10001f60
jmp 0x10023a78
cmp byte [ebp + 0x30], 0
je 0x10023a69
mov eax, dword [ebp + 0x20]
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
mov eax, dword [ebp + 0x2c]
sar ecx, 2
mov dword [eax], ecx
jmp 0x10023a78
push ecx
push ecx
mov ecx, dword [ebp + 0x18]
call fcn.100263e5
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100253d7
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov byte [ebp - 4], dl
mov dword [ebp - 8], ecx
je 0x100254be
cmp byte [ebp + 0x10], 0
je 0x1002540d
mov eax, dword [ebp + 0x28]
push dword [ebp + 0x20]
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
mov edx, dword [eax]
call fcn.10020634
pop ecx
jmp 0x100254dc
mov edx, dword [ebp + 0x1c]
xor ecx, ecx
mov eax, dword [ebp + 0x34]
mov ebx, dword [ebp + 0x24]
push 0
pop edi
mov eax, dword [eax]
mov dword [edx], eax
mov eax, dword [ebx]
cmp eax, 0xe0ea
setl cl
cmp dword [edx], ecx
mov edx, dword [ebp + 0xc]
jle 0x10025439
cmp dword [edx], edi
je 0x10025439
xor ecx, ecx
inc ecx
jmp 0x1002543b
mov ecx, edi
mov eax, dword [ebx]
cmp ecx, 0xb2235412
mov esi, dword [ebp + 0x38]
mov dword [esi], eax
mov eax, dword [ebp + 0x30]
mov dword [eax], ecx
sbb eax, eax
mov ecx, dword [ebp - 8]
neg eax
mov dword [ecx], eax
mov ecx, dword [ecx]
mov eax, dword [edx]
xor edx, edx
cmp eax, ecx
mov eax, dword [ebp + 0xc]
setle dl
xor ecx, ecx
mov eax, dword [eax]
cmp edx, eax
mov eax, dword [esi]
setg cl
imul eax, ecx
test eax, eax
jne 0x1002547a
cmp dword [ebx], edi
je 0x1002547d
xor edi, edi
inc edi
mov eax, dword [ebx]
xor ecx, ecx
cmp eax, edi
mov eax, dword [ebp + 8]
setge cl
xor edx, edx
mov eax, dword [eax]
cmp ecx, eax
mov eax, dword [ebp + 0x18]
setl dl
xor ecx, ecx
mov eax, dword [eax]
sub edx, eax
mov eax, dword [ebx]
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0x2d1f
setne al
xor ecx, ecx
cmp eax, 0xb681
mov eax, dword [ebp + 0x2c]
setl cl
mov dword [eax], ecx
jmp 0x100254dc
test dl, dl
je 0x100254d1
push 0x135d
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
jmp 0x100254dc
push 0x334
call dword [sym.imp.USER32.dll_GetKeyState]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002733e
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100660da
call fcn.10064c08
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
lea ecx, [ebp - 0x38]
push 4
call fcn.100014bd
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], esi
mov dword [ebp - 0x40], esi
mov dword [ebp - 0x3c], esi
mov dword [ebp - 0x24], 0x20aa
cmp dword [ebp - 0x24], 0x2122
jle 0x100273da
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x20], esi
mov ecx, esi
mov dword [ebp - 0x1c], 0x23f1
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x14], ecx
mov eax, ebx
shl eax, cl
mov ecx, 0x10081dd8
xor eax, edi
cdq
push edx
push eax
call fcn.1000c947
mov ecx, dword [ebp - 0x14]
add ecx, esi
dec dword [ebp - 0x1c]
mov dword [ebp - 0x14], ecx
jne 0x10027399
inc esi
push 0
mov dword [ebp - 0x20], esi
cmp esi, 0x6d06
pop esi
jl 0x1002738a
inc ebx
cmp ebx, 0x7cc2
jl 0x10027387
inc edi
cmp edi, 0x566f
jl 0x10027385
mov byte [ebp - 4], 1
cmp dword [ebp - 0x24], 0x2059
jge 0x10027414
mov edx, str.mvescouj_ftso_ykjq_ttlpdbe_skbisgnn_zrpqs_tgnie_cbmduf_jcwvk_tgwd_tlrwwup_morfdb
mov ecx, 0x10081dd8
call fcn.1000fdbf
jmp 0x10027414
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], esi
jmp 0x10027426
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2c], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1002741c
push ecx
lea eax, [ebp - 0x18]
mov dl, 1
push eax
lea eax, [ebp - 0x38]
mov ecx, 0x6b31
push eax
call fcn.100272af
add esp, 0xc
inc dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
cmp dword [ebp - 0x2c], esi
jne 0x10027452
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x38]
push 0xfffffffffffffffa
pop edi
mov dword [eax + 8], ecx
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], 0x45c17473
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x14], 0xffffffec
jmp 0x100274f8
push 1
push ecx
push 0x1b2c
mov dword [ebp - 0x24], 0x1d534a2c
mov edx, 0x4df
push ecx
call fcn.100272fc
mov eax, dword [ebp - 0x24]
xor edx, edx
mov eax, dword [ebp - 0x14]
add esp, 0x10
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x2c]
mov eax, dword [ebp - 0x2c]
add ecx, 0x49a354bd
cmp ecx, eax
mov ecx, 0x69ee35c
mov eax, dword [ebp - 0x20]
setge dl
sub ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
push 0
setl dl
neg eax
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp - 0x38]
setle cl
sub ecx, 0xcd53
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
pop eax
setne al
imul eax, eax, 0x6446
mov dword [ebp - 0x24], eax
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], edi
jg 0x10027480
mov dword [ebp - 0x14], esi
jmp 0x10027508
dec dword [ebp - 0x40]
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jle 0x10027502
lea ecx, [ebp - 0x38]
call fcn.10001540
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10029552
Capabilities:
Extract resource via kernel32 functions
Get system information on windows
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov byte [ebp - 4], dl
push ebx
push esi
push edi
test cl, cl
je 0x10029601
cmp byte [ebp + 0xc], 0
je 0x10029585
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10029625
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x10029625
mov dword [ebp - 8], 0x6f5
cmp dword [ebp - 8], 0xa9c
jle 0x100295e0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
xor esi, esi
xor edi, edi
mov ebx, 0x54ce
mov eax, edi
lea ecx, [ebp - 0x20]
cdq
push edx
push eax
call fcn.10001301
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100295bf
mov eax, dword [eax]
push eax
call fcn.1004c2d0
pop ecx
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.1000168f
add edi, esi
dec ebx
jne 0x100295a8
inc esi
cmp esi, 0x74a2
jl 0x100295a1
push 0x334
call dword [sym.imp.USER32.dll_GetKeyState]
cmp dword [ebp - 8], 0x6b4
jge 0x10029625
push str.sewyypd_cnbtu_mxhema_sxouscdso_uytkv
call fcn.1004c2d0
pop ecx
jmp 0x10029625
test dl, dl
je 0x1002960f
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x10029625
mov eax, dword [ebp + 0x10]
push dword [ebp - 8]
mov ecx, dword [ebp + 0x14]
push dword [eax + 4]
push dword [eax]
push dword [ecx + 4]
call fcn.1002c8f5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10029e5f
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100661f3
call fcn.10064c08
sub esp, 0xc
push ebx
push esi
mov byte [ebp - 0x14], dl
mov dword [ebp - 0x18], 0x6144
cmp dword [ebp - 0x18], 0x632c
push edi
mov dword [ebp - 0x10], esp
jle 0x10029eac
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x10081dd8
xor eax, esi
cdq
push edx
push eax
call fcn.1000c947
inc edi
cmp edi, 0x5d2c
jl 0x10029e89
inc esi
cmp esi, 0x3933
jl 0x10029e87
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x5fc7
jge 0x10029ec8
mov edx, str.ztjkggja_qcs_mrw_gxkpc_tbd_ylpny_iairsqfl_zzqimqfvn
mov ecx, 0x10081dd8
call fcn.1000fdbf
cmp byte [ebp - 0x14], 0
je 0x10029f0a
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x10029f12
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
and dword [eax + ecx*4], 0
inc dword [edx]
cmp dword [edx], 3
jl 0x10029edf
jmp 0x10029f12
push 0
call dword [sym.imp.KERNEL32.dll_SetDllDirectoryW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002f59e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
cmp byte [ebp + 0x10], 0
push ebx
push edi
mov edi, ecx
mov byte [esp + 8], dl
mov dword [esp + 0x1c], edi
je 0x1002f693
cmp byte [ebp + 0xc], 0
je 0x1002f5e1
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x1002f6cc
push 0x135d
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
jmp 0x1002f6cc
mov dword [esp + 0x14], 0x5c4c
cmp dword [esp + 0x14], 0x6025
jle 0x1002f65c
xor edi, edi
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0xc], 0x61bd
mov ecx, ebx
mov eax, edi
sar eax, cl
lea ecx, [esp + 0x20]
cdq
push edx
push eax
call fcn.10001301
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002f623
mov eax, dword [eax]
push eax
call fcn.1004c2d0
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.1000168f
dec ebx
dec dword [esp + 0xc]
jne 0x1002f607
mov ebx, dword [esp + 0x10]
inc ebx
mov dword [esp + 0x10], ebx
cmp ebx, 0xe9b
jl 0x1002f5fb
inc edi
cmp edi, 0x2bf5
jl 0x1002f5f5
mov edi, dword [esp + 0x1c]
cmp dword [esp + 0x14], 0x5987
jge 0x1002f671
push str.mkmandlz_qmxzfjtm_sgbbsgum
call fcn.1004c2d0
pop ecx
mov dword [edi], 0
cmp dword [edi], 2
jge 0x1002f6cc
mov edx, dword [ebp + 0x18]
mov ecx, dword [edi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 8
inc dword [edi]
cmp dword [edi], 2
jl 0x1002f67f
jmp 0x1002f6cc
test dl, dl
je 0x1002f6a4
push 0x334
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x1002f6cc
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1002f6cc
push 0
push 0x238e
push 0x18f1
push 0
push 0x255a
push 0x605
push 0
call dword [sym.imp.KERNEL32.dll_CreateFileA]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002f6df
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0xc], 0
je 0x1002f6f4
mov eax, dword [ebp + 8]
mov dword [eax], 1
jmp 0x1002f6fc
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop ecx
pop ebp
ret

Function at 0x1002fdb8
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x1002fdcf
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8