joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10006951
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10062660
call fcn.10061fc8
sub esp, 0xc
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], esi
je 0x100069a1
cmp byte [ebp + 0x1c], 0
je 0x10006987
mov eax, dword [ebp + 0x24]
xor ecx, ecx
inc ecx
mov eax, dword [eax]
sub ecx, eax
mov eax, dword [ebp + 0x18]
jmp 0x10006a78
cmp byte [ecx], 0
je 0x10006a7a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_HeapCreate]
jmp 0x10006a7a
cmp byte [ebp + 0x30], 0
je 0x100069d3
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x10006a7a
mov esi, dword [ebp + 0x20]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 5
inc dword [edx]
cmp dword [edx], 1
jl 0x100069bc
jmp 0x10006a7a
mov dword [ebp + 0x14], 0x1d5a
cmp dword [ebp + 0x14], 0x1e6f
jle 0x10006a1d
xor edi, edi
xor ebx, ebx
xor esi, esi
mov eax, ebx
mov ecx, 0x10080098
cdq
idiv esi
xor edx, edi
mov eax, edx
cdq
push edx
push eax
call fcn.1000b94d
inc esi
cmp esi, 0x6ea4
jl 0x100069e9
inc ebx
cmp ebx, 0x4453
jl 0x100069e7
inc edi
cmp edi, 0x1da2
jl 0x100069e5
mov esi, dword [ebp - 0x14]
and dword [ebp - 4], 0
cmp dword [ebp + 0x14], 0x1cdd
jge 0x10006a58
mov edx, str.qzc_xtlbyq_gjmesnv_thlyv_kklq_pmdjr_fmatfxfwd_ftlmvr_wgglehqh_opgthx_bzzlilyv_wsccn_fluqojiq
mov ecx, 0x10080098
call fcn.1000f355
jmp 0x10006a58
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x2c]
mov dword [eax], 7
mov eax, dword [esi]
mov eax, dword [esi]
mov dword [ecx], eax
mov eax, dword [ecx]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov ecx, dword [ecx]
mov eax, dword [ebp + 0x28]
neg ecx
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10016ce6
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10016d07
push 0x2ce5
push 1
call fcn.10016d98
pop ecx
pop ecx
jmp 0x10016d94
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10016d76
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10016d57
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10016d74
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.100014f6
mov dword [eax], 0xb0befcdf
jmp 0x10016d4c
jmp 0x10016d94
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10016d94
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esp, ebp
pop ebp
ret
Function at 0x10017ffb
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10062d75
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x5c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001803c
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x2c]
push 1
call fcn.100181c8
pop ecx
pop ecx
jmp 0x100181b7
lea eax, [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x10018067
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
jmp 0x100181b7
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x28], 0x5817
mov dword [ebp - 0x4c], str.detu_oywdgqqst_fyse_jsglysqc_sderqg_bshxjvi_zdaajs_andmkj_oxfsyth
cmp dword [ebp - 0x28], 0x5b32
jle 0x1001813c
and dword [ebp - 0x18], 0
jmp 0x1001809b
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x686f
jge 0x1001813c
and dword [ebp - 0x1c], 0
jmp 0x100180b5
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x7e47
jge 0x10018137
and dword [ebp - 0x20], 0
jmp 0x100180cb
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x2ac9
jge 0x10018132
and dword [ebp - 0x24], 0
jmp 0x100180e1
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x6912
jge 0x10018130
mov eax, dword [ebp - 0x18]
cdq
idiv dword [ebp - 0x1c]
imul edx, dword [ebp - 0x20]
mov eax, edx
cdq
idiv dword [ebp - 0x24]
mov eax, edx
cdq
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], edx
push dword [ebp - 0x50]
push dword [ebp - 0x54]
lea ecx, [ebp - 0x6c]
call fcn.10001381
pop ecx
pop ecx
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
call fcn.100014aa
push eax
call fcn.10049bf0
pop ecx
lea ecx, [ebp - 0x6c]
call fcn.100014a0
jmp 0x100180da
jmp 0x100180c4
jmp 0x100180ae
jmp 0x10018094
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x1001815e
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 2
jge 0x1001817b
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x48]
call fcn.100014f6
mov dword [eax], 1
jmp 0x10018153
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x5590
jge 0x10018191
push dword [ebp - 0x4c]
call fcn.10049bf0
pop ecx
jmp 0x100181ad
or dword [ebp - 4], 0xffffffff
jmp 0x100181b7
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100181ee
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10018248
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10018237
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10018235
push 0
push 0x21f4
call dword [sym.imp.USER32.dll_FlashWindow]
jmp 0x10018243
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
jmp 0x100182e7
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x100182c7
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10018298
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jg 0x100182c5
push dword [ebp - 0x2c]
push 0x3ad7
push 1
push 1
push 0x39b8
push 0x3cec
push 1
push dword [ebp - 4]
call fcn.1001640d
add esp, 0x20
jmp 0x1001828d
jmp 0x100182e7
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x100182e7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov esp, ebp
pop ebp
ret
Function at 0x10020c2a
Capabilities:
Connect pipe
Encode data using xor

Disassembly:
mov eax, 0x10063004
call fcn.10061fc8
push ecx
push ecx
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x10020cc0
cmp byte [edx], 0
je 0x10020ca4
mov dword [ebp - 0x14], 0x2c44
cmp dword [ebp - 0x14], 0x2e15
jle 0x10020c7e
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x10080098
xor eax, esi
cdq
push edx
push eax
call fcn.1000b94d
inc edi
cmp edi, 0x4c47
jl 0x10020c5b
inc esi
cmp esi, 0x4480
jl 0x10020c59
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x28d7
jge 0x10020ca4
mov edx, str.uefgwzm_vtzqahd_cbje_jxwxi
mov ecx, 0x10080098
call fcn.1000f355
jmp 0x10020cc9
mov eax, dword [ebp + 0x10]
mov dword [eax], 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100258d2
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov dword [ebp - 4], 0x21b8
mov ebx, edx
cmp dword [ebp - 4], 0x246e
mov dword [ebp - 8], ebx
jle 0x10025936
push esi
push edi
xor esi, esi
xor edi, edi
mov ebx, 0xc9f
mov eax, edi
lea ecx, [ebp - 0x20]
cdq
push edx
push eax
call fcn.10001381
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10025910
mov eax, dword [eax]
push eax
call fcn.10049bf0
pop ecx
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.10001612
add edi, esi
dec ebx
jne 0x100258f9
inc esi
cmp esi, 0xea4
jl 0x100258f2
mov ebx, dword [ebp - 8]
pop edi
pop esi
cmp dword [ebp - 4], 0x1ed4
jge 0x1002594a
push str.cphk_ofhmfeeem_ruiupc_ffsdxvpzn_sipxvyvfr_znusp_amyoptgtm_wvpipft_vtgcv_koqeiti_tttodhkwt_ghsppilj_znxhpidtd_halrm
call fcn.10049bf0
pop ecx
cmp byte [ebp + 0xc], 0
je 0x10025961
cmp byte [ebx], 0
je 0x1002597d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
jmp 0x1002597d
mov eax, dword [ebp + 0x14]
mov dword [eax], 7
jmp 0x10025978
mov dword [ebp - 4], 0xd9a924c0
inc dword [ebp - 4]
dec dword [eax]
cmp dword [eax], 0xfffffff0
jle 0x1002596c
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10025a93
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10063289
call fcn.10061fc8
sub esp, 0x10
push ebx
push esi
mov dword [ebp - 0x1c], 0x65ce
cmp dword [ebp - 0x1c], 0x6600
push edi
mov dword [ebp - 0x10], esp
jle 0x10025b07
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov dword [ebp - 0x18], ecx
sar eax, cl
lea ecx, [ebx + edi]
xor eax, ecx
mov ecx, 0x10080098
cdq
push edx
push eax
call fcn.1000b94d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x7252
jl 0x10025ac4
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x5913
jl 0x10025abf
inc ebx
cmp ebx, 0x1314
jl 0x10025aba
inc edi
cmp edi, 0x676a
jl 0x10025ab8
cmp byte [ebp + 0x14], 0
je 0x10025b60
mov edx, dword [ebp + 0x18]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x10025b30
mov edi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [edi]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [edx]
cmp dword [edx], 3
jl 0x10025b1e
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x62e1
jge 0x10025b4f
mov edx, str.jiojgu_flryfkrpm_imcjq_jcdntftqb_zxnzxar_cinjufxj
mov ecx, 0x10080098
call fcn.1000f355
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x10025b7f
push 0x130f
push 0
push 0xcab
push 0x793
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov dword [ebp - 0x14], 0x7c10
cmp dword [ebp - 0x14], 0x7fbd
jle 0x10025bcc
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov eax, ebx
sar eax, cl
mov ecx, 0x10080098
and eax, edi
cdq
push edx
push eax
call fcn.1000b94d
mov ecx, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x61a4
jl 0x10025b98
inc ebx
cmp ebx, 0x3f89
jl 0x10025b93
inc edi
cmp edi, 0x114a
jl 0x10025b91
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x7a4c
jge 0x10025b30
mov edx, str.iuxbtsl_vqkevpsa_cxdziijzi_yoeqzovjn_tmwgfykz_cvgjovb_bwelpaydb_dtzaxsgho_nooap_zxavdqe_kyrpz_xjp
mov ecx, 0x10080098
call fcn.1000f355
jmp 0x10025b30

Function at 0x1002767b
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov dword [0x109ccac4], ecx
inc edx
mov esi, 0x270
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
mov dword [edx*4 + 0x109ccac4], ecx
inc edx
cmp edx, esi
jl 0x10027690
mov dword [0x109ccac0], esi
pop esi
pop ebp
ret 8
Function at 0x100276b6
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x109ccac4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x109cce50
jl 0x100276c4
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x109cd0f4
jl 0x10027704
mov ecx, dword [0x109cde40]
xor ecx, dword [0x109ccac4]
and ecx, edi
xor ecx, dword [0x109cde40]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x109ccac0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x109cd0f4]
mov dword [0x109cd480], eax
pop esi
ret

Function at 0x10028855
Capabilities:
Delete file

Disassembly:
mov eax, 0x1006343c
call fcn.10061fc8
sub esp, 0x10
push ebx
push esi
mov byte [ebp - 0x14], cl
mov dword [ebp - 0x1c], 0x16b9
cmp dword [ebp - 0x1c], 0xec9
push edi
mov dword [ebp - 0x10], esp
jge 0x100288e9
mov dword [0x1085d200], 1
mov esi, 0x10876b64
call fcn.10028829
mov dword [esi], eax
add esi, 4
cmp esi, 0x10876c54
jle 0x1002888a
push 0x10876c54
mov esi, 0x1006ba60
push esi
call fcn.1004a0ea
pop ecx
pop ecx
jmp 0x100288da
dec eax
push 0x1085d2f4
push esi
mov dword [0x10876c54], eax
call fcn.1004a0ea
mov eax, dword [0x1085d2f4]
push dword [eax*4 + 0x10876b60]
push 0x1006ba64
call fcn.10049bf0
add esp, 0x10
mov eax, dword [0x10876c54]
test eax, eax
jne 0x100288b0
dec eax
mov dword [0x10876c54], eax
cmp byte [ebp - 0x14], 0
je 0x1002890c
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], 0x332b
cmp dword [ebp - 0x1c], 0x33fb
jle 0x1002895a
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, edi
mov ecx, 0x10080098
cdq
idiv ebx
lea eax, [esi + edx]
cdq
push edx
push eax
call fcn.1000b94d
inc ebx
cmp ebx, 0x3ae
jl 0x10028922
inc edi
cmp edi, 0x346f
jl 0x10028920
inc esi
cmp esi, 0x3965
jl 0x1002891e
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push ecx
push ecx
mov byte [ebp - 0x15], 0
lea ecx, [ebp - 0x15]
call fcn.1002ba3d
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x2f51
pop ecx
pop ecx
jge 0x100288fb
mov edx, str.bbbqggul_wlnssncv_kgdvbmpvl_mdipf_rhqmaz_ayyap
mov ecx, 0x10080098
call fcn.1000f355
jmp 0x100288fb
Function at 0x1002b09b
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10063663
call fcn.10061fc8
sub esp, 0x1c
push ebx
push esi
mov dword [ebp - 0x28], 0x7971
xor ebx, ebx
cmp dword [ebp - 0x28], 0x7ac8
push edi
mov dword [ebp - 0x10], esp
jle 0x1002b0ea
mov esi, ebx
mov dword [ebp - 0x24], ebx
lea eax, [ebx + esi]
mov ecx, 0x10080098
cdq
push edx
push eax
call fcn.1000b94d
inc ebx
cmp ebx, 0x994
jl 0x1002b0c5
inc esi
push 0
pop ebx
cmp esi, 0x5f67
jl 0x1002b0c2
mov dword [ebp - 0x24], 0x5de2
cmp dword [ebp - 0x24], 0x61bf
jle 0x1002b159
mov esi, ebx
mov dword [ebp - 0x1c], ebx
mov eax, ebx
mov dword [ebp - 0x18], ebx
mov ecx, ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], ecx
cdq
idiv ecx
mov eax, ebx
mov ecx, 0x10080098
sub eax, edx
xor eax, esi
cdq
push edx
push eax
call fcn.1000b94d
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x20], ecx
cmp ecx, 0x4e3a
jl 0x1002b10c
inc eax
mov dword [ebp - 0x18], eax
push 0
pop ebx
cmp eax, 0x2528
jl 0x1002b104
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x4b61
jl 0x1002b0ff
inc esi
cmp esi, 0xd9c
jl 0x1002b0fc
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x24], 0x5b00
jge 0x1002b174
mov edx, str.oinx_hjxfbcc_nlueukgye_cni
mov ecx, 0x10080098
call fcn.1000f355
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0xc], 0
je 0x1002b247
mov dword [ebp - 0x24], 0x23f2
cmp dword [ebp - 0x24], 0xad4
jge 0x1002b23e
mov dword [0x10876c58], ebx
mov esi, 0x1085d064
jmp 0x1002b227
mov eax, dword [0x10876b58]
cmp eax, 1
jl 0x1002b23e
mov ecx, dword [0x1085d064]
test ecx, ecx
js 0x1002b23e
cmp ecx, eax
jle 0x1002b1ed
push 0x100700c8
call fcn.1004a9d6
pop ecx
jmp 0x1002b221
jne 0x1002b1f6
push 0x100700cc
jmp 0x1002b1e5
push 0x19860
push 0xffffffffffffffff
push 0x1085d2f8
call fcn.100421b0
push 2
xor edx, edx
xor ecx, ecx
call fcn.1002afec
push edx
push eax
push str._lld_n
call fcn.10049bf0
add esp, 0x1c
inc dword [0x10876c58]
push esi
push 0x10876b58
push str._d__d
call fcn.1004a0ea
add esp, 0xc
test eax, eax
jne 0x1002b1c8
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1002b250
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x28], 0x7658
jge 0x1002b26f
mov edx, str.xxj_cbz_kaitxgtex_enfaph_qca_gmaliby_mvlzginzo_obyyhmuq_kvhx
mov ecx, 0x10080098
call fcn.1000f355
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002b3f7
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006366d
call fcn.10061fc8
sub esp, 0x28
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov byte [ebp - 0x14], dl
je 0x1002b483
test dl, dl
je 0x1002b42e
mov eax, dword [ebp + 8]
movzx eax, word [eax]
push eax
push ecx
mov ecx, dword [ebp + 0x14]
call fcn.1002cc93
jmp 0x1002b54e
xor edi, edi
mov dword [esi], 0
inc edi
jmp 0x1002b47a
push edi
lea ecx, [ebp - 0x30]
call fcn.100014b5
mov dword [ebp + 0x10], 0
jmp 0x1002b45b
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x30]
mov dword [eax + ecx*4], 0xe0184dcc
inc dword [ebp + 0x10]
cmp dword [ebp + 0x10], edi
jl 0x1002b44b
mov eax, dword [ebp - 0x30]
push eax
dec dword [eax]
call fcn.10049cc1
and dword [ebp - 0x30], 0
and dword [ebp - 0x2c], 0
and dword [ebp - 0x28], 0
inc dword [esi]
pop ecx
cmp dword [esi], edi
jle 0x1002b439
jmp 0x1002b54e
mov dword [ebp - 0x1c], 0x4568
cmp dword [ebp - 0x1c], 0x492f
jle 0x1002b4f3
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp + 0x10], edi
xor ebx, ebx
and dword [ebp - 0x24], 0
lea eax, [edi + esi]
mov edi, dword [ebp - 0x24]
mov ecx, ebx
mov esi, eax
mov dword [ebp - 0x20], eax
sar esi, cl
mov eax, esi
mov ecx, 0x10080098
xor eax, edi
cdq
push edx
push eax
call fcn.1000b94d
inc edi
cmp edi, 0x6bd8
jl 0x1002b4b2
mov esi, dword [ebp - 0x18]
inc ebx
mov edi, dword [ebp + 0x10]
cmp ebx, 0x3be0
jl 0x1002b49f
inc edi
mov dword [ebp + 0x10], edi
cmp edi, 0x62c5
jl 0x1002b49d
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x4083
jl 0x1002b498
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x4523
jge 0x1002b50f
mov edx, str.pwnoofmvx_iiynpx_pyl_qkglyc_jrfmypxfe_chdzomfgu_lrh_pihpizdah_xllijdccq_gcqntd_nzjzxxs_sronozq_slt
mov ecx, 0x10080098
call fcn.1000f355
cmp byte [ebp + 0x18], 0
je 0x1002b536
mov eax, dword [ebp + 0x1c]
dec dword [eax]
jmp 0x1002b54e
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1002b54e
push 0x11ae
push 0x23bb
call dword [sym.imp.USER32.dll_GetWindowLongW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002fc94
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10063876
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], 0xcab
mov dword [ebp - 0x24], str.wcdbvv_dwwbrczn_ffq_npt_ixip_tmav_mkf_farpw
cmp dword [ebp - 0x1c], 0xcba
jle 0x1002fd46
push 0x6e0
push 0
push 0x1a16
call dword [sym.imp.USER32.dll_GetWindowTextW]
and dword [ebp - 0x14], 0
jmp 0x1002fcec
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1809
jge 0x1002fd46
and dword [ebp - 0x18], 0
jmp 0x1002fd02
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x7649
jge 0x1002fd44
mov eax, dword [ebp - 0x14]
and eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edx
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x44]
call fcn.10001381
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
call fcn.100014aa
push eax
call fcn.10049bf0
pop ecx
lea ecx, [ebp - 0x44]
call fcn.100014a0
jmp 0x1002fcfb
jmp 0x1002fce5
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push dword [ebp + 0x14]
push 1
push dword [ebp + 8]
call fcn.1002fda9
add esp, 0x14
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x940
jge 0x1002fd72
push dword [ebp - 0x24]
call fcn.10049bf0
pop ecx
jmp 0x1002fd8e
or dword [ebp - 4], 0xffffffff
jmp 0x1002fd98
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Encode data using base64

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [ebp + 0x10]
push ebx
push esi
xor esi, esi
push edi
xor ebx, ebx
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], esi
mov dword [ebp - 0x10], eax
cmp esi, dword [ebp + 0x10]
jge 0x401191
mov eax, dword [ebp - 0x10]
push 3
pop edx
cmp eax, edx
mov dword [ebp - 0xc], edx
jge 0x401032
mov dword [ebp - 0xc], eax
mov ecx, dword [ebp - 0xc]
mov eax, 0x3d3d3d3d
lea edi, [ebp - 4]
stosw word es:[edi], ax
test ecx, ecx
stosb byte es:[edi], al
jle 0x401059
mov eax, dword [ebp + 8]
lea edi, [ebp - 4]
add esi, eax
mov eax, ecx
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, edx
rep movsb byte es:[edi], byte [esi]
mov cl, byte [ebp - 4]
mov al, cl
shr al, 2
test ebx, ebx
mov byte [ebp - 1], al
je 0x40108e
mov edi, dword [ebp + 0x14]
test edi, edi
jle 0x401096
mov eax, ebx
mov esi, dword [ebp + 0xc]
sub eax, dword [ebp - 8]
cdq
idiv edi
test edx, edx
jne 0x401099
mov byte [ebx + esi], 0xd
inc ebx
mov byte [ebx + esi], 0xa
inc ebx
add dword [ebp - 8], 2
jmp 0x401099
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x14]
jmp 0x401099
mov esi, dword [ebp + 0xc]
movzx eax, byte [ebp - 1]
mov edx, dword [str.CEGIKMOQSUWY___acegikmoqsu]
and cl, 3
shl cl, 4
mov al, byte [eax + edx]
mov byte [ebx + esi], al
mov al, byte [ebp - 3]
mov dl, al
inc ebx
shr dl, 4
add cl, dl
test ebx, ebx
je 0x4010df
test edi, edi
jle 0x4010df
mov eax, ebx
sub eax, dword [ebp - 8]
cdq
idiv edi
test edx, edx
jne 0x4010dc
mov byte [ebx + esi], 0xd
inc ebx
mov byte [ebx + esi], 0xa
inc ebx
add dword [ebp - 8], 2
mov al, byte [ebp - 3]
mov edx, dword [str.CEGIKMOQSUWY___acegikmoqsu]
and al, 0xf
movzx ecx, cl
shl al, 2
mov cl, byte [ecx + edx]
mov byte [ebx + esi], cl
mov cl, byte [ebp - 2]
mov dl, cl
inc ebx
shr dl, 6
add al, dl
test ebx, ebx
mov byte [ebp - 1], al
je 0x401123
test edi, edi
jle 0x401123
mov eax, ebx
sub eax, dword [ebp - 8]
cdq
idiv edi
test edx, edx
jne 0x401123
mov byte [ebx + esi], 0xd
inc ebx
mov byte [ebx + esi], 0xa
inc ebx
add dword [ebp - 8], 2
movzx eax, byte [ebp - 1]
mov edx, dword [str.CEGIKMOQSUWY___acegikmoqsu]
mov al, byte [eax + edx]
mov byte [ebx + esi], al
inc ebx
cmp dword [ebp - 0xc], 2
jg 0x40113f
mov byte [ebx + esi - 1], 0x3d
and cl, 0x3f
test ebx, ebx
je 0x401164
test edi, edi
jle 0x401164
mov eax, ebx
sub eax, dword [ebp - 8]
cdq
idiv edi
test edx, edx
jne 0x401164
mov byte [ebx + esi], 0xd
inc ebx
mov byte [ebx + esi], 0xa
inc ebx
add dword [ebp - 8], 2
movzx eax, cl
mov ecx, dword [str.CEGIKMOQSUWY___acegikmoqsu]
mov al, byte [eax + ecx]
mov byte [ebx + esi], al
inc ebx
cmp dword [ebp - 0xc], 1
jg 0x40117f
mov byte [ebx + esi - 1], 0x3d
mov esi, dword [ebp - 0x14]
add esi, 3
sub dword [ebp - 0x10], 3
mov dword [ebp - 0x14], esi
jmp 0x401019
pop edi
mov eax, ebx
pop esi
pop ebx
leave
ret