joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40a260
Capabilities:
Delete file
Get common file path

Disassembly:
sub esp, 0x130
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_lstrlenA]
push ebp
mov ebp, dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push esi
push edi
mov edi, dword [sym.imp.KERNEL32.dll_lstrcatA]
mov dword [esp + 0x18], str.DWRCS.EXE
mov dword [esp + 0x1c], str.DWRCS.INI
mov dword [esp + 0x20], str.DWRCK.DLL
mov dword [esp + 0x24], str.DWRCShell.dll
mov dword [esp + 0x28], str.DWRCShell.dlx
mov dword [esp + 0x2c], str.DWRCSI.DLL
mov dword [esp + 0x30], str.DWRCSET.dll
mov dword [esp + 0x34], str.DWRCST.exe
mov dword [esp + 0x38], str.DWRCST.exe.manifest
mov dword [esp + 0x10], 1
lea esi, [esp + 0x18]
mov dword [esp + 0x14], 9
lea eax, [esp + 0x3c]
push 0x104
push eax
call ebp
lea ecx, [esp + 0x3c]
push ecx
call ebx
cmp byte [esp + eax + 0x3b], 0x5c
je 0x40a2fe
lea edx, [esp + 0x3c]
push 0x41d1c8
push edx
call edi
mov eax, dword [esi]
lea ecx, [esp + 0x3c]
push eax
push ecx
call edi
lea edx, [esp + 0x3c]
push edx
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
test eax, eax
jne 0x40a31b
mov dword [esp + 0x10], eax
mov eax, dword [esp + 0x14]
add esi, 4
dec eax
mov dword [esp + 0x14], eax
jne 0x40a2d8
mov eax, dword [esp + 0x10]
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x130
ret

Function at 0x40b794
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 4]
push esi
mov esi, dword [esp + 0xc]
mov eax, esi
shr eax, 2
test eax, eax
push edi
mov edi, dword [esp + 0x14]
jle 0x40b7cf
push ebx
movzx edx, byte [ecx]
xor ebx, ebx
inc ecx
mov bh, byte [ecx]
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x10
or edx, ebx
inc ecx
movzx ebx, byte [ecx]
shl ebx, 0x18
or edx, ebx
inc ecx
xor edi, edx
dec eax
jne 0x40b7ac
pop ebx
and esi, 3
xor eax, eax
dec esi
je 0x40b7eb
dec esi
je 0x40b7e4
dec esi
jne 0x40b7f0
movzx eax, byte [ecx]
shl eax, 0x10
inc ecx
xor edx, edx
mov dh, byte [ecx]
or eax, edx
inc ecx
movzx ecx, byte [ecx]
or eax, ecx
xor eax, edi
pop edi
pop esi
ret 0xc
Function at 0x10001e20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
xor edx, edx
push ebx
push esi
push edi
mov edi, ecx
mov esi, dword [edi]
lea eax, [esi*4]
test eax, eax
je 0x10001e56
mov ebx, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
sub ebx, ecx
mov al, byte [ecx + ebx]
inc edx
mov byte [ecx], al
inc ecx
mov esi, dword [edi]
lea eax, [esi*4]
cmp edx, eax
jb 0x10001e42
mov eax, dword [edi + 4]
inc eax
shl esi, 2
shl eax, 4
mov dword [ebp - 0xc], esi
cmp esi, eax
jae 0x10001fa4
mov eax, dword [ebp + 0xc]
add eax, 0xfffffffd
add eax, esi
mov bh, byte [eax]
mov cl, byte [eax + 1]
xor edx, edx
mov ch, byte [eax + 2]
mov bl, byte [eax - 1]
mov dword [ebp - 0x10], eax
mov eax, esi
shr eax, 2
div dword [edi]
mov byte [ebp - 8], bl
mov eax, edx
mov byte [ebp - 7], bh
mov byte [ebp + 0xb], cl
mov byte [ebp - 6], cl
mov byte [ebp - 1], ch
mov byte [ebp - 5], ch
test eax, eax
jne 0x10001ef9
lea eax, [ebp - 8]
mov byte [ebp - 7], cl
mov byte [ebp - 6], ch
mov ecx, edi
push eax
mov byte [ebp - 8], bh
mov byte [ebp - 5], bl
call fcn.10001fb0
mov eax, dword [edi]
xor edx, edx
mov cl, 1
lea esi, [eax*4]
mov eax, dword [ebp - 0xc]
div esi
mov esi, eax
sub esi, 1
je 0x10001ee6
mov dl, cl
add cl, cl
shr dl, 7
movzx eax, dl
imul eax, eax, 0x1b
xor cl, al
sub esi, 1
jne 0x10001ed2
mov bl, byte [ebp - 8]
mov dh, byte [ebp - 5]
xor bl, cl
mov dl, byte [ebp - 6]
mov bh, byte [ebp - 7]
mov esi, dword [ebp - 0xc]
jmp 0x10001f24
mov edx, dword [edi]
cmp edx, 6
jbe 0x10001f1e
cmp eax, 4
jne 0x10001f1e
lea eax, [ebp - 8]
mov ecx, edi
push eax
call fcn.10001fb0
mov dh, byte [ebp - 5]
mov dl, byte [ebp - 6]
mov bh, byte [ebp - 7]
mov bl, byte [ebp - 8]
jmp 0x10001f24
mov dh, byte [ebp - 1]
mov dl, byte [ebp + 0xb]
mov eax, dword [edi]
mov ecx, esi
shl eax, 2
sub ecx, eax
mov eax, dword [ebp + 0xc]
movzx eax, byte [ecx + eax]
mov ecx, dword [ebp - 0x10]
xor al, bl
mov byte [ecx + 3], al
mov eax, esi
mov ecx, dword [edi]
shl ecx, 2
sub eax, ecx
mov ecx, dword [ebp + 0xc]
mov al, byte [eax + ecx + 1]
xor al, bh
mov ebx, dword [ebp - 0x10]
mov byte [ebx + 4], al
lea ecx, [ebx + 4]
mov byte [ebp + 0xb], al
mov eax, esi
mov dword [ebp - 0x10], ecx
mov ecx, dword [edi]
shl ecx, 2
sub eax, ecx
mov ecx, dword [ebp + 0xc]
movzx eax, byte [eax + ecx + 2]
xor al, dl
mov byte [ebx + 5], al
mov eax, esi
mov ecx, dword [edi]
add esi, 4
shl ecx, 2
sub eax, ecx
mov dword [ebp - 0xc], esi
mov ecx, dword [ebp + 0xc]
movzx eax, byte [eax + ecx + 3]
xor al, dh
mov byte [ebx + 6], al
mov eax, dword [edi + 4]
mov bh, byte [ebp + 0xb]
inc eax
shl eax, 4
cmp esi, eax
mov eax, dword [ebp - 0x10]
jb 0x10001e75
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x10002040
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 0x14]
sub esp, 0x10
xor ecx, ecx
push esi
mov esi, dword [ebp + 8]
test edx, edx
je 0x10002195
push ebx
mov ebx, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 0x10]
cmp edx, 8
jb 0x10002178
lea eax, [ebx - 1]
add eax, edx
cmp edi, eax
ja 0x1000207e
lea eax, [edx - 1]
add eax, edi
cmp eax, ebx
jae 0x10002178
lea eax, [edx - 1]
add eax, esi
cmp edi, eax
ja 0x10002094
lea eax, [edx - 1]
add eax, edi
cmp eax, esi
jae 0x10002178
cmp edx, 0x40
jb 0x10002135
mov eax, edx
and eax, 0x3f
mov dword [ebp - 4], eax
mov eax, edx
sub eax, dword [ebp - 4]
mov edx, edi
sub edx, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebx + 0x10]
mov dword [ebp - 8], edx
mov ebx, esi
sub ebx, dword [ebp + 0xc]
mov edx, esi
sub edx, edi
mov dword [ebp - 0xc], edx
lea edx, [edi + 0x20]
nop word [eax + eax]
movups xmm0, xmmword [eax - 0x10]
mov edi, dword [ebp - 8]
lea eax, [eax + 0x40]
movups xmm1, xmmword [ecx + esi]
lea edx, [edx + 0x40]
xorps xmm1, xmm0
movups xmmword [edx - 0x60], xmm1
movups xmm0, xmmword [eax - 0x40]
movups xmm1, xmmword [ebx + eax - 0x40]
xorps xmm1, xmm0
movups xmmword [edi + eax - 0x40], xmm1
mov edi, dword [ebp - 0xc]
movups xmm0, xmmword [eax - 0x30]
movups xmm1, xmmword [edi + edx - 0x40]
mov edi, dword [ebp + 0x10]
xorps xmm1, xmm0
movups xmmword [edx - 0x40], xmm1
movups xmm1, xmmword [esi + ecx + 0x30]
add ecx, 0x40
movups xmm0, xmmword [eax - 0x20]
xorps xmm1, xmm0
movups xmmword [edx - 0x30], xmm1
cmp ecx, dword [ebp - 0x10]
jb 0x100020d0
cmp dword [ebp - 4], 8
mov edx, dword [ebp + 0x14]
jb 0x10002171
mov eax, dword [ebp + 0xc]
jmp 0x1000213c
mov eax, dword [ebp + 0xc]
mov ebx, esi
sub ebx, eax
mov dword [ebp + 0x14], edx
add eax, ecx
and dword [ebp + 0x14], 0xfffffff8
sub edi, dword [ebp + 0xc]
mov dword [ebp - 0x10], edi
nop dword [eax + eax]
movq xmm1, qword [ebx + eax]
lea eax, [eax + 8]
movq xmm0, qword [eax - 8]
add ecx, 8
xorps xmm1, xmm0
movq qword [edi + eax - 8], xmm1
cmp ecx, dword [ebp + 0x14]
jb 0x10002150
mov edi, dword [ebp + 0x10]
cmp ecx, edx
jae 0x10002193
mov ebx, dword [ebp + 0xc]
sub esi, ebx
lea eax, [ecx + ebx]
sub edi, ebx
sub edx, ecx
mov cl, byte [eax + esi]
lea eax, [eax + 1]
xor cl, byte [eax - 1]
mov byte [edi + eax - 1], cl
sub edx, 1
jne 0x10002181
pop edi
pop ebx
pop esi
mov esp, ebp
pop ebp
ret 0x10
Function at 0x10011360
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100465fd
mov eax, dword fs:[0]
push eax
sub esp, 0x18
push ebx
push esi
push edi
mov eax, dword [0x1005a280]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [ebp + 0xc]
cmp dword [eax + 0x14], 0xf
jbe 0x10011393
mov eax, dword [eax]
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov ebx, eax
cmp ebx, 0xffffffff
je 0x100113cb
push 0
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
cmp eax, 0xffffffff
jne 0x100113f4
push ebx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
mov dword [eax], 0
mov dword [eax + 4], 0
mov dword [eax + 8], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
xor esi, esi
xor edi, edi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 4], edi
test eax, eax
je 0x1001141e
lea ecx, [ebp + 0xf]
push ecx
push eax
lea ecx, [ebp - 0x24]
call fcn.1000fe50
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
push 0
lea ecx, [ebp - 0x14]
push ecx
push eax
push esi
push ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
push ebx
test eax, eax
jne 0x10011491
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ebx, dword [ebp + 8]
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
test esi, esi
je 0x1001147d
sub edi, esi
mov eax, esi
cmp edi, 0x1000
jb 0x10011473
mov esi, dword [eax - 4]
add edi, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100114f8
push edi
push esi
call fcn.100278c5
add esp, 8
mov eax, ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp - 0x10]
cmp dword [ebp - 0x14], eax
je 0x100114d8
mov ebx, dword [ebp + 8]
mov dword [ebx], 0
mov dword [ebx + 4], 0
mov dword [ebx + 8], 0
test esi, esi
je 0x1001147d
sub edi, esi
mov eax, esi
cmp edi, 0x1000
jb 0x10011473
mov esi, dword [eax - 4]
add edi, 0x23
sub eax, esi
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100114f8
jmp 0x10011473
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x20]
mov dword [eax], esi
mov dword [eax + 4], ecx
mov dword [eax + 8], edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call fcn.1002caaf
int3
Function at 0x10012500
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10046776
mov eax, dword fs:[0]
push eax
sub esp, 0x250
mov eax, dword [0x1005a280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x218]
push 0x208
push 0
push eax
mov dword [ebp - 0x24c], esi
call fcn.10029940
mov edi, dword [ebp + 0xc]
push 0x1004a818
push edi
call fcn.1000fab0
add esp, 0x14
test al, al
je 0x10012565
mov eax, 0x1a
jmp 0x1001257d
push 0x1004a81c
push edi
call fcn.1000fab0
add esp, 8
test al, al
je 0x10012728
xor eax, eax
push 0
push eax
lea eax, [ebp - 0x218]
push eax
push 0
call dword [sym.imp.SHELL32.dll_SHGetSpecialFolderPathW]
xorps xmm0, xmm0
test eax, eax
je 0x1001272b
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x238], 0
movups xmmword [ebp - 0x248], xmm0
mov dword [ebp - 0x234], 0
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100125c0
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x248]
call fcn.1000fbb0
xorps xmm0, xmm0
mov dword [ebp - 4], 0
lea ecx, [ebp - 0x218]
mov dword [ebp - 0x220], 0
movups xmmword [ebp - 0x230], xmm0
mov dword [ebp - 0x21c], 0
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10012610
sub ecx, edx
lea eax, [ebp - 0x218]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x230]
call fcn.1000fbb0
lea eax, [ebp - 0x230]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x25c]
push eax
call fcn.10011500
add esp, 8
mov edx, dword [eax]
xorps xmm0, xmm0
mov ecx, edx
mov byte [ebp - 4], 2
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
lea edi, [ecx + 1]
nop dword [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10012670
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.10002af0
lea ecx, [ebp - 0x25c]
call fcn.100016c0
mov ecx, dword [ebp - 0x21c]
cmp ecx, 7
jbe 0x100126cd
mov edx, dword [ebp - 0x230]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x100126c3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001276a
push ecx
push edx
call fcn.100278c5
add esp, 8
mov ecx, dword [ebp - 0x234]
xor eax, eax
mov dword [ebp - 0x220], 0
mov dword [ebp - 0x21c], 7
mov word [ebp - 0x230], ax
cmp ecx, 7
jbe 0x1001274d
mov edx, dword [ebp - 0x248]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x1001271c
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x1001276a
push ecx
push edx
call fcn.100278c5
add esp, 8
jmp 0x1001274d
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0xf
mov byte [esi], 0
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100278e1
mov esp, ebp
pop ebp
ret
call fcn.1002caaf
int3
Function at 0x10012770
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
cmp dword [eax + 0x14], 0xf
jbe 0x1001277e
mov eax, dword [eax]
push esi
push 0
push 0x80
push 3
push 0
push 1
push SysReAllocString
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
jne 0x100127a7
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
push edi
push 0
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
push esi
mov edi, eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
cmp edi, 0xffffffff
jne 0x100127c8
pop edi
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLastError]
mov eax, edi
pop edi
pop esi
pop ebp
ret
Function at 0x10017260
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10046db6
mov eax, dword fs:[0]
push eax
sub esp, 0x864
mov eax, dword [0x1005a280]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
mov dword [ebp - 0x86c], esi
call dword [sym.imp.USER32.dll_GetForegroundWindow]
mov edi, eax
test edi, edi
je 0x1001740d
push 0x800
lea eax, [ebp - 0x828]
push 0
push eax
call fcn.10029940
add esp, 0xc
lea eax, [ebp - 0x828]
push 0x400
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
jle 0x1001740d
xorps xmm0, xmm0
mov dword [ebp - 0x830], 0
lea ecx, [ebp - 0x828]
mov dword [ebp - 0x82c], 0
movups xmmword [ebp - 0x840], xmm0
lea edx, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10017300
sub ecx, edx
lea eax, [ebp - 0x828]
sar ecx, 1
push ecx
push eax
lea ecx, [ebp - 0x840]
call fcn.1000fbb0
lea eax, [ebp - 0x840]
mov dword [ebp - 4], 0
push eax
lea eax, [ebp - 0x868]
push eax
call fcn.10011500
add esp, 8
mov edx, dword [eax]
xorps xmm0, xmm0
mov ecx, edx
mov byte [ebp - 4], 1
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
lea edi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10017360
sub ecx, edi
push ecx
push edx
mov ecx, esi
call fcn.10002af0
mov edx, dword [ebp - 0x868]
test edx, edx
je 0x100173ca
mov ecx, dword [ebp - 0x860]
mov eax, edx
sub ecx, edx
cmp ecx, 0x1000
jb 0x100173a2
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100174da
push ecx
push edx
call fcn.100278c5
add esp, 8
mov dword [ebp - 0x868], 0
mov dword [ebp - 0x864], 0
mov dword [ebp - 0x860], 0
mov ecx, dword [ebp - 0x82c]
cmp ecx, 7
jbe 0x100174bd
mov edx, dword [ebp - 0x840]
lea ecx, [ecx*2 + 2]
mov eax, edx
cmp ecx, 0x1000
jb 0x100174b3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100174da
jmp 0x100174b3
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
lea eax, [ebp - 0x13]
push eax
call fcn.10001440
add esp, 8
lea ecx, [ebp - 0x859]
push ecx
lea ecx, [ebp - 0x13]
push ecx
push eax
lea ecx, [ebp - 0x858]
call fcn.100012b0
push 5
push str.W_e:
push 0
lea ecx, [ebp - 0x858]
mov dword [ebp - 4], 2
call fcn.100021f0
xorps xmm0, xmm0
movups xmmword [esi], xmm0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
movups xmm0, xmmword [eax]
movups xmmword [esi], xmm0
movq xmm0, qword [eax + 0x10]
movq qword [esi + 0x10], xmm0
mov dword [eax + 0x10], 0
mov dword [eax + 0x14], 0xf
mov byte [eax], 0
mov ecx, dword [ebp - 0x844]
cmp ecx, 0xf
jbe 0x100174bd
mov edx, dword [ebp - 0x858]
inc ecx
mov eax, edx
cmp ecx, 0x1000
jb 0x100174b3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x100174df
push ecx
push edx
call fcn.100278c5
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.100278e1
mov esp, ebp
pop ebp
ret
call fcn.1002caaf
call fcn.1002caaf
int3
Function at 0x1001f4c0
Capabilities:
Terminate process

Disassembly:
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
push eax
push 0
push 0x100001
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov esi, eax
push 0
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
pop esi
ret
Function at 0x1001ff60
Capabilities:
Capture screenshot

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x88
mov eax, dword [0x1005a280]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x78]
push eax
push 0x100201c0
push 0
push 0
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0
mov dword [ebp - 0x70], 0
call dword [sym.imp.USER32.dll_EnumDisplayMonitors]
mov edx, dword [ebp - 0x78]
test eax, eax
je 0x100200cb
test esi, esi
js 0x100200cb
mov eax, dword [ebp - 0x74]
sub eax, edx
sar eax, 2
cmp esi, eax
jae 0x100200cb
mov esi, dword [edx + esi*4]
lea eax, [ebp - 0x68]
push 0x64
push 0
push eax
call fcn.10029940
add esp, 0xc
mov dword [ebp - 0x6c], 0x68
lea eax, [ebp - 0x6c]
push eax
push esi
call dword [sym.imp.USER32.dll_GetMonitorInfoW]
test eax, eax
je 0x10020087
mov eax, dword [ebp - 0x60]
mov esi, dword [ebp - 0x5c]
sub eax, dword [ebp - 0x68]
sub esi, dword [ebp - 0x64]
push ebx
push edi
push 0
push 0
push 0
push 0x1004ae40
mov dword [ebp - 0x7c], eax
mov dword [ebp - 0x84], esi
call dword [sym.imp.GDI32.dll_CreateDCW]
mov edi, eax
push edi
mov dword [ebp - 0x80], edi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
push esi
push dword [ebp - 0x7c]
mov ebx, eax
push edi
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov edi, dword [sym.imp.GDI32.dll_SelectObject]
push eax
push ebx
mov dword [ebp - 0x88], eax
call edi
push 0xcc0020
push dword [ebp - 0x64]
mov esi, eax
push dword [ebp - 0x68]
push dword [ebp - 0x80]
push dword [ebp - 0x84]
push dword [ebp - 0x7c]
push 0
push 0
push ebx
call dword [sym.imp.GDI32.dll_BitBlt]
push esi
push ebx
call edi
push ebx
call dword [sym.imp.GDI32.dll_DeleteDC]
push dword [ebp - 0x80]
push 0
call dword [sym.imp.USER32.dll_ReleaseDC]
mov edx, dword [ebp - 0x78]
mov esi, dword [ebp - 0x88]
pop edi
pop ebx
jmp 0x100200cd
mov edx, dword [ebp - 0x78]
test edx, edx
je 0x100200ff
mov ecx, dword [ebp - 0x70]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x100200b0
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10020110
push ecx
push edx
call fcn.100278c5
add esp, 8
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100278e1
mov esp, ebp
pop ebp
ret 4
xor esi, esi
test edx, edx
je 0x100200fd
mov ecx, dword [ebp - 0x70]
mov eax, edx
sub ecx, edx
and ecx, 0xfffffffc
cmp ecx, 0x1000
jb 0x100200f3
mov edx, dword [eax - 4]
add ecx, 0x23
sub eax, edx
add eax, 0xfffffffc
cmp eax, 0x1f
ja 0x10020110
push ecx
push edx
call fcn.100278c5
add esp, 8
mov eax, esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100278e1
mov esp, ebp
pop ebp
ret 4
call fcn.1002caaf
int3
Function at 0x10023ea0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, ecx
push edi
mov dword [ebp - 4], esi
mov eax, dword [esi]
cmp eax, 0x270
jne 0x10023efd
lea edx, [esi + 8]
mov edi, eax
nop dword [eax]
mov ecx, dword [edx]
lea edx, [edx + 4]
xor ecx, dword [edx - 8]
and ecx, 0x7fffffff
xor ecx, dword [edx - 8]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x62c]
xor eax, ecx
mov dword [edx + 0x9b8], eax
sub edi, 1
jne 0x10023ec0
mov eax, dword [esi]
jmp 0x10023fdb
cmp eax, 0x4e0
jb 0x10023fdb
lea edi, [esi + 0x9c4]
mov esi, 0xe3
push ebx
mov ebx, dword [edi]
lea edx, [edi]
mov eax, ebx
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, ebx
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx + 0x634]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x10023f16
mov edi, dword [ebp - 4]
mov esi, 0x18c
add edi, 0xd50
mov ebx, dword [edi]
mov eax, ebx
lea edx, [edi]
mov ebx, dword [edx + 4]
lea edi, [edx + 4]
mov ecx, eax
xor ecx, ebx
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [edx - 0xd4c]
xor eax, ecx
mov dword [edx - 0x9c0], eax
sub esi, 1
jne 0x10023f61
mov esi, dword [ebp - 4]
pop ebx
mov eax, dword [esi + 0x1380]
mov ecx, dword [esi + 4]
xor ecx, eax
and ecx, 0x7fffffff
xor ecx, eax
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
xor eax, eax
mov dword [esi], 0
mov edx, dword [esi + eax*4 + 4]
inc eax
mov dword [esi], eax
mov ecx, edx
mov eax, dword [esi + 0x1384]
shr ecx, 0xb
and eax, ecx
xor edx, eax
mov eax, edx
and eax, 0xff3a58ad
shl eax, 7
xor edx, eax
mov eax, edx
and eax, 0xffffdf8c
shl eax, 0xf
xor edx, eax
mov eax, edx
shr eax, 0x12
pop edi
xor eax, edx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10024590
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov eax, 0x1390
call fcn.100281d0
mov eax, dword [0x1005a280]
xor eax, ebp
mov dword [ebp - 4], eax
call fcn.10027194
mov dword [ebp - 8], 0xffffffff
mov ecx, 1
mov dword [ebp - 0x1388], eax
nop
mov edx, eax
shr edx, 0x1e
xor edx, eax
imul eax, edx, 0x6c078965
add eax, ecx
mov dword [ebp + ecx*4 - 0x1388], eax
inc ecx
cmp ecx, 0x270
jb 0x100245c0
mov eax, dword [ebp + 0xc]
lea ecx, [ebp - 0x138c]
push esi
mov esi, dword [ebp + 8]
xor eax, 0x80000000
xor esi, 0x80000000
mov dword [ebp - 0x138c], 0x270
sub eax, esi
cmp eax, 0xffffffff
jne 0x10024611
call fcn.10023ea0
mov ecx, eax
jmp 0x10024655
push edi
lea edi, [eax + 1]
call fcn.10023ea0
mul edi
mov dword [ebp - 0x1390], eax
mov ecx, edx
cmp eax, edi
jae 0x10024654
mov eax, edi
xor edx, edx
neg eax
div edi
push ebx
mov ebx, edx
cmp dword [ebp - 0x1390], ebx
jae 0x10024653
nop dword [eax + eax]
lea ecx, [ebp - 0x138c]
call fcn.10023ea0
mul edi
mov ecx, edx
cmp eax, ebx
jb 0x10024640
pop ebx
pop edi
lea eax, [ecx + esi]
mov ecx, dword [ebp - 4]
xor ecx, ebp
xor eax, 0x80000000
pop esi
call fcn.100278e1
mov esp, ebp
pop ebp
ret 8