joyce8/EMBER2024-capa huggingface dataset:
Function at 0x7e4b59
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
test ecx, ecx
jle 0x7e4ca9
mov dword [ebp - 8], ecx
push ebx
mov cl, byte [edi]
mov dl, byte [eax]
mov bl, cl
or cl, dl
xor bl, dl
shr bl, 1
sub cl, bl
mov byte [ebp - 4], cl
mov cl, byte [esi]
mov dl, cl
or cl, byte [ebp - 4]
xor dl, byte [ebp - 4]
shr dl, 1
sub cl, dl
mov byte [esi], cl
mov cl, byte [edi + 1]
mov dl, byte [eax + 1]
mov bl, cl
or cl, dl
xor bl, dl
shr bl, 1
sub cl, bl
mov byte [ebp - 4], cl
mov cl, byte [esi + 1]
mov dl, cl
or cl, byte [ebp - 4]
xor dl, byte [ebp - 4]
shr dl, 1
sub cl, dl
mov byte [esi + 1], cl
mov cl, byte [edi + 2]
mov dl, byte [eax + 2]
mov bl, cl
or cl, dl
xor bl, dl
shr bl, 1
sub cl, bl
mov byte [ebp - 4], cl
mov cl, byte [esi + 2]
mov dl, cl
or cl, byte [ebp - 4]
xor dl, byte [ebp - 4]
shr dl, 1
sub cl, dl
mov byte [esi + 2], cl
mov cl, byte [edi + 3]
mov dl, byte [eax + 3]
mov bl, cl
or cl, dl
xor bl, dl
shr bl, 1
sub cl, bl
mov byte [ebp - 4], cl
mov cl, byte [esi + 3]
mov dl, cl
xor dl, byte [ebp - 4]
or cl, byte [ebp - 4]
shr dl, 1
sub cl, dl
mov byte [esi + 3], cl
mov cl, byte [edi + 4]
mov dl, byte [eax + 4]
mov bl, cl
xor bl, dl
or cl, dl
shr bl, 1
sub cl, bl
mov byte [ebp - 4], cl
mov cl, byte [esi + 4]
mov dl, cl
xor dl, byte [ebp - 4]
or cl, byte [ebp - 4]
shr dl, 1
sub cl, dl
mov byte [esi + 4], cl
mov cl, byte [edi + 5]
mov dl, byte [eax + 5]
mov bl, cl
xor bl, dl
shr bl, 1
or cl, dl
sub cl, bl
mov byte [ebp - 4], cl
mov cl, byte [esi + 5]
mov dl, cl
or cl, byte [ebp - 4]
xor dl, byte [ebp - 4]
shr dl, 1
sub cl, dl
mov byte [esi + 5], cl
mov cl, byte [edi + 6]
mov dl, byte [eax + 6]
mov bl, cl
or cl, dl
xor bl, dl
shr bl, 1
sub cl, bl
mov byte [ebp - 4], cl
mov cl, byte [esi + 6]
mov dl, cl
xor dl, byte [ebp - 4]
or cl, byte [ebp - 4]
shr dl, 1
sub cl, dl
mov byte [esi + 6], cl
mov cl, byte [edi + 7]
mov dl, byte [eax + 7]
add edi, dword [ebp + 0x14]
add eax, dword [ebp + 0x18]
mov bl, cl
or cl, dl
xor bl, dl
shr bl, 1
sub cl, bl
mov byte [ebp - 4], cl
mov cl, byte [esi + 7]
mov dl, cl
xor dl, byte [ebp - 4]
or cl, byte [ebp - 4]
shr dl, 1
sub cl, dl
mov byte [esi + 7], cl
add esi, dword [ebp + 0x10]
dec dword [ebp - 8]
jne 0x7e4b72
pop ebx
pop edi
pop esi
leave
ret
Function at 0x7e58fe
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x10]
mov edx, esi
push dword [ebp + 0xc]
mov eax, edi
push dword [ebp + 8]
call fcn.007e5479
add esp, 0xc
lea edx, [esi + 8]
lea eax, [edi + 8]
pop ebp
jmp fcn.007e5479
Function at 0x821078
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [edi + 0x2c]
push esi
mov esi, dword [edi + 0x3c]
sub esi, dword [edi + 0x74]
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x2c]
lea ecx, [ebx + ecx - 0x106]
sub esi, eax
cmp eax, ecx
jb 0x8210fd
mov eax, dword [edi + 0x38]
push ebx
lea ecx, [eax + ebx]
push ecx
push eax
call fcn.00829850
mov eax, dword [edi + 0x4c]
mov ecx, dword [edi + 0x44]
sub dword [edi + 0x70], ebx
sub dword [edi + 0x6c], ebx
add esp, 0xc
sub dword [edi + 0x5c], ebx
mov dword [ebp - 4], eax
lea eax, [ecx + eax*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x8210c0
mov eax, dword [edi + 0x40]
mov dword [ebp - 4], ebx
lea eax, [eax + ebx*2]
dec eax
dec eax
movzx ecx, word [eax]
mov edx, ecx
sub edx, ebx
cmp ecx, ebx
sbb ecx, ecx
not ecx
and ecx, edx
dec dword [ebp - 4]
mov word [eax], cx
jne 0x8210e2
add esi, ebx
mov eax, dword [edi]
cmp dword [eax + 4], 0
je 0x821158
mov ecx, dword [edi + 0x74]
add ecx, dword [edi + 0x6c]
push esi
add ecx, dword [edi + 0x38]
mov esi, eax
push ecx
call fcn.00820dc6
add dword [edi + 0x74], eax
mov esi, dword [edi + 0x74]
pop ecx
pop ecx
cmp esi, 3
jb 0x821144
mov eax, dword [edi + 0x6c]
mov ecx, dword [edi + 0x38]
lea edx, [eax + ecx]
movzx eax, byte [edx]
mov ecx, dword [edi + 0x58]
mov dword [edi + 0x48], eax
shl eax, cl
movzx ecx, byte [edx + 1]
xor eax, ecx
and eax, dword [edi + 0x54]
mov dword [edi + 0x48], eax
cmp esi, 0x106
jae 0x821158
mov eax, dword [edi]
cmp dword [eax + 4], 0
jne 0x821081
pop esi
pop ebx
leave
ret
Function at 0x828ba4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 8]
mov eax, ecx
cdq
and edx, 7
add eax, edx
push ebx
mov ebx, dword [esp + 0x10]
sar eax, 3
and ecx, 7
push esi
mov esi, ecx
test eax, eax
jle 0x828bed
push edi
mov edi, eax
mov ecx, dword [esp + 0x10]
push 8
call fcn.00824e86
mov ecx, ebx
shr ecx, 8
movzx ebx, bl
xor eax, ecx
and eax, 0xff
shl ebx, 8
xor ebx, dword [eax*4 + 0x10380978]
dec edi
jne 0x828bc5
pop edi
test esi, esi
jle 0x828c1b
mov ecx, dword [esp + 0xc]
push 1
call fcn.00824e86
mov ecx, ebx
shr ecx, 0xf
and ecx, 1
and ebx, 0x7fff
xor eax, ecx
add ebx, ebx
test eax, eax
je 0x828c18
xor ebx, 0x8005
dec esi
jne 0x828bf1
pop esi
mov eax, ebx
pop ebx
ret
Function at 0x9134c0
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x222000]
push edi
or ebp, 0xffffffff
jmp 0x9134e2
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x9134e9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x9134d8
mov eax, 1
add ebx, ebx
jne 0x9134fb
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x9134f0
jne 0x91350c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x9134f0
xor ecx, ecx
sub eax, 3
jb 0x913520
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x913592
mov ebp, eax
add ebx, ebx
jne 0x91352b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x913538
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x91355c
inc ecx
add ebx, ebx
jne 0x913548
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x91353d
jne 0x913559
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x91353d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x91357c
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x91356d
jmp 0x9134de
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x91357c
add edi, ecx
jmp 0x9134de
pop esi
mov edi, esi
mov ecx, 0x47f7
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x91359a
cmp byte [edi], 0x11
jne 0x91359a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x91359f
lea edi, [esi + 0x510000]
mov eax, dword [edi]
or eax, eax
je 0x913617
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x537644]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x537734]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x9135cc
mov ecx, edi
jns 0x9135fb
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x537738]
or eax, eax
je 0x913611
mov dword [ebx], eax
add ebx, 4
jmp 0x9135e9
call dword [esi + 0x537748]
mov ebp, dword [esi + 0x53773c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x227]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x91364b
sub esp, 0xffffff80
jmp 0x4a95d5
Function at 0x403191
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], 0
mov eax, dword [ebp - 0x34]
mov dword [eax + 0x3cc], 0xaedebcad
mov ecx, dword [ebp + 8]
mov edx, dword [ecx + 0x3ec]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [ebp + 8]
mov ecx, dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [eax + 0x320], ecx
cmp dword [ebp - 4], 1
jne 0x40384f
mov edx, dword [ebp + 8]
cmp dword [edx + 0x398], 0
je 0x40384f
mov eax, dword [ebp + 8]
mov dword [eax + 0x230], 0
jmp 0x403233
add al, byte [eax]
add byte [ebx - 0x6e74f7b3], cl
aam 3
add byte [ebx + eax*4 + 0x45], al
add dword [eax + 0x48894745], ebp
aam 0xa8
add byte [edx - 0x75], cl
dec ebx
or byte [eax + 0x4e024d91], ch
add byte [eax + 0x518b50c2], ch
or byte [eax + 0x54025390], ch
add byte [eax + 0x5783564d], ch
xor byte [eax + 0x5a045900], ch
mov edx, dword [ecx + 0x440003d4]
add dword [ebp + 1], 0xffffffa8
inc ebp
inc edi
mov dword [eax - 0x2c], ecx
test al, 0
dec edx
mov ecx, dword [ebx + 8]
test al, 0x91
dec ebp
add cl, byte [esi]
test al, 0xc2
push eax
mov edx, dword [ecx + 8]
test al, 0x90
nop
push ebx
add dl, byte [eax + eax - 0x58]
dec ebp
test al, 0x4d
push esi
adc dword [edi + 0x30], 0xffffffa8
add byte [ecx + 4], bl
pop edx
pop ebx
test al, 0x55
pop esp
mov ebx, dword [ebp + 8]
test al, 0x8a
pop edi
add esp, dword [eax]
test al, 0x48
bound esi, qword [ebx + 0x63]
mov ebp, dword [eax + 0x66826508]
add ch, byte [eax + 0x694d6800]
xor ebp, dword [eax + 0x6c016b8a]
add ch, byte [eax + 0x6f456e00]
mov ebp, dword [eax + 0x720071d4]
mov ebp, dword [eax + 0x75807408]
add ebp, dword [eax + 0x78db7700]
pop esp
test al, 2
jp 0x40322e
jnp 0x40320c
test al, 8
jge 0x403206
jle 0x403289
test al, 0
or byte [ebp - 0x7f], 0x8b
test al, 0xb8
add dword [eax], 0xffffff84
mov byte [eax - 0x78a579f8], ch
jmp [eax - 0x75f77675]
mov ecx, 0xb9a11255
adc bh, byte [ecx - 0x467dee00]
adc bh, byte [ecx - 0x46b2ee00]
adc bh, byte [ecx - 0x46ffed88]
adc bh, byte [ecx - 0x4610ed04]
adc bh, byte [ecx - 0x4603ed75]
adc bh, byte [ecx - 0x46bfed75]
adc bh, byte [ecx - 0x4603ed77]
adc bh, byte [ecx - 0x4674ed13]
adc bh, byte [ecx - 0x4674edab]
adc bh, byte [ecx - 0x4674ee00]
adc bh, byte [ecx - 0x46fded6f]
adc bh, byte [ecx - 0x4674edb0]
adc bh, byte [ecx - 0x46fced70]
adc bh, byte [ecx - 0x4674edb3]
adc bh, byte [ecx - 0x46fded7e]
adc bh, byte [ecx - 0x46fced7f]
adc bh, byte [ecx - 0x46ffedfc]
adc bh, byte [ecx - 0x46efed98]
adc bh, byte [ecx - 0x4674edb3]
adc bh, byte [ecx - 0x46adee00]
adc bh, byte [ecx - 0xffed70]
adc al, byte [ebx]
mov ecx, 0x1204b912
add byte [ecx + 0x1268b912], bh
adc byte [ecx + 0x124db912], bh
mov edi, dword [ecx + 0x1200b912]
push edx
mov ecx, 0x1290b912
add bh, bh
adc eax, sym.imp.KERNEL32.dll_GetLastError
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 5
jne 0x403915
push 0x45b
push 0x1000
push 0xfffa
push 0
xchg byte [edi + esi*4 - 0x797838e9], bl
pushfd
scasd eax, dword es:[edi]
pop ss
mov dword [edi + 0x108fd412], 0x8789b708
xchg dword [edx], edx
fmul qword [edi - 0x75a4f6b2]
xchg dword [edi - 0x78787822], eax
jb 0x4038b1
adc cl, ah
invalid
Function at 0x40708d
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4379f0
cmp edx, dword [eax]
je 0x4070af
add eax, 8
inc ecx
cmp eax, 0x437a80
jl 0x4070a0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4379f0]
jne 0x4071dd
mov eax, dword [0x438378]
cmp eax, 1
je 0x4071b7
test eax, eax
jne 0x4070e0
cmp dword [0x437944], 1
je 0x4071b7
cmp edx, 0xfc
je 0x4071dd
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x407117
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.00407640
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004077b0
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x40715a
lea eax, [ebp - 0x1a4]
push eax
call fcn.004077b0
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x40d488
push edi
call fcn.00408100
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.00407640
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.00407650
lea eax, [ebp - 0xa0]
push 0x40d468
push eax
call fcn.00407650
push dword [esi + 0x4379f4]
lea eax, [ebp - 0xa0]
push eax
call fcn.00407650
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.00408074
add esp, 0x2c
pop edi
jmp 0x4071dd
lea eax, [ebp + 8]
lea esi, [esi + 0x4379f4]
push 0
push eax
push dword [esi]
call fcn.004077b0
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x100033ad
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push esi
push edi
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10003423
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x100033e5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x10003421
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x34]
push eax
call fcn.10001af4
pop ecx
mov esi, eax
lea edi, [ebp - 0x28]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call fcn.10003254
shl eax, 1
mov ecx, dword [ebp - 0x20]
mov eax, dword [ecx + eax*4]
sub eax, 0x12c
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
jmp 0x10003455
jmp 0x10003455
lea eax, [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
push 0
push dword [ebp - 0x18]
push 0x6418
push 0x4254
mov eax, dword [ebp - 0x1c]
push dword [eax]
push 0x25a7
push 0xcef
call fcn.1000d022
add esp, 0x1c
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100128b4
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x38
mov byte [esp + 4], cl
push ebx
push edi
test cl, cl
je 0x100129a4
mov dword [esp + 0x20], 0x2cb7
cmp dword [esp + 0x20], 0x2e68
jle 0x10012983
xor edi, edi
mov dword [esp + 0x1c], edi
xor ebx, ebx
mov dword [esp + 0x18], ebx
xor eax, eax
mov dword [esp + 0x10], edi
mov ecx, ebx
mov dword [esp + 0x14], eax
shl edi, cl
mov dword [esp + 0x10], edi
and dword [esp + 0x24], 0
mov ebx, edi
mov edi, dword [esp + 0x24]
mov ecx, eax
sar ebx, cl
mov eax, ebx
lea ecx, [esp + 0x28]
or eax, edi
cdq
push edx
push eax
call fcn.10001a7f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10012928
mov eax, dword [eax]
push eax
call fcn.10048643
pop ecx
push 0
push 1
lea ecx, [esp + 0x30]
call fcn.1000f099
inc edi
cmp edi, 0x366b
jl 0x1001290e
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
inc eax
mov dword [esp + 0x14], eax
cmp eax, 0x4bb1
jl 0x100128ff
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
inc ebx
mov dword [esp + 0x18], ebx
cmp ebx, 0x17d1
jl 0x100128ed
inc edi
mov dword [esp + 0x1c], edi
cmp edi, 0x2e19
jl 0x100128e7
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
cmp dword [esp + 0x20], 0x2c88
jge 0x100129c4
push str.bsoig_lwzh_vjwzldw_jmtejp_tlv_amkocz_mqxw_egtkdpwqx_vtgapc_xkws
call fcn.10048643
pop ecx
jmp 0x100129c4
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x100129c4
mov edi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [edi]
and dword [eax + ecx*4], 0
inc dword [edx]
cmp dword [edx], 2
jl 0x100129b5
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10014341
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x100621da
call fcn.10061438
sub esp, 0x28
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], edi
mov esi, ecx
je 0x1001443e
cmp byte [ebp + 0x1c], 0
je 0x1001442d
and dword [ebp - 0x20], 0
xor eax, eax
mov dword [ebp - 0x1c], 7
mov word [ebp - 0x30], ax
and dword [ebp - 4], eax
lea edx, [ebp + 0x14]
push 0x4e7b
xor ebx, ebx
lea ecx, [ebp - 0x30]
inc ebx
push ebx
push ebx
push 0x24de
push 0xd76
push 0x7d49
push ebx
push 0x1313
push 0x57d5
call fcn.1001422a
mov eax, dword [0x101458e4]
add esp, 0x24
test bl, al
jne 0x100143dd
or eax, ebx
mov dword [0x101458e4], eax
push 0x6811
mov byte [ebp - 4], bl
call fcn.1000e440
pop ecx
mov word [0x101458d8], ax
mov byte [ebp - 4], 0
xor esi, esi
cmp dword [ebp + 0x14], esi
jbe 0x10014409
lea eax, [ebp - 0x30]
push eax
push ecx
push 0x101458d8
push ecx
push 0x5e6e
push 0x4700
mov cl, bl
call fcn.100141b0
add esp, 0x18
inc esi
cmp esi, dword [ebp + 0x14]
jb 0x100143e4
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x30]
cmp ecx, eax
je 0x1001441d
push 0xffffffffffffffff
push 0
push eax
call fcn.1000f12b
push 0
push ebx
lea ecx, [ebp - 0x30]
call fcn.1000f26d
jmp 0x10014501
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x10014501
cmp byte [ebp + 0xc], 0
je 0x100144e7
mov dword [ebp + 8], 0x61fc
cmp dword [ebp + 8], 0x6302
jle 0x10014480
xor esi, esi
mov ebx, esi
mov edi, 0x1ee5
mov eax, ebx
mov ecx, 0x1007fdb8
cdq
push edx
push eax
call fcn.1000e5de
dec ebx
dec edi
jne 0x10014461
inc esi
cmp esi, 0xd01
jl 0x1001445a
mov edi, dword [ebp - 0x18]
mov dword [ebp - 4], 2
cmp dword [ebp + 8], 0x5ef1
jge 0x100144be
mov edx, str.haewx_cxbeojmaz_rfd_bfyjmkcc_yspmktd_ybvflh_pbkv_csou_rohe
mov ecx, 0x1007fdb8
call fcn.100113ff
jmp 0x100144be
or dword [ebp - 4], 0xffffffff
cmp byte [edi], 0
je 0x10014501
push 0x3831
xor ebx, ebx
mov edx, 0x3b9f
inc ebx
mov ecx, 0x33ab
push ebx
push ebx
push 0
call fcn.10012ff7
add esp, 0x10
jmp 0x10014501
mov edx, dword [ebp + 0x18]
mov dword [edx], 0
jmp 0x100144fc
mov ecx, dword [edx]
mov eax, dword [esi]
or dword [eax + ecx*4], 0xffffffff
inc dword [edx]
cmp dword [edx], 2
jl 0x100144f2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10014e05
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x10014e1c
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x10014e3e
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x10144544
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x101448d0
jl 0x10014e4c
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x10144b74
jl 0x10014e8c
mov ecx, dword [0x101458c0]
xor ecx, dword [0x10144544]
and ecx, edi
xor ecx, dword [0x101458c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x10144540], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10144b74]
mov dword [0x10144f00], eax
pop esi
ret

Function at 0x10015b81
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov byte [ebp - 8], dl
test cl, cl
je 0x10015bd4
test dl, dl
je 0x10015bb6
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x10015bf0
sub esp, 0x10
mov edx, 0x74e1
push 1
push 0x5a49
push ecx
push ecx
call fcn.100156d3
add esp, 0x20
jmp 0x10015bf0
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10015bf0
push 0x1e23
xor eax, eax
push eax
push eax
push 0x14cb
call dword [sym.imp.GDI32.dll_PolyPolygon]
jmp 0x10015bf0
cmp byte [ebp + 8], 0
je 0x10015be5
mov eax, dword [ebp + 0x10]
mov dword [eax], 0x9ae4f78d
jmp 0x10015bf0
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov esp, ebp
pop ebp
ret
Function at 0x1001834b
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
mov byte [esp + 8], dl
mov eax, ecx
mov dword [esp + 0x14], 0x6f8
cmp dword [esp + 0x14], 0x99f
push esi
push edi
mov dword [esp + 0x18], eax
jle 0x100183dd
xor esi, esi
xor ebx, ebx
mov dword [esp + 0x14], 0x1c4b
xor edi, edi
mov eax, ebx
lea ecx, [esp + 0x20]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001a7f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001839e
mov eax, dword [eax]
push eax
call fcn.10048643
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.1000f099
inc edi
cmp edi, 0x728a
jl 0x10018381
add ebx, esi
dec dword [esp + 0x14]
jne 0x1001837f
inc esi
cmp esi, 0x6bf3
jl 0x10018375
push 0
push 0x1e2c
call dword [sym.imp.USER32.dll_GetWindowRect]
mov eax, dword [esp + 0x18]
cmp byte [esp + 0x10], 0
je 0x100183f9
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1001841a
push 0x257d
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x1001841a
mov edx, dword [ebp + 8]
mov dword [edx], 0
jmp 0x10018415
mov ecx, dword [edx]
mov eax, dword [eax]
mov dword [eax + ecx*4], 1
inc dword [edx]
mov eax, dword [esp + 0x18]
cmp dword [edx], 4
jl 0x10018404
cmp dword [esp + 0x1c], 0x588
jge 0x1001842f
push str.lhmyq_clyp_kmtptchbp_knbp_rarybia_vdd_reah_oadtnhjwa_rcbwta_lqgxnmjsi_fzeuuv
call fcn.10048643
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10019493
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10062556
call fcn.10061438
sub esp, 0x24
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], edi
je 0x100194fa
mov edi, dword [ebp + 0x10]
mov esi, dword [edi]
mov edi, dword [edi + 4]
jmp 0x100194f4
push esi
lea ecx, [ebp - 0x30]
call fcn.1000e6f3
push dword [ebp + 8]
and dword [ebp - 4], 0
mov edx, 0x75e6
push 0x7079
push ecx
lea ecx, [ebp - 0x30]
call fcn.1001b891
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
add esp, 0xc
push 0
push 1
call fcn.1000f26d
add esi, 0x18
cmp esi, edi
jne 0x100194bb
jmp 0x10019572
mov dword [ebp - 0x14], 0x2273
cmp dword [ebp - 0x14], 0x2524
jle 0x10019531
xor esi, esi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x1007fdb8
xor eax, esi
cdq
push edx
push eax
call fcn.1000e5de
inc ebx
cmp ebx, 0x5f9a
jl 0x1001950e
inc esi
cmp esi, 0x58be
jl 0x1001950c
mov dword [ebp - 4], 1
cmp dword [ebp - 0x14], 0x20c5
jge 0x1001956f
mov edx, str.maxcak_nvq_kuuaqb_weza_afp_oujoknc_gmgyb
mov ecx, 0x1007fdb8
call fcn.100113ff
jmp 0x1001956f
and dword [edi], 0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret