joyce8/EMBER2024-capa huggingface dataset:
Function at 0x46882b
Capabilities:
Access peb ldr_data
Get process filename
Resolve function by parsing pe exports

Disassembly:
add bl, al
cld
call fcn.004688b5
pushal
mov ebp, esp
xor eax, eax
mov edx, dword fs:[eax + 0x30]
mov edx, dword [edx + 0xc]
mov edx, dword [edx + 0x14]
mov esi, dword [edx + 0x28]
movzx ecx, word [edx + 0x26]
xor edi, edi
lodsb al, byte [esi]
cmp al, 0x61
jl 0x468852
sub al, 0x20
ror edi, 0xd
add edi, eax
loop 0x46884b
push edx
push edi
mov edx, dword [edx + 0x10]
mov ecx, dword [edx + 0x3c]
mov ecx, dword [ecx + edx + 0x78]
jecxz 0x4688af
add ecx, edx
push ecx
mov ebx, dword [ecx + 0x20]
add ebx, edx
mov ecx, dword [ecx + 0x18]
jecxz 0x4688ae
dec ecx
mov esi, dword [ebx + ecx*4]
add esi, edx
xor edi, edi
lodsb al, byte [esi]
ror edi, 0xd
add edi, eax
cmp al, ah
jne 0x46887c
add edi, dword [ebp - 8]
cmp edi, dword [ebp + 0x24]
jne 0x468872
pop eax
mov ebx, dword [eax + 0x24]
add ebx, edx
mov cx, word [ebx + ecx*2]
mov ebx, dword [eax + 0x1c]
add ebx, edx
mov eax, dword [ebx + ecx*4]
add eax, edx
mov dword [esp + 0x24], eax
pop ebx
pop ebx
popal
pop ecx
pop edx
push ecx
jmp eax
pop edi
pop edi
pop edx
mov edx, dword [edx]
jmp 0x468842

Function at 0x469630
Capabilities:
Enumerate files on windows
Get common file path

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x270
mov eax, dword [0x4b507c]
mov edi, dword [esp + 0x284]
lea esi, [esp + 0x25]
xor eax, esp
mov dword [esp + 0x26c], eax
push 0x107
push esi
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
push esi
call fcn.0047e720
add esp, 4
lea ebx, [esp + 0x12c]
mov word [esp + eax + 0x25], 0x2a5c
mov byte [esp + eax + 0x27], 0
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
cmp eax, 0xffffffff
je 0x4696aa
mov ebp, dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov esi, eax
push 0x140
push ebx
call edi
add esp, 8
push ebx
push esi
call ebp
test eax, eax
jne 0x469690
push esi
call dword [sym.imp.KERNEL32.dll_FindClose]
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov ecx, esp
mov dword [ecx], eax
push 4
push ecx
call edi
add esp, 8
lea esi, [esp + 5]
push 0x20
push esi
call fcn.00469524
add esp, 8
test al, al
je 0x4696e5
mov ebx, 0x20
push ebx
push esi
call edi
add esp, 8
push ebx
push esi
call fcn.00467374
add esp, 8
push edi
call fcn.0046bf1f
add esp, 4
mov ecx, dword [esp + 0x26c]
xor ecx, esp
call fcn.0046f0c8
add esp, 0x270
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x469707
Capabilities:
Get memory capacity

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x54
mov eax, dword [0x4b507c]
xor eax, esp
mov dword [esp + 0x50], eax
call dword [sym.imp.USER32.dll_GetForegroundWindow]
lea edi, [esp + 0x2c]
mov esi, 4
mov dword [edi], eax
push esi
push edi
push 9
call fcn.0043ea34
add esp, 0xc
call dword [sym.imp.USER32.dll_GetCapture]
mov dword [edi], eax
push esi
push edi
push 0xa
call fcn.0043ea34
add esp, 0xc
call dword [sym.imp.USER32.dll_GetClipboardOwner]
mov dword [edi], eax
push esi
push edi
push 0xb
call fcn.0043ea34
add esp, 0xc
push 0x1cbf
call dword [sym.imp.USER32.dll_GetQueueStatus]
lea ecx, [esp + 0x28]
mov dword [ecx], eax
push esi
push ecx
push 0xc
call fcn.0043ea34
add esp, 0xc
lea edi, [esp + 0x20]
push edi
call dword [sym.imp.USER32.dll_GetCursorPos]
mov esi, 8
push esi
push edi
push 0xd
call fcn.0043ea34
add esp, 0xc
mov edi, esp
push edi
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
mov eax, 0x20
push eax
push edi
push 6
call fcn.0043ea34
add esp, 0xc
lea ebx, [esp + 0x30]
lea edi, [esp + 0x48]
lea ebp, [esp + 0x40]
add esi, ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push edi
push ebp
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetThreadTimes]
mov eax, 0x20
push eax
push ebx
push 0xe
call fcn.0043ea34
add esp, 0xc
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push edi
push ebp
push esi
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov eax, 0x20
push eax
push ebx
push 0xf
call fcn.0043ea34
add esp, 0xc
mov ecx, dword [esp + 0x50]
xor ecx, esp
call fcn.0046f0c8
add esp, 0x54
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x46d5fc
Capabilities:
Get common file path
Set current directory

Disassembly:
push ebp
push ebx
push edi
push esi
sub esp, 0x108
mov ecx, dword [0x4b507c]
mov al, byte [esp + 0x124]
mov esi, dword [esp + 0x120]
mov edi, dword [esp + 0x11c]
xor ebp, ebp
mov ebx, 0
xor ecx, esp
test al, al
mov dword [esp + 0x104], ecx
je 0x46d64c
mov eax, esp
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
dec eax
cmp eax, 0x103
setb bl
mov al, byte [esp + 0x128]
test edi, edi
mov dword [esi], 0x4c
je 0x46d665
xor ebp, ebp
cmp byte [edi], 0
cmovne ebp, edi
test al, al
mov dword [esi + 0x2c], ebp
je 0x46d675
push esi
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameA]
jmp 0x46d67c
push esi
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameA]
mov esi, eax
test edi, edi
je 0x46d699
push edi
push 0x104
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
dec eax
cmp eax, 0x103
jb 0x46d699
mov byte [edi], 0
test bl, bl
je 0x46d6a6
mov eax, esp
push eax
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryA]
mov ecx, dword [esp + 0x104]
test esi, esi
setne bl
xor ecx, esp
call fcn.0046f0c8
mov eax, ebx
add esp, 0x108
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x484054
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0048405f

Function at 0x4843de
Capabilities:
Create thread
Print debug messages

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.004843e9

Function at 0x485b57
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00485b62
Function at 0x1000a60b
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x1000a622
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x1000a644
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x100793a4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x10079730
jl 0x1000a652
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x100799d4
jl 0x1000a692
mov ecx, dword [0x1007a720]
xor ecx, dword [0x100793a4]
and ecx, edi
xor ecx, dword [0x1007a720]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x100793a0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x100799d4]
mov dword [0x10079d60], eax
pop esi
ret
Function at 0x1001fe59
Capabilities:
Log keystrokes via polling
Query environment variable

Disassembly:
mov eax, 0x1005d5c7
call fcn.1005cab0
sub esp, 0x20
push ebx
push esi
mov byte [ebp - 0x14], cl
mov eax, edx
mov dword [ebp - 0x20], 0x926
cmp dword [ebp - 0x20], 0x9c6
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], eax
jle 0x1001feec
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x18], edi
and dword [ebp - 0x28], 0
mov ecx, edi
mov edi, dword [ebp - 0x28]
mov dword [ebp - 0x24], esi
shl esi, cl
mov eax, esi
mov ecx, 0x10077fd8
or eax, edi
or eax, ebx
cdq
push edx
push eax
call fcn.10004c70
inc edi
cmp edi, 0x5f10
jl 0x1001fe9e
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x4b8b
jl 0x1001fe90
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x1766
jl 0x1001fe8b
inc ebx
cmp ebx, 0x4981
jl 0x1001fe86
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov eax, dword [ebp - 0x2c]
cmp byte [ebp + 0x14], 0
je 0x1001ff1e
cmp byte [ebp - 0x14], 0
je 0x1001ff00
mov eax, dword [ebp + 8]
add dword [eax], 4
jmp 0x1001ff36
mov byte [ebp + 0x17], 0
cmp byte [ebp + 0x17], 0
je 0x1001ff36
push 0
push 0x22cc
push 0x1b86
call dword [sym.imp.GDI32.dll_CreatePen]
jmp 0x1001ff36
cmp byte [ebp + 0xc], 0
je 0x1001ff28
dec dword [eax]
jmp 0x1001ff36
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1001ff36
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x910
jge 0x1001ff52
mov edx, str.nwl_hdbeh_plt_nftvcamc_esyer_vakez_nztb_vmrmquo_rkr_vhtvf_evab_ffciioj
mov ecx, 0x10077fd8
call fcn.10007021
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002056d
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005d5e5
call fcn.1005cab0
sub esp, 0x18
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x10020673
mov dword [ebp - 0x20], 0x5b02
xor esi, esi
cmp dword [ebp - 0x20], 0x5c6d
jle 0x10020629
mov ebx, esi
mov edi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], 0x5619
mov edi, esi
mov esi, dword [ebp - 0x14]
mov ecx, edi
mov eax, esi
sar eax, cl
mov ecx, 0x10077fd8
xor eax, ebx
cdq
push edx
push eax
call fcn.10004c70
inc edi
cmp edi, 0x537a
jl 0x100205b6
dec esi
dec dword [ebp - 0x18]
push 0
mov dword [ebp - 0x14], esi
pop esi
jne 0x100205b1
mov edi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x36b3
jl 0x100205a7
inc ebx
cmp ebx, 0x7099
jl 0x100205a2
push 0x1cdb
push 0xd17
push 0x4f3
push 0x1f17
push 0x1509
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
mov eax, dword [ebp + 0xc]
xor edx, edx
mov ecx, dword [eax]
mov eax, dword [eax]
cmp ecx, eax
mov eax, dword [ebp + 0x10]
setle dl
mov dword [eax], edx
mov dword [ebp - 4], esi
cmp dword [ebp - 0x20], 0x57c8
jge 0x10020657
mov edx, str.ovpxug_aiqp_pjwnonssm
mov ecx, 0x10077fd8
call fcn.10007021
jmp 0x10020694
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x10020694
push 0x26f4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetMapMode]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100225f3
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005d63b
call fcn.1005cab0
sub esp, 0x1c
mov dword [ebp - 0x28], edx
mov byte [ebp - 0x18], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x10022642
push 0x6604
push 1
lea eax, [ebp - 0x11]
mov byte [ebp - 0x11], 0
push eax
push 0x5ea9
mov ecx, 0x30da
call fcn.1001eb2d
add esp, 0x10
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x20], 0x3eeb
cmp dword [ebp - 0x20], 0x3fad
jle 0x10022696
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
and dword [ebp - 0x24], 0
mov ebx, edi
and ebx, esi
mov esi, dword [ebp - 0x24]
mov eax, ebx
mov ecx, 0x10077fd8
xor eax, esi
cdq
push edx
push eax
call fcn.10004c70
inc esi
cmp esi, 0x6f87
jl 0x10022664
mov esi, dword [ebp - 0x1c]
inc edi
cmp edi, 0x28fe
jl 0x10022659
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x105c
jl 0x10022657
mov eax, dword [ebp + 0x10]
xor edx, edx
mov ecx, dword [eax]
mov eax, dword [eax]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setle dl
mov dword [eax], edx
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x3d87
jge 0x10022631
mov edx, str.szusxdn_qnb_tuakw_avk_mvhkw_prpsg_ierwkmsjt_cznx_dlz_dlchd_jdfumh_rljh_ckozqtf_zrsobtasm
mov ecx, 0x10077fd8
call fcn.10007021
jmp 0x10022631
Function at 0x100280d7
Capabilities:
Accept command line arguments
Encode data using xor

Disassembly:
mov eax, 0x1005d74b
call fcn.1005cab0
sub esp, 0x34
and dword [ebp - 0x28], 0
lea eax, [ebp - 0x40]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor esi, esi
push fcn.10004daa
push fcn.1000a360
inc esi
mov dword [ebp - 0x20], edx
push esi
push 0x18
push eax
mov dword [ebp - 0x24], ecx
call fcn.10046030
mov dword [ebp - 4], esi
mov dword [ebp - 0x18], 0x8f0
cmp dword [ebp - 0x18], 0xb7a
jle 0x1002816f
xor ebx, ebx
mov dword [ebp - 0x14], ebx
xor edi, edi
and dword [ebp - 0x1c], 0
mov esi, ebx
mov ebx, dword [ebp - 0x1c]
mov ecx, edi
shl esi, cl
mov eax, esi
mov ecx, 0x10077fd8
xor eax, ebx
cdq
push edx
push eax
call fcn.10004c70
inc ebx
cmp ebx, 0x6c1e
jl 0x10028134
mov ebx, dword [ebp - 0x14]
inc edi
cmp edi, 0x35f5
jl 0x10028127
inc ebx
mov dword [ebp - 0x14], ebx
cmp ebx, 0x7342
jl 0x10028125
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
xor esi, esi
inc esi
push dword [ebp - 0x20]
lea eax, [ebp - 0x40]
push ecx
push eax
push dword [ebp + 8]
call fcn.10028b24
add esp, 0x10
mov byte [ebp - 4], 2
cmp dword [ebp - 0x18], 0x6df
jge 0x100281bd
mov edx, str.qdvff_jdkrri_uvt_oifyvk_njjrx_wtbivk_zoesaoq_xnnvm_qebzlzlky_cgtav_vobag_fqpqa_kyecpwnc_qrcbtrzvs
mov ecx, 0x10077fd8
call fcn.10007021
jmp 0x100281bd
lea eax, [ebp - 0x40]
mov dword [ebp - 4], esi
mov ecx, dword [ebp - 0x24]
push eax
call fcn.10007bd7
push fcn.10004daa
push esi
push 0x18
lea eax, [ebp - 0x40]
mov dword [ebp - 0x28], esi
push eax
mov byte [ebp - 4], 0
call fcn.10045c8b
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10028278
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005d78b
call fcn.1005cab0
sub esp, 0x2c
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], ecx
je 0x10028314
push 3
pop ecx
mov dword [ebp + 8], ecx
mov dword [ebp + 8], 0xffffffff
mov dword [ebp + 8], 0x8afa2faf
mov dword [ebp + 8], 0x5b8b78ac
mov dword [ebp - 0x14], 0x3ccc0998
mov dword [ebp + 8], 0
jmp 0x100282d0
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x1c], 0
inc dword [ebp + 8]
cmp dword [ebp + 8], 1
jl 0x100282c2
mov dword [ebp + 8], 0
jmp 0x100282ed
mov eax, dword [ebp + 8]
mov dword [ebp + eax*4 - 0x34], 2
inc dword [ebp + 8]
cmp dword [ebp + 8], ecx
jl 0x100282df
inc dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
cmp eax, 1
setle cl
mov dword [ebp - 0x1c], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x14], 0x4a5
cmp dword [ebp - 0x14], 0x603
jle 0x10028361
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp + 8], ecx
mov eax, ebx
shl eax, cl
mov ecx, 0x10077fd8
xor eax, edi
cdq
push edx
push eax
call fcn.10004c70
mov ecx, dword [ebp + 8]
inc ecx
mov dword [ebp + 8], ecx
cmp ecx, 0x2ff1
jl 0x1002832d
inc ebx
cmp ebx, 0x6850
jl 0x10028328
inc edi
cmp edi, 0xdcf
jl 0x10028326
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x322
jge 0x1002837d
mov edx, str.tpkyziu_oima_smmtdim_ubr
mov ecx, 0x10077fd8
call fcn.10007021
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], 0xd08
cmp dword [ebp - 0x18], 0xfe4
jle 0x100283d3
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x20], edi
mov dword [ebp + 8], 0x43af
mov ecx, edi
mov eax, ebx
sar eax, cl
mov ecx, 0x10077fd8
cdq
push edx
push eax
call fcn.10004c70
dec edi
dec dword [ebp + 8]
jne 0x100283a2
mov edi, dword [ebp - 0x14]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x7594
jl 0x10028398
inc ebx
cmp ebx, 0x3b64
jl 0x10028393
mov eax, dword [ebp - 0x24]
xor edx, edx
mov ecx, dword [eax]
mov eax, dword [eax]
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setle dl
mov dword [eax], edx
mov dword [ebp - 4], 2
cmp dword [ebp - 0x18], 0xc44
jge 0x10028303
mov edx, str.dicgxad_wnvr_xomsm_lbt_yemhj_qpcgi_uokozbdz_syrnl_vdvfooaqt_ydsqktke_kdduzkb_jxupm_vhlx_tpjq
mov ecx, 0x10077fd8
call fcn.10007021
jmp 0x10028303
Function at 0x1002ae87
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005d8e1
call fcn.1005cab0
sub esp, 0x1c
push ebx
push esi
mov dword [ebp - 0x1c], 0x498f
mov ebx, edx
cmp dword [ebp - 0x1c], 0x49f9
mov eax, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], eax
jle 0x1002af14
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x14], edi
mov eax, edi
xor ebx, ebx
and eax, esi
mov dword [ebp - 0x20], eax
mov esi, eax
xor edi, edi
mov eax, edi
mov ecx, 0x10077fd8
and eax, ebx
xor eax, esi
cdq
push edx
push eax
call fcn.10004c70
inc edi
cmp edi, 0x10fd
jl 0x1002aecb
inc ebx
cmp ebx, 0x6a21
jl 0x1002aec9
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x66ed
jl 0x1002aebe
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0xcbf
jl 0x1002aeb9
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
cmp byte [ebp + 0x20], 0
je 0x1002af2c
mov ecx, dword [eax + 4]
push dword [ebp + 0xc]
sub ecx, dword [eax]
mov edx, dword [eax]
call fcn.1002cf70
pop ecx
jmp 0x1002af55
mov edi, dword [ebp + 0x1c]
mov esi, dword [ebp + 0x10]
mov eax, dword [edi + 4]
sub eax, dword [edi]
sar eax, 2
mov dword [esi], eax
jmp 0x1002af51
and dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
mov ecx, edi
call fcn.1002c47b
inc dword [esi]
mov eax, dword [esi]
cmp eax, dword [ebx]
jl 0x1002af3e
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x48f5
jge 0x1002af71
mov edx, str.bwgnuuwx_rhne_xwqtrzmp_ymemjyf_cvdbl_bgxume_hruxj_bhzhga_eyqwzjavn_qzbzut_unktwum_xbzwuo_chvirir
mov ecx, 0x10077fd8
call fcn.10007021
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002b14e
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005d8f3
call fcn.1005cab0
sub esp, 0x28
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x1002b19a
cmp byte [ebp + 0x18], 0
je 0x1002b181
and dword [ecx], 0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [edx], 0
je 0x1002b170
push 0x146f
push 0x1097
push 0
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
jmp 0x1002b170
cmp byte [ebp + 8], 0
je 0x1002b1c8
push 0x21
pop edx
lea ecx, [ebp - 0x34]
call fcn.10007d51
and dword [ebp - 4], 0
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
push eax
call fcn.1002c83f
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.100053a8
jmp 0x1002b170
mov dword [ebp - 0x18], 0x6b2f
cmp dword [ebp - 0x18], 0x6c46
jle 0x1002b224
xor edi, edi
xor esi, esi
mov dword [ebp - 0x14], esi
xor ebx, ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp + 0x10], 0x422b
mov eax, esi
mov ecx, 0x10077fd8
xor eax, edi
cdq
push edx
push eax
call fcn.10004c70
add esi, ebx
dec dword [ebp + 0x10]
jne 0x1002b1eb
mov esi, dword [ebp - 0x14]
inc ebx
cmp ebx, 0x703e
jl 0x1002b1e1
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x59ef
jl 0x1002b1df
inc edi
cmp edi, 0x42ea
jl 0x1002b1da
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1002b238
xor dl, dl
mov ecx, 0x151
call fcn.10029500
mov dword [ebp - 4], 1
cmp dword [ebp - 0x18], 0x6998
jge 0x1002b170
mov edx, str.grjiq_cxswwnbkq_hcpdudzxo_whvoa_bdzevqe_nbeddbl_mtgzzinrk
mov ecx, 0x10077fd8
call fcn.10007021
jmp 0x1002b170
Function at 0x1002beea
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1005d9f4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x84
push ebx
push esi
push ecx
mov edx, 0x27f0
lea ecx, [esp + 0x40]
call fcn.1003f9f3
pop ecx
xor esi, esi
lea ecx, [esp + 0x6c]
push eax
mov dword [esp + 0x98], esi
call fcn.1003da99
xor ebx, ebx
mov byte [esp + 0x94], 2
push esi
inc ebx
lea ecx, [esp + 0x40]
push ebx
call fcn.100053a8
lea ecx, [esp + 0x6c]
call fcn.1003f57f
push ecx
mov edx, 0x26f3
lea ecx, [esp + 0x28]
call fcn.1003f9f3
mov edx, 0x26f4
mov byte [esp + 0x98], 3
lea ecx, [esp + 0x40]
call fcn.1003f9f3
pop ecx
mov edx, eax
mov byte [esp + 0x94], 4
lea ecx, [esp + 0x18]
call fcn.100285d3
push esi
push ebx
lea ecx, [esp + 0x44]
mov byte [esp + 0x9c], 6
call fcn.100053a8
push ecx
mov edx, 0x26f5
lea ecx, [esp + 0x58]
call fcn.1003f9f3
pop ecx
mov edx, eax
mov byte [esp + 0x94], 7
lea ecx, [esp + 0xc]
call fcn.100285d3
push esi
push ebx
lea ecx, [esp + 0x5c]
mov byte [esp + 0x9c], 9
call fcn.100053a8
push 0x16a3
push 0x17c6
lea eax, [esp + 0x20]
mov dl, bl
push eax
lea eax, [esp + 0x30]
mov ecx, 0x3baa
push eax
push 0xeba
push 0x5ee9
push ebx
push ebx
lea eax, [esp + 0x2c]
push eax
push 0x2a34
push 0x74d7
call fcn.1002ba4d
add esp, 0x2c
lea ecx, [esp + 0xc]
call fcn.1002c71a
lea ecx, [esp + 0x18]
call fcn.1002c71a
push esi
push ebx
lea ecx, [esp + 0x2c]
call fcn.100053a8
or dword [esp + 0x94], 0xffffffff
lea ecx, [esp + 0x6c]
call fcn.1003f7fc
mov ecx, dword [esp + 0x8c]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10034d90
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005dba9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10034eed
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10034ded
push 0x20c
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x10034eeb
mov dword [ebp - 0x24], 0x56e5
mov dword [ebp - 0x34], str.lba_fkfroy_vhfmexq_cadmucczg_dcttcf_tph_bnbye_zrlyjbid
cmp dword [ebp - 0x24], 0x5872
jle 0x10034e94
and dword [ebp - 0x20], 0
jmp 0x10034e15
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x8051
jge 0x10034e94
and dword [ebp - 0x14], 0
jmp 0x10034e2b
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x9de
jge 0x10034e8f
and dword [ebp - 0x18], 0
jmp 0x10034e41
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1b38
jge 0x10034e8d
and dword [ebp - 0x1c], 0
jmp 0x10034e57
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x7759
jge 0x10034e8b
mov eax, dword [ebp - 0x14]
cdq
idiv dword [ebp - 0x18]
mov eax, edx
cdq
idiv dword [ebp - 0x1c]
add edx, dword [ebp - 0x20]
mov eax, edx
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
mov ecx, 0x10077fd8
call fcn.10004c70
jmp 0x10034e50
jmp 0x10034e3a
jmp 0x10034e24
jmp 0x10034e0e
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x556b
jge 0x10034eb4
mov edx, dword [ebp - 0x34]
mov ecx, 0x10077fd8
call fcn.10007021
jmp 0x10034ed0
or dword [ebp - 4], 0xffffffff
jmp 0x10034eda
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
jmp 0x10034f01
push 0x32b1
push 1
push 0x3407
call fcn.10032f83
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret