joyce8/EMBER2024-capa huggingface dataset:
Function at 0x405ef4
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x422a34], 0
push esi
jne 0x405f2b
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405f05
mov dword [ecx*4 + 0x422a30], eax
inc ecx
cmp ecx, 0x100
jl 0x405f00
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x405f5c
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x422a30]
xor eax, esi
inc ecx
dec edx
jne 0x405f3e
pop edi
not eax
pop esi
ret 0xc

Function at 0x42e000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
sub eax, reloc.kernel32.dll_CreateProcessW
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
nop
nop
add eax, 0xc
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x42e01e
popal
nop
nop
nop
nop
nop
jmp loc.00401219
Function at 0x412402
Capabilities:
Allocate thread local storage
Get thread local storage value
Set thread local storage value

Disassembly:
cmp dword [0x4186e0], 0
push ebx
push esi
mov esi, 0x4186e8
jne 0x41242e
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
push esi
mov dword [0x418700], eax
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
mov dword [0x4186e0], 1
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov ebx, eax
test ebx, ebx
jne 0x4124cb
push 0x14
push 8
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov ebx, eax
test ebx, ebx
je 0x4124f5
push esi
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov eax, dword [0x4186e4]
test eax, eax
je 0x412470
mov dword [eax], ebx
push edi
push esi
mov dword [ebx + 4], eax
mov dword [0x4186e4], ebx
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
lea edi, [ebx + 0x10]
push 0
push 0
push 0x100000
push edi
call esi
push eax
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_DuplicateHandle]
push 8
push 0xffffffffffffffff
push ebx
push 0x4124fa
push dword [edi]
lea eax, [ebx + 0xc]
push eax
call dword [sym.imp.KERNEL32.dll_RegisterWaitForSingleObject]
push ebx
push dword [0x418700]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
push 0xc
push 0
push dword [0x418068]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
test eax, eax
je 0x4124f5
mov ecx, dword [esp + 0xc]
mov dword [eax + 4], ecx
mov ecx, dword [esp + 0x10]
mov dword [eax + 8], ecx
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
mov dword [ebx + 8], eax
pop esi
pop ebx
ret 8

Function at 0xe11834
Capabilities:
Encode data using xor

Disassembly:
jmp 0xe1183e
pushal
call 0xe11844
pop ebp
sub ebp, 0x10
sub ebp, 0xa11834
jmp 0xe1185a
mov eax, 0xa11834
add eax, ebp
add eax, 0x4c
mov ecx, 0x5b9
mov edx, 0xf40ad32a
xor byte [eax], dl
inc eax
dec ecx
jne 0xe11871
jmp 0xe11884
mov eax, dword [0x16a3a1e7]
sub ch, byte [edx]
sub ch, byte [ebx + 0x2a2ad2eb]
sub ch, byte [ecx]
out 0x92, eax
and ch, byte [edx]
sub ch, byte [edx]
nop
add ch, byte [edx]
sub ch, byte [edx]
invalid
Function at 0x401496
Capabilities:
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
and dword [ebp - 0x14], 0
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x14]
push edi
mov dword [ebp - 0x34], esi
mov eax, dword [esi]
mov ebx, dword [esi + 4]
mov dword [ebp - 8], eax
mov eax, dword [0x41b5d0]
mov dword [ebp - 0x28], eax
mov eax, dword [0x41b5d4]
mov dword [ebp - 0x30], eax
call fcn.0040148f
mov edi, dword [ebp - 0x14]
mov eax, dword [0x41b5d8]
add edi, 0x23f
mov dword [ebp - 0x20], eax
mov eax, dword [0x41b5dc]
push 0x20
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x24], eax
pop esi
mov dword [ebp - 0x18], 2
add dword [ebp - 0x18], 3
mov edx, dword [ebp - 8]
mov eax, edx
mov ecx, dword [0x2d5ec0c]
shl eax, 4
mov dword [ebp - 4], eax
cmp ecx, 0xc
jne 0x40151f
push 0x418248
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 4]
mov ecx, dword [0x2d5ec0c]
add eax, dword [ebp - 0x20]
cmp ecx, 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0x2d5ec08]
mov dword [ebp - 0x1c], 0xedeb2e40
cmove eax, dword [ebp - 0x1c]
and dword [ebp - 0x1c], 0
cmp ecx, 0x3eb
mov dword [0x2d5ec08], eax
mov eax, dword [0x2d5eb60]
cmove eax, dword [ebp - 0x1c]
mov dword [0x2d5eb60], eax
lea eax, [edi + edx]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 8]
shr eax, 5
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x24]
add dword [ebp - 0x10], eax
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 4]
mov dword [0x2d5ec04], 0xf4ea3dee
call fcn.0040146c
mov ecx, dword [ebp - 0x10]
xor ecx, eax
sub ebx, ecx
mov dword [ebp - 0x10], ecx
mov eax, ebx
mov dword [ebp - 0x2c], ebx
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
add dword [ebp - 4], eax
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x2c]
nop
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x18]
mov eax, ebx
shr eax, cl
add eax, dword [ebp - 0x30]
mov dword [ebp - 0x10], eax
xor eax, dword [ebp - 0x1c]
xor dword [ebp - 4], eax
mov eax, dword [ebp - 4]
sub dword [ebp - 8], eax
add edi, 0x61c88647
mov dword [ebp - 0x14], edi
dec esi
jne 0x4014e7
mov esi, dword [ebp - 0x34]
mov eax, dword [ebp - 8]
pop edi
mov dword [esi + 4], ebx
mov dword [esi], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x4015ef
Capabilities:
Query environment variable

Disassembly:
mov eax, dword [0x2d5ec0c]
push esi
mov esi, eax
shr esi, 3
push edi
mov edi, dword [0x2d5eb64]
test esi, esi
je 0x401632
cmp eax, 0x959
jne 0x40161e
call dword [sym.imp.KERNEL32.dll_FreeConsole]
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, edi
call fcn.00401496
add edi, 8
dec esi
je 0x401632
mov eax, dword [0x2d5ec0c]
jmp 0x401605
pop edi
pop esi
ret 4
Function at 0x40d179
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x41a36c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.00405045
mov dword [ebp - 0x14], eax
cmp dword [0x4652c0], esi
jne 0x40d26c
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40d1f9
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40d34c
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40d34c
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40d34c
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x4652c0], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x4652c4], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x4652c8], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4652d0], eax
test eax, eax
je 0x40d269
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x4652cc], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40d291
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40d284
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40d2a6
push 4
pop eax
jmp 0x40d34e
cmp dword [ebp - 0x14], esi
je 0x40d2a6
push dword [0x4652c0]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40d28b
mov eax, dword [0x4652cc]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40d304
cmp dword [0x4652d0], edi
je 0x40d304
push eax
call ebx
push dword [0x4652d0]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40d304
test eax, eax
je 0x40d304
call ecx
test eax, eax
je 0x40d2f9
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40d2f9
test byte [ebp - 8], 1
jne 0x40d304
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40d334
mov eax, dword [0x4652c4]
cmp eax, edi
je 0x40d331
push eax
call ebx
test eax, eax
je 0x40d331
call eax
mov esi, eax
test esi, esi
je 0x40d331
mov eax, dword [0x4652c8]
cmp eax, edi
je 0x40d331
push eax
call ebx
test eax, eax
je 0x40d331
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x4652c0]
call ebx
test eax, eax
je 0x40d34c
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40d34e
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0040432b
mov esp, ebp
pop ebp
ret
Function at 0x1000cbde
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1000cc14
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 8], eax
push 1
push 0x7c6b
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
push dword [eax]
call fcn.1000cca9
add esp, 0x10
jmp 0x1000cca5
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1000cc5d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1000cc5b
push 0x2580
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x1000cca5
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1000cc8b
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x1000cca5
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.1000f328
and dword [eax], 0
jmp 0x1000cc80
mov esp, ebp
pop ebp
ret
Function at 0x100163c9
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov dword [ebp - 8], 0x1b31
mov ebx, edx
cmp dword [ebp - 8], 0x1caa
push esi
push edi
mov dword [ebp - 0xc], ebx
jle 0x10016454
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 4], ecx
mov eax, ebx
cdq
idiv ecx
mov ecx, edi
mov eax, esi
sub ecx, edx
sar eax, cl
lea ecx, [ebp - 0x24]
cdq
push edx
push eax
call fcn.10001acf
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10016414
mov eax, dword [eax]
push eax
call fcn.10049e23
pop ecx
push 0
push 1
lea ecx, [ebp - 0x24]
call fcn.1000fa8e
mov ecx, dword [ebp - 4]
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x45de
jl 0x100163f2
inc ebx
cmp ebx, 0x77b9
jl 0x100163ed
inc edi
cmp edi, 0x430e
jl 0x100163eb
inc esi
cmp esi, 0x339b
jl 0x100163e9
mov ebx, dword [ebp - 0xc]
cmp dword [ebp - 8], 0x1aec
jge 0x10016468
push str.pfonckhu_wmqipixz_bveivlm_omo_abbdqozco_wkbmt_dpk_xmtytdpz
call fcn.10049e23
pop ecx
cmp byte [ebp + 8], 0
je 0x10016472
inc dword [ebx]
jmp 0x1001647d
push 0x587
call dword [sym.imp.USER32.dll_GetKeyState]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10016b3a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100614ce
call fcn.10060810
sub esp, 0xc
mov byte [ebp - 0x14], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10016bd9
mov dword [ebp - 0x18], 0x10b0
cmp dword [ebp - 0x18], 0x138f
jle 0x10016b9c
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x1007d358
and eax, edi
xor eax, esi
cdq
push edx
push eax
call fcn.1000ef91
inc ebx
cmp ebx, 0x1c72
jl 0x10016b6e
inc edi
cmp edi, 0x81c
jl 0x10016b6c
inc esi
cmp esi, 0x39a7
jl 0x10016b6a
mov eax, dword [ebp + 0xc]
dec dword [eax]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0xd7b
jge 0x10016bbd
mov edx, str.haukl_fgr_wvdmvn_dgjzrjc
mov ecx, 0x1007d358
call fcn.10011e0c
jmp 0x10016bed
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10016bed
mov edx, 0x4910
xor cl, cl
call fcn.10018409
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10017e9a
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0x20], 0
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
je 0x10017f32
mov edi, dword [ebp + 0x18]
xor esi, esi
mov ebx, dword [ebp + 0x34]
inc esi
mov eax, dword [edi]
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [edx], esi
mov ecx, dword [ebx]
mov eax, dword [edx]
xor edx, edx
dec dword [ebx]
cmp ecx, eax
mov eax, dword [ebp + 0x1c]
cmove esi, edx
xor ecx, ecx
mov eax, dword [eax]
cmp esi, eax
mov eax, dword [ebp + 0xc]
setne cl
mov eax, dword [eax]
sub ecx, eax
cmp ecx, dword [edi]
jle 0x10017eed
cmp dword [ebx], edx
je 0x10017ef0
xor edx, edx
inc edx
mov esi, dword [ebp + 0x14]
lea eax, [edx + 0x2ed07459]
mov edx, dword [ebp + 0x2c]
cmp eax, dword [esi]
jle 0x10017f02
mov eax, dword [edx]
mov ecx, dword [ebp - 4]
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [ecx]
xor ecx, ecx
test eax, eax
sete cl
cmp ecx, dword [esi]
jle 0x10017f18
mov eax, dword [edx]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x1c]
mov eax, dword [eax]
mov eax, dword [edi]
add eax, 0x731d497c
mov dword [ecx], eax
mov eax, dword [ebp + 0x44]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x10017f44
mov eax, dword [ebp + 0x40]
cmp byte [eax], 0
je 0x10017f44
xor edx, edx
push edx
push edx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10019cc0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100615cc
call fcn.10060810
sub esp, 0xc
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, edx
je 0x10019d9e
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x10019d73
mov dword [ebp - 0x18], 0x2a9b
cmp dword [ebp - 0x18], 0x2e07
jle 0x10019d30
xor esi, esi
xor edi, edi
xor ebx, ebx
lea eax, [ebx + edi]
mov ecx, 0x1007d358
and eax, esi
cdq
push edx
push eax
call fcn.1000ef91
inc ebx
cmp ebx, 0x3a02
jl 0x10019d03
inc edi
cmp edi, 0x7eaf
jl 0x10019d01
inc esi
cmp esi, 0x55ba
jl 0x10019cff
push 0x100e
push 1
push 0x30d1
push 1
push 1
push 0x5569
mov edx, 0x1a91
mov ecx, 0x44a4
call fcn.10014f46
and dword [ebp - 4], 0
add esp, 0x18
cmp dword [ebp - 0x18], 0x2a3a
jge 0x10019d73
mov edx, str.rbvkkh_eqfzdibrz_gzou_fwttlyfr
mov ecx, 0x1007d358
call fcn.10011e0c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x18], 0x721f
cmp dword [ebp - 0x18], 0x7509
jle 0x10019dd5
xor esi, esi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x1007d358
xor eax, esi
cdq
push edx
push eax
call fcn.1000ef91
inc ebx
cmp ebx, 0x6964
jl 0x10019db2
inc esi
cmp esi, 0xa42
jl 0x10019db0
inc dword [edi]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x18], 0x6f73
jge 0x10019d73
mov edx, str.tsmqqxyzo_ljygl_qnrulqup_thpyzya
mov ecx, 0x1007d358
call fcn.10011e0c
jmp 0x10019d73

Function at 0x1001a237
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
test dl, dl
je 0x1001a312
cmp byte [ebp + 0xc], 0
je 0x1001a271
push ecx
push ecx
lea eax, [esp + 0x16]
mov byte [esp + 0x16], 0
push 0
push eax
mov edx, 0x67e2
call fcn.10019e15
add esp, 0x10
jmp 0x1001a339
cmp byte [ecx], 0
je 0x1001a339
mov dword [esp + 0x14], 0x473a
cmp dword [esp + 0x14], 0x4af2
jle 0x1001a2f0
xor esi, esi
mov dword [esp + 0x10], esi
xor edi, edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov esi, edx
mov ecx, ebx
mov eax, esi
sar eax, cl
lea ecx, [esp + 0x18]
cdq
push edx
push eax
call fcn.10001acf
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001a2b9
mov eax, dword [eax]
push eax
call fcn.10049e23
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.1000fa8e
inc ebx
cmp ebx, 0x290c
jl 0x1001a29d
mov esi, dword [esp + 0x10]
inc edi
cmp edi, 0x4821
jl 0x1001a294
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0xb9d
jl 0x1001a292
push 0x587
call dword [sym.imp.USER32.dll_GetKeyState]
cmp dword [esp + 0x14], 0x44bc
jge 0x1001a339
push str.weuqydpyr_qrmjooz_xji_gjdybtp_rblfukto_xlxb_lgid_wptwjayxq_tmiqkpfzu_gvzeicp_erp_xaalxdum
call fcn.10049e23
pop ecx
jmp 0x1001a339
cmp byte [ebp + 8], 0
je 0x1001a32b
push 0
push 0
push 0
push 0x3ce
call dword [sym.imp.GDI32.dll_CreateEnhMetaFileW]
jmp 0x1001a339
lea edx, [esp + 0xf]
mov byte [esp + 0xf], 0
call fcn.1001a227
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100217f4
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006197b
call fcn.10060810
sub esp, 0x14
push ebx
push esi
mov dword [ebp - 0x18], 0x5b13
mov eax, edx
cmp dword [ebp - 0x18], 0x5d22
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
jle 0x1002185c
xor esi, esi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x14], 0x45a9
mov eax, ebx
mov ecx, 0x1007d358
xor eax, esi
cdq
push edx
push eax
call fcn.1000ef91
add ebx, edi
dec dword [ebp - 0x14]
jne 0x1002182c
inc edi
cmp edi, 0x4c4c
jl 0x10021823
inc esi
cmp esi, 0x4c6d
jl 0x10021821
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
push eax
push 1
push 0x974
push dword [ebp + 8]
push ecx
push 0
call fcn.1002483b
and dword [ebp - 4], 0
add esp, 0x18
cmp dword [ebp - 0x18], 0x584c
jge 0x1002188e
mov edx, str.rmtfcblj_ztyqrddhe_kpdruzqpl_jwao_ghn_wcv
mov ecx, 0x1007d358
call fcn.10011e0c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100247ae
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10024811
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x100247eb
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100247e9
push 0x587
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x1002480f
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 0
mov ecx, dword [ebp - 0x18]
call fcn.1000f328
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x10024837
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
push 1
push dword [ebp - 0x1c]
push 0x2839
push dword [ebp - 0x20]
push 0x6a42
call fcn.10023980
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x1002554d
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x100255c8
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10025597
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10025595
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x100255c6
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x100255c6
push 0
push 0x7a7d
push 0x6b7
push 0x32b0
call fcn.100325cb
add esp, 0x10
jmp 0x10025613
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x100255ef
push 0x2580
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x10025613
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10025613
push 0
push 0x5b69
call fcn.1002623e
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10034196
Capabilities:
Log keystrokes
Log keystrokes via polling

Disassembly:
mov eax, 0x10061f72
call fcn.10060810
push ecx
push ecx
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x100342ca
cmp byte [ebp + 0x18], 0
je 0x1003421e
mov dword [ebp - 0x14], 0x5e98
cmp dword [ebp - 0x14], 0x6003
jle 0x100341d3
push 0x192f
call dword [sym.imp.KERNEL32.dll_ExitThread]
cmp byte [edx], 0
je 0x100341e3
push 0x587
call dword [sym.imp.USER32.dll_GetKeyState]
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x5d8c
jge 0x100341ff
mov edx, str.cxdnr_pqfz_jfibpuyp_yumclooz_dym_bsyxrdby_rxvsdxxpl_rns_nrmpbrdx_wfjzpxld_armd_nagyacx
mov ecx, 0x1007d358
call fcn.10011e0c
jmp 0x10034308
mov dword [ebp - 0x14], 0x3ee1
cmp dword [ebp - 0x14], 0x4186
jle 0x10034268
push 0x1d4f
push 0
push 0
push 0x1ff
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
xor esi, esi
xor edi, edi
mov ebx, 0x158e
mov eax, edi
mov ecx, 0x1007d358
cdq
push edx
push eax
call fcn.1000ef91
add edi, esi
dec ebx
jne 0x1003424b
inc esi
cmp esi, 0x779c
jl 0x10034244
mov edx, dword [ebp + 0xc]
push 2
pop edi
mov dword [edx], 0
cmp dword [edx], edi
jge 0x1003428c
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x76ee
inc dword [edx]
cmp dword [edx], edi
jl 0x1003427b
mov dword [ebp - 4], edi
cmp dword [ebp - 0x14], 0x3db4
jge 0x100341ff
mov edx, str.lmrtmz_cbbbvromi_tpwcz_gizoav_hjya_hpot
mov ecx, 0x1007d358
call fcn.10011e0c
jmp 0x100341ff
cmp byte [ebp + 0x14], 0
je 0x100342f6
push 1
push 0
push 0
push 0x7c19
push 0x524e
mov edx, 0x65b1
mov byte [ebp + 0x13], 0
lea ecx, [ebp + 0x13]
call fcn.10034196
add esp, 0x14
jmp 0x10034308
cmp byte [ecx], 0
je 0x10034308
push 0
push 0x2172
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret