joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003f1a6
Capabilities:
Query or enumerate registry value

Disassembly:
push 0x10
mov eax, 0x10043494
call fcn.1004049f
xor ebx, ebx
push 0x1004a9c4
lea ecx, [ebp - 0x1c]
mov dword [ebp - 0x14], ebx
mov esi, ebx
call fcn.1003d6a0
mov dword [ebp - 4], ebx
cmp dword [0x1004a9bc], ebx
je 0x1003f1f0
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esi, eax
jmp 0x1003f295
push 1
push ebx
lea eax, [ebp - 0x14]
push eax
push dword [ebp + 0xc]
call fcn.1003d6a0
test eax, eax
jns 0x1003f208
push 8
pop edi
jmp 0x1003f285
mov ebx, dword [ebp + 0x1c]
mov edx, dword [ebx]
mov eax, dword [0x1004a9c0]
shr edx, 1
push edx
mov dword [ebp - 0x10], edx
mov ecx, dword [eax]
push eax
call dword [ecx + 0xc]
cmp dword [ebp - 0x10], 0
mov esi, eax
jbe 0x1003f229
mov byte [esi], 0
lea eax, [ebp - 0x10]
push eax
push esi
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp - 0x14]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
mov edi, eax
mov eax, dword [ebp - 0x10]
test eax, eax
je 0x1003f25d
mov ecx, dword [ebx]
shr ecx, 1
je 0x1003f25d
dec ecx
dec eax
cmp ecx, eax
cmovae ecx, eax
mov byte [ecx + esi], 0
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], 0
jbe 0x1003f285
cmp dword [ecx], 2
jbe 0x1003f26f
cmp dword [ecx], 7
jne 0x1003f285
push eax
lea eax, [ebp + 0x18]
push eax
push esi
call fcn.1003d6a0
test eax, eax
js 0x1003f203
mov eax, dword [ebp - 0x10]
add eax, eax
mov dword [ebx], eax
push dword [ebp - 0x14]
call fcn.1003d6a0
push esi
call fcn.1003d6a0
mov esi, edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x1c]
call fcn.100311d4
mov eax, esi
call fcn.10040577
ret 0x18
Function at 0x40bbc6
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 0xc]
xor edx, edx
mov ecx, dword [ebp + 0xc]
and eax, 3
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, edx
sub ecx, eax
je 0x40bc10
rol edx, 5
xor edx, dword [esi + ebx]
add esi, 4
imul eax, edx, 0x9e3779b9
rol eax, 5
xor eax, 4
imul edx, eax, 0x9e3779b9
cmp esi, ecx
jb 0x40bbdf
jmp 0x40bc10
movsx ecx, byte [esi + ebx]
rol edx, 5
xor edx, ecx
imul edx, edx, 0x9e3779b9
inc esi
cmp esi, dword [ebp + 0xc]
jb 0x40bc00
pop esi
mov eax, edx
pop ebx
pop ebp
ret

Function at 0x40cb33
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push 1
lea esi, [ebx - 1]
push 0x2000
not esi
push ebx
and esi, 0xf0deafff
push esi
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
mov edi, eax
cmp edi, esi
jne 0x40cb68
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
lea eax, [ebp - 0x24]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
cmp esi, dword [ebp - 0x18]
jb 0x40cb92
lea eax, [esi + ebx]
cmp eax, dword [ebp - 0x18]
jb 0x40cb92
test edi, edi
je 0x40cb5f
push 0x8000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_VirtualFree]
jmp 0x40cb5f
test edi, edi
je 0x40cb9a
mov eax, edi
jmp 0x40cb61
push 1
push 0x2000
push ebx
push 0
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
test eax, eax
jne 0x40cb61
mov esi, 0xc3
push esi
push str.c:_builds_moz2_slave_fx_team_w32_d_0000000000000000_build_src_mfbt_Poison.cpp
push str.no_usable_poison_region_identified
call fcn.004106d8
add esp, 0xc
int3
Function at 0x402a20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
pushal
call 0x402a2f
pop dword [ebp - 4]
mov eax, 0x5d4d0312
add eax, 0xa2f3271d
sub dword [ebp - 4], eax
mov dword [ebp - 0x14], 0x52c8d995
add dword [ebp - 0x14], 0xfb896bb6
mov dword [ebp - 0x10], 0xc0e0731d
sub dword [ebp - 0x10], 0x8ead26d8
mov dword [ebp - 0xc], 0xcb44058
sub dword [ebp - 0xc], 0xc067fc2a
mov dword [ebp - 8], 0xb73c729b
sub dword [ebp - 8], 0xb73c729b
lea eax, [ebp - 0x14]
push eax
mov eax, 0x871bb57a
sub eax, 0x86da84e2
add eax, dword [ebp - 4]
call dword [eax]
mov dword [ebp - 0x14], 0xac020e65
add dword [ebp - 0x14], 0xc8705af1
mov dword [ebp - 0x10], 0x20b2e75
add dword [ebp - 0x10], 0x3f613300
mov dword [ebp - 0xc], 0xfadfd60e
sub dword [ebp - 0xc], 0x977069a2
mov dword [ebp - 8], 0xf73c9902
add dword [ebp - 8], 0x8c366fe
lea ebx, [ebp - 0x14]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 4]
call dword [eax]
push 0x40
push 0x1000
push 0x385a4
push 0
call eax
mov ecx, 0xd1e19216
sub ecx, 0xd1e14d40
mov edi, eax
mov esi, 0x41a400
add esi, dword [ebp - 4]
mov ebx, 0x16b20b18
sub ebx, 0x6f56e10c
mov edx, dword [esi]
xor edx, ebx
mov dword [edi], edx
add edi, 0x1a6c648e
add edi, 0xe5939b76
add esi, 4
loop 0x402b46
add eax, 0x1062b
xor ebx, ebx
add ebx, eax
add eax, 0xaf1ebbd1
sub eax, 0xaf1ebbcc
mov ecx, 0xbb5eaabc
sub ecx, 0xbb1eaabc
add ecx, dword [ebp - 4]
call ebx
leave
ret

Function at 0x407a60
Capabilities:
Link many functions at runtime

Disassembly:
push edi
mov edi, ecx
cmp dword [edi + 0x34], 0
jne 0x407b30
push ebx
push esi
push str.mapi32.dll
call dword [sym.imp.kernel32.dll_LoadLibraryA]
push 0xc
mov dword [edi + 0x18], eax
call dword [sym.imp.MSVCR120.dll_void____cdecl_operator_new_unsigned_int_]
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x407ad0
xorps xmm0, xmm0
movq qword [ebx], xmm0
push str.MAPIFreeBuffer
mov dword [ebx + 8], 0
push dword [edi + 0x18]
call esi
push str.MAPIAllocateBuffer
push dword [edi + 0x18]
mov esi, eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [ebx + 8], esi
mov esi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [ebx], vtable.MapiAllocator.0
mov dword [ebx + 4], eax
jmp 0x407ad2
xor ebx, ebx
push str.MAPIInitialize
push dword [edi + 0x18]
mov dword [edi + 0x1c], ebx
call esi
push str.MAPIUninitialize
push dword [edi + 0x18]
mov dword [edi + 0x24], eax
call esi
push str.MAPILogonEx
push dword [edi + 0x18]
mov dword [edi + 0x28], eax
call esi
push str.MAPIAdminProfiles
push dword [edi + 0x18]
mov dword [edi + 0x2c], eax
call esi
mov dword [edi + 0x30], eax
mov eax, dword [edi + 0x24]
pop esi
pop ebx
test eax, eax
je 0x407b30
cmp dword [edi + 0x28], 0
je 0x407b30
cmp dword [edi + 0x2c], 0
je 0x407b30
push 0
call eax
mov dword [edi + 0x14], eax
test eax, eax
js 0x407b30
mov dword [edi + 0x34], 1
pop edi
ret
Function at 0x401f10
Capabilities:
Get disk information
Inspect load icon resource
Read file on windows

Disassembly:
mov eax, dword [esp + 4]
sub esp, 0x148
push ebx
push esi
push edi
push 0x65
push eax
call dword [sym.imp.USER32.dll_LoadIconA]
lea ecx, [esp + 0xc]
call fcn.00401000
lea ecx, [esp + 0x50]
push 0x104
push ecx
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
lea edx, [esp + 0x50]
lea ecx, [esp + 0xc]
push edx
call fcn.004012b0
test eax, eax
je 0x402021
lea eax, [esp + 0x50]
push 0x404030
push eax
call dword [sym.imp.MSVCRT.dll_fopen]
mov esi, eax
add esp, 8
test esi, esi
je 0x402084
lea ecx, [esp + 0x50]
push ecx
lea ecx, [esp + 0x10]
call fcn.00401290
mov edi, dword [sym.imp.MSVCRT.dll_fseek]
sub eax, 8
push 0
push eax
push esi
call edi
mov ebx, dword [sym.imp.MSVCRT.dll_fread]
push esi
push 1
lea edx, [esp + 0x24]
push 8
push edx
call ebx
mov eax, dword [esp + 0x2c]
push 0
push eax
push esi
call edi
push esi
push 1
lea ecx, [esp + 0x48]
push 0x38
push ecx
call ebx
push esi
call dword [sym.imp.MSVCRT.dll_fclose]
mov eax, dword [esp + 0x88]
mov edx, dword [esp + 0x50]
add esp, 0x3c
test eax, eax
mov eax, dword [esp + 0x10]
push edx
push eax
jne 0x401ffe
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401800
jmp 0x402084
sub esp, 0x38
mov ecx, 0xe
lea esi, [esp + 0x58]
mov edi, esp
rep movsd dword es:[edi], dword [esi]
lea ecx, [esp + 0x90]
push ecx
lea ecx, [esp + 0x50]
call fcn.00401a90
jmp 0x402084
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString_1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, eax
mov esi, 1
xor ebx, ebx
test edi, esi
je 0x40206a
mov dl, bl
lea ecx, [esp + 0x10]
add dl, 0x41
push edx
call sub.MFC42.DLL_CString::operator_1
push 0x40412c
lea ecx, [esp + 0x14]
call fcn.004020e2
lea ecx, [esp + 0xc]
mov eax, dword [esp + 0x10]
push eax
push 0
call fcn.00401cf0
add esi, esi
inc ebx
cmp ebx, 0x1a
jl 0x402039
lea ecx, [esp + 0xc]
call fcn.00401040
lea ecx, [esp + 0x10]
call sub.MFC42.DLL_CString::CString
lea ecx, [esp + 0xc]
call fcn.00401030
pop edi
pop esi
xor eax, eax
pop ebx
add esp, 0x148
ret 0x10

Function at 0x433000
Capabilities:
Encode data using xor

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
mov ecx, 0x78d93761
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x43304e
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x433024
mov eax, section..data
nop
nop
mov ebx, 0x4304d8
mov ecx, 0x3cc85e9a
nop
test eax, eax
nop
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x10011023
Capabilities:
Terminate process

Disassembly:
jmp 0x1001cb00
jmp fcn.1001cb30
cmp ecx, dword [0x10021054]
jne 0x1001cb0a
repz ret
jmp 0x100110b9

Function at 0x10016640
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
pushal
call 0x1001664f
pop dword [ebp - 0x3c]
mov eax, 0x1001664f
sub dword [ebp - 0x3c], eax
mov dword [ebp - 0x4c], 0x11e0b4e6
add dword [ebp - 0x4c], 0x3c719065
mov dword [ebp - 0x48], 0x716dbdc8
sub dword [ebp - 0x48], 0x3f3a7183
mov dword [ebp - 0x44], 0xaca70dc1
add dword [ebp - 0x44], 0x9fa5366d
mov dword [ebp - 0x40], 0x785e5c74
sub dword [ebp - 0x40], 0x785e5c74
lea eax, [ebp - 0x4c]
push eax
mov eax, sym.imp.kernel32.dll_LoadLibraryA
add eax, dword [ebp - 0x3c]
call dword [eax]
mov dword [ebp - 0x4c], 0x13f069fd
sub dword [ebp - 0x4c], 0x9f7e00a7
mov dword [ebp - 0x48], 0x42598629
add dword [ebp - 0x48], 0xff12db4c
mov dword [ebp - 0x44], 0xd3b1cb9
add dword [ebp - 0x44], 0x56344fb3
mov dword [ebp - 0x40], 0x78a3213d
add dword [ebp - 0x40], 0x875cdec3
lea ebx, [ebp - 0x4c]
push ebx
push eax
mov eax, 0xa4102e73
sub eax, 0x940e0c83
add eax, dword [ebp - 0x3c]
call dword [eax]
push 0x40
push 0x1000
push 0x399e4
push 0
call eax
mov ecx, 0x51c7
mov ebx, eax
mov esi, 0x10024a00
add esi, dword [ebp - 0x3c]
mov edx, 0x4b90fc5e
add dword [ebp - 0x28], 0xd30dbbb0
mov edi, dword [esi]
mov dword [ebp - 0x2c], 0x3cd52435
add edi, edx
xor dword [ebp - 0x14], 0x121f76c
mov dword [ebx], edi
mov dword [ebp - 8], 0x3241b68e
add ebx, 4
add esi, 0x4ca8155f
add esi, 0xb357eaa5
loop 0x10016755
add eax, 0x962f2b96
sub eax, 0x962df1a7
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xae647b0c
sub ecx, 0x9e647b0c
add ecx, dword [ebp - 0x3c]
call ebx
leave
ret
Function at 0x405ec3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x405ee7
xor eax, eax
test eax, eax
je 0x405ef9
cmp byte [ebp + eax - 0x121], 0x5c
je 0x405ef9
xor ecx, ecx
jmp 0x405efc
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x409010]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
leave
ret 4

Function at 0x405f9c
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x42c654], 0
push esi
jne 0x405fd3
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x405fad
mov dword [ecx*4 + 0x42c650], eax
inc ecx
cmp ecx, 0x100
jl 0x405fa8
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406004
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x42c650]
xor eax, esi
inc ecx
dec edx
jne 0x405fe6
pop edi
not eax
pop esi
ret 0xc

Function at 0x4064e3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x4064e3
lcall 0x5de5, 0x8b10c483
jmp fcn.00799dac
Function at 0x1001b611
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
pushal
call 0x1001b620
pop dword [ebp - 0x34]
mov eax, 0xe68e0ca8
add eax, 0x2973a978
sub dword [ebp - 0x34], eax
push 0x40
push 0x1000
push 0x3fba2
push 0
mov eax, 0xf7de7eca
add eax, 0x1824e212
add eax, dword [ebp - 0x34]
call dword [eax]
mov ecx, 0x452b
mov esi, eax
mov edi, 0x631dda4e
sub edi, 0x531a1c4e
add edi, dword [ebp - 0x34]
mov ebx, 0xf8dbdf28
add dword [ebp - 8], 0xa3473af5
mov edx, dword [edi]
add dword [ebp - 0xc], 0x2f9a16c1
xor edx, ebx
xor dword [ebp - 8], edx
mov dword [esi], edx
xor dword [ebp - 4], 0xd269097
add esi, 0x8a8dd051
sub esi, 0x8a8dd04d
add edi, 0x71e12b99
add edi, 0x8e1ed46b
loop 0x1001b673
add eax, 0x564d9eb7
add eax, 0xa9b368c8
mov ebx, eax
add eax, 0x45f6bee5
add eax, 0xba094120
mov ecx, 0x69443886
sub ecx, 0x59443886
add ecx, dword [ebp - 0x34]
call ebx
leave
ret

Function at 0x100289d0
Capabilities:
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x808
mov eax, dword [0x100330b4]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [0x10035b0c]
test dword [ebp + 8], eax
je 0x10028a7a
lea eax, [ebp + 0x10]
push eax
push dword [ebp + 0xc]
lea eax, [ebp - 0x808]
push eax
call fcn.1001b611
xor eax, eax
add esp, 0xc
mov word [ebp - 8], ax
mov eax, dword [0x10035b08]
test eax, eax
je 0x10028a6d
lea ecx, [ebp - 0x808]
push ecx
push eax
call fcn.1001b611
mov eax, dword [0x100330ac]
pop ecx
pop ecx
test eax, eax
jle 0x10028a7a
push esi
mov esi, dword [0x10035b10]
push edi
mov edi, dword [0x10035b14]
cdq
push edx
push eax
push edi
push esi
call fcn.10029420
add esi, 1
mov dword [0x10035b10], esi
adc edi, 0
or eax, edx
mov dword [0x10035b14], edi
pop edi
pop esi
jne 0x10028a7a
push dword [0x10035b08]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fflush]
pop ecx
jmp 0x10028a7a
lea eax, [ebp - 0x808]
push eax
call dword [sym.imp.kernel32.dll_OutputDebugStringW]
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10028d50
leave
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x433072
nop
mov ebx, 0x40de38
nop
nop
nop
nop
nop
mov ecx, ebx
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
mov esi, 0xf8392e
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
add eax, edi
nop
nop
nop
nop
nop
nop
nop
loop 0x433060
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
je 0x4330d2
nop
nop
nop
nop
nop
mov ebx, 0x4304d8
nop
nop
mov ecx, ebx
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x5ee90426
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4330c0
nop
nop
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x10001120
Capabilities:
Resolve function by parsing pe exports
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xa8
mov eax, esp
mov dword [eax], 0x9c7be4
mov eax, dword [sym.imp.KERNEL32.dll_GetThreadPriority]
call eax
sub esp, 4
mov ecx, esp
mov dword [ecx + 4], 0x1ff
mov dword [ecx], 0x527f16
mov ecx, dword [sym.imp.KERNEL32.dll_TerminateThread]
mov dword [esp + 0x6c], eax
call ecx
sub esp, 8
xor ecx, ecx
lea edx, [esp + 0x78]
mov dword [esp + 0x68], eax
mov dword [esp + 0x64], edx
mov dword [esp + 0x60], ecx
jmp 0x10001233
mov eax, esp
mov dword [eax + 4], 0xa72
mov dword [eax], 0xa72
mov eax, dword [sym.imp.USER32.dll_SetLastErrorEx]
call eax
sub esp, 8
jmp 0x100011db
xor eax, eax
mov ecx, 0x30
mov edx, dword [esp + 0x64]
mov dword [esp], edx
mov dword [esp + 4], 0
mov dword [esp + 8], 0x30
mov dword [esp + 0x5c], eax
mov dword [esp + 0x58], ecx
call fcn.10001a20
mov eax, esp
lea ecx, [esp + 0x78]
mov dword [eax + 4], ecx
mov dword [eax], 0x5df
mov eax, dword [sym.imp.USER32.dll_GetGUIThreadInfo]
call eax
sub esp, 8
mov dword [esp + 0x54], eax
jmp 0x1000129d
mov eax, dword [esp + 0x50]
add eax, 1
mov dword [esp + 0x4c], eax
mov eax, dword [esp + 0x4c]
cmp eax, 0x7d
mov dword [esp + 0x48], eax
je 0x10001263
jmp 0x10001241
mov eax, dword [esp + 0x44]
add eax, 1
mov ecx, esp
mov dword [ecx], 0xf9e689
mov ecx, dword [sym.imp.USER32.dll_UnhookWindowsHookEx]
mov dword [esp + 0x40], eax
call ecx
sub esp, 4
mov ecx, dword [esp + 0x40]
cmp ecx, 0xa
mov dword [esp + 0x3c], eax
mov dword [esp + 0x44], ecx
je 0x10001303
jmp 0x100011f9
mov eax, dword [esp + 0x60]
xor ecx, ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0x48], ecx
mov eax, dword [esp + 0x48]
mov ecx, 0x12
mov dword [esp + 0x50], eax
xor edx, edx
div ecx
cmp edx, 0
je 0x10001173
jmp 0x100011db
xor eax, eax
xor ecx, ecx
mov edx, dword [esp + 0x38]
sub edx, 0x4b
mov dword [esp + 0x34], eax
mov dword [esp + 0x30], ecx
mov dword [esp + 0x2c], edx
je 0x1000118e
jmp 0x10001282
mov eax, dword [esp + 0x38]
sub eax, 0xe
mov ecx, dword [esp + 0x30]
mov dword [esp + 0x28], eax
mov dword [esp + 0x44], ecx
jne 0x100011f9
jmp 0x1000129d
mov eax, 0x7e0e7d
mov dword [esp + 0x74], eax
mov dword [esp + 0x70], 0xd0c
mov eax, esp
lea ecx, [esp + 0x70]
mov dword [eax + 0x10], ecx
lea ecx, [esp + 0x74]
mov dword [eax + 0xc], ecx
mov dword [eax + 8], 0x45b
mov dword [eax + 4], 0xa03
mov dword [eax], 0xa03
mov eax, dword [sym.imp.ole32.dll_CoWaitForMultipleHandles]
call eax
sub esp, 0x14
mov ecx, esp
mov dword [ecx], 0xe04
mov ecx, dword [sym.imp.USER32.dll_AllowSetForegroundWindow]
mov dword [esp + 0x24], eax
call ecx
sub esp, 4
mov ecx, dword [sym.imp.KERNEL32.dll_GetSystemDefaultLCID]
mov dword [esp + 0x20], eax
call ecx
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x38]
add eax, 1
cmp eax, 0xa1
sete cl
mov dword [esp + 0x18], eax
mov byte [esp + 0x17], cl
mov al, byte [esp + 0x17]
test al, 1
mov ecx, dword [esp + 0x18]
mov dword [esp + 0x60], ecx
jne 0x10001331
jmp 0x10001233
mov esp, ebp
pop ebp
ret

Function at 0x10001e5c
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100d2f60]
jne 0x10001e66
repz ret
jmp fcn.1000210d
Function at 0x10002730
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x18
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
mov dword [0x100d2f44], 0
mov byte [0x100d2f48], 0
mov dword [0x100d2f38], 0x223a
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [0x100d2f40], 0
jmp 0x10002851
mov eax, 0x100
mov dword [0x100d2f4c], 0
mov ecx, dword [0x100d2f44]
mov edx, dword [0x100d2f40]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + edx]
add edi, ecx
mov dword [ebp - 0x1c], eax
mov eax, edx
xor edx, edx
mov ecx, dword [ebp - 0x10]
div ecx
mov ebx, dword [ebp - 0x14]
movzx edx, byte [ebx + edx]
add edi, edx
mov dword [0x100d2f4c], edi
mov eax, edi
cdq
mov edi, dword [ebp - 0x1c]
idiv edi
mov dword [0x100d2f44], edx
mov dword [0x100d2f38], 0x9d4
mov edx, dword [0x100d2f40]
mov cl, byte [esi + edx]
mov byte [0x100d2f48], cl
mov dword [0x100d2f38], 0xfffff859
mov edx, dword [0x100d2f44]
mov cl, byte [esi + edx]
mov edx, dword [0x100d2f40]
mov byte [esi + edx], cl
mov dword [0x100d2f38], 0x1f37
mov cl, byte [0x100d2f48]
mov edx, dword [0x100d2f44]
mov byte [esi + edx], cl
mov edx, dword [0x100d2f38]
add edx, 0xfffffbe3
mov dword [0x100d2f38], edx
mov edx, dword [0x100d2f40]
add edx, 1
mov dword [0x100d2f40], edx
cmp edx, 0x100
jl 0x10002775
jmp 0x10002892
mov dword [0x100d2f40], 0
jmp 0x10002775
mov dword [0x100d2f38], 0x23f6
mov eax, dword [0x100d2f40]
mov ecx, eax
mov dl, cl
mov dword [ebp - 0x20], eax
mov byte [ebp - 0x21], dl
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x20]
mov dl, byte [ebp - 0x21]
mov byte [eax + ecx], dl
mov esi, dword [0x100d2f40]
add esi, 1
mov dword [0x100d2f40], esi
cmp esi, 0x100
jl 0x10002851
jmp 0x10002842
add esp, 0x18
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x100028c0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x64
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
call fcn.100028a0
xor ecx, ecx
mov dword [0x100d2f38], 0x26c3
mov edx, ecx
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x38], edx
mov dword [ebp - 0x3c], ecx
mov eax, dword [ebp - 0x3c]
mov ecx, dword [ebp - 0x38]
lea edx, section..data
imul esi, eax, 0x64
mov edi, edx
add edi, esi
add edi, 0x60
mov esi, dword [edi]
imul edi, eax, 0x64
add edx, edi
add edx, 0x5c
movzx edx, word [edx]
xor edx, esi
add edx, ecx
add eax, 1
cmp eax, 0x331
mov ecx, edx
mov dword [ebp - 0x40], edx
mov dword [ebp - 0x38], ecx
mov dword [ebp - 0x3c], eax
jne 0x100028eb
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x44], eax
lea eax, [0x100be5ce]
mov ecx, 0xe
mov edx, dword [ebp - 0x44]
mov dword [esp], edx
mov dword [esp + 4], eax
mov dword [esp + 8], 0xe
mov dword [ebp - 0x48], ecx
call fcn.10003500
mov dword [0x100d2f3c], 0x1da2
mov dword [0x100d2f38], 0xbcc
mov eax, dword [ebp - 0x44]
mov dword [esp], eax
call fcn.10002480
mov ecx, eax
mov dword [0x100d2f58], eax
mov eax, esp
mov edx, dword [ebp - 0x40]
mov dword [eax + 4], edx
mov dword [eax + 0xc], 4
mov dword [eax + 8], 0x1000
mov dword [eax], 0
call ecx
sub esp, 0x10
xor ecx, ecx
mov edx, ecx
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x50], edx
mov dword [ebp - 0x54], ecx
mov eax, dword [ebp - 0x54]
mov ecx, dword [ebp - 0x50]
lea edx, section..data
imul esi, eax, 0x64
mov edi, edx
add edi, esi
add edi, 0x60
mov esi, dword [edi]
imul edi, eax, 0x64
mov ebx, edx
add ebx, edi
add ebx, 0x58
mov edi, dword [ebx]
imul ebx, eax, 0x64
add edx, ebx
add edx, 0x5c
movzx edx, word [edx]
xor edx, esi
mov esi, dword [ebp - 0x4c]
add esi, ecx
mov dword [esp], esi
mov dword [esp + 4], edi
mov dword [esp + 8], edx
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x5c], ecx
mov dword [ebp - 0x60], edx
call fcn.100033e0
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x5c]
add eax, ecx
mov edx, dword [ebp - 0x58]
add edx, 1
cmp edx, 0x331
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x54], edx
jne 0x100029b4
mov eax, dword [ebp - 0x4c]
mov dword [esp], eax
mov dword [esp + 4], eax
mov ecx, dword [ebp - 0x40]
mov dword [esp + 8], ecx
call fcn.10003340
xor eax, eax
mov dword [0x100d2f3c], 0xe79
mov ecx, dword [ebp - 0x4c]
add ecx, 0x606b7
mov edx, dword [ebp - 0x30]
mov dword [edx], ecx
mov dword [edx + 4], 0x12c600
mov ecx, dword [ebp - 0x4c]
add ecx, 0x345ab
mov dword [edx + 8], ecx
mov ecx, dword [0x100d2f3c]
add ecx, 0x745
mov dword [0x100d2f38], ecx
mov dword [edx + 0xc], 0x2010
add esp, 0x64
pop esi
pop edi
pop ebx
pop ebp
ret