joyce8/EMBER2024-capa huggingface dataset:
Function at 0x408c60
Capabilities:
Terminate thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 8
mov eax, dword [ebx + 0x6c]
mov ecx, dword [eax]
push esi
push edi
mov edi, dword [ebx + 0x58]
mov dword [esp + 0xc], ecx
mov dword [esp + 8], edi
jmp 0x408c80
mov esi, dword [ebx + 0x6c]
mov eax, dword [ebx + 0x58]
test edi, edi
je 0x408c8e
cmp edi, eax
je 0x408c93
call fcn.0040ac85
cmp dword [esp + 0xc], esi
je 0x408dbf
test edi, edi
jne 0x408db4
call fcn.0040ac85
xor eax, eax
mov edx, dword [esp + 0xc]
cmp edx, dword [eax + 0x14]
jne 0x408cba
call fcn.0040ac85
mov eax, dword [esp + 0xc]
mov edi, dword [eax + 8]
mov eax, dword [edi + 0x24]
mov dword [edi + 0xc], 1
test eax, eax
je 0x408cd6
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [edi + 8]
lea esi, [edi + 4]
mov dword [esi + 8], 1
test eax, eax
je 0x408d17
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x408d06
mov ecx, dword [esi + 4]
push 0
push ecx
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov edx, dword [esi + 4]
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
mov eax, dword [edi + 0x24]
mov dword [edi + 0xc], 1
test eax, eax
je 0x408d2c
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
mov eax, dword [esi + 4]
mov dword [esi + 8], 1
test eax, eax
je 0x408d6a
push 0x1388
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x408d59
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
mov eax, dword [edi + 0x24]
test eax, eax
je 0x408d78
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov ecx, esi
call fcn.00408eb0
push edi
call fcn.0040a57a
mov eax, dword [esp + 0xc]
add esp, 4
test eax, eax
jne 0x408dbb
call fcn.0040ac85
xor eax, eax
mov esi, dword [esp + 0xc]
cmp esi, dword [eax + 0x14]
jne 0x408da5
call fcn.0040ac85
mov edx, dword [esi]
mov edi, dword [esp + 8]
mov dword [esp + 0xc], edx
jmp 0x408c80
mov eax, dword [edi]
jmp 0x408cac
mov eax, dword [eax]
jmp 0x408d97
mov ecx, dword [ebx + 0x6c]
mov eax, dword [ecx]
mov dword [ecx], ecx
mov ecx, dword [ebx + 0x6c]
mov dword [ecx + 4], ecx
xor ecx, ecx
mov dword [ebx + 0x70], ecx
cmp eax, dword [ebx + 0x6c]
je 0x408df5
mov esi, dword [eax]
push eax
call fcn.0040a57a
add esp, 4
mov eax, esi
cmp esi, dword [ebx + 0x6c]
jne 0x408dd6
mov dword [ebx + 0x50], 0
pop edi
pop esi
mov esp, ebp
pop ebp
ret
pop edi
mov dword [ebx + 0x50], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x408eb0
Capabilities:
Terminate thread

Disassembly:
push 0xffffffffffffffff
push 0x41805b
mov eax, dword fs:[0]
push eax
push ecx
push esi
mov eax, dword [0x41f280]
xor eax, esp
push eax
lea eax, [esp + 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [esp + 8], esi
mov dword [esi], vtable.CThreadHolder.0
mov dword [esp + 0x14], 0
mov eax, dword [esi + 4]
mov dword [esi + 8], 1
test eax, eax
je 0x408f21
push 0xffffffffffffffff
push eax
call dword [sym.imp.KERNEL32.dll_WaitForSingleObject]
cmp eax, 0x102
jne 0x408f10
mov eax, dword [esi + 4]
push 0
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
mov ecx, dword [esi + 4]
push ecx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 4], 0
cmp dword [esi + 0x14], 0
jne 0x408f32
push esi
call fcn.00409000
call fcn.00409080
mov dword [esp + 0x14], 0xffffffff
mov esi, dword [esi + 0x18]
sub esi, 0x10
lea edx, [esi + 0xc]
or eax, 0xffffffff
lock xadd dword [edx], eax
dec eax
test eax, eax
jg 0x408f59
mov ecx, dword [esi]
mov edx, dword [ecx]
mov eax, dword [edx + 4]
push esi
call eax
mov ecx, dword [esp + 0xc]
mov dword fs:[0], ecx
pop ecx
pop esi
add esp, 0x10
ret
Function at 0x40d9dc
Capabilities:
Get file version info

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffe8
push ebx
xor edx, edx
mov dword [ebp - 8], edx
mov ebx, eax
xor eax, eax
push ebp
push 0x40dab2
push dword fs:[eax]
mov dword fs:[eax], esp
mov dword [ebp - 4], 0xffffffff
lea eax, [ebp - 8]
mov edx, ebx
call fcn.00404a58
lea eax, [ebp - 8]
call fcn.00404ed0
lea eax, [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404e80
push eax
call sub.version.dll_GetFileVersionInfoSizeA
mov ebx, eax
test ebx, ebx
je 0x40da9c
mov eax, ebx
call fcn.0040275c
mov dword [ebp - 0x10], eax
xor eax, eax
push ebp
push 0x40da95
push dword fs:[eax]
mov dword fs:[eax], esp
mov eax, dword [ebp - 0x10]
push eax
push ebx
mov eax, dword [ebp - 0xc]
push eax
mov eax, dword [ebp - 8]
call fcn.00404e80
push eax
call sub.version.dll_GetFileVersionInfoA
test eax, eax
je 0x40da7f
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
push eax
push 0x40dac4
mov eax, dword [ebp - 0x10]
push eax
call sub.version.dll_VerQueryValueA
test eax, eax
je 0x40da7f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax + 8]
mov dword [ebp - 4], eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40da9c
mov eax, dword [ebp - 0x10]
call fcn.0040277c
ret
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40dab9
lea eax, [ebp - 8]
call fcn.004049c0
ret

Function at 0x40e088
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor edx, edx
mov dword [ebp - 0xc], edx
xor edx, edx
push ebp
push 0x40e0ec
push dword fs:[edx]
mov dword fs:[edx], esp
push 7
lea edx, [ebp - 7]
push edx
push 0x1004
push eax
call sub.kernel32.dll_GetLocaleInfoA_1
lea eax, [ebp - 0xc]
lea edx, [ebp - 7]
mov ecx, 7
call fcn.00404c30
mov eax, dword [ebp - 0xc]
push eax
call sub.kernel32.dll_GetACP
mov edx, eax
pop eax
call fcn.00409664
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x40e0f3
lea eax, [ebp - 0xc]
call fcn.004049c0
ret

Function at 0x422bcc
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
push edi
mov edi, 0x49e88c
cmp dword [edi], 0
jne 0x422c48
push 0x40
push 0x1000
push 0x1000
push 0
call sub.kernel32.dll_VirtualAlloc_1
mov esi, eax
mov eax, dword [0x49e888]
mov dword [esi], eax
lea edx, [esi + 4]
mov eax, 0x49b5c8
mov ecx, 2
call fcn.004029dc
mov edx, 0x422ba4
lea eax, [esi + 5]
call fcn.00422bc4
mov dword [esi + 6], eax
lea ebx, [esi + 0xa]
mov byte [ebx], 0xe8
lea edx, [esi + 4]
mov eax, ebx
call fcn.00422bc4
mov dword [ebx + 1], eax
mov eax, dword [edi]
mov dword [ebx + 5], eax
mov dword [edi], ebx
add ebx, 0xd
mov eax, ebx
sub eax, esi
cmp eax, 0xffc
jl 0x422c1d
mov dword [0x49e888], esi
mov eax, dword [edi]
mov ebx, dword [edi]
mov edx, dword [ebx + 5]
mov dword [edi], edx
mov edx, dword [ebp + 8]
mov dword [ebx + 5], edx
mov edx, dword [ebp + 0xc]
mov dword [ebx + 9], edx
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x4240f4
Capabilities:
Encode data using xor

Disassembly:
mov ecx, edx
mov edx, eax
xor eax, eax
rol ax, 5
xor al, byte [edx]
inc edx
dec ecx
jne 0x4240fa
ret
Function at 0x426548
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffd4
mov dword [ebp - 8], edx
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push eax
call sub.kernel32.dll_GetSystemInfo
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
dec ecx
js 0x426599
lea eax, [ebp - 0x2c]
cmp word [eax + 0x20], 3
je 0x426580
mov eax, dword [edx + ecx*4]
bswap eax
shr eax, 8
mov dword [edx + ecx*4], eax
dec ecx
jns 0x426570
jmp 0x426599
push ebx
xor ebx, ebx
mov eax, dword [edx + ecx*4]
mov bh, al
mov bl, ah
shr eax, 0x10
shl ebx, 8
mov bl, al
mov dword [edx + ecx*4], ebx
dec ecx
jns 0x426581
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000b95d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1000b9d2
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1000b9c3
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1000b9a3
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jg 0x1000b9c1
mov byte [ebp - 1], 0
push 1
push 1
lea eax, [ebp - 1]
push eax
call fcn.1000a950
add esp, 0xc
jmp 0x1000b998
jmp 0x1000b9d0
push 0
push 0xe9f
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x1000b9fc
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push 0x5c80
push dword [ebp - 0x20]
push 1
call fcn.1000420b
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x1000ba00
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1000ba23
push 0x6e0
push 1
push 0x4158
call fcn.1000ba64
add esp, 0xc
jmp 0x1000ba60
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1000ba4c
push 1
push 0x102
push 0x2453
push 0x526
call dword [sym.imp.USER32.dll_SetDlgItemInt]
jmp 0x1000ba60
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1000ba60
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov esp, ebp
pop ebp
ret
Function at 0x100145e3
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x100145fa
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x1001461c
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x1007d254
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x1007d5e0
jl 0x1001462a
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x1007d884
jl 0x1001466a
mov ecx, dword [0x1007e5d0]
xor ecx, dword [0x1007d254]
and ecx, edi
xor ecx, dword [0x1007e5d0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x1007d250], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x1007d884]
mov dword [0x1007dc10], eax
pop esi
ret

Function at 0x10014db9
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10060962
call fcn.1005fe44
sub esp, 0x10
push ebx
push esi
mov dword [ebp - 0x18], 0x98b
mov eax, ecx
cmp dword [ebp - 0x18], 0xbd9
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], eax
jle 0x10014e2d
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
lea eax, [edi + esi]
xor eax, ecx
mov ecx, 0x1007bfb8
xor eax, ebx
cdq
push edx
push eax
call fcn.1000dd80
mov ecx, dword [ebp - 0x14]
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x6d83
jl 0x10014dec
inc ebx
cmp ebx, 0x22f1
jl 0x10014de7
inc edi
cmp edi, 0x7e72
jl 0x10014de5
inc esi
cmp esi, 0x3691
jl 0x10014de3
mov eax, dword [ebp - 0x1c]
push ecx
push ecx
push dword [ebp + 8]
mov edx, eax
push ecx
push ecx
push 0
call fcn.10015226
and dword [ebp - 4], 0
add esp, 0x18
cmp dword [ebp - 0x18], 0x88f
jge 0x10014e5c
mov edx, str.wumzb_cou_bdjpvhdo
mov ecx, 0x1007bfb8
call fcn.10010bec
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10016d07
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10060b41
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x58
push ebx
push esi
push edi
mov dword [esp + 0x10], 0x18a3
mov ebx, ecx
cmp dword [esp + 0x10], 0x9db
push 0
mov dword [esp + 0x1c], ebx
pop edi
jge 0x10016de3
lea eax, [esp + 0xc]
push eax
push 0x100689d0
call fcn.1004773b
pop ecx
pop ecx
mov dword [esp + 0x20], edi
mov dword [esp + 0x24], edi
call fcn.1001a668
mov dword [esp + 0x20], eax
mov dword [esp + 0x6c], edi
mov esi, edi
mov eax, dword [esp + 0xc]
test eax, eax
jle 0x10016dad
lea eax, [esp + 0x14]
push eax
push 0x100689d0
call fcn.1004773b
movzx eax, byte [0x1007d152]
pop ecx
pop ecx
push eax
lea eax, [esp + 0x18]
push eax
push ecx
lea eax, [esp + 0x34]
push eax
lea ecx, [esp + 0x30]
call fcn.1001a6b7
mov eax, dword [esp + 0xc]
inc esi
cmp esi, eax
jl 0x10016d77
sub eax, dword [esp + 0x24]
inc eax
push eax
push str._ld_n
call fcn.10047a23
or dword [esp + 0x74], 0xffffffff
mov eax, dword [esp + 0x28]
pop ecx
pop ecx
push eax
push dword [eax]
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x2c]
call fcn.1001a297
push dword [esp + 0x20]
call fcn.10047bf9
pop ecx
cmp byte [ebp + 8], 0
je 0x10016ed2
mov dword [esp + 0x10], 0x17b6
cmp dword [esp + 0x10], 0x19e8
jle 0x10016e86
push edi
push 0x1b1
push edi
push edi
push 0x210f
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esi, edi
xor ebx, ebx
mov ecx, ebx
lea eax, [edi + esi]
shl eax, cl
lea ecx, [esp + 0x30]
cdq
push edx
push eax
call fcn.10001a9f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10016e38
mov eax, dword [eax]
push eax
call fcn.10047a23
pop ecx
push 0
push 1
lea ecx, [esp + 0x38]
call fcn.1000e875
inc ebx
cmp ebx, 0xa14
jl 0x10016e1b
inc edi
cmp edi, 0x1768
jl 0x10016e19
inc esi
push 0
pop edi
cmp esi, 0x1930
jl 0x10016e19
push edi
push 0x1259
push edi
push edi
push 0x586
push 0x15b7
call dword [sym.imp.USER32.dll_ToAsciiEx]
mov ebx, dword [esp + 0x18]
cmp dword [esp + 0x10], 0x1557
jge 0x10016e9b
push str.jigaxvk_lpmohvl_eqk_jbv_vacpd_ugkgrqkb_zybklwqnr_uythehtq_bwy_bggkvbmi
call fcn.10047a23
pop ecx
mov eax, dword [ebp + 0x1c]
or dword [esp + 0x6c], 0xffffffff
mov ecx, dword [ebp + 0x14]
push 0xffffffffffffffff
push dword [eax]
lea eax, [esp + 0x50]
push eax
call fcn.100196db
push eax
mov ecx, ebx
mov dword [esp + 0x70], 3
call fcn.1001978e
push edi
push 1
lea ecx, [esp + 0x50]
call fcn.1000ea49
jmp 0x10016ee1
mov eax, dword [ebp + 0x20]
cmp byte [eax], 0
je 0x10016ee1
push edi
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
mov ecx, dword [esp + 0x64]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100185e2
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
je 0x100186af
cmp byte [ebp + 0xc], 0
je 0x10018610
push ecx
push ecx
push dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
call fcn.1001a08b
jmp 0x1001871a
mov dword [esp + 0x1c], 0x5d9e
cmp dword [esp + 0x1c], 0x5f45
push 0
pop ebx
jle 0x10018684
mov edi, ebx
mov esi, ebx
mov eax, ebx
mov dword [esp + 0x18], 0xc89
mov dword [esp + 0x14], eax
xor eax, edi
lea ecx, [esp + 0x20]
cdq
push edx
push eax
call fcn.10001a9f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001864f
mov eax, dword [eax]
push eax
call fcn.10047a23
pop ecx
push ebx
push 1
lea ecx, [esp + 0x28]
call fcn.1000e875
mov eax, dword [esp + 0x14]
add eax, esi
dec dword [esp + 0x18]
mov dword [esp + 0x14], eax
jne 0x10018637
inc esi
cmp esi, 0x5cc7
jl 0x10018629
inc edi
cmp edi, 0x83a
jl 0x10018627
push 0x2292
push ebx
push ebx
push ebx
push ebx
push 0xcf2
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [esp + 0x1c], 0x5d3a
jge 0x1001871a
push str.ndhtd_kjxvozfz_gwtv_zqzz_srjjuftz_iovmps_dhrsnc_njrmxej_khzqew_aoi
call fcn.10047a23
pop ecx
jmp 0x1001871a
cmp byte [ebp + 8], 0
je 0x100186c1
movzx eax, word [edx]
push eax
push ecx
call fcn.10019bdd
jmp 0x1001871a
push 0x799f
push 1
push 0x725d
lea eax, [esp + 0x1e]
mov dword [esp + 0x28], 0x9ac78948
push 0x45e0
xor ebx, ebx
mov edx, 0x5c15
mov byte [esp + 0x22], bl
xor cl, cl
push eax
call fcn.1001579e
add esp, 8
mov byte [esp + 0x1f], bl
lea eax, [esp + 0x1f]
mov edx, 0x2d18
push 0x622
push eax
push 0x4ac0
push ebx
push 0x5e60
call fcn.10015279
add esp, 0x20
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10018efe
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2ac
mov dword [ebp - 0xc], 0x1b95
cmp dword [ebp - 0xc], 0x7a2
push ebx
mov ebx, ecx
jge 0x10018fb7
and dword [ebp - 0x2ac], 0
lea eax, [ebp - 4]
push eax
push 0x100689cc
call fcn.1004773b
mov eax, dword [ebp - 4]
pop ecx
pop ecx
test eax, eax
je 0x10018fb7
push esi
push edi
dec eax
mov dword [ebp - 4], eax
lea eax, [ebp - 8]
push eax
push 0x100689cc
call fcn.1004773b
pop ecx
xor edi, edi
pop ecx
mov ecx, dword [ebp - 8]
inc edi
cmp ecx, edi
jl 0x10018f7a
lea esi, [ebp - 0x2a8]
push esi
push 0x100689cc
call fcn.1004773b
pop ecx
pop ecx
mov ecx, dword [ebp - 8]
inc edi
add esi, 4
cmp edi, ecx
jle 0x10018f62
xor edx, edx
test ecx, ecx
jle 0x10018fa3
mov eax, dword [ebp + ecx*4 - 0x2ac]
sub eax, dword [ebp + ecx*4 - 0x2b0]
sub ecx, 2
dec eax
xor edx, eax
test ecx, ecx
jg 0x10018f80
test edx, edx
je 0x10018fa3
push str.windy_will_win
jmp 0x10018fa8
push str.wqb_will_win
call fcn.10047f7c
mov eax, dword [ebp - 4]
pop ecx
test eax, eax
jne 0x10018f3e
pop edi
pop esi
push 0x495
push 1
push ebx
push 1
mov edx, 0x2dee
lea ecx, [ebp - 0x10]
call fcn.10018878
mov eax, dword [ebp - 0x10]
add esp, 0x10
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100191e3
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10060c6e
call fcn.1005fe44
sub esp, 0x24
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x100192d2
cmp dword [ecx + 0x14], 8
jb 0x1001920a
mov edx, dword [ecx]
jmp 0x1001920c
mov edx, ecx
mov eax, dword [ecx + 0x10]
mov ax, word [edx + eax*2 - 2]
mov edx, dword [ebp + 0xc]
cmp ax, word [edx]
je 0x100192b6
push 0x5a1
push 1
push 1
push 0x4d4e
push 0x5a2e
push 1
push ecx
push 0x232b
mov ecx, 0x69c0
call fcn.100171bd
mov dword [ebp - 0x18], 0x6318
add esp, 0x20
cmp dword [ebp - 0x18], 0x6490
jle 0x1001929a
push 0x13df
call dword [sym.imp.USER32.dll_GetKeyboardType]
xor esi, esi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x14], 0x53ac
mov eax, ebx
mov ecx, 0x1007bfb8
xor eax, esi
cdq
push edx
push eax
call fcn.1000dd80
add ebx, edi
dec dword [ebp - 0x14]
jne 0x10019270
inc edi
cmp edi, 0x62fe
jl 0x10019267
inc esi
cmp esi, 0xd2d
jl 0x10019265
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x613e
jge 0x100192b6
mov edx, str.qupg_pbst_jtohq_reylmf_kyx_hbqdtdhjf
mov ecx, 0x1007bfb8
call fcn.10010bec
jmp 0x100192fb
push 0x21
pop edx
lea ecx, [ebp - 0x30]
call fcn.10012ae8
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
push eax
mov dword [ebp - 4], 2
call fcn.1001a08b
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.1000ea49
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001ac70
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x10], 0
je 0x1001ac82
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
add dword [edx], eax
pop ebp
ret
push 0x2292
xor eax, eax
push eax
push eax
push eax
push eax
push 0xcf2
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebp
ret
Function at 0x1001b0f8
Capabilities:
Extract resource via kernel32 functions
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
push ebx
mov dword [esp + 0x14], 0x180f
cmp dword [esp + 0x14], 0x18e2
push esi
push edi
mov dword [esp + 0x24], edx
jle 0x1001b196
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
xor esi, esi
mov dword [esp + 0x18], esi
mov edi, esi
mov dword [esp + 0x14], 0xc78
mov esi, edi
mov dword [esp + 0x10], 0x12f8
xor ebx, ebx
mov ecx, ebx
mov eax, esi
sar eax, cl
lea ecx, [esp + 0x28]
cdq
push edx
push eax
call fcn.10001a9f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001b15a
mov eax, dword [eax]
push eax
call fcn.10047a23
pop ecx
push 0
push 1
lea ecx, [esp + 0x30]
call fcn.1000e875
inc ebx
cmp ebx, 0x128d
jl 0x1001b13e
dec esi
dec dword [esp + 0x10]
jne 0x1001b13c
dec edi
dec dword [esp + 0x14]
jne 0x1001b132
mov esi, dword [esp + 0x18]
inc esi
mov dword [esp + 0x18], esi
cmp esi, 0x4692
jl 0x1001b128
cmp dword [esp + 0x1c], 0x14ae
jge 0x1001b1ab
push str.lzjq_lqucmu_skypmhe_aca_opwsihjk_keyywur_xvvgntt_khlsvqid_nwukha_mul
call fcn.10047a23
pop ecx
cmp byte [ebp + 0x14], 0
je 0x1001b1d9
mov eax, dword [ebp + 0x10]
lea esi, [esp + 0xf]
mov ecx, dword [ebp + 8]
push esi
mov byte [esp + 0x13], 0
mov edx, dword [eax]
mov eax, dword [ecx]
push edx
push eax
mov dword [ecx + 4], eax
lea eax, [esp + 0x2c]
push eax
call fcn.1001df1c
jmp 0x1001b296
mov dword [esp + 0x10], 0x119b
cmp dword [esp + 0x10], 0x11dc
jle 0x1001b27a
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
xor esi, esi
mov dword [esp + 0x14], esi
xor edi, edi
mov dword [esp + 0x18], edi
mov eax, esi
mov dword [esp + 0x1c], 0x5b3c
cdq
xor ebx, ebx
idiv edi
mov dword [esp + 0x20], edx
xor esi, esi
mov edi, 0x57e
mov eax, esi
lea ecx, [esp + 0x40]
cdq
push edx
push eax
call fcn.10001a9f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001b235
mov eax, dword [eax]
push eax
call fcn.10047a23
pop ecx
push 0
push 1
lea ecx, [esp + 0x48]
call fcn.1000e875
add esi, ebx
dec edi
jne 0x1001b21d
add ebx, dword [esp + 0x20]
dec dword [esp + 0x1c]
jne 0x1001b216
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
inc edi
mov dword [esp + 0x18], edi
cmp edi, 0x1003
jl 0x1001b203
inc esi
mov dword [esp + 0x14], esi
cmp esi, 0x6b6b
jl 0x1001b1fd
mov eax, dword [esp + 0x24]
and dword [eax], 0
cmp dword [esp + 0x10], 0xf50
jge 0x1001b296
push str.jgjte_wng_gkrnvdb_ytrkvqafm_syiwxlnvd_pca
call fcn.10047a23
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001ed00
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x10060e9d
call fcn.1005fe44
sub esp, 0x2dc
push ebx
push esi
mov dword [ebp - 0x1c], 0x9ac78948
xor ebx, ebx
mov dword [ebp - 0x14], 0x4220
mov esi, ecx
cmp dword [ebp - 0x14], 0x42b0
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x60], edx
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x64], ebx
jle 0x1001ed77
mov edi, ebx
mov esi, ebx
mov dword [ebp - 0x1c], ebx
mov ecx, ebx
mov eax, esi
sar eax, cl
mov ecx, 0x1007bfb8
or eax, edi
cdq
push edx
push eax
call fcn.1000dd80
inc ebx
cmp ebx, 0x1795
jl 0x1001ed41
inc esi
push 0
pop ebx
cmp esi, 0x1235
jl 0x1001ed3e
inc edi
cmp edi, 0x722a
jl 0x1001ed3c
mov esi, dword [ebp - 0x38]
mov byte [ebp - 0x15], bl
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x14], 0x4050
jge 0x1001ed95
mov edx, str.xobulnx_vdfxrrzpb_skzns_zhpemlw_sjqxn_hdzerkxo_hozky_qziro_bwatx
mov ecx, 0x1007bfb8
call fcn.10010bec
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x15], 0
je 0x1001eda6
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1001edc0
push 0x240c
push 0xaa1
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
mov edx, dword [ebp - 0x60]
push ecx
mov ecx, esi
call fcn.1002d39f
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret