joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100171d4
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov byte [ebp - 8], dl
push esi
test dl, dl
je 0x10017238
mov esi, dword [ebp + 0x10]
mov dword [esi], 0
jmp 0x10017231
push 0x15ce
push 0x746a
push 0x126c
push 0x4ce3
push 0x4786
push 0x18d2
push 0
push 0x6889
lea eax, [ebp - 1]
mov byte [ebp - 1], 0
push eax
push 1
push 0xb29
mov dl, 1
mov ecx, 0x4fd8
call fcn.10018c6a
add esp, 0x2c
dec dword [esi]
cmp dword [esi], 0xffffffe5
jl 0x100171ec
jmp 0x10017247
push 0
push 0x119b
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10017287
Capabilities:
Get file system object information

Disassembly:
mov eax, 0x1005b379
call fcn.1005a5c0
sub esp, 0x30
cmp byte [ebp + 0x1c], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, edx
mov byte [ebp - 0x18], cl
je 0x100173e1
xor esi, esi
cmp byte [ebp + 8], 0
je 0x100172cd
push 0x1dd5
push 0x1350
push esi
push 0x587
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x10017406
cmp dword [ebx], esi
je 0x10017359
movdqa xmm0, xmmword [str._b_b_b_b]
lea eax, [ebp - 0x28]
mov dword [ebp + 0x1c], 0x6595ad33
lea ecx, [ebp - 0x28]
push dword [ebp + 0x1c]
movdqu xmmword [ebp - 0x38], xmm0
push eax
lea eax, [ebp - 0x38]
mov dword [ebp - 0x28], esi
push eax
push esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], esi
call fcn.10014747
cmp dword [ebx], esi
je 0x10017320
mov eax, dword [ebp + 0x10]
xor edi, edi
inc edi
mov ecx, dword [eax]
mov eax, edi
sub eax, ecx
je 0x10017320
mov eax, dword [ebp - 0x28]
cmp dword [eax + 4], esi
jne 0x10017322
mov edi, esi
mov ecx, dword [ebp + 0x18]
xor edx, edx
mov dword [ebp + 0x1c], esi
mov eax, dword [ebp + 0x1c]
push 0xfffffffffffffff8
mov dword [ecx], eax
mov eax, dword [ebx]
sub edi, eax
mov eax, dword [ecx]
pop ecx
sub ecx, eax
mov eax, dword [ebp - 0x28]
cmp ecx, edi
setge dl
xor ecx, ecx
cmp edx, dword [eax + 8]
mov eax, dword [ebp + 0x14]
setg cl
mov dword [eax], ecx
lea ecx, [ebp - 0x28]
call fcn.1000f3c0
jmp 0x1001736d
mov dword [ebp + 0x1c], 0xdae89405
mov dword [ebp - 0x1c], 0xffffffff
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov dword [ebp + 0x1c], 0x5b52
cmp dword [ebp + 0x1c], 0x5e65
jle 0x100173a3
mov edi, esi
mov ebx, esi
mov esi, 0x2c9e
mov eax, ebx
mov ecx, 0x10077318
cdq
push edx
push eax
call fcn.1000f05b
add ebx, edi
dec esi
jne 0x10017386
inc edi
cmp edi, 0x4e2c
jl 0x1001737f
mov dword [ebp - 4], esi
cmp dword [ebp + 0x1c], 0x5a9a
jge 0x100172c8
mov edx, str.xdrqwwynp_ybt_aimhwejo_fkrbsxygc_wccgragy
mov ecx, 0x10077318
call fcn.10013928
jmp 0x100172c8
test cl, cl
je 0x100173f2
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [eax], 0xad6
jmp 0x10017406
push 0
push 0x1420
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10018581
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1005b408
call fcn.1005a5c0
sub esp, 0x24
cmp byte [ebp + 0x18], 0
mov eax, edx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x18], eax
je 0x100186b2
mov dword [ebp + 0x18], 0x3147
cmp dword [ebp + 0x18], 0x3276
jle 0x100185f4
xor esi, esi
xor ebx, ebx
mov ecx, ebx
mov eax, esi
shl eax, cl
mov ecx, 0x10077318
cdq
push edx
push eax
call fcn.1000f05b
inc ebx
cmp ebx, 0x5b4e
jl 0x100185b9
inc esi
cmp esi, 0x2228
jl 0x100185b7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
cmp byte [ebp + 0x14], 0
je 0x10018668
mov dword [ebp - 0x18], 0x17f5
cmp dword [ebp - 0x18], 0x71b
jge 0x10018659
lea eax, [ebp - 0x14]
push eax
push 0x100639fc
call fcn.10043a7b
cmp dword [ebp - 0x14], 2
pop ecx
pop ecx
jne 0x1001862d
push 0x10065260
call fcn.10043f86
pop ecx
jmp 0x10018659
push str.6_n10_n15_n
call fcn.10043d63
pop ecx
push 3
pop esi
cmp dword [ebp - 0x14], esi
jle 0x10018659
push 0x12
pop edi
push edi
push str._ld_n
call fcn.10043d63
inc esi
add edi, 6
pop ecx
pop ecx
cmp esi, dword [ebp - 0x14]
jl 0x10018643
push 0xd5d
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x10018677
mov eax, dword [edi]
mov eax, dword [edi]
mov eax, dword [edi]
mov eax, dword [edi]
mov eax, dword [ebp + 0xc]
mov edx, dword [edi]
mov dword [eax], edx
and dword [ebp - 4], 0
cmp dword [ebp + 0x18], 0x3076
jge 0x10018693
mov edx, str.ppptxyczj_fcsfdp_nygluy_qbk_mpf_xrazrcbe_xfrbpf_pvte_cilek_nyfop_vkwytknu_saxjblov_jgipusgkh
mov ecx, 0x10077318
call fcn.10013928
jmp 0x10018772
cmp byte [ebp + 8], 0
je 0x100186d7
mov byte [ebp + 0x1b], 0
cmp byte [ebp + 0x1b], 0
je 0x10018772
xor dl, dl
mov ecx, 0x79b7
call fcn.1001acc0
jmp 0x10018772
mov dword [ebp + 0x18], 0x7529
cmp dword [ebp + 0x18], 0x7660
jle 0x1001873e
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, edi
cdq
idiv ebx
mov eax, esi
mov ecx, edx
sar eax, cl
lea ecx, [ebp - 0x30]
cdq
push edx
push eax
call fcn.10001aa4
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001870d
mov eax, dword [eax]
push eax
call fcn.10043d63
pop ecx
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.1000fb16
inc ebx
cmp ebx, 0x5585
jl 0x100186ed
inc edi
cmp edi, 0xdfc
jl 0x100186eb
inc esi
cmp esi, 0x5e4d
jl 0x100186e9
mov eax, dword [ebp - 0x18]
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
jmp 0x10018759
mov ecx, dword [edx]
mov eax, dword [eax]
mov dword [eax + ecx*4], 1
inc dword [edx]
mov eax, dword [ebp - 0x18]
cmp dword [edx], 2
jl 0x10018749
cmp dword [ebp + 0x18], 0x7170
jge 0x10018772
push str.tcpkmpkuy_gvyp_mhujkvmx_hcrebewyy_szeh_psbkr_ghxe_gsn_chtgfcqw_xezepgsb
call fcn.10043d63
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100190f8
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005b430
call fcn.1005a5c0
sub esp, 0x34
mov dword [ebp - 0x28], edx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x10019177
xor esi, esi
inc esi
cmp byte [ebp + 0x1c], 0
je 0x1001914d
push 0xac4
push esi
push 0x5301
push 0x4bcb
push 0
lea eax, [ebp - 0x11]
mov byte [ebp - 0x11], 0
push eax
push esi
mov edx, 0x6c33
mov ecx, 0x2630
call fcn.1001935b
add esp, 0x1c
jmp 0x100192fd
mov edx, dword [ebp + 0x20]
mov dword [edx], 0
cmp dword [edx], esi
jge 0x100192fd
mov edi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [edi]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [edx]
cmp dword [edx], esi
jl 0x10019161
jmp 0x100192fd
cmp byte [ebp + 8], 0
je 0x100192e1
mov dword [ebp - 0x24], 0x424e
cmp dword [ebp - 0x24], 0x43b2
jle 0x100191fa
xor edi, edi
xor esi, esi
mov dword [ebp - 0x20], esi
mov ebx, esi
mov dword [ebp - 0x1c], 0x1bcd
mov dword [ebp - 0x18], ebx
mov esi, ebx
mov ebx, 0x4313
mov eax, esi
mov ecx, 0x10077318
xor eax, edi
cdq
push edx
push eax
call fcn.1000f05b
dec esi
dec ebx
jne 0x100191ab
mov ebx, dword [ebp - 0x18]
dec ebx
dec dword [ebp - 0x1c]
mov dword [ebp - 0x18], ebx
jne 0x100191a4
mov esi, dword [ebp - 0x20]
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x7faf
jl 0x10019198
inc edi
cmp edi, 0x68b0
jl 0x10019193
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x41cc
jge 0x10019216
mov edx, str.swkpdeia_mzdywu_okqt_cbpguwx_rmlmd_abvsmek_uguti
mov ecx, 0x10077318
call fcn.10013928
or dword [ebp - 4], 0xffffffff
xor esi, esi
mov dword [ebp - 0x24], 0x7b5b
cmp dword [ebp - 0x24], 0x7d05
jle 0x10019298
xor edi, edi
inc esi
xor ebx, ebx
mov ecx, ebx
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0x40]
cdq
push edx
push eax
call fcn.10001aa4
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001924c
mov eax, dword [eax]
push eax
call fcn.10043d63
pop ecx
push 0
push esi
lea ecx, [ebp - 0x40]
call fcn.1000fb16
inc ebx
cmp ebx, 0x26a5
jl 0x10019231
inc edi
cmp edi, 0x1a4e
jl 0x1001922f
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
jmp 0x10019299
inc esi
cmp dword [ebp - 0x24], 0x78f7
jge 0x100192ad
push str.oxfxhh_jua_pydcxxqs_uuupl_wjpfvsp_mltsohklo_wan_klsa_yoi_zxfb_tqwcp_ihu
call fcn.10043d63
pop ecx
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov eax, dword [eax]
mov eax, dword [ebp + 0x18]
mov dword [eax], 0xffffffff
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
test eax, eax
mov eax, dword [ebp + 0x24]
setne cl
sub esi, ecx
xor ecx, ecx
imul esi, dword [eax]
mov eax, dword [ebp + 0xc]
cmp esi, 0xb0d6
setge cl
mov dword [eax], ecx
jmp 0x100192fd
mov eax, dword [ebp + 0x28]
cmp byte [eax], 0
je 0x100192fd
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001935b
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1005b442
call fcn.1005a5c0
sub esp, 0x24
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
je 0x1001940f
cmp byte [ebp + 8], 0
je 0x10019405
xor esi, esi
mov dword [ebp + 0x10], 0xdcec3d7d
inc esi
mov dword [ebp - 0x18], 0xfffffffc
push esi
lea ecx, [ebp - 0x2c]
call fcn.1000f33d
xor edi, edi
lea eax, [ebp - 0x20]
push edi
push 0x517d
push 0x3495
push esi
push esi
push eax
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], edi
push eax
push 0xffc
mov edx, 0x398d
mov ecx, 0x6eca
call fcn.10019bd8
add esp, 0x20
lea edx, [ebp - 0x2c]
cmp dword [ebp + 0x10], edi
je 0x100193f6
push ecx
lea eax, [ebp + 0x10]
mov dword [ebp - 0x1c], 0x37a3a11c
push eax
lea eax, [ebp - 0x18]
push eax
push esi
lea ecx, [ebp - 0x1c]
call fcn.1001632e
add esp, 0x10
jmp 0x100193fb
call fcn.100196fd
lea ecx, [ebp - 0x2c]
call fcn.1000f3c0
jmp 0x1001946e
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
jmp 0x1001946e
cmp byte [ebp + 0x1c], 0
je 0x1001942c
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1001946e
push 0x1fb6
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x1001946e
mov ebx, dword [ebp + 0x14]
xor edi, edi
xor esi, esi
inc esi
mov dword [ebx], edi
jmp 0x1001946a
inc dword [ecx]
mov dword [edx], esi
cmp dword [edx], edi
jl 0x10019468
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
mov edx, dword [ebp + 0x18]
push esi
push ecx
push dword [ebp + 0x20]
call fcn.100166c8
add esp, 0xc
dec dword [ebx]
cmp dword [ebx], edi
jge 0x10019446
mov ebx, dword [ebp + 0x14]
xor esi, esi
mov edx, dword [ebp - 0x10]
inc esi
mov ecx, dword [ebp - 0x14]
inc dword [ebx]
cmp dword [ebx], esi
jle 0x10019438
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001a6e5
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005b4a0
call fcn.1005a5c0
sub esp, 0x14
push ebx
push esi
mov dword [ebp - 0x18], 0x4d3
mov ebx, ecx
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
cmp dword [ebp - 0x18], 0x819
mov dword [ebp - 0x1c], ebx
jle 0x1001a757
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x14], 0x21f
mov dword [ebp - 0x20], esi
mov eax, ebx
mov ecx, 0x10077318
xor eax, esi
cdq
push edx
push eax
call fcn.1000f05b
inc esi
cmp esi, 0x3e61
jl 0x1001a727
add ebx, edi
dec dword [ebp - 0x14]
push 0
pop esi
jne 0x1001a724
inc edi
cmp edi, 0xdd3
jl 0x1001a71b
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x18], 0x174
jge 0x1001a793
mov edx, str.ivosgloo_ezvpok_udb_oqvofvdp
mov ecx, 0x10077318
call fcn.10013928
jmp 0x1001a793
cmp byte [ebp + 0x20], 0
je 0x1001a7e1
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x28]
mov ecx, dword [eax]
mov eax, dword [edx]
cmp dword [eax + ecx*4], esi
jne 0x1001a7af
mov ecx, dword [ebp + 0x1c]
mov eax, dword [ecx]
dec dword [ecx]
mov eax, dword [edx]
mov edi, dword [ebp + 8]
cmp dword [eax + 4], esi
jne 0x1001a7d0
mov eax, dword [ebp + 0x30]
xor edx, edx
mov ecx, dword [edi]
mov eax, dword [eax]
cmp eax, ecx
mov eax, dword [ebp + 0x2c]
setle dl
cmp edx, dword [eax]
jne 0x1001a7d0
mov eax, dword [edi]
mov eax, dword [ebx]
mov eax, dword [edi]
mov ecx, dword [ebp + 0x14]
mov eax, dword [edi]
mov eax, dword [ecx]
mov dword [ecx], esi
mov dword [edi], esi
jmp 0x1001a800
mov edx, dword [ebp + 0x24]
mov dword [edx], esi
cmp dword [edx], 2
jge 0x1001a800
mov esi, dword [ebp + 0x38]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 1
inc dword [edx]
cmp dword [edx], 2
jl 0x1001a7ee
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001a848
Capabilities:
Identify system language via api
Read .ini file

Disassembly:
mov eax, 0x1005b4aa
call fcn.1005a5c0
sub esp, 0x18
push ebx
push esi
mov dword [ebp - 0x1c], 0x365c
mov al, cl
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
cmp dword [ebp - 0x1c], 0x3a3a
mov dword [ebp - 0x20], edx
mov byte [ebp - 0x11], al
jle 0x1001a8a5
mov ebx, esi
mov dword [ebp - 0x18], esi
mov ecx, esi
mov eax, ebx
shl eax, cl
mov ecx, 0x10077318
cdq
push edx
push eax
call fcn.1000f05b
inc esi
cmp esi, 0x2ae1
jl 0x1001a87a
inc ebx
push 0
pop esi
cmp ebx, 0x1fd3
jl 0x1001a877
mov al, byte [ebp - 0x11]
test al, al
je 0x1001a96a
mov dword [ebp - 0x18], 0x2de6
cmp dword [ebp - 0x18], 0x2e0e
jle 0x1001a8f0
mov ebx, esi
mov dword [ebp - 0x20], esi
mov ecx, esi
mov eax, ebx
shl eax, cl
mov ecx, 0x10077318
cdq
push edx
push eax
call fcn.1000f05b
inc esi
cmp esi, 0x6da
jl 0x1001a8c2
inc ebx
push 0
pop esi
cmp ebx, 0xf29
jl 0x1001a8bf
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x18], 0x2c40
jge 0x1001a929
mov edx, str.jfx_ynia_rsdavgwdz_fbt_vfxb_nczzwbxyr_ukvzg
mov ecx, 0x10077318
call fcn.10013928
jmp 0x1001a929
cmp byte [ebp + 0x10], 0
je 0x1001a950
mov edx, dword [ebp + 0x2c]
mov dword [edx], esi
cmp dword [edx], 3
jge 0x1001a9a3
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 1
inc dword [edx]
cmp dword [edx], 3
jl 0x1001a93c
jmp 0x1001a9a3
mov eax, dword [ebp + 0x24]
cmp byte [eax], 0
je 0x1001a9a3
push esi
push 0x1703
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x1001a9a3
cmp byte [ebp + 0x18], 0
je 0x1001a977
mov eax, dword [ebp + 0x1c]
dec dword [eax]
jmp 0x1001a9a3
mov eax, dword [ebp + 8]
xor ebx, ebx
mov dword [eax], 0xf3de0369
mov eax, dword [ebp + 0x28]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x20]
mov eax, dword [eax]
cmp dword [eax + ecx*4], esi
mov eax, dword [ebp + 0xc]
sete bl
xor edx, edx
mov eax, dword [eax]
cmp ebx, eax
mov eax, dword [ebp - 0x20]
setne dl
mov dword [eax], edx
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x35b1
jge 0x1001a9c2
mov edx, str.ftzszhylx_erapya_moungf_hwvr_uxx_wvrbo_lagvd_gmpguolx_qoktbaxhk_jkdpmu_mdcutza
mov ecx, 0x10077318
call fcn.10013928
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001a9ed
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
mov byte [ebp - 0xc], cl
push ebx
push esi
push edi
test cl, cl
je 0x1001aacb
mov dword [ebp - 0x20], 0x195d
cmp dword [ebp - 0x20], 0x1cc3
push 0
pop ebx
jle 0x1001aa9d
push 0x2621
push ebx
push ebx
push 0x13f4
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov dword [ebp - 0x1c], ebx
mov edi, ebx
mov dword [ebp - 0x18], 0x57f0
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x10], 0x7ede
mov esi, ebx
mov ecx, esi
mov eax, edi
shl eax, cl
lea ecx, [ebp - 0x3c]
cdq
push edx
push eax
call fcn.10001aa4
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001aa60
mov eax, dword [eax]
push eax
call fcn.10043d63
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.1000fb16
inc esi
cmp esi, 0x2663
jl 0x1001aa45
inc edi
dec dword [ebp - 0x10]
jne 0x1001aa43
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x1c]
add edi, esi
dec dword [ebp - 0x18]
mov dword [ebp - 0x14], edi
jne 0x1001aa39
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x4111
jl 0x1001aa2d
mov byte [ebp - 5], bl
cmp byte [ebp - 5], 0
je 0x1001aab5
push 1
mov edx, 0x7f1b
xor cl, cl
call fcn.1001a9ed
pop ecx
cmp dword [ebp - 0x20], 0x177c
jge 0x1001aadf
push str.urievtnv_rkme_dqfq_bxuh_dhfedhukp_rnd_xbw_gtlwe_jvx_lgstntp_jqbxum_zmjicnzl_cdhcnsx_pkjkgiknq
call fcn.10043d63
pop ecx
jmp 0x1001aadf
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x1f13
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001ab12
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
cmp byte [ebp + 0x20], 0
push ebx
push esi
push edi
mov dword [esp + 0x14], edx
mov byte [esp + 0xc], cl
je 0x1001ac11
mov dword [esp + 0x14], 0x4d6d
cmp dword [esp + 0x14], 0x4ebf
jle 0x1001abb7
push 0x1b69
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor edi, edi
xor esi, esi
mov dword [esp + 0x10], esi
mov ebx, esi
mov esi, 0x2379
mov eax, ebx
lea ecx, [esp + 0x18]
and eax, edi
cdq
push edx
push eax
call fcn.10001aa4
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001ab85
mov eax, dword [eax]
push eax
call fcn.10043d63
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.1000fb16
dec ebx
dec esi
jne 0x1001ab6b
mov esi, dword [esp + 0x10]
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0x144b
jl 0x1001ab64
inc edi
cmp edi, 0xaaa
jl 0x1001ab5e
cmp dword [esp + 0x14], 0x4bb3
jge 0x1001abcc
push str.lgocmfa_hamvninc_srgnesf_omatoi_uipqwkeo_ehul_svtyhdd_gvzbphnul_vweiaq_xeyugf_xvmpdxi_rhxjpdms_vjrvk
call fcn.10043d63
pop ecx
cmp byte [ebp + 0x18], 0
je 0x1001abf4
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1001ac63
push 1
push 0x6914
push ecx
xor dl, dl
mov cl, 1
call fcn.10016aca
add esp, 0xc
jmp 0x1001ac63
mov edx, dword [ebp + 0x10]
mov ecx, dword [edx]
lea eax, [ecx + 2]
mov dword [edx], eax
call fcn.100157a3
mov ecx, dword [ebp + 0x24]
movzx eax, ax
push eax
call fcn.1000f1f8
jmp 0x1001ac63
test cl, cl
je 0x1001ac20
mov eax, dword [ebp + 8]
mov dword [eax], 0xffffffff
jmp 0x1001ac63
mov edi, dword [ebp + 0x1c]
xor ecx, ecx
mov esi, dword [ebp + 0x14]
mov eax, dword [edi]
cmp eax, 1
mov eax, dword [edi]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esi]
setl dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esi]
setl cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [esi]
setle bl
xor edx, edx
cmp ebx, eax
mov eax, dword [esp + 0x14]
setne dl
xor ecx, ecx
mov eax, dword [eax]
cmp edx, dword [eax]
setg cl
mov dword [edi], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100207ef
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
xor eax, eax
test dl, dl
je 0x10020814
push 0x1dd5
push 0x1350
push eax
push 0x587
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x1002081e
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
mov esp, ebp
pop ebp
ret

Function at 0x10020be1
Capabilities:
Start service

Disassembly:
mov eax, 0x1005b7b6
call fcn.1005a5c0
sub esp, 0x28
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ebx
mov esi, ecx
je 0x10020c3e
cmp byte [ebp + 0xc], 0
je 0x10020c31
push 0x21
pop edx
lea ecx, [ebp - 0x30]
call fcn.1003b761
and dword [ebp - 4], 0
push ecx
push ecx
push eax
mov ecx, esi
call fcn.1002500c
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.1000fe44
jmp 0x10020cfd
push 0
call dword [sym.imp.ADVAPI32.dll_CloseServiceHandle]
jmp 0x10020cfd
mov dword [ebp + 0x14], 0x21dd
cmp dword [ebp + 0x14], 0x24d1
jle 0x10020c8b
xor esi, esi
xor edi, edi
xor ebx, ebx
mov ecx, ebx
lea eax, [edi + esi]
sar eax, cl
mov ecx, 0x10077318
cdq
push edx
push eax
call fcn.1000f05b
inc ebx
cmp ebx, 0x559
jl 0x10020c54
inc edi
cmp edi, 0x314e
jl 0x10020c52
inc esi
cmp esi, 0x2205
jl 0x10020c50
call fcn.1003b3a3
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 4], 1
cmp dword [ebp + 0x14], 0x2119
jge 0x10020cc9
mov edx, str.yjkcflp_jclhybp_rme_kvwoymzw_vsaialt_mmu_iebgtwqf
mov ecx, 0x10077318
call fcn.10013928
jmp 0x10020cc9
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x10], 0
je 0x10020ce6
cmp byte [ebx], 0
je 0x10020cfd
mov edx, 0x52c1
xor cl, cl
call fcn.10020a37
jmp 0x10020cfd
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10020cfd
push 0
push 0x119b
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10020f63
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x1005b832
call fcn.1005a5c0
sub esp, 0x30
mov byte [ebp - 0x18], dl
mov eax, ecx
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10020fc2
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
push 0xffffffffffffffff
push dword [eax]
lea eax, [ebp - 0x38]
push eax
call fcn.100244ab
mov ecx, dword [ebp + 0xc]
push eax
mov dword [ebp - 4], 2
call fcn.1002462c
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.1000fe44
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], 0x3302
cmp dword [ebp - 0x1c], 0x3433
jle 0x1002100e
xor esi, esi
xor edi, edi
xor ebx, ebx
lea eax, [ebx + edi]
mov ecx, 0x10077318
or eax, esi
cdq
push edx
push eax
call fcn.1000f05b
inc ebx
cmp ebx, 0x2d9f
jl 0x10020fd8
inc edi
cmp edi, 0x27ad
jl 0x10020fd6
inc esi
cmp esi, 0x27f8
jl 0x10020fd4
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
mov eax, dword [ebp - 0x20]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.100243a1
mov edx, dword [ebp + 0x24]
mov dword [ebp - 4], 3
cmp dword [ebp - 0x1c], 0x2f9e
mov dword [edx], eax
jge 0x10020fb1
mov edx, str.wfu_xdvdnnu_dzzeztw_wql_bnnuqcta_mybqkkl_nwbxq_gcjsdjbro_mwuj_sawn
mov ecx, 0x10077318
call fcn.10013928
jmp 0x10020fb1