joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002ae4
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061b63
call fcn.10061518
sub esp, 0x18
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x10002bc3
mov dword [ebp - 0x1c], 0x4c24
cmp dword [ebp - 0x1c], 0x4cd0
jle 0x10002b83
push 0
push 0x1058
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
xor edi, edi
xor esi, esi
mov dword [ebp - 0x18], esi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
and dword [ebp - 0x20], 0
mov eax, esi
cdq
idiv ebx
mov esi, dword [ebp - 0x20]
mov ebx, 0x3f9b
mov dword [ebp - 0x24], edx
mov eax, esi
mov ecx, 0x1007d858
xor eax, edi
cdq
push edx
push eax
call fcn.1000bb8e
add esi, dword [ebp - 0x24]
dec ebx
jne 0x10002b45
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
inc ebx
mov dword [ebp - 0x14], ebx
cmp ebx, 0x7087
jl 0x10002b31
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x610e
jl 0x10002b2c
inc edi
cmp edi, 0x1a9c
jl 0x10002b27
push 0
call dword [sym.imp.USER32.dll_RegisterWindowMessageW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x484c
jge 0x10002ba7
mov edx, str.cdtrbfx_swnxgmq_jqjvjys_qjfr_lifmxfqgu_zsyeyztk_aazm_mfqrwil_keih_razkabs
mov ecx, 0x1007d858
call fcn.1000dfd7
jmp 0x10002bca
mov eax, dword [ebp + 0xc]
mov ecx, dword [edx]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002bdb
Capabilities:
Delete directory

Disassembly:
mov eax, 0x10061b6d
call fcn.10061518
sub esp, 0x1c
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], dl
mov dword [ebp - 0x24], esi
je 0x10002c2f
test dl, dl
je 0x10002c0d
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x10002d96
mov eax, dword [ebp + 8]
xor edx, edx
inc edx
mov dword [eax], edx
cmp dword [eax], 0
jl 0x10002d96
mov ecx, dword [ebp + 0x14]
mov dword [ecx], edx
dec dword [eax]
cmp dword [eax], 0
jge 0x10002c21
jmp 0x10002d96
cmp byte [ebp + 0x18], 0
je 0x10002cd2
mov dword [ebp - 0x18], 0x5170
cmp dword [ebp - 0x18], 0x517e
jle 0x10002c85
xor esi, esi
mov dword [ebp + 0xc], esi
xor edi, edi
mov ebx, 0x4122
xor esi, esi
mov eax, edi
mov ecx, 0x1007d858
or eax, esi
cdq
push edx
push eax
call fcn.1000bb8e
inc esi
cmp esi, 0x7341
jl 0x10002c57
mov esi, dword [ebp + 0xc]
add edi, esi
dec ebx
jne 0x10002c55
inc esi
mov dword [ebp + 0xc], esi
cmp esi, 0xc68
jl 0x10002c4e
mov byte [ebp + 0xf], 0
cmp byte [ebp + 0xf], 0
je 0x10002c97
push 0
call dword [sym.imp.GDI32.dll_DeleteObject]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x5011
jge 0x10002cb3
mov edx, str.kchr_wlxrd_kaar_prlrgk_ibnotdkge_nzxhqn_gpw_bcis_pwh_uhwqpfy_yaescj
mov ecx, 0x1007d858
call fcn.1000dfd7
jmp 0x10002d96
mov dword [ebp + 0xc], 0x2ae5
cmp dword [ebp + 0xc], 0x2cf4
jle 0x10002d49
xor edi, edi
mov dword [ebp - 0x1c], edi
xor esi, esi
mov dword [ebp - 0x18], esi
mov ebx, esi
mov dword [ebp + 0xc], 0x1b05
mov ecx, ebx
mov dword [ebp - 0x20], edi
xor esi, esi
shl edi, cl
mov ecx, esi
mov eax, edi
sar eax, cl
mov ecx, 0x1007d858
cdq
push edx
push eax
call fcn.1000bb8e
inc esi
cmp esi, 0x3018
jl 0x10002cfe
mov edi, dword [ebp - 0x1c]
dec ebx
dec dword [ebp + 0xc]
jne 0x10002cf5
mov esi, dword [ebp - 0x18]
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x2dab
jl 0x10002cec
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x9e4
jl 0x10002ce7
push 0x84a
call dword [sym.imp.KERNEL32.dll_ExitThread]
mov dword [ebp - 4], 2
cmp dword [ebp + 0xc], 0x275e
jge 0x10002d87
mov edx, str.jhywk_jsz_nvd_zvvllqurb_tmv_kxzywcgus_jfiiah_pszcqzg_yeqjvbbp_thylcerc
mov ecx, 0x1007d858
call fcn.1000dfd7
jmp 0x10002d87
mov eax, dword [ebp + 0x10]
mov dword [esi], 0xffffffff
mov dword [eax], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100036c8
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
mov edi, edx
xor edx, edx
cmp byte [ebp + 8], dl
je 0x100036f5
push edx
push edx
push edx
push edx
push edx
push edx
push edx
push 0xfab
push 0x1e40
push 0x1675
push edx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x1000370a
mov esi, dword [ebp + 0xc]
mov dword [esi], edx
jmp 0x10003705
mov ecx, dword [esi]
mov eax, dword [edi]
mov dword [eax + ecx*4], edx
inc dword [esi]
cmp dword [esi], 2
jl 0x100036fc
pop edi
pop esi
pop ebp
ret
Function at 0x10003dad
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061bc1
call fcn.10061518
sub esp, 0x14
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x14], ebx
je 0x10003dfa
mov edx, dword [ebp + 0x2c]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x10003f15
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x4778
inc dword [edx]
cmp dword [edx], 3
jl 0x10003de3
jmp 0x10003f15
mov dword [ebp - 0x1c], 0x157a
cmp dword [ebp - 0x1c], 0x1706
jle 0x10003e48
xor edi, edi
xor esi, esi
mov dword [ebp - 0x18], esi
mov ebx, esi
mov esi, 0x1284
mov eax, ebx
mov ecx, 0x1007d858
xor eax, edi
cdq
push edx
push eax
call fcn.1000bb8e
dec ebx
dec esi
jne 0x10003e18
mov esi, dword [ebp - 0x18]
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x1cd7
jl 0x10003e11
inc edi
cmp edi, 0x5d6
jl 0x10003e0c
mov ebx, dword [ebp - 0x14]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x14f3
jge 0x10003e83
mov edx, str.qcgqgw_lcxg_pbkm_yjzxc_ihwtllq_gkxlcd_mhupe_xstavamgs_bsddubnpv_vmt_gxaw
mov ecx, 0x1007d858
call fcn.1000dfd7
jmp 0x10003e83
mov esi, dword [ebp + 0x14]
mov ecx, dword [ebx]
mov eax, dword [esi]
cmp dword [eax + ecx*4], 0
jne 0x10003eed
mov edx, dword [ebx]
xor ebx, ebx
mov ecx, dword [esi]
mov eax, dword [ecx + 4]
cmp eax, dword [ecx + edx*4]
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x30]
setle bl
sub ebx, 0x39ef5b50
mov dword [eax], ebx
mov eax, dword [eax]
mov ebx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ecx]
xor ecx, ecx
mov eax, dword [ebp + 0x1c]
mov edi, dword [ebx]
mov esi, dword [esi]
mov eax, dword [eax]
cmp eax, 0x30c5
mov eax, dword [ebp - 0x20]
setg cl
xor edx, edx
cmp ecx, dword [esi + edi*4]
mov eax, dword [eax]
setle dl
sub edx, eax
jne 0x10003edf
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov eax, dword [ebp + 0x30]
mov ecx, dword [ebp + 0x20]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ecx]
mov eax, dword [ebx]
mov eax, dword [ebp + 0x24]
xor ecx, ecx
mov eax, dword [eax]
test eax, eax
mov eax, dword [ebp + 0x14]
mov esi, dword [ebx]
setne cl
xor edx, edx
cmp ecx, 0xffffffff
mov eax, dword [eax]
setle dl
xor ecx, ecx
cmp edx, dword [eax + esi*4]
mov eax, dword [ebp + 0x1c]
setle cl
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003f26
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061bcb
call fcn.10061518
sub esp, 0x2c
mov byte [ebp - 0x14], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10003fdb
cmp byte [ecx], 0
je 0x10003f64
push 0x5a1c
push 1
push 0x7d88
xor dl, dl
mov ecx, 0x1095
call fcn.10002da7
add esp, 0xc
mov dword [ebp - 0x18], 0x6d9b
cmp dword [ebp - 0x18], 0x6da7
jle 0x10003fb6
xor esi, esi
xor edi, edi
mov eax, edi
lea ecx, [ebp - 0x34]
xor eax, esi
cdq
push edx
push eax
call fcn.1000260d
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10003f91
mov eax, dword [eax]
push eax
call fcn.1004ae5e
pop ecx
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.1000c17a
inc edi
cmp edi, 0x43ef
jl 0x10003f78
inc esi
cmp esi, 0x472b
jl 0x10003f76
cmp dword [ebp - 0x18], 0x6b80
jge 0x10003fca
push str.yifs_mifbgjj_shpbixf_ixzwhwvv_udqu_lvabqiz_mwvk
call fcn.1004ae5e
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], 0x7b27
cmp dword [ebp - 0x1c], 0x7cd2
jle 0x10004026
xor edi, edi
xor esi, esi
mov dword [ebp - 0x18], esi
mov ebx, esi
mov esi, 0x42e8
mov eax, ebx
mov ecx, 0x1007d858
xor eax, edi
cdq
push edx
push eax
call fcn.1000bb8e
dec ebx
dec esi
jne 0x10003ff9
mov esi, dword [ebp - 0x18]
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x183e
jl 0x10003ff2
inc edi
cmp edi, 0x742a
jl 0x10003fed
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringByteLen]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x7898
jge 0x10003fca
mov edx, str.klqgdn_rwxc_hyzqrmz_vakynsov
mov ecx, 0x1007d858
call fcn.1000dfd7
jmp 0x10003fca
Function at 0x10005685
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061c68
call fcn.10061518
sub esp, 0x20
mov byte [ebp - 0x14], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x1000577b
mov dword [ebp - 0x24], 0x2fe7
cmp dword [ebp - 0x24], 0x325e
jle 0x1000572e
push 0
push 0
push 0x3ca
push 0xe8b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
xor esi, esi
mov dword [ebp - 0x20], esi
xor edi, edi
mov dword [ebp - 0x1c], edi
xor ebx, ebx
mov eax, edi
and dword [ebp - 0x2c], 0
cdq
idiv ebx
mov edi, dword [ebp - 0x2c]
and edx, esi
mov dword [ebp - 0x28], edx
mov esi, edx
mov eax, esi
mov ecx, 0x1007d858
xor eax, edi
cdq
push edx
push eax
call fcn.1000bb8e
inc edi
cmp edi, 0x1da6
jl 0x100056ed
mov esi, dword [ebp - 0x20]
inc ebx
mov edi, dword [ebp - 0x1c]
cmp ebx, 0x6e98
jl 0x100056da
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0xa12
jl 0x100056d8
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x4676
jl 0x100056d3
cmp byte [ebp - 0x14], 0
je 0x1000573b
mov eax, dword [ebp + 0xc]
inc dword [eax]
jmp 0x10005743
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x2e48
jge 0x1000575f
mov edx, str.phdjegmu_emzz_onihhxmy_wrpe_pfozquwlv_ggfoof_pnvukwh_bhysglhjo_cdp_hxkwt_qztrsazw_pdusm_nyl
mov ecx, 0x1007d858
call fcn.1000dfd7
jmp 0x100057ba
cmp byte [ebp + 8], 0
je 0x100057a4
mov byte [ebp - 0x15], 0
cmp byte [ebp - 0x15], 0
je 0x100057ba
push 0xae4
push 0
push 0xeb1
push 0x1a83
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
jmp 0x100057ba
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100066db
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061ca3
call fcn.10061518
sub esp, 0xc
cmp byte [ebp + 0x20], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], dl
mov byte [ebp - 0x18], cl
je 0x1000679e
test dl, dl
je 0x10006719
mov eax, dword [ebp + 0x18]
mov dword [eax], 0xffffffff
mov eax, dword [ebp + 8]
mov dword [eax], 0xffffffff
jmp 0x100067d6
mov dword [ebp + 0x20], 0x3885
cmp dword [ebp + 0x20], 0x38fb
jle 0x1000675f
xor esi, esi
xor edi, edi
xor ebx, ebx
mov ecx, ebx
mov eax, edi
shl eax, cl
mov ecx, 0x1007d858
xor eax, esi
cdq
push edx
push eax
call fcn.1000bb8e
inc ebx
cmp ebx, 0x5615
jl 0x1000672f
inc edi
cmp edi, 0x273a
jl 0x1000672d
inc esi
cmp esi, 0x2292
jl 0x1000672b
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [edx], eax
and dword [ebp - 4], 0
cmp dword [ebp + 0x20], 0x3717
jge 0x10006714
mov edx, str.ghieh_cus_tzrmahk_genebvs_lpi_favskzoip_xzdh_zhgvc_swaldoxu_rtcoqawvw_cvor_smoi_lxzqli_fdj
mov ecx, 0x1007d858
call fcn.1000dfd7
jmp 0x10006714
test cl, cl
je 0x100067c4
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x100067d6
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
or dword [eax + ecx*4], 0xffffffff
inc dword [edx]
cmp dword [edx], 3
jl 0x100067b3
jmp 0x100067d6
mov eax, dword [ebp + 0x1c]
cmp byte [eax], 0
je 0x100067d6
push 0
push 0
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10006e88
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0x14], 0
mov byte [ebp - 4], dl
je 0x10006eb9
cmp byte [ebp + 0x18], 0
je 0x10006eb1
cmp byte [ecx], 0
je 0x10006eee
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetMenu]
jmp 0x10006eee
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x10006eee
test dl, dl
je 0x10006ee4
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10006eee
push esi
mov esi, dword [ebp + 0x1c]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 1
inc dword [edx]
cmp dword [edx], 2
jl 0x10006ecf
pop esi
jmp 0x10006eee
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10010a26
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10062081
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10010b8b
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x10010b7a
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x10010b78
mov dword [ebp - 0x20], 0x142c
mov dword [ebp - 0x38], str.dnubgjm_vuzzjjcyv_zrpwuintl_cjblzwub_zhmt
cmp dword [ebp - 0x20], 0x15b4
jle 0x10010b34
push 0x2117
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
and dword [ebp - 0x14], 0
jmp 0x10010abf
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x8022
jge 0x10010b34
and dword [ebp - 0x18], 0
jmp 0x10010ad5
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x6010
jge 0x10010b32
and dword [ebp - 0x1c], 0
jmp 0x10010aeb
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x94
jge 0x10010b30
mov eax, dword [ebp - 0x14]
xor eax, dword [ebp - 0x18]
or eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
lea ecx, [ebp - 0x58]
call fcn.1000260d
pop ecx
pop ecx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
call fcn.1000bb0c
push eax
call fcn.1004ae5e
pop ecx
lea ecx, [ebp - 0x58]
call fcn.1000bb02
jmp 0x10010ae4
jmp 0x10010ace
jmp 0x10010ab8
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x11ad
jge 0x10010b52
push dword [ebp - 0x38]
call fcn.1004ae5e
pop ecx
jmp 0x10010b6e
or dword [ebp - 4], 0xffffffff
jmp 0x10010b78
jmp 0x10010b89
push 0
push 0x1cf
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x10010ba4
push 0
push 0x5dad
push 0x268c
push 0x5f88
call fcn.1000f12b
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100261b4
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
je 0x100261ec
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1002628f
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
or dword [eax + ecx*4], 0xffffffff
inc dword [edx]
cmp dword [edx], 2
jl 0x100261d8
jmp 0x1002628f
mov dword [ebp - 8], 0x2593
cmp dword [ebp - 8], 0x26fe
jle 0x10026258
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor edi, edi
xor esi, esi
mov dword [ebp - 4], esi
mov ebx, esi
mov esi, 0x5620
mov eax, ebx
lea ecx, [ebp - 0x20]
or eax, edi
cdq
push edx
push eax
call fcn.1000260d
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10026229
mov eax, dword [eax]
push eax
call fcn.1004ae5e
pop ecx
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.1000c17a
dec ebx
dec esi
jne 0x10026210
mov esi, dword [ebp - 4]
inc esi
mov dword [ebp - 4], esi
cmp esi, 0x588d
jl 0x10026209
inc edi
cmp edi, 0x4e71
jl 0x10026204
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x1002627b
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xeb77278f
inc dword [edx]
cmp dword [edx], 1
jl 0x10026269
cmp dword [ebp - 8], 0x2268
jge 0x1002628f
push str.nqvtv_zbifgbdgz_wedqgyhbs_nfv_lixio_smwm
call fcn.1004ae5e
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100262bb
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
mov byte [ebp - 4], cl
mov esi, edx
mov dword [ebp - 0x10], 0x1a20
cmp dword [ebp - 0x10], 0x1b7a
push edi
mov dword [ebp - 0x14], esi
jle 0x10026331
xor ebx, ebx
xor edi, edi
xor esi, esi
mov dword [ebp - 0xc], 0x73f6
mov eax, esi
lea ecx, [ebp - 0x2c]
and eax, ebx
cdq
push edx
push eax
call fcn.1000260d
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10026302
mov eax, dword [eax]
push eax
call fcn.1004ae5e
pop ecx
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.1000c17a
add esi, edi
dec dword [ebp - 0xc]
jne 0x100262e9
inc edi
cmp edi, 0x5f15
jl 0x100262e0
inc ebx
cmp ebx, 0x6400
jl 0x100262de
mov esi, dword [ebp - 0x14]
cmp byte [ebp - 4], 0
je 0x1002634b
mov byte [ebp - 5], 0
cmp byte [ebp - 5], 0
je 0x1002635f
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x1002635f
mov dword [esi], 0
jmp 0x1002635a
cmp dword [esi], 0
jne 0x1002635f
inc dword [esi]
cmp dword [esi], 3
jle 0x10026353
cmp dword [ebp - 0x10], 0x1793
jge 0x10026373
push str.aeviuwj_novwsxun_yicjny_ekya_dydwxz_eqm_utropjgdl_vuun_oljk_lhdojeppb_fjf_qiwmu
call fcn.1004ae5e
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10029dfe
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10062782
call fcn.10061518
sub esp, 0x38
push ebx
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0xece3
push esi
mov dword [ebp - 0x2c], 0x5ef3
cmp dword [ebp - 0x2c], 0x5fd8
push edi
mov dword [ebp - 0x10], esp
jle 0x10029e87
mov esi, ebx
mov dword [ebp - 0x28], ebx
mov edi, ebx
mov eax, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x30], ebx
lea ebx, [eax + edi]
and ebx, esi
mov esi, dword [ebp - 0x30]
mov eax, ebx
mov ecx, 0x1007d858
xor eax, esi
cdq
push edx
push eax
call fcn.1000bb8e
inc esi
cmp esi, 0x7dc7
jl 0x10029e44
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x18], eax
push 0
pop ebx
cmp eax, 0x26f0
jl 0x10029e39
inc edi
cmp edi, 0x7e9c
jl 0x10029e34
inc esi
mov dword [ebp - 0x28], esi
cmp esi, 0x1cc3
jl 0x10029e32
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x2c], 0x5d0e
jge 0x10029ea2
mov edx, str.plf_aco_hgyej_itzwmavvy_sytpxhspg
mov ecx, 0x1007d858
call fcn.1000dfd7
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x30], 0xfffffff7
mov dword [ebp - 0x18], ebx
jmp 0x10029ee2
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x40], 0x4d1454bc
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10029ed4
xor esi, esi
mov dword [ebp - 0x18], ebx
inc esi
jmp 0x10029efa
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x24], esi
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x10029ef0
cmp dword [ebp - 0x1c], ebx
jne 0x10029f49
cmp dword [ebp - 0x38], ebx
jne 0x10029f0c
mov dword [ebp - 0x34], esi
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov edx, 0xfffe
cmp eax, edx
setg cl
mov dword [ebp - 0x24], ecx
mov eax, dword [ebp - 0x1c]
inc dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
sub ecx, edx
neg ecx
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [ebp - 0x20]
setg dl
xor ecx, ecx
cmp eax, edx
mov eax, ebx
setg cl
cmp ecx, dword [ebp - 0x1c]
jle 0x10029f4b
mov eax, esi
cmp eax, dword [ebp - 0x1c]
jne 0x10029f55
cmp dword [ebp - 0x20], ebx
jne 0x10029f5c
mov edx, esi
cmp dword [ebp - 0x24], ebx
jne 0x10029f5e
mov edx, ebx
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
cmp edx, eax
setle cl
xor eax, eax
cmp ecx, 4
setl al
sub eax, dword [ebp - 0x1c]
jne 0x10029f7c
cmp dword [ebp - 0x20], ebx
jne 0x10029f7c
mov esi, ebx
mov dword [ebp - 0x30], esi
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10029f91
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
push 0x8bad
push 0x1013d
call fcn.10022317
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10031951
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100629b0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100319cf
lea eax, [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x100319b1
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x100319af
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x100319ca
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x100319ca
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
jmp 0x10031b1e
lea eax, [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x100319fb
push 0xae4
push 0
push 0xeb1
push 0x1a83
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
jmp 0x10031b1e
mov dword [ebp - 0x28], 0x1860
mov dword [ebp - 0x40], str.zgli_ruchydfw_xjd_etyvdfiv_opb
cmp dword [ebp - 0x28], 0x1960
jle 0x10031aad
and dword [ebp - 0x20], 0
jmp 0x10031a23
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x908
jge 0x10031a99
and dword [ebp - 0x18], 0
jmp 0x10031a39
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x50a0
jge 0x10031a97
and dword [ebp - 0x1c], 0
jmp 0x10031a4f
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x68b0
jge 0x10031a95
and dword [ebp - 0x24], 0
jmp 0x10031a65
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x1c69
jge 0x10031a93
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1c]
or eax, dword [ebp - 0x20]
or eax, dword [ebp - 0x24]
cdq
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
push dword [ebp - 0x44]
push dword [ebp - 0x48]
mov ecx, 0x1007d858
call fcn.1000bb8e
jmp 0x10031a5e
jmp 0x10031a48
jmp 0x10031a32
jmp 0x10031a1c
push 0x1a21
push 0
push 0
push 0x262a
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov byte [ebp - 0x12], 0
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x1579
jge 0x10031acb
mov edx, dword [ebp - 0x40]
mov ecx, 0x1007d858
call fcn.1000dfd7
jmp 0x10031ae7
or dword [ebp - 4], 0xffffffff
jmp 0x10031af1
movzx eax, byte [ebp - 0x12]
test eax, eax
je 0x10031b1e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0x2036
push 0x260d
push 0x8bd
push 0xa74
push 0
call dword [sym.imp.USER32.dll_TrackPopupMenu]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret