joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100363fe
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10062834
call fcn.10060e94
sub esp, 0xc
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x100364cd
mov dword [ebp - 0x18], 0x1b8f
cmp dword [ebp - 0x18], 0x1e83
jle 0x10036472
xor esi, esi
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
xor eax, ebx
mov ecx, 0x1007cfd8
xor eax, edi
or eax, esi
cdq
push edx
push eax
call fcn.1000703f
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x7b67
jl 0x10036436
inc ebx
cmp ebx, 0x3d41
jl 0x10036431
inc edi
cmp edi, 0x5b2f
jl 0x1003642f
inc esi
cmp esi, 0x4e2c
jl 0x1003642d
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x10036495
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 4
inc dword [edx]
cmp dword [edx], 1
jl 0x10036483
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x1aad
jge 0x100364b1
mov edx, str.mhspksrww_pbeysu_cwdzwhid_dwoxwtqdw_hqiddnbj_uficmppub_krq_qbyhru_gxbqza_polhfg_kmuehaqcd_qnapzqe_uubbeaay
mov ecx, 0x1007cfd8
call fcn.1000b30d
jmp 0x100364ea
mov eax, dword [ebp + 0x10]
mov dword [eax], 0xfffffffa
cmp dword [eax], 0xfffffff8
jl 0x100364ea
mov ecx, dword [ebp + 0x14]
cmp dword [ecx], 0
jne 0x100364ea
dec dword [eax]
cmp dword [eax], 0xfffffff8
jge 0x100364de
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100366aa
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
mov esi, ecx
push edi
test dl, dl
je 0x10036709
cmp byte [ebp + 0x10], 0
je 0x100366dd
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x100367c9
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
jmp 0x100367c9
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 4
jge 0x100367c9
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x88cdf8ab
inc dword [edx]
cmp dword [edx], 4
jl 0x100366f2
jmp 0x100367c9
cmp byte [ebp + 0x14], 0
je 0x10036738
mov dword [esi], 0
cmp dword [esi], 2
jge 0x100367c9
mov edx, dword [ebp + 0x18]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0x3f08700d
inc dword [esi]
cmp dword [esi], 2
jl 0x10036721
jmp 0x100367c9
mov byte [esp + 0x13], 0
mov dword [esp + 0x14], 0x77a8
cmp dword [esp + 0x14], 0x7915
jle 0x100367a0
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
lea ecx, [esp + 0x18]
or eax, edi
or eax, esi
cdq
push edx
push eax
call fcn.10001301
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10036771
mov eax, dword [eax]
push eax
call fcn.10048570
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.1000162e
inc ebx
cmp ebx, 0x3c59
jl 0x10036755
inc edi
cmp edi, 0x7a9
jl 0x10036753
inc esi
cmp esi, 0x65d1
jl 0x10036751
cmp byte [esp + 0x13], 0
je 0x100367b4
push 0
push 0x54d
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
cmp dword [esp + 0x14], 0x74fb
jge 0x100367c9
push str.kjnw_ynykqvf_wlapav_cxjz_jnqpgoon_prjntpx_yekgh_oirjusv_gzljoshta_fdllhfcul_umayeq
call fcn.10048570
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10036b60
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006285c
call fcn.10060e94
sub esp, 0x1c
push ebx
push esi
mov dword [ebp - 0x18], 0x4371
mov ebx, edx
cmp dword [ebp - 0x18], 0x4446
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], ecx
jle 0x10036bd4
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
and dword [ebp - 0x20], 0
mov ebx, esi
mov esi, dword [ebp - 0x20]
mov ecx, edi
sar ebx, cl
mov eax, ebx
mov ecx, 0x1007cfd8
xor eax, esi
cdq
push edx
push eax
call fcn.1000703f
inc esi
cmp esi, 0x48f2
jl 0x10036b9f
mov esi, dword [ebp - 0x14]
inc edi
cmp edi, 0x27ee
jl 0x10036b92
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x6f57
jl 0x10036b90
mov ebx, dword [ebp - 0x1c]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x40c1
jge 0x10036c0f
mov edx, str.tnsj_lolk_now_ddqhrgyyo_pxmfnz_pixxz_jiakv_wuuworejp_bpzre_oiqntb_ekdsgl_swxrxwfnw_grudkxdto_yanbgmr
mov ecx, 0x1007cfd8
call fcn.1000b30d
jmp 0x10036c0f
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0xc], 0
je 0x10036c2c
push 0
push 0x352
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
jmp 0x10036c3e
mov eax, dword [ebp + 8]
mov ecx, dword [ebx]
sub ecx, dword [eax]
sar ecx, 1
push ecx
mov ecx, dword [ebp - 0x24]
call fcn.1000c00a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10036d40
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
cmp byte [ebp + 0x1c], 0
push ebx
push esi
push edi
je 0x10036da8
cmp byte [ebp + 8], 0
je 0x10036d7c
mov dword [ecx], 0
jmp 0x10036d72
mov dword [esp + 0xc], 0xfffffff6
mov dword [esp + 0xc], 9
dec dword [ecx]
cmp dword [ecx], 0xfffffffc
jne 0x10036d60
jmp 0x10036e5d
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10036e5d
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 1
inc dword [edx]
cmp dword [edx], 2
jl 0x10036d91
jmp 0x10036e5d
cmp byte [ebp + 0x14], 0
je 0x10036dcc
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10036e5d
push 0x1e77
push 0
call dword [sym.imp.USER32.dll_GetSubMenu]
jmp 0x10036e5d
cmp byte [edx], 0
je 0x10036e5d
mov dword [esp + 0xc], 0x320
cmp dword [esp + 0xc], 0x5c9
push 0
pop ebx
jle 0x10036e30
mov esi, ebx
mov edi, ebx
mov eax, esi
lea ecx, [esp + 0x10]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001301
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10036e0b
mov eax, dword [eax]
push eax
call fcn.10048570
pop ecx
push ebx
push 1
lea ecx, [esp + 0x18]
call fcn.1000162e
inc edi
cmp edi, 0x4623
jl 0x10036dee
inc esi
cmp esi, 0x621f
jl 0x10036dec
push 0x477
push ebx
push 0x1e2a
push 0x1700
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
cmp dword [esp + 0xc], 0x2b5
jge 0x10036e5d
push str.adyklinu_rxmmzwu_lryqx_tvldu_ztzlp_hksb_yyxr_zmbtpnh_mjytnrkg_lorroldp_ujft_wtbu_wpdm
call fcn.10048570
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003737f
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006287a
call fcn.10060e94
sub esp, 0xc
push ebx
push esi
mov dword [ebp - 0x14], 0x7e84
mov ebx, ecx
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
cmp dword [ebp - 0x14], 0x8128
mov dword [ebp - 0x18], ebx
jle 0x100373e1
push esi
push esi
push 0x210d
push esi
call dword [sym.imp.KERNEL32.dll_GetFullPathNameW]
mov edi, esi
mov ebx, esi
mov eax, ebx
mov ecx, 0x1007cfd8
xor eax, edi
cdq
push edx
push eax
call fcn.1000703f
inc ebx
cmp ebx, 0x3292
jl 0x100373bb
inc edi
cmp edi, 0x3af7
jl 0x100373b9
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x14], 0x7cd1
jge 0x100373fc
mov edx, str.hxdlgin_bknqctw_lauryomp_wwbj_jun_ehv_omtoz_qhhzqvir_plqobkdmb_jalt_liuph_jsvdxpxzh
mov ecx, 0x1007cfd8
call fcn.1000b30d
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 8], 0
je 0x1003745c
mov edi, dword [ebp + 0x10]
mov dword [edi], esi
jmp 0x10037455
push 0x2d42
push 1
push edi
push dword [ebp + 0xc]
mov edx, 0x4364
mov cl, 1
push 1
push 0x4d60
call fcn.10035671
add esp, 0x18
inc dword [edi]
cmp dword [edi], 4
jl 0x10037432
jmp 0x1003746f
cmp byte [ebx], 0
je 0x1003746f
push esi
push 0x352
push esi
push esi
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10038330
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 8], dl
push ebx
push esi
test cl, cl
je 0x10038391
xor ebx, ebx
cmp byte [ebp + 0xc], bl
je 0x10038371
mov esi, dword [ebp + 0x10]
mov dword [esi], ebx
jmp 0x1003836b
lea eax, [ebp - 1]
mov byte [ebp - 1], bl
push eax
push ecx
push 0x2bc3
push ecx
push ebx
mov ecx, 0x6ec8
call fcn.100371f0
add esp, 0x14
inc dword [esi]
cmp dword [esi], ebx
jle 0x1003834d
jmp 0x100383cc
mov esi, dword [ebp + 8]
mov dword [esi], ebx
jmp 0x1003838b
mov byte [ebp - 2], bl
cmp byte [ebp - 2], bl
je 0x10038389
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
dec dword [esi]
cmp dword [esi], ebx
jge 0x10038378
jmp 0x100383cc
test dl, dl
je 0x1003839d
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x100383cc
xor ebx, ebx
mov byte [ebp - 2], bl
cmp byte [ebp - 2], bl
je 0x100383cc
push 0x27b2
push ebx
push 0x3d0a
push 0x366b
push ebx
push 0x56f7
mov edx, 0x5e0e
mov cl, 1
call fcn.10035671
add esp, 0x18
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003846b
Capabilities:
Encode data using xor
Set environment variable

Disassembly:
mov eax, 0x100628f5
call fcn.10060e94
push ecx
push ecx
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], cl
je 0x10038551
mov dword [ebp + 0xc], 0x21ba
cmp dword [ebp + 0xc], 0x2284
jle 0x100384ce
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x1007cfd8
xor eax, edi
xor eax, esi
cdq
push edx
push eax
call fcn.1000703f
inc ebx
cmp ebx, 0x621a
jl 0x100384a0
inc edi
cmp edi, 0x48c8
jl 0x1003849e
inc esi
cmp esi, 0x4c2e
jl 0x1003849c
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0x216b
jge 0x100384ea
mov edx, str.dnlt_najjpfaz_ldvv_wse_zgskax_oka_taakrcobr_adl_evoul
mov ecx, 0x1007cfd8
call fcn.1000b30d
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x14], 0
je 0x1003852c
mov byte [ebp + 0xf], 0
cmp byte [ebp + 0xf], 0
je 0x1003858b
sub esp, 0x30
push 1
push ecx
call fcn.100367fa
add esp, 0x38
jmp 0x1003858b
mov edx, dword [ebp + 0x18]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x1003858b
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [edx]
cmp dword [edx], 3
jl 0x1003853d
jmp 0x1003858b
cmp byte [ebp + 0x1c], 0
je 0x10038579
mov dword [edx], 0
cmp dword [edx], 4
jge 0x1003858b
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 5
inc dword [edx]
cmp dword [edx], 4
jl 0x10038565
jmp 0x1003858b
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1003858b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100389f5
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
test dl, dl
je 0x10038a3c
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10038a3a
push 0x269c
push 0x4b1b
push 0x43d9
push 0x7e4d
push 0
push 1
push 0x3e59
push 0
push 0x414e
mov edx, 0xcf1
mov ecx, 0x6888
call fcn.100380d0
add esp, 0x24
pop ebp
ret
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
Function at 0x100398eb
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10062998
call fcn.10060e94
sub esp, 0x10
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
je 0x1003991a
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [eax + 0xc], 0x7a16482
jmp 0x100399bf
mov dword [ebp - 0x18], 0x80b
cmp dword [ebp - 0x18], 0xbbe
jle 0x10039964
xor edi, edi
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x14], 0x7e80
mov eax, esi
mov ecx, 0x1007cfd8
xor eax, edi
cdq
push edx
push eax
call fcn.1000703f
add esi, ebx
dec dword [ebp - 0x14]
jne 0x10039937
inc ebx
cmp ebx, 0x960
jl 0x1003992e
inc edi
cmp edi, 0xa0a
jl 0x1003992c
mov esi, dword [ebp - 0x1c]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x68a
jge 0x1003999f
mov edx, str.dvjpjuu_kbxdulpsg_mlgcut_valwz_eyfhv_segoqjd_cwmepub_rvucuq_edlr_joplhl_ekpngtp_zlevmhseb
mov ecx, 0x1007cfd8
call fcn.1000b30d
jmp 0x1003999f
mov dword [esi], 0
cmp dword [esi], 4
jge 0x100399bf
mov edx, dword [ebp + 0xc]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0x88cdf8ab
inc dword [esi]
cmp dword [esi], 4
jl 0x100399ad
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100399d0
Capabilities:
Create pipe

Disassembly:
mov eax, 0x100629b2
call fcn.10060e94
sub esp, 0x54
push ebx
push esi
push edi
mov byte [ebp - 0x10], cl
mov dword [ebp - 0x1c], 0x25f5
cmp dword [ebp - 0x1c], 0x287e
push 0
pop ebx
jle 0x10039a4c
mov esi, ebx
mov edi, esi
mov ebx, 0x108e
mov eax, edi
lea ecx, [ebp - 0x60]
cdq
push edx
push eax
call fcn.10001301
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10039a16
mov eax, dword [eax]
push eax
call fcn.10048570
pop ecx
push 0
push 1
lea ecx, [ebp - 0x60]
call fcn.1000162e
dec edi
dec ebx
jne 0x100399ff
inc esi
cmp esi, 0x26d7
jl 0x100399f8
push 0xc02
push 0x1385
push 0xbc3
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualAlloc]
cmp byte [ebp - 0x10], 0
je 0x10039a7f
push ebx
push 0x6f85
push 1
push 0x7e2
lea eax, [ebp - 0x11]
mov byte [ebp - 0x11], bl
push eax
push 1
mov edx, 0xc7b
mov ecx, 0x3e73
call fcn.10036d40
add esp, 0x18
jmp 0x10039b6b
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
mov dword [eax + 4], ebx
mov eax, dword [esi]
cmp dword [eax + 4], 0x12
jge 0x10039b6b
push 3
pop edi
push edi
lea ecx, [ebp - 0x38]
call fcn.1000145c
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x18], 0x25ef2c36
mov dword [ebp - 0x18], 0xfffffffc
mov dword [ebp - 0x18], 0x7cfaf425
mov dword [ebp - 0x18], 0x457d6700
push edi
call fcn.1000145c
mov byte [ebp - 4], 1
mov dword [ebp - 0x18], 0x4c9d8d92
mov dword [ebp - 0x20], 0xfec1b16e
mov dword [ebp - 0x18], ebx
jmp 0x10039aea
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
mov dword [eax + ecx*4], ebx
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10039ade
mov dword [ebp - 0x18], ebx
jmp 0x10039b02
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x48], 0x377cc424
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10039af4
mov dword [ebp - 0x18], ebx
jmp 0x10039b1d
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
mov dword [eax + ecx*4], 0xec80f219
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], edi
jl 0x10039b0d
lea eax, [ebp - 0x20]
push 1
push eax
call fcn.10038a43
mov byte [ebp - 0x12], bl
cmp byte [ebp - 0x12], 0
pop ecx
pop ecx
je 0x10039b46
push 0x16b3
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
lea ecx, [ebp - 0x2c]
call fcn.100014df
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x38]
call fcn.100014df
mov eax, dword [esi]
inc dword [eax + 4]
mov eax, dword [esi]
cmp dword [eax + 4], 0x12
jl 0x10039a96
cmp dword [ebp - 0x1c], 0x2350
jge 0x10039b7f
push str.gmvpvidqj_tfypwris_neasrygs_xyljtkg_sylj
call fcn.10048570
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10039beb
Capabilities:
Set environment variable

Disassembly:
mov eax, 0x10061a15
call fcn.10060e94
sub esp, 0x30
mov byte [ebp - 0x14], dl
push ebx
test dl, dl
je 0x10039c1f
xor ebx, ebx
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], bl
je 0x10039ce2
push ebx
mov ecx, 0x1528
call fcn.10036ebb
pop ecx
jmp 0x10039ce2
mov dword [ebp - 0x18], 0x2db58e46
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x18], 0x57ad95e1
mov dword [ebp - 0x18], 0x9bf39019
push 3
call fcn.1000145c
xor ebx, ebx
lea ecx, [ebp - 0x30]
push 2
mov dword [ebp - 4], ebx
call fcn.1000145c
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x18], 0x764361a6
push 4
call fcn.1000145c
mov dword [ebp - 0x18], ebx
jmp 0x10039c77
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
mov dword [eax + ecx*4], 0xbe4438b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x10039c67
mov dword [ebp - 0x18], ebx
jmp 0x10039c92
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
mov dword [eax + ecx*4], 0x17d72b90
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x10039c82
mov dword [ebp - 0x18], ebx
jmp 0x10039cad
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov dword [eax + ecx*4], 0xfb389fa1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x10039c9d
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10039cc4
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x24]
dec dword [eax + 4]
call fcn.100014df
lea ecx, [ebp - 0x30]
call fcn.100014df
lea ecx, [ebp - 0x3c]
call fcn.100014df
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003f4c9
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov dword [esp + 0x10], edx
mov byte [esp + 4], cl
push ebx
push esi
push edi
test cl, cl
je 0x1003f590
mov dword [esp + 0x18], 0x2786
cmp dword [esp + 0x18], 0x2a85
jle 0x1003f563
xor esi, esi
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x14], eax
add eax, ebx
lea ecx, [edi + esi]
or eax, ecx
lea ecx, [esp + 0x20]
cdq
push edx
push eax
call fcn.10001301
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003f520
mov eax, dword [eax]
push eax
call fcn.10048570
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.1000162e
mov eax, dword [esp + 0x14]
inc eax
mov dword [esp + 0x14], eax
cmp eax, 0x6c91
jl 0x1003f503
inc ebx
cmp ebx, 0x2214
jl 0x1003f4fd
inc edi
cmp edi, 0x63b7
jl 0x1003f4fb
inc esi
cmp esi, 0x378c
jl 0x1003f4f9
mov edx, dword [esp + 0x1c]
mov eax, dword [ebp + 8]
mov ecx, edx
push dword [esp + 0x1c]
push dword [eax + 4]
push dword [eax]
push dword [edx + 4]
call fcn.100422a0
cmp dword [esp + 0x18], 0x241d
jge 0x1003f5ab
push str.krzi_gqpb_teygm_qxlhu_edc_ftphxzo_zoxiv_zen_wzyzstlp_arumw_fmychl_zuugwsv_mre_vvusybfr
call fcn.10048570
pop ecx
jmp 0x1003f5ab
push 0x477
push 0
push 0x1e2a
push 0x1700
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003f8cb
Capabilities:
Set environment variable

Disassembly:
mov eax, 0x10062c35
call fcn.10060e94
sub esp, 0x10
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x10], esp
cmp byte [ebp + 8], bl
je 0x1003f97a
mov byte [ebp - 0x11], bl
mov dword [ebp - 0x18], 0x4590
cmp dword [ebp - 0x18], 0x45a2
jle 0x1003f935
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x1c], ebx
mov ecx, ebx
lea eax, [edi + esi]
shl eax, cl
mov ecx, 0x1007cfd8
cdq
push edx
push eax
call fcn.1000703f
inc ebx
cmp ebx, 0x76d4
jl 0x1003f903
inc edi
push 0
pop ebx
cmp edi, 0x54f
jl 0x1003f900
inc esi
cmp esi, 0xca1
jl 0x1003f8fe
cmp byte [ebp - 0x11], 0
je 0x1003f943
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x4476
jge 0x1003f95e
mov edx, str.emkulv_yecvkrx_cuh_fqoimpyzu
mov ecx, 0x1007cfd8
call fcn.1000b30d
jmp 0x1003f995
push 0x548
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolygon]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003f9cc
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
cmp byte [ebp + 0x10], 0
mov eax, edx
push ebx
push esi
push edi
mov dword [esp + 0x1c], eax
je 0x1003fa0b
cmp byte [ebp + 0xc], 0
je 0x1003f9fe
and dword [esp + 0x14], 0
lea eax, [esp + 0x14]
push eax
call fcn.100077b6
jmp 0x1003faad
mov ecx, dword [ebp + 0x14]
mov eax, dword [ecx]
mov dword [ecx + 4], eax
jmp 0x1003faad
cmp byte [ebp + 8], 0
je 0x1003faa7
mov dword [esp + 0x18], 0x274d
cmp dword [esp + 0x18], 0x2b13
jle 0x1003fa8d
xor esi, esi
mov dword [esp + 0x14], esi
mov ebx, 0x1f3c
xor edi, edi
mov dword [esp + 0x10], ebx
xor esi, esi
mov ebx, 0x3bee
mov eax, esi
lea ecx, [esp + 0x20]
cdq
push edx
push eax
call fcn.10001301
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003fa57
mov eax, dword [eax]
push eax
call fcn.10048570
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.1000162e
add esi, edi
dec ebx
jne 0x1003fa3f
mov esi, dword [esp + 0x14]
add edi, esi
dec dword [esp + 0x10]
jne 0x1003fa38
inc esi
mov dword [esp + 0x14], esi
cmp esi, 0x5439
jl 0x1003fa2d
mov eax, dword [esp + 0x1c]
and dword [eax], 0
cmp dword [esp + 0x18], 0x26fc
jge 0x1003faad
push str.ihknflvrz_drnt_doorpojv
call fcn.10048570
pop ecx
jmp 0x1003faad
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003fdc7
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
mov byte [ebp - 4], cl
mov dword [ebp - 0x14], 0x7ddb
cmp dword [ebp - 0x14], 0x8184
push esi
push edi
jle 0x1003fe57
xor esi, esi
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [ebp - 0xc], edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov edi, edx
xor esi, esi
lea ecx, [esi + ebx]
mov eax, edi
shl eax, cl
lea ecx, [ebp - 0x30]
cdq
push edx
push eax
call fcn.10001301
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003fe14
mov eax, dword [eax]
push eax
call fcn.10048570
pop ecx
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.1000162e
inc esi
cmp esi, 0xa63
jl 0x1003fdf8
inc ebx
cmp ebx, 0x5b22
jl 0x1003fdf6
mov edi, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
inc edi
mov dword [ebp - 0xc], edi
cmp edi, 0x245
jl 0x1003fded
inc esi
mov dword [ebp - 0x10], esi
cmp esi, 0x1c93
jl 0x1003fde8
cmp dword [ebp - 0x14], 0x7d66
jge 0x1003fe6b
push str.fmxl_hovcfes_iempv_yvm_mghlfzg_aengwqfq_kapknfzd_qkjfbxsw_nruhhcty_awtfal_gpvjjek
call fcn.10048570
pop ecx
cmp byte [ebp - 4], 0
je 0x1003fe85
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1003fea5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x1003fea5
mov eax, dword [ebp + 0x10]
lea esi, [ebp - 5]
mov ecx, dword [ebp + 0x14]
push esi
mov byte [ebp - 5], 0
mov edx, dword [eax]
mov eax, dword [ecx]
push edx
push eax
mov dword [ecx + 4], eax
lea eax, [ebp - 0x18]
push eax
call fcn.100420ee
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret