joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10019357
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005c3a1
call fcn.1005bac8
sub esp, 0x1c
push ebx
push esi
mov dword [ebp - 0x1c], 0x6956
mov ebx, edx
cmp dword [ebp - 0x1c], 0x6968
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ecx
jle 0x100193dd
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x14], edi
lea eax, [edi + esi]
mov edi, 0x2d71
mov dword [ebp - 0x20], eax
mov esi, eax
mov eax, esi
mov ecx, 0x10076b78
xor eax, ebx
cdq
push edx
push eax
call fcn.10001c56
dec esi
dec edi
jne 0x1001939b
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x1026
jl 0x1001938e
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x4799
jl 0x10019389
inc ebx
cmp ebx, 0x2317
jl 0x10019384
mov ecx, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x28]
cmp byte [ebp + 0x18], 0
je 0x100193f2
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x10]
push dword [eax]
call fcn.100184c8
jmp 0x10019418
mov eax, dword [ebp + 0xc]
push 0x1a
pop esi
cmp dword [eax], esi
jge 0x10019403
movzx edx, word [ecx]
add edx, dword [eax]
jmp 0x10019410
mov eax, dword [eax]
cdq
idiv esi
mov eax, dword [ebp + 0x20]
movzx eax, word [eax]
add edx, eax
push edx
mov ecx, ebx
call fcn.1001a75a
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x6758
jge 0x10019434
mov edx, str.xxtwtk_dbtl_tpplywep_rhzs_gpssnmu_acflwys_fwheisn_rocrbs_mes_fhiuq
mov ecx, 0x10076b78
call fcn.10003a53
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001945f
Capabilities:
Get file system object information
Start service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
mov dword [esp + 0xc], 0x292f
mov eax, ecx
cmp dword [esp + 0xc], 0x2a0f
push esi
push edi
mov dword [esp + 0x1c], eax
jle 0x100194ec
xor esi, esi
mov dword [esp + 0x10], esi
xor edi, edi
mov ecx, edi
mov dword [esp + 0x18], esi
xor ebx, ebx
shl esi, cl
mov ecx, ebx
mov eax, esi
sar eax, cl
lea ecx, [esp + 0x20]
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100194b1
mov eax, dword [eax]
push eax
call fcn.10043bf4
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.100020a8
inc ebx
cmp ebx, 0x6951
jl 0x10019495
mov esi, dword [esp + 0x10]
inc edi
cmp edi, 0x5f68
jl 0x1001948b
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0x608d
jl 0x10019489
mov eax, dword [esp + 0x1c]
cmp byte [ebp + 8], 0
je 0x10019512
cmp byte [eax], 0
je 0x1001952d
push 0x1c07
push 0xcf
push 0
push 0x562
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x1001952d
mov byte [esp + 0xf], 0
cmp byte [esp + 0xf], 0
je 0x1001952d
push 0
push 0x3d1
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
cmp dword [esp + 0x14], 0x2735
jge 0x10019542
push str.mxaylp_hpyqyh_gswhp_neiwsu
call fcn.10043bf4
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001a81f
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov dword [0x1027eaa4], ecx
inc edx
mov esi, 0x270
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
mov dword [edx*4 + 0x1027eaa4], ecx
inc edx
cmp edx, esi
jl 0x1001a834
mov dword [0x1027eaa0], esi
pop esi
pop ebp
ret 8

Function at 0x1001a85a
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x1027eaa4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x1027ee30
jl 0x1001a868
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x1027f0d4
jl 0x1001a8a8
mov ecx, dword [0x1027fe20]
xor ecx, dword [0x1027eaa4]
and ecx, edi
xor ecx, dword [0x1027fe20]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x1027eaa0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x1027f0d4]
mov dword [0x1027f460], eax
pop esi
ret
Function at 0x1001d459
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp byte [ebp + 0x1c], 0
push ebx
push esi
mov byte [ebp - 4], dl
je 0x1001d4f9
cmp byte [ebp + 0x10], 0
je 0x1001d48c
mov eax, dword [ebp + 0x18]
push dword [ebp + 0x14]
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
mov edx, dword [eax]
call fcn.1002230e
pop ecx
jmp 0x1001d572
mov dword [ebp - 8], 0xfffffffc
xor ebx, ebx
mov dword [ebp + 0x1c], 0xffffffff
xor esi, esi
mov dword [ebp - 0xc], 0x8319
inc esi
mov dword [ebp + 0x1c], ebx
mov dword [ebp + 0x1c], 0xffffffff
mov dword [ebp - 0x10], esi
mov dword [ebp + 0x1c], 0xfe497d6a
mov dword [ebp + 0x1c], ebx
jmp 0x1001d4cd
mov eax, dword [ebp + 0x1c]
mov dword [ebp + eax*4 - 0x18], 0x788afb1c
inc dword [ebp + 0x1c]
cmp dword [ebp + 0x1c], 2
jl 0x1001d4bf
cmp dword [ebp - 8], ebx
je 0x1001d4df
mov ecx, esi
cmp dword [ebp - 0x18], ebx
jne 0x1001d4e1
mov ecx, ebx
mov eax, dword [ebp - 0xc]
sub ecx, eax
jne 0x1001d4ed
cmp dword [ebp - 8], ebx
je 0x1001d4f2
cmp dword [ebp - 0x10], ebx
jne 0x1001d4f4
mov esi, ebx
mov dword [ebp + 0x1c], esi
jmp 0x1001d572
test dl, dl
je 0x1001d50c
movzx eax, word [ecx]
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.10003ded
jmp 0x1001d572
push edi
mov edi, dword [ebp + 0xc]
xor ebx, ebx
mov dword [edi], ebx
cmp dword [edi], ebx
jl 0x1001d571
xor esi, esi
inc esi
mov dword [ebp + 0x1c], 0x1ca2961c
mov dword [ebp + 0x1c], esi
mov dword [ebp + 0x1c], esi
mov dword [ebp + 0x1c], 0xffffffff
mov dword [ebp + 0x1c], 0xffffffff
mov dword [ebp + 0x1c], 0xffffffff
mov dword [ebp - 8], ebx
mov dword [ebp + 0x1c], ebx
jmp 0x1001d553
mov eax, dword [ebp + 0x1c]
mov dword [ebp + eax*4 - 0x24], 0xb59008cf
inc dword [ebp + 0x1c]
cmp dword [ebp + 0x1c], 3
jl 0x1001d545
mov byte [ebp + 0x1f], bl
cmp byte [ebp + 0x1f], bl
je 0x1001d568
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
inc dword [ebp - 8]
dec dword [edi]
cmp dword [edi], ebx
jge 0x1001d51b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001d578
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005c615
call fcn.1005bac8
sub esp, 0x14
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
je 0x1001d5bc
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.10001a9d
pop ecx
mov dword [ebp - 0x20], eax
mov ecx, esi
lea eax, [ebp - 0x20]
push eax
call fcn.1001f654
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], 0x2cd7
cmp dword [ebp - 0x1c], 0x3045
jle 0x1001d62f
push 0x2260
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetROP2]
xor edi, edi
xor esi, esi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x18], eax
lea ecx, [eax + ebx]
mov eax, esi
sar eax, cl
mov ecx, 0x10076b78
xor eax, edi
cdq
push edx
push eax
call fcn.10001c56
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x4198
jl 0x1001d5f0
inc ebx
cmp ebx, 0x5b70
jl 0x1001d5eb
inc esi
cmp esi, 0x7ff4
jl 0x1001d5e9
inc edi
cmp edi, 0x404d
jl 0x1001d5e7
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x1001d64d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x2a45
jge 0x1001d5ab
mov edx, str.lgdxlgge_aqjls_yzkbnws_wxkcxs_mmf_urae_nvvs_ymsio_lsq_vfet_wnyuwlcy_vshwr_epyniukt_zfkapqed
mov ecx, 0x10076b78
call fcn.10003a53
jmp 0x1001d5ab
Function at 0x1001dc3e
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005c653
call fcn.1005bac8
sub esp, 0x38
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x1001ddce
mov dword [ebp - 0x1c], 0x3f42
cmp dword [ebp - 0x1c], 0x4223
jle 0x1001dcb1
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
and dword [ebp - 0x24], 0
mov ebx, esi
mov esi, dword [ebp - 0x24]
mov ecx, edi
shl ebx, cl
mov eax, ebx
mov ecx, 0x10076b78
xor eax, esi
cdq
push edx
push eax
call fcn.10001c56
inc esi
cmp esi, 0xfc0
jl 0x1001dc7f
mov esi, dword [ebp - 0x18]
inc edi
cmp edi, 0x5bec
jl 0x1001dc72
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0xf23
jl 0x1001dc70
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x3bad
jge 0x1001dccd
mov edx, str.gazhgv_opngeec_refd_fslffdax_avua_qnaaseu_opvxqigxi_ncwu_lzi_bwfbtno_jcnrx_kskbm_cmmowujli
mov ecx, 0x10076b78
call fcn.10003a53
mov esi, dword [ebp + 0x10]
or dword [ebp - 4], 0xffffffff
cmp dword [esi + 0x14], 8
jb 0x1001dcf8
mov ecx, dword [esi]
jmp 0x1001dcfa
mov ecx, esi
mov eax, dword [esi + 0x10]
mov ax, word [ecx + eax*2 - 2]
mov ecx, dword [ebp + 8]
cmp ax, word [ecx]
je 0x1001ddd8
mov dword [ebp - 0x24], 0x7997
cmp dword [ebp - 0x24], 0x7c0a
jle 0x1001dd97
xor ebx, ebx
mov dword [ebp - 0x20], ebx
xor edi, edi
xor eax, eax
mov dword [ebp - 0x18], 0x4cd2
mov dword [ebp - 0x1c], eax
mov ecx, eax
mov dword [ebp - 0x28], ebx
xor esi, esi
shl ebx, cl
mov eax, ebx
lea ecx, [ebp - 0x40]
xor eax, esi
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001dd53
mov eax, dword [eax]
push eax
call fcn.10043bf4
pop ecx
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.100020a8
inc esi
cmp esi, 0x3af7
jl 0x1001dd3a
mov eax, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x20]
add eax, edi
dec dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
jne 0x1001dd31
inc edi
cmp edi, 0x4856
jl 0x1001dd25
inc ebx
mov dword [ebp - 0x20], ebx
cmp ebx, 0x3f67
jl 0x1001dd23
mov esi, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
mov dl, 1
push 0
push 0xf1f
push 0x87f
push 1
push 0x371b
push esi
call fcn.1001d459
add esp, 0x18
cmp dword [ebp - 0x24], 0x78db
jge 0x1001ddd8
push str.fxzb_fkjepwymy_zqnshoo_qcdhbifee_epcgltns_jlq_krnlx
call fcn.10043bf4
pop ecx
jmp 0x1001ddd8
push ecx
push ecx
push ecx
mov ecx, edx
call fcn.10020830
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001ee04
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1005c713
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x84
push ebx
push esi
push ecx
mov edx, 0x1987
lea ecx, [esp + 0x40]
call fcn.10001ace
pop ecx
xor esi, esi
lea ecx, [esp + 0x6c]
push eax
mov dword [esp + 0x98], esi
call fcn.1003bed9
xor ebx, ebx
mov byte [esp + 0x94], 2
push esi
inc ebx
lea ecx, [esp + 0x40]
push ebx
call fcn.10002214
push ecx
push ecx
lea edx, [esp + 0x74]
mov cl, bl
call fcn.1001ebf2
pop ecx
mov edx, 0x188a
lea ecx, [esp + 0x28]
call fcn.10001ace
mov edx, 0x188b
mov byte [esp + 0x98], 3
lea ecx, [esp + 0x40]
call fcn.10001ace
pop ecx
mov edx, eax
mov byte [esp + 0x94], 4
lea ecx, [esp + 0x18]
call fcn.1001b6e3
push esi
push ebx
lea ecx, [esp + 0x44]
mov byte [esp + 0x9c], 6
call fcn.10002214
push ecx
mov edx, 0x188c
lea ecx, [esp + 0x58]
call fcn.10001ace
pop ecx
mov edx, eax
mov byte [esp + 0x94], 7
lea ecx, [esp + 0xc]
call fcn.1001b6e3
push esi
push ebx
lea ecx, [esp + 0x5c]
mov byte [esp + 0x9c], 9
call fcn.10002214
push ecx
push 0x5c56
push ebx
lea eax, [esp + 0x30]
push eax
push ecx
lea eax, [esp + 0x20]
push eax
push ecx
lea edx, [esp + 0x34]
call fcn.1001ed07
add esp, 0x1c
lea ecx, [esp + 0xc]
call fcn.1001fb78
lea ecx, [esp + 0x18]
call fcn.1001fb78
push esi
push ebx
lea ecx, [esp + 0x2c]
call fcn.10002214
or dword [esp + 0x94], 0xffffffff
lea ecx, [esp + 0x6c]
call fcn.1003d8af
mov ecx, dword [esp + 0x8c]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100220d4
Capabilities:
Query environment variable
Start service

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x14], 0
je 0x10022104
cmp byte [ebp + 0x10], 0
je 0x100220eb
mov dword [edx], 5
pop ebp
ret
xor eax, eax
mov byte [ebp + 0x17], al
cmp byte [ebp + 0x17], al
je 0x10022123
push eax
push 0x3d1
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
pop ebp
ret
cmp byte [ebp + 8], 0
je 0x10022114
mov eax, dword [ebp + 0xc]
movzx ecx, byte [ecx]
add dword [eax], ecx
pop ebp
ret
push 0xe3d
xor eax, eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
pop ebp
ret

Function at 0x10022b52
Capabilities:
Resume thread

Disassembly:
push 0
test cl, cl
je 0x10022b5f
call dword [sym.imp.USER32.dll_GetMenuItemCount]
ret
call dword [sym.imp.KERNEL32.dll_ResumeThread]
ret

Function at 0x100232f0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov byte [ebp - 8], dl
push ebx
push esi
push edi
test dl, dl
je 0x10023319
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x100233d4
push 0
call dword [sym.imp.USER32.dll_GetMenuItemCount]
jmp 0x100233d4
mov esi, dword [ebp + 0x10]
mov dword [esi], 0x19
jmp 0x100233cb
mov dword [ebp - 0x10], 0x29bb
cmp dword [ebp - 0x10], 0x2c23
jle 0x1002339f
push 0x56d
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
xor edi, edi
xor esi, esi
mov dword [ebp - 0xc], 0x78e4
xor ebx, ebx
mov ecx, ebx
mov eax, esi
sar eax, cl
lea ecx, [ebp - 0x28]
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10023370
mov eax, dword [eax]
push eax
call fcn.10043bf4
pop ecx
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.100020a8
inc ebx
cmp ebx, 0x2030
jl 0x10023355
add esi, edi
dec dword [ebp - 0xc]
jne 0x10023353
inc edi
cmp edi, 0x3f36
jl 0x1002334a
mov esi, dword [ebp + 0x10]
mov dword [ebp - 0xc], 0xa79cc099
cmp dword [ebp - 0x10], 0x26cf
jge 0x100233ba
push str.xmpiv_sfytha_kspdcv_qoxjalbi_qanpqoo_vnzu_tcchccrau_yxm_eirhaqdye
call fcn.10043bf4
pop ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0xc], 0xffffffff
mov eax, dword [ebp - 0xc]
mov dword [ecx], eax
dec dword [esi]
cmp dword [esi], 0x17
jge 0x10023327
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002355d
Capabilities:
Get file system object information

Disassembly:
mov eax, 0x1005c893
call fcn.1005bac8
sub esp, 0x14
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, edx
je 0x100235eb
cmp byte [ebp + 0x10], 0
je 0x100235e0
mov eax, dword [ebp + 0x18]
mov ecx, edi
mov ebx, dword [ebp + 0x20]
push ebx
mov eax, dword [eax]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x14]
push eax
call fcn.1002b21f
mov esi, dword [ebp - 0x14]
cmp esi, dword [edi]
je 0x100235ab
mov eax, dword [ebx]
cmp eax, dword [esi + 0x10]
jge 0x100235cf
push ecx
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], ebx
push eax
push ecx
mov ecx, edi
call fcn.1002b9bb
push eax
add eax, 0x10
mov ecx, edi
push eax
push esi
lea eax, [ebp - 0x20]
push eax
call fcn.1002b9eb
mov esi, dword [ebp - 0x20]
mov eax, dword [ebp + 8]
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x18], eax
jmp 0x100236da
mov dword [ecx], 0
jmp 0x100236da
cmp byte [ebp + 0xc], 0
je 0x100236a5
mov dword [ebp - 0x18], 0x37a0
cmp dword [ebp - 0x18], 0x3a55
jle 0x1002365e
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
mov dword [ebp + 8], edi
mov eax, edi
xor ebx, ebx
and eax, esi
mov dword [ebp - 0x20], eax
mov esi, eax
xor edi, edi
lea eax, [edi + ebx]
mov ecx, 0x10076b78
or eax, esi
cdq
push edx
push eax
call fcn.10001c56
inc edi
cmp edi, 0x162c
jl 0x1002361c
inc ebx
cmp ebx, 0x6a71
jl 0x1002361a
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 0x14]
inc edi
mov dword [ebp + 8], edi
cmp edi, 0x3879
jl 0x1002360f
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x73ca
jl 0x1002360a
push 0
push 0x1592
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x36f9
jge 0x10023689
mov edx, str.bdfj_qrraxh_yajn_agy_afhzpgxm_kjiofzoj_czmqceln_bwl_ktimp_ozirtb_vefru_ohafqpeq
mov ecx, 0x10076b78
call fcn.10003a53
jmp 0x100236da
mov esi, dword [ebp + 0x14]
mov dword [esi], 0xffffffef
jmp 0x100236d5
mov byte [ebp + 0xb], 0
cmp byte [ebp + 0xb], 0
je 0x100236d3
push 0x1c07
push 0xcf
push 0
push 0x562
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
inc dword [esi]
cmp dword [esi], 3
je 0x100236b0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002384e
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005c8a7
call fcn.1005bac8
sub esp, 0x14
push ebx
push esi
mov dword [ebp - 0x18], 0x571a
mov eax, ecx
cmp dword [ebp - 0x18], 0x58f0
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], eax
jle 0x100238c1
xor esi, esi
mov dword [ebp - 0x14], esi
mov edi, esi
mov ebx, 0x13c2
xor esi, esi
mov eax, edi
mov ecx, 0x10076b78
xor eax, esi
cdq
push edx
push eax
call fcn.10001c56
inc esi
cmp esi, 0x1d36
jl 0x10023887
dec edi
dec ebx
jne 0x10023885
mov esi, dword [ebp - 0x14]
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x4658
jl 0x1002387e
push ebx
call dword [sym.imp.OLEAUT32.dll_VariantClear]
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
cmp byte [ebp + 8], 0
je 0x100238ce
mov eax, dword [ebp + 0x10]
dec dword [eax]
jmp 0x100238d2
mov al, byte [eax]
mov byte [edx], al
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x55fb
jge 0x100238ee
mov edx, str.ksf_bxocpmqao_nqwodpot
mov ecx, 0x10076b78
call fcn.10003a53
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10023ab1
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x1005c8b1
call fcn.1005bac8
sub esp, 0x30
push ebx
push esi
push edi
mov byte [ebp - 0x18], cl
mov edi, edx
mov dword [ebp - 0x20], 0xa5d
cmp dword [ebp - 0x20], 0xad5
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edi
jle 0x10023b34
xor esi, esi
xor edi, edi
mov dword [ebp - 0x1c], 0x8a7
xor ebx, ebx
mov eax, edi
lea ecx, [ebp - 0x3c]
cdq
idiv ebx
mov eax, edx
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10023b05
mov eax, dword [eax]
push eax
call fcn.10043bf4
pop ecx
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.100020a8
inc ebx
cmp ebx, 0x5a2c
jl 0x10023ae9
add edi, esi
dec dword [ebp - 0x1c]
jne 0x10023ae7
inc esi
cmp esi, 0x24e7
jl 0x10023ade
mov edi, dword [ebp - 0x24]
cmp dword [ebp - 0x20], 0x759
jge 0x10023b48
push str.swhv_exydehdqt_anqnssak_tndqoeu_qurp_eeuanf_tvzlssg_shzyrqx_zuochexz_rapa_fshp
call fcn.10043bf4
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x18], 0
je 0x10023c28
mov dword [ebp - 0x1c], 0x51e2
cmp dword [ebp - 0x1c], 0x5403
jle 0x10023bc3
push 0x1ff4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov eax, ebx
cdq
idiv ecx
lea eax, [edi + esi]
mov ecx, edx
sar eax, cl
mov ecx, 0x10076b78
cdq
push edx
push eax
call fcn.10001c56
mov ecx, dword [ebp - 0x20]
inc ecx
mov dword [ebp - 0x20], ecx
cmp ecx, 0xd0c
jl 0x10023b80
inc ebx
cmp ebx, 0x4fcb
jl 0x10023b7b
inc edi
cmp edi, 0x61cd
jl 0x10023b79
inc esi
cmp esi, 0xef1
jl 0x10023b77
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x4f3f
jge 0x10023be2
mov edx, str.tryp_rebk_qjtzaa_xle_ygkvgm_hjgar_qdt_oxok_kkqcep_dduhp_oubdvz_ajzx_vztd
mov ecx, 0x10076b78
call fcn.10003a53
mov esi, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
mov dword [esi], 0
jmp 0x10023c1e
mov edx, dword [ebp + 0x18]
push 1
push 0x603d
call fcn.1002686b
inc dword [esi]
pop ecx
pop ecx
cmp dword [esi], 0xa
jl 0x10023c0b
jmp 0x10023cb3
mov dword [ebp - 0x20], 0x7d9c
cmp dword [ebp - 0x20], 0x7dcb
jle 0x10023c5e
xor esi, esi
xor ebx, ebx
lea eax, [ebx + esi]
mov ecx, 0x10076b78
cdq
push edx
push eax
call fcn.10001c56
inc ebx
cmp ebx, 0x48c
jl 0x10023c3c
inc esi
cmp esi, 0x567b
jl 0x10023c3a
mov dword [ebp - 4], 4
cmp dword [ebp - 0x20], 0x7d73
jge 0x10023c9c
mov edx, str.arawsecq_btvd_kzu_uolst_uasmcx
mov ecx, 0x10076b78
call fcn.10003a53
jmp 0x10023c9c
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov eax, dword [ecx]
mov eax, dword [ecx]
mov eax, dword [ecx]
mov eax, dword [edi]
mov eax, dword [ebp + 0x1c]
mov ecx, dword [edi]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10024908
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
cmp byte [ebp + 8], 0
push esi
push edi
mov byte [esp + 0xc], dl
mov esi, ecx
je 0x10024974
test dl, dl
je 0x1002494c
mov dword [esi], 0
jmp 0x10024942
mov byte [esp + 0xa], 0
cmp byte [esp + 0xa], 0
je 0x10024940
push ecx
mov cl, 1
call fcn.10022b52
pop ecx
inc dword [esi]
cmp dword [esi], 2
jle 0x1002492b
jmp 0x10024a36
push 0x39eb
push 0x2aeb
lea eax, [esp + 0x13]
mov byte [esp + 0x13], 0
push 0
push eax
mov edx, 0x5d3f
call fcn.10025621
add esp, 0x10
jmp 0x10024a36
cmp byte [ebp + 0xc], 0
je 0x10024a25
mov esi, dword [ebp + 0x10]
mov dword [esi], 0
jmp 0x10024a1a
mov dword [esp + 0x14], 0x20f620a3
mov dword [esp + 0x10], 0x3158
cmp dword [esp + 0x10], 0x31bc
jle 0x100249f0
xor edi, edi
xor esi, esi
mov eax, edi
lea ecx, [esp + 0x18]
cdq
idiv esi
mov eax, edx
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100249c7
mov eax, dword [eax]
push eax
call fcn.10043bf4
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.100020a8
inc esi
cmp esi, 0x2272
jl 0x100249aa
inc edi
cmp edi, 0x968
jl 0x100249a8
mov esi, dword [ebp + 0x10]
lea eax, [esp + 0x14]
xor dl, dl
push eax
push 0x207e
call fcn.10023783
cmp dword [esp + 0x18], 0x2ed1
pop ecx
pop ecx
jge 0x10024a18
push str.qrqgb_npayk_uzyjdy_rbdsbbk_deyctmues_gjp
call fcn.10043bf4
pop ecx
dec dword [esi]
cmp dword [esi], 0xffffffed
je 0x1002498c
jmp 0x10024a36
push 0
push 0xf44
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret