joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10009fcc
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1005cc83
call fcn.1005c3e4
sub esp, 0x50
mov byte [ebp - 0x18], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x1000a12a
test cl, cl
je 0x1000a10c
mov dword [ebp - 0x20], 0x4d3a
cmp dword [ebp - 0x20], 0x4dfa
jle 0x1000a04f
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov eax, ebx
cdq
idiv ecx
mov ecx, 0x100758b8
and edx, edi
or edx, esi
mov eax, edx
cdq
push edx
push eax
call fcn.10004429
mov ecx, dword [ebp - 0x1c]
inc ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x7503
jl 0x1000a00d
inc ebx
cmp ebx, 0x5413
jl 0x1000a008
inc edi
cmp edi, 0x57d9
jl 0x1000a006
inc esi
cmp esi, 0x1140
jl 0x1000a004
sub esp, 0x18
mov ecx, esp
push dword [ebp + 8]
call fcn.1000738c
lea ecx, [ebp - 0x2c]
call fcn.1000920b
add esp, 0x18
and dword [ebp - 4], 0
mov byte [ebp - 4], 1
cmp dword [ebp - 0x20], 0x4ac2
jge 0x1000a087
mov edx, str.icdxxkju_fmhxkch_bfjqjezt_dncj_uezjy
mov ecx, 0x100758b8
call fcn.100067d6
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
cmp dword [ebp - 0x2c], eax
je 0x1000a104
push dword [ebp - 0x20]
and dword [ebp - 0x34], 0
xor ecx, ecx
push eax
push dword [ebp - 0x2c]
mov word [ebp - 0x44], cx
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x30], 7
call fcn.1000c182
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x44]
mov byte [ebp - 4], 3
call fcn.10009eef
lea ecx, [ebp - 0x44]
push 0
push 1
test eax, eax
jns 0x1000a0ff
mov eax, dword [ebp + 0x14]
mov byte [eax], 1
call fcn.10004b5d
lea ecx, [ebp - 0x2c]
call fcn.10004c54
jmp 0x1000a1e0
call fcn.10004b5d
mov eax, dword [ebp + 0x14]
mov byte [eax], 0
jmp 0x1000a0d8
push 0x1d36
push 0x11ba
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
jmp 0x1000a1e0
cmp byte [ebp + 0x1c], 0
je 0x1000a153
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1000a1e0
push 0
push 0x1821
push 0x1432
call dword [sym.imp.GDI32.dll_CreatePen]
jmp 0x1000a1e0
mov dword [ebp - 0x1c], 0x3312
cmp dword [ebp - 0x1c], 0x3641
jle 0x1000a1b7
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x20], 0x86c
xor edi, edi
mov ecx, edi
mov eax, ebx
shl eax, cl
lea ecx, [ebp - 0x5c]
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000a18b
mov eax, dword [eax]
push eax
call fcn.100442bc
pop ecx
push 0
push 1
lea ecx, [ebp - 0x5c]
call fcn.10004a91
inc edi
cmp edi, 0x3acb
jl 0x1000a170
add ebx, esi
dec dword [ebp - 0x20]
jne 0x1000a16e
inc esi
cmp esi, 0x4ec2
jl 0x1000a165
cmp dword [ebp - 0x1c], 0x2f8a
jge 0x1000a1cb
push str.tgqzvund_pyarwrbq_edch_cdm_geckug_kfdz_rbpfhhpf_tkwvrhd_xoroxgadc_ibxpa_whofvbxj_hgxg_htzbmgu
call fcn.100442bc
pop ecx
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0x1000a1e0
push 0x693
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000b1f3
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1005cd9a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb8
push ebx
mov dword [esp + 8], 0x2355
cmp dword [esp + 8], 0x255a
push esi
push edi
jle 0x1000b278
push 0x23
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor esi, esi
xor edi, edi
mov ebx, 0x2ec4
mov eax, edi
lea ecx, [esp + 0x60]
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000b256
mov eax, dword [eax]
push eax
call fcn.100442bc
pop ecx
push 0
push 1
lea ecx, [esp + 0x68]
call fcn.10004a91
add edi, esi
dec ebx
jne 0x1000b23e
inc esi
cmp esi, 0x354c
jl 0x1000b237
cmp dword [esp + 0x10], 0x233b
jge 0x1000b28d
push str.jycad_mewvsizq_mlv_mzlpvn_ryqj_pfa_phdtktb_smxwo_tlns_wqjxvm_qziuveqo_ybq_pnr_pgzc
call fcn.100442bc
pop ecx
or dword [esp + 0xcc], 0xffffffff
mov edx, 0x12c1
push ecx
lea ecx, [esp + 0xac]
call fcn.1003e262
pop ecx
push eax
lea ecx, [esp + 0x48]
mov dword [esp + 0xd0], 2
call fcn.10020108
push 0
push 1
lea ecx, [esp + 0xb0]
mov byte [esp + 0xd4], 4
call fcn.10004b5d
lea ecx, [esp + 0x44]
call fcn.10021a6f
push ecx
mov edx, 0x11c4
lea ecx, [esp + 0x30]
call fcn.1003e262
mov edx, 0x11c5
mov byte [esp + 0xd0], 5
lea ecx, [esp + 0x94]
call fcn.1003e262
pop ecx
mov edx, eax
mov byte [esp + 0xcc], 6
lea ecx, [esp + 0x14]
call fcn.10008f0f
push 0
push 1
lea ecx, [esp + 0x98]
mov byte [esp + 0xd4], 8
call fcn.10004b5d
push ecx
mov edx, 0x11c6
lea ecx, [esp + 0x7c]
call fcn.1003e262
pop ecx
mov edx, eax
mov byte [esp + 0xcc], 9
lea ecx, [esp + 0x20]
call fcn.10008f0f
push 0
push 1
lea ecx, [esp + 0x80]
mov byte [esp + 0xd4], 0xb
call fcn.10004b5d
mov esi, dword [esp + 0x18]
cmp dword [esp + 0x14], esi
je 0x1000b3c4
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x20]
cdq
push 0x18
pop edi
idiv edi
sub esi, dword [esp + 0x14]
mov ecx, eax
mov eax, esi
cdq
idiv edi
cmp eax, ecx
jne 0x1000b3c4
push 0x7b28
push 0x69cc
push ecx
lea eax, [esp + 0x2c]
mov edx, 0x797c
push eax
lea eax, [esp + 0x3c]
push eax
push ecx
lea eax, [esp + 0x2c]
push eax
push ecx
push 0x195e
mov cl, 1
call fcn.1000b119
add esp, 0x24
lea ecx, [esp + 0x20]
call fcn.1000bb49
lea ecx, [esp + 0x14]
call fcn.1000bb49
push 0
push 1
lea ecx, [esp + 0x34]
call fcn.10004b5d
or dword [esp + 0xcc], 0xffffffff
lea ecx, [esp + 0x44]
call fcn.10021c91
mov ecx, dword [esp + 0xc4]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000c60b
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005cde4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1000c642
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x1000c71c
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 0x1c36
mov dword [ebp - 0x2c], str.yhxbxfvz_pihubjyn_bdm_zerytu_xnq_tzgmce_uax_kzb
cmp dword [ebp - 0x1c], 0x1c73
jle 0x1000c6cc
and dword [ebp - 0x14], 0
jmp 0x1000c672
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x5d5f
jge 0x1000c6cc
and dword [ebp - 0x18], 0
jmp 0x1000c688
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x4b00
jge 0x1000c6ca
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
push dword [ebp - 0x30]
push dword [ebp - 0x34]
lea ecx, [ebp - 0x4c]
call fcn.10001a65
pop ecx
pop ecx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
call fcn.10004409
push eax
call fcn.100442bc
pop ecx
lea ecx, [ebp - 0x4c]
call fcn.100043ff
jmp 0x1000c681
jmp 0x1000c66b
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1000c6e0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x1a7c
jge 0x1000c6f6
push dword [ebp - 0x2c]
call fcn.100442bc
pop ecx
jmp 0x1000c712
or dword [ebp - 4], 0xffffffff
jmp 0x1000c71c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10011238
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1001126a
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
push 0x484a
push 0x20f7
push dword [ebp - 4]
push 0x5d1c
push 1
call fcn.100112dc
add esp, 0x14
jmp 0x100112d8
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001129a
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov byte [eax], 1
jmp 0x100112d8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x100112d8
push 0
push 0xae1
push 0x10a9
push 0x1c57
push 0x1dca
push 0x24e1
push 0xc3e
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov esp, ebp
pop ebp
ret
Function at 0x10012ac5
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005ce9c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10012c40
lea eax, [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x10012c16
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x18], eax
mov eax, dword [0x10076ab4]
and eax, 1
jne 0x10012b4c
mov eax, dword [0x10076ab4]
or eax, 1
mov dword [0x10076ab4], eax
and dword [ebp - 4], 0
mov ecx, 0x10076ab8
call fcn.1001f196
push 0x1005d79b
call fcn.10044292
pop ecx
or dword [ebp - 4], 0xffffffff
movzx eax, byte [0x10076a10]
test eax, eax
je 0x10012bac
mov ecx, 0x10076ab8
call fcn.1001f25b
movzx eax, al
test eax, eax
jne 0x10012bac
push dword [ebp - 0x10]
lea eax, [ebp - 0x14]
push eax
mov ecx, 0x10076ab8
call fcn.1001f264
lea eax, [ebp - 0x2c]
push eax
mov ecx, 0x10076ab8
call fcn.1001f24d
push eax
lea ecx, [ebp - 0x14]
call fcn.1001f183
movzx eax, al
test eax, eax
je 0x10012bac
lea ecx, [ebp - 0x14]
call fcn.1001f279
mov ecx, dword [ebp - 0x18]
mov eax, dword [eax + 4]
mov dword [ecx], eax
jmp 0x10012c4e
mov eax, dword [ebp - 0x10]
push dword [eax]
lea eax, [ebp - 0x44]
push eax
call fcn.1003ced1
pop ecx
pop ecx
mov dword [ebp - 4], 1
lea eax, [ebp - 0x44]
push eax
call fcn.100111fa
pop ecx
mov dword [ebp - 0x1c], eax
push 0x7fa3
push 1
push 0x10076a10
push 0x10076ab8
push 1
lea eax, [ebp - 0x1c]
push eax
push dword [ebp - 0x10]
call fcn.100126d4
add esp, 0x1c
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.10004563
jmp 0x10012c4e
push 0
push 0xae1
push 0x10a9
push 0x1c57
push 0x1dca
push 0x24e1
push 0xc3e
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x10012c4e
push 0
push 0x546f
call fcn.1000d5bd
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100235d2
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
mov byte [ebp - 4], cl
mov dword [ebp - 0x10], 0x7729
cmp dword [ebp - 0x10], 0x77d3
push esi
push edi
jle 0x10023656
xor edi, edi
xor esi, esi
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 8], 0x2890
xor ebx, ebx
mov eax, esi
lea ecx, [ebp - 0x30]
and eax, ebx
and eax, edi
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002361c
mov eax, dword [eax]
push eax
call fcn.100442bc
pop ecx
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.10004a91
inc ebx
cmp ebx, 0x34e2
jl 0x10023601
dec esi
dec dword [ebp - 8]
jne 0x100235ff
mov esi, dword [ebp - 0xc]
inc esi
mov dword [ebp - 0xc], esi
cmp esi, 0x4ebb
jl 0x100235f5
inc edi
cmp edi, 0x94
jl 0x100235f0
cmp dword [ebp - 0x10], 0x74a2
jge 0x1002366a
push str.eek_sunz_ztgmlbve_depi_mnyguxc_kks_bxetzvgxa
call fcn.100442bc
pop ecx
cmp byte [ebp - 4], 0
je 0x1002367a
mov eax, dword [ebp + 8]
dec dword [eax]
jmp 0x10023731
mov dword [ebp - 0x14], 0x1f53
cmp dword [ebp - 0x14], 0x2139
jle 0x10023708
xor esi, esi
mov dword [ebp - 0xc], esi
xor edi, edi
mov dword [ebp - 0x10], edi
mov ecx, edi
mov dword [ebp - 8], esi
mov edi, esi
xor ebx, ebx
sar edi, cl
mov dword [ebp - 8], edi
xor esi, esi
mov dword [ebp - 0x18], edi
and edi, ebx
mov eax, edi
lea ecx, [ebp - 0x48]
xor eax, esi
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100236c2
mov eax, dword [eax]
push eax
call fcn.100442bc
pop ecx
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.10004a91
inc esi
cmp esi, 0x3895
jl 0x100236a9
mov edi, dword [ebp - 8]
inc ebx
cmp ebx, 0x7316
jl 0x100236a2
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0xc]
inc edi
mov dword [ebp - 0x10], edi
cmp edi, 0x14c
jl 0x10023694
inc esi
mov dword [ebp - 0xc], esi
cmp esi, 0x2471
jl 0x1002368f
cmp dword [ebp - 0x14], 0x1b87
jge 0x1002371c
push str.pdxgpfd_tnoyc_gfigs_csphviss_skqzzcf_gxgyuk_fvnskmutu_xfwlagmk_fsbczf_kysuermur_xlvoz
call fcn.100442bc
pop ecx
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10023731
push 0x693
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10023738
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005d0ab
call fcn.1005c3e4
sub esp, 0x10
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
je 0x1002376c
push 0x1cd6
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CombineRgn]
jmp 0x10023805
mov dword [ebp - 0x18], 0x2430
cmp dword [ebp - 0x18], 0x2744
jle 0x100237c6
xor edi, edi
xor ebx, ebx
xor esi, esi
xor eax, eax
mov dword [ebp - 0x14], eax
add eax, esi
mov ecx, 0x100758b8
xor eax, ebx
xor eax, edi
cdq
push edx
push eax
call fcn.10004429
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x5f73
jl 0x10023787
inc esi
cmp esi, 0x11da
jl 0x10023782
inc ebx
cmp ebx, 0x7e35
jl 0x10023780
inc edi
cmp edi, 0x5e36
jl 0x1002377e
mov esi, dword [ebp - 0x1c]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x20d9
jge 0x10023801
mov edx, str.jprli_dzulwipxw_cgttsrfk_iqov_hshiacj_mgzejhn_nzjps
mov ecx, 0x100758b8
call fcn.100067d6
jmp 0x10023801
mov eax, dword [esi]
mov dword [esi], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10024626
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov byte [ebp - 8], cl
test dl, dl
je 0x10024654
cmp byte [ebp + 8], 0
je 0x1002464c
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x1002468e
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x1002468e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
jmp 0x1002468e
test cl, cl
je 0x1002467f
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1002468e
push 0x1e1e
push 1
push 1
push 0x6c16
xor dl, dl
mov ecx, 0x7d70
call fcn.10024f41
add esp, 0x10
jmp 0x1002468e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndDialog]
mov esp, ebp
pop ebp
ret
Function at 0x100246c7
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x1005d0bf
call fcn.1005c3e4
sub esp, 0x18
mov byte [ebp - 0x18], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x1002471e
test dl, dl
je 0x100246f8
xor dl, dl
mov byte [ebp - 0x11], 0
lea ecx, [ebp - 0x11]
call fcn.10024bbd
jmp 0x1002486e
mov esi, dword [ebp + 0xc]
mov ecx, esi
mov eax, dword [esi]
push dword [eax + 4]
call fcn.1002a41c
mov eax, dword [esi]
mov dword [eax + 4], eax
mov eax, dword [esi]
mov dword [eax], eax
mov eax, dword [esi]
mov dword [eax + 8], eax
and dword [esi + 4], 0
jmp 0x1002486e
mov dword [ebp - 0x20], 0x1d16
cmp dword [ebp - 0x20], 0x208d
jle 0x10024774
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov ebx, 0x4bd9
xor esi, esi
mov eax, edi
mov ecx, 0x100758b8
cdq
idiv esi
mov eax, edx
cdq
push edx
push eax
call fcn.10004429
inc esi
cmp esi, 0x6da9
jl 0x1002473c
mov esi, dword [ebp - 0x1c]
add edi, esi
dec ebx
jne 0x1002473a
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x5edc
jl 0x10024733
push ebx
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x1c95
jge 0x10024790
mov edx, str.aigpwjug_riaovnmnw_xuo_agzlbuv_tfudxqsvv_fdwxerl_bnqbsqc_lmsv_lfdsq_rbu_wfv_mqzswr
mov ecx, 0x100758b8
call fcn.100067d6
cmp byte [ebp + 0x14], 0
je 0x100247c9
push 0xe5
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x1002486e
mov esi, dword [ebp + 0x20]
xor edx, edx
mov ebx, dword [ebp + 0x18]
mov edi, dword [ebp + 8]
mov eax, dword [esi]
mov dword [ebx], eax
cmp dword [ebx], edx
je 0x1002482d
mov eax, dword [esi]
mov ecx, dword [ebx]
mov eax, dword [edi]
cmp ecx, eax
mov eax, dword [edi]
setne dl
xor ecx, ecx
cmp edx, eax
setle cl
cmp ecx, 0x7153413f
jl 0x10024806
cmp dword [edi], 0
jne 0x10024806
and dword [ebp - 0x20], 0
xor edx, edx
inc edx
jmp 0x1002480c
xor edx, edx
inc edx
mov dword [ebp - 0x20], edx
mov ecx, dword [esi]
mov eax, dword [esi]
add eax, dword [ebp - 0x20]
add ecx, eax
mov ecx, dword [ebp + 0x10]
jne 0x1002481c
mov eax, dword [ecx]
mov eax, dword [edi]
mov eax, dword [ebx]
mov dword [ecx], eax
mov eax, dword [ecx]
cmp dword [ecx], 0
jne 0x1002482b
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [edi]
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp + 0x24]
setne cl
xor edx, edx
mov dword [eax], ecx
mov ecx, dword [eax]
mov eax, dword [edi]
cmp ecx, eax
mov eax, dword [esi]
setl dl
xor ecx, ecx
cmp edx, eax
mov edx, dword [esi]
mov eax, dword [edi]
setl cl
imul edx, ecx
sub edx, 0xfffffff6
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
sub edx, eax
mov eax, dword [edi]
cmp edx, eax
mov eax, dword [ebp + 0x1c]
setg cl
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10024bd0
Capabilities:
Create pipe
Encode data using xor

Disassembly:
mov eax, 0x1005d0d3
call fcn.1005c3e4
sub esp, 0x30
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], dl
mov byte [ebp - 0x18], cl
je 0x10024d56
mov dword [ebp - 0x20], 0x3cc8
cmp dword [ebp - 0x20], 0x3d28
jle 0x10024c5b
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp + 8], edi
mov ecx, edi
mov dword [ebp - 0x24], esi
xor ebx, ebx
shl esi, cl
xor edi, edi
mov eax, esi
mov ecx, 0x100758b8
xor eax, edi
xor eax, ebx
cdq
push edx
push eax
call fcn.10004429
inc edi
cmp edi, 0x64ce
jl 0x10024c18
inc ebx
cmp ebx, 0x7808
jl 0x10024c16
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 0x1c]
inc edi
mov dword [ebp + 8], edi
cmp edi, 0xf27
jl 0x10024c0d
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x4514
jl 0x10024c08
cmp byte [ebp - 0x14], 0
je 0x10024ca2
mov byte [ebp + 0xb], 0
cmp byte [ebp + 0xb], 0
je 0x10024d1b
push 0x121e
push 0x74dc
push 0xd9b
push 0x2655
push 1
push 0x3e16
push 0x601e
push 0x5674
mov dl, 1
xor cl, cl
call fcn.100246c7
add esp, 0x20
jmp 0x10024d1b
mov dword [ebp + 8], 0x5db
cmp dword [ebp + 8], 0x6d3
jle 0x10024cf7
xor esi, esi
xor edi, edi
mov eax, esi
lea ecx, [ebp - 0x3c]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10024cd2
mov eax, dword [eax]
push eax
call fcn.100442bc
pop ecx
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.10004a91
inc edi
cmp edi, 0x2829
jl 0x10024cb6
inc esi
cmp esi, 0x1267
jl 0x10024cb4
cmp dword [ebp + 8], 0x4f5
jge 0x10024d0b
push str.joqlesqg_tbzobqx_lea_irw
call fcn.100442bc
pop ecx
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10024d1b
push 0
call dword [sym.imp.USER32.dll_CreateIconIndirect]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x3a04
jge 0x10024d3a
mov edx, str.rjietlrfo_jxm_iotuqlmn_uduuri_dicwxattz
mov ecx, 0x100758b8
call fcn.100067d6
jmp 0x10024db2
test cl, cl
je 0x10024d80
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x10024db2
push 0xc87
push 0x2651
push 0xdc6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
jmp 0x10024db2
mov byte [ebp + 0xb], 0
cmp byte [ebp + 0xb], 0
je 0x10024db2
push 0
push 0xae1
push 0x10a9
push 0x1c57
push 0x1dca
push 0x24e1
push 0xc3e
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10024dc3
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
mov dword [ebp - 0x14], 0x875
mov eax, edx
cmp dword [ebp - 0x14], 0xb0c
push esi
push edi
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
jle 0x10024e63
xor edi, edi
mov dword [ebp - 0x10], edi
xor esi, esi
mov dword [ebp - 0xc], esi
mov ebx, esi
mov dword [ebp - 8], 0x3d9f
and dword [ebp - 0x18], 0
mov esi, edi
mov edi, dword [ebp - 0x18]
mov ecx, ebx
sar esi, cl
mov eax, esi
lea ecx, [ebp - 0x38]
or eax, edi
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10024e1d
mov eax, dword [eax]
push eax
call fcn.100442bc
pop ecx
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.10004a91
inc edi
cmp edi, 0x2fab
jl 0x10024e04
mov edi, dword [ebp - 0x10]
dec ebx
dec dword [ebp - 8]
jne 0x10024df7
mov esi, dword [ebp - 0xc]
inc esi
mov dword [ebp - 0xc], esi
cmp esi, 0x7fd
jl 0x10024dee
inc edi
mov dword [ebp - 0x10], edi
cmp edi, 0x42de
jl 0x10024de9
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
cmp byte [ebp + 0xc], 0
je 0x10024e7f
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x10024e83
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x10024e83
mov eax, dword [eax]
mov dword [ecx], eax
cmp dword [ebp - 0x14], 0x563
jge 0x10024e97
push str.jjgvn_vzkg_rhau
call fcn.100442bc
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10025284
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005d0e7
call fcn.1005c3e4
push ecx
push ecx
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x100252b4
mov eax, dword [ebp + 0x10]
mov ecx, dword [edx]
add dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x14], 0x2876
cmp dword [ebp - 0x14], 0x2a45
jle 0x100252fa
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x100758b8
xor eax, esi
cdq
push edx
push eax
call fcn.10004429
inc edi
cmp edi, 0x22a2
jl 0x100252c8
inc esi
cmp esi, 0x304
jl 0x100252c6
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ClientToScreen]
mov eax, dword [ebp + 8]
dec dword [eax]
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x2490
jge 0x100252a3
mov edx, str.nxerg_ghkeqili_ugttdi_dcjhdp
mov ecx, 0x100758b8
call fcn.100067d6
jmp 0x100252a3