joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4039f0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x30
call sub.KERNEL32.dll_GetCommandLineW
lea ebx, [ebp - 0x10]
mov dword [esp + 8], 0xffffffff
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [method.QString.fromWCharArray_wchar_t_const__int_]
push edx
lea esi, [ebp - 0xc]
mov dword [esp + 4], ebx
mov dword [esp], esi
call dword [method.QString.toLocal8Bit___const]
push eax
mov eax, dword [ebp - 0x10]
lock dec dword [eax]
setne dl
test dl, dl
jne 0x403a40
mov eax, dword [ebp - 0x10]
mov dword [esp], eax
call dword [method.QString.free_QString::Data_]
mov dword [ebp - 0x14], 0
mov dword [esp + 4], 4
mov dword [esp], 0x30
call dword [method.QVectorData.allocate_int__int_]
mov ebx, eax
test eax, eax
je 0x403b88
mov dword [ebp - 0x18], ebx
mov dword [ebx], 1
mov dword [ebx + 8], 8
mov dword [ebx + 4], 8
mov al, byte [ebx + 0xc]
or eax, 1
and eax, 0xfffffffd
mov byte [ebx + 0xc], al
mov dword [esp + 8], 0x20
mov dword [esp + 4], 0
add ebx, 0x10
mov dword [esp], ebx
call dword [sym.imp.QtCore4.dll_qMemSet_void__int__unsigned_int_]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax]
dec edx
je 0x403b74
mov eax, dword [eax + 8]
mov dword [esp + 4], eax
mov dword [esp], esi
call dword [method.QByteArray.realloc_int_]
mov eax, dword [ebp - 0xc]
mov edx, dword [eax + 0xc]
lea ebx, [ebp - 0x18]
mov dword [esp + 0x14], ebx
lea eax, [ebp - 0x14]
mov dword [esp + 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [esp + 0xc], eax
mov dword [esp + 8], edx
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.QtCore4.dll_qWinMain_HINSTANCE____HINSTANCE____char__int__int__QVector_char__
mov eax, dword [ebp - 0x18]
mov edx, dword [eax]
dec edx
je 0x403b10
mov edx, dword [eax + 4]
mov dword [esp + 8], edx
mov eax, dword [eax + 8]
mov dword [esp + 4], eax
mov dword [esp], ebx
call fcn.00408678
mov eax, dword [ebp - 0x18]
add eax, 0x10
mov dword [esp + 4], eax
mov eax, dword [ebp - 0x14]
mov dword [esp], eax
call fcn.00403538
mov ebx, eax
mov eax, dword [ebp - 0x18]
test eax, eax
je 0x403b38
lock dec dword [eax]
setne dl
test dl, dl
je 0x403b5c
mov eax, dword [ebp - 0xc]
lock dec dword [eax]
setne dl
test dl, dl
jne 0x403b51
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call dword [sym.imp.QtCore4.dll_qFree_void_]
mov eax, ebx
lea esp, [ebp - 8]
pop ebx
pop esi
leave
ret 0x10
mov dword [esp + 4], 4
mov eax, dword [ebp - 0x18]
mov dword [esp], eax
call dword [method.QVectorData.free_QVectorData__int_]
jmp 0x403b38
mov edx, dword [eax + 0xc]
lea ecx, [eax + 0x10]
cmp edx, ecx
jne 0x403ab1
jmp 0x403ac7
call dword [sym.imp.QtCore4.dll_qBadAlloc__]
jmp 0x403a66
Function at 0x1000523d
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x10005254
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x10005276
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x10114ab4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x10114e40
jl 0x10005284
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x101150e4
jl 0x100052c4
mov ecx, dword [0x10115e30]
xor ecx, dword [0x10114ab4]
and ecx, edi
xor ecx, dword [0x10115e30]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x10114ab0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x101150e4]
mov dword [0x10115470], eax
pop esi
ret
Function at 0x1000c133
Capabilities:
Get common file path
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
mov byte [esp + 8], cl
push esi
push edi
test cl, cl
je 0x1000c179
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1000c203
push 0x19a4
push 0
push 1
push 0x5e0
push 0
mov edx, 0x4d43
mov ecx, 0x716f
call fcn.1000c9ba
add esp, 0x14
jmp 0x1000c203
mov dword [esp + 0x14], 0x2267
cmp dword [esp + 0x14], 0x2589
jle 0x1000c1d5
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
xor edi, edi
mov eax, edi
lea ecx, [esp + 0x18]
and eax, esi
cdq
push edx
push eax
call fcn.10001a8a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000c1af
mov eax, dword [eax]
push eax
call fcn.1004b583
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.10004d7a
inc edi
cmp edi, 0x67d2
jl 0x1000c195
inc esi
cmp esi, 0x266d
jl 0x1000c193
mov byte [esp + 0xf], 0
cmp byte [esp + 0xf], 0
je 0x1000c1ee
push 0x14c7
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [esp + 0x14], 0x220c
jge 0x1000c203
push str.vjtbpel_posvj_qled_yjmyso_miynvp_neyyd_jbxgxxd_tca_qoddx_xvgey
call fcn.1004b583
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000c315
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x1000c33e
cmp byte [edx], 0
je 0x1000c3c0
push 0
call fcn.1000bfe5
jmp 0x1000c3bf
mov dword [esp + 0x10], 0x6b7
cmp dword [esp + 0x10], 0x7c5
jle 0x1000c39a
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
xor esi, esi
xor edi, edi
mov eax, edi
lea ecx, [esp + 0x18]
or eax, esi
cdq
push edx
push eax
call fcn.10001a8a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000c374
mov eax, dword [eax]
push eax
call fcn.1004b583
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.10004d7a
inc edi
cmp edi, 0x38f4
jl 0x1000c35a
inc esi
cmp esi, 0x11b2
jl 0x1000c358
and dword [esp + 0x14], 0
lea eax, [esp + 0x14]
push eax
mov ecx, ebx
call fcn.1000f906
cmp dword [esp + 0x10], 0x394
jge 0x1000c3c0
push str.muixsmmo_cnrxq_uevpkwq_dubra_xjy_jissdf_nmqqci_yzuylzisi
call fcn.1004b583
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10010571
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
test dl, dl
je 0x10010585
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
mov eax, dword [ebp + 0xc]
add dword [eax], ecx
pop ebp
ret
push 0x14c7
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
pop ebp
ret
Function at 0x100125de
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100634a0
call fcn.100628b0
sub esp, 0x18
mov byte [ebp - 0x14], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, edx
mov dword [ebp - 0x24], edi
test cl, cl
je 0x1001260c
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
jmp 0x100126bb
mov dword [ebp - 0x20], 0x32c
cmp dword [ebp - 0x20], 0x44a
jle 0x10012673
push 0
call dword [sym.imp.USER32.dll_DestroyIcon]
xor esi, esi
mov dword [ebp - 0x1c], esi
mov edi, esi
mov dword [ebp - 0x18], 0x5f52
xor ebx, ebx
xor esi, esi
mov eax, esi
mov ecx, 0x1007f2b8
xor eax, ebx
or eax, edi
cdq
push edx
push eax
call fcn.1000473c
inc esi
cmp esi, 0x2807
jl 0x10012636
inc ebx
cmp ebx, 0x79c2
jl 0x10012634
dec edi
dec dword [ebp - 0x18]
jne 0x10012632
mov esi, dword [ebp - 0x1c]
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x5566
jl 0x10012629
mov edi, dword [ebp - 0x24]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x5d
jge 0x100126ab
mov edx, str.amanx_vpmt_jrbc_xtaqft_ntzmm_gdpsh_spkzbe
mov ecx, 0x1007f2b8
call fcn.1000877a
jmp 0x100126ab
cmp byte [edi], 0
je 0x100126bb
push 0x235d
call dword [sym.imp.USER32.dll_GetQueueStatus]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10012bc0
Capabilities:
Accept command line arguments
Encode data using xor

Disassembly:
mov eax, 0x100634aa
call fcn.100628b0
sub esp, 0x10
mov byte [ebp - 0x14], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10012c6b
mov dword [ebp - 0x18], 0x398d
cmp dword [ebp - 0x18], 0x39fb
jle 0x10012c2b
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, edi
mov ecx, 0x1007f2b8
cdq
idiv ebx
xor edx, esi
mov eax, edx
cdq
push edx
push eax
call fcn.1000473c
inc ebx
cmp ebx, 0x7acf
jl 0x10012bfa
inc edi
cmp edi, 0x390d
jl 0x10012bf8
inc esi
cmp esi, 0x722f
jl 0x10012bf6
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x3822
jge 0x10012c4f
mov edx, str.xzj_sjexiervo_vyujya_qedbersio_mrhn_hdpq_wzelamc_lyxqmnm_ynohpvq_fdnurxoe
mov ecx, 0x1007f2b8
call fcn.1000877a
jmp 0x10012c73
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10014396
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov byte [ebp - 0xc], dl
push esi
push edi
test dl, dl
je 0x1001442c
mov byte [ebp - 5], 0
cmp byte [ebp - 5], 0
je 0x1001443c
push 0
mov ecx, 0x77bb
call fcn.10013b01
mov dword [ebp - 0x10], 0x24ac
cmp dword [ebp - 0x10], 0x24bd
pop ecx
jle 0x10014416
xor esi, esi
xor edi, edi
mov eax, edi
lea ecx, [ebp - 0x28]
and eax, esi
cdq
push edx
push eax
call fcn.10001a8a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100143f1
mov eax, dword [eax]
push eax
call fcn.1004b583
pop ecx
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.10004d7a
inc edi
cmp edi, 0x10b7
jl 0x100143d8
inc esi
cmp esi, 0x675c
jl 0x100143d6
cmp dword [ebp - 0x10], 0x20c8
jge 0x1001443c
push str.fqegoecdg_mzi_mbsf_hzigfmrbv_gly_nthylbzc_niv_jayjnuks_ujd_tuoknvtys_dtqakmo_jqapnx
call fcn.1004b583
pop ecx
jmp 0x1001443c
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1001443c
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1001583b
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10063566
call fcn.100628b0
push ecx
push ecx
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
je 0x1001589d
cmp byte [ebp + 0xc], 0
je 0x1001588b
mov edx, dword [ebp + 0x1c]
xor esi, esi
inc esi
mov dword [edx], 0
jmp 0x10015876
mov ecx, dword [edx]
mov eax, dword [edi]
mov dword [eax + ecx*4], 0xffff
inc dword [edx]
cmp dword [edx], esi
jl 0x10015869
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [edx], 0
je 0x1001587a
push ecx
push ecx
mov dl, 1
call fcn.10012bc0
pop ecx
pop ecx
jmp 0x1001587a
mov dword [ebp + 0x10], 0x3928
cmp dword [ebp + 0x10], 0x3c14
jle 0x100158e0
xor esi, esi
xor edi, edi
xor ebx, ebx
lea eax, [ebx + edi]
mov ecx, 0x1007f2b8
xor eax, esi
cdq
push edx
push eax
call fcn.1000473c
inc ebx
cmp ebx, 0x261c
jl 0x100158b3
inc edi
cmp edi, 0x75c1
jl 0x100158b1
inc esi
cmp esi, 0x59af
jl 0x100158af
cmp byte [ebp + 0x14], 0
je 0x100158f0
push 0
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
jmp 0x10015910
mov edx, dword [ebp + 8]
xor esi, esi
inc esi
mov dword [edx], 0
cmp dword [edx], esi
jge 0x10015910
mov edi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [edi]
mov dword [eax + ecx*4], esi
inc dword [edx]
cmp dword [edx], esi
jl 0x10015903
and dword [ebp - 4], 0
cmp dword [ebp + 0x10], 0x3777
jge 0x1001587a
mov edx, str.jrklury_gtdav_pxiex_ghffvwk_vwdfw_kpomtwd_vhbjfuyji_dmaxfqukv_rlhsohdq
mov ecx, 0x1007f2b8
call fcn.1000877a
jmp 0x1001587a
Function at 0x10015c97
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006357a
call fcn.100628b0
sub esp, 0x14
push ebx
push esi
mov byte [ebp - 0x14], dl
mov ebx, ecx
mov dword [ebp - 0x1c], 0x643d
cmp dword [ebp - 0x1c], 0x67e4
push edi
mov dword [ebp - 0x10], esp
jle 0x10015ce6
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x1007f2b8
xor eax, esi
cdq
push edx
push eax
call fcn.1000473c
inc edi
cmp edi, 0x6a13
jl 0x10015cc3
inc esi
cmp esi, 0x1b24
jl 0x10015cc1
cmp byte [ebp - 0x14], 0
je 0x10015cf4
mov dword [ebx], 0xfffffffa
jmp 0x10015d10
push 0x3902
push 0x1c3a
push ecx
mov dl, 1
mov byte [ebp - 0x15], 0
lea ecx, [ebp - 0x15]
call fcn.10012716
add esp, 0xc
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x6084
jge 0x10015d2c
mov edx, str.wgigkmyzw_phr_mifvvg
mov ecx, 0x1007f2b8
call fcn.1000877a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001b96d
Capabilities:
Modify service

Disassembly:
mov eax, 0x10063834
call fcn.100628b0
sub esp, 0x6c
push ebx
push esi
push edi
mov dword [ebp - 0x10], 0x102f
cmp dword [ebp - 0x10], 0x10c4
push 0
pop ebx
jle 0x1001b9e4
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
sar eax, cl
lea ecx, [ebp - 0x5c]
cdq
push edx
push eax
call fcn.10001a8a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001b9c0
mov eax, dword [eax]
push eax
call fcn.1004b583
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x5c]
call fcn.10004d7a
inc edi
cmp edi, 0xa56
jl 0x1001b9a5
inc esi
cmp esi, 0x7b0e
jl 0x1001b9a3
cmp dword [ebp - 0x10], 0xec7
jge 0x1001b9f8
push str.jcs_ebj_hfvgl_ossz_rmfnthwfk
call fcn.1004b583
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0xc], 0
je 0x1001ba30
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1001bb57
push ebx
push 0x2d42
push 0x446d
mov edx, 0x2fa2
mov ecx, 0x6aff
call fcn.1001ce2b
add esp, 0xc
jmp 0x1001bb57
xor eax, eax
lea ecx, [ebp - 0x44]
inc eax
mov dword [ebp - 0x18], eax
push eax
call fcn.100049ee
mov dword [ebp - 4], 4
lea ecx, [ebp - 0x38]
xor eax, eax
mov dword [ebp - 0x2c], 0x907c4e7c
inc eax
mov dword [ebp - 0x20], 2
mov dword [ebp - 0x28], eax
push eax
call fcn.100049ee
mov byte [ebp - 4], 5
mov dword [ebp - 0x10], 0x9af
cmp dword [ebp - 0x10], 0x9fa
jle 0x1001baba
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
shl eax, cl
lea ecx, [ebp - 0x74]
cdq
push edx
push eax
call fcn.10001a8a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001ba96
mov eax, dword [eax]
push eax
call fcn.1004b583
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x74]
call fcn.10004d7a
inc edi
cmp edi, 0x2df1
jl 0x1001ba7b
inc esi
cmp esi, 0x1b59
jl 0x1001ba79
mov dword [ebp - 0x1c], ebx
cmp dword [ebp - 0x10], 0x76c
jge 0x1001bad1
push str.fnpcs_svjlpjgox_kozssotuo_thvlry_eejquc_irmci_bagqsrx_evbe_mcslcbme_eoiy_vjudzkrrc_tgvjxq
call fcn.1004b583
pop ecx
push 0x6451
push 0x49a9
lea eax, [ebp - 0x14]
mov dword [ebp - 4], 5
push eax
push 0x310b
push 0x79f9
lea eax, [ebp - 0x44]
mov dword [ebp - 0x24], 0x4605dd88
push eax
push ebx
push ebx
push 0x378b
mov dl, 1
mov ecx, 0x5f2e
call fcn.1001ce5a
add esp, 0x24
lea eax, [ebp - 0x38]
lea edx, [ebp - 0x14]
push eax
push ecx
call fcn.1001b7f0
pop ecx
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x18]
push eax
push ecx
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x44]
push eax
lea eax, [ebp - 0x20]
push eax
push ecx
lea eax, [ebp - 0x24]
push eax
lea edx, [ebp - 0x28]
lea ecx, [ebp - 0x2c]
call fcn.1001bbe6
add esp, 0x24
lea ecx, [ebp - 0x38]
call fcn.10004a4b
lea ecx, [ebp - 0x44]
call fcn.10004a4b
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001d2e5
Capabilities:
Delete file

Disassembly:
mov eax, 0x10063969
call fcn.100628b0
sub esp, 0x3c
mov byte [ebp - 0x18], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x1001d463
mov dword [ebp - 0x2c], 0x5a16
cmp dword [ebp - 0x2c], 0x5dd1
jle 0x1001d37a
xor esi, esi
mov dword [ebp - 0x24], esi
xor edi, edi
mov dword [ebp - 0x20], edi
xor ebx, ebx
mov dword [ebp - 0x28], esi
mov ecx, edi
mov dword [ebp - 0x1c], ebx
sar esi, cl
mov edi, ebx
mov ebx, 0x2ed9
mov eax, edi
mov ecx, 0x1007f2b8
or eax, esi
cdq
push edx
push eax
call fcn.1000473c
dec edi
dec ebx
jne 0x1001d330
mov ebx, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 0x1c], ebx
cmp ebx, 0x3a24
jl 0x1001d329
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x24]
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x68bb
jl 0x1001d31d
inc esi
mov dword [ebp - 0x24], esi
cmp esi, 0xdfb
jl 0x1001d318
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov byte [ebp - 0x11], 0
lea edx, [ebp - 0x11]
push 0x7f03
xor cl, cl
call fcn.1001b52e
mov dword [ebp - 0x28], 0x525b
cmp dword [ebp - 0x28], 0x55ee
pop ecx
jle 0x1001d414
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x20], edi
mov eax, esi
mov dword [ebp - 0x24], 0x4295
cdq
xor ebx, ebx
idiv edi
mov dword [ebp - 0x30], edx
mov esi, ebx
mov edi, 0x47d4
mov eax, esi
lea ecx, [ebp - 0x48]
cdq
push edx
push eax
call fcn.10001a8a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001d3d7
mov eax, dword [eax]
push eax
call fcn.1004b583
pop ecx
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.10004d7a
dec esi
dec edi
jne 0x1001d3c0
add ebx, dword [ebp - 0x30]
dec dword [ebp - 0x24]
jne 0x1001d3b9
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x226
jl 0x1001d3a8
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x416b
jl 0x1001d3a3
cmp dword [ebp - 0x28], 0x5105
jge 0x1001d428
push str.iykgaydwn_gjrqzvx_syxufp_odou_gwowcg_tnuuhcu_ewn_sfva_xdjurear_phl_srad_porvupft_qycgxnwu_nrs
call fcn.1004b583
pop ecx
mov dword [ebp - 4], 2
cmp dword [ebp - 0x2c], 0x5826
jge 0x1001d447
mov edx, str.mgsdcik_wbyx_bbjjkxhg_fwuneqjx
mov ecx, 0x1007f2b8
call fcn.1000877a
jmp 0x1001d465
inc dword [edx]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001e579
Capabilities:
Get common file path

Disassembly:
mov eax, 0x100639e2
call fcn.100628b0
sub esp, 0x44
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
je 0x1001e5e0
cmp byte [ebp + 8], 0
je 0x1001e5ae
and dword [edx], 0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x20]
mov ecx, dword [eax]
mov eax, dword [esi]
sub eax, ecx
push eax
push ecx
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x38]
push eax
call fcn.1001f72a
mov ecx, dword [ebp + 0x10]
and dword [ebp - 4], 0
push eax
call fcn.1001f7d8
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.10005081
jmp 0x1001e59d
cmp byte [ebp + 0x14], 0
je 0x1001e67c
mov dword [ebp - 0x14], 0x71e7
cmp dword [ebp - 0x14], 0x73b3
jle 0x1001e64c
xor esi, esi
xor ebx, ebx
mov dword [ebp + 0x18], 0x5f0d
xor edi, edi
mov eax, ebx
lea ecx, [ebp - 0x50]
and eax, edi
cdq
push edx
push eax
call fcn.10001a8a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001e620
mov eax, dword [eax]
push eax
call fcn.1004b583
pop ecx
push 0
push 1
lea ecx, [ebp - 0x50]
call fcn.10004d7a
inc edi
cmp edi, 0x6cb3
jl 0x1001e607
add ebx, esi
dec dword [ebp + 0x18]
jne 0x1001e605
inc esi
cmp esi, 0x4db1
jl 0x1001e5fc
cmp dword [ebp - 0x14], 0x6fe0
jge 0x1001e660
push str.ojm_dvsbw_rlkkgd_qbzjc_duhw_dcfd_woqpdoh_bvcww_tmx_xyicysc_zsfed
call fcn.1004b583
pop ecx
mov eax, dword [ebp + 0x1c]
or dword [ebp - 4], 0xffffffff
cmp byte [eax], 0
je 0x1001e59d
mov cl, 1
call fcn.1001b67f
jmp 0x1001e59d
mov byte [ebp + 0x1b], 0
mov dword [ebp - 0x1c], 0xfb1
cmp dword [ebp - 0x1c], 0x11ba
jle 0x1001e6df
xor edi, edi
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x14], 0x4e9
mov ecx, esi
mov eax, ebx
sar eax, cl
mov ecx, 0x1007f2b8
or eax, edi
cdq
push edx
push eax
call fcn.1000473c
dec esi
dec dword [ebp - 0x14]
jne 0x1001e6a3
mov esi, dword [ebp - 0x18]
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x3e3d
jl 0x1001e699
inc ebx
cmp ebx, 0x31fb
jl 0x1001e694
inc edi
cmp edi, 0x6ad8
jl 0x1001e692
cmp byte [ebp + 0x1b], 0
je 0x1001e6f2
push 0x14c7
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 4], 3
cmp dword [ebp - 0x1c], 0xc13
jge 0x1001e59d
mov edx, str.udfbzkegd_rmdwoy_tlu_jaofq_chfrodgta_klfpdx_thmmwx
mov ecx, 0x1007f2b8
call fcn.1000877a
jmp 0x1001e59d
Function at 0x1002354d
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10063b69
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], 0x4f5
mov dword [ebp - 0x24], str.ltut_yjpbrbdwg_inqetida_nllnjcmbr_ulmizv_yuiidp_xmhmpey
cmp dword [ebp - 0x1c], 0x507
jle 0x100235fb
and dword [ebp - 0x14], 0
jmp 0x10023593
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x5674
jge 0x100235ef
and dword [ebp - 0x18], 0
jmp 0x100235a9
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x52e1
jge 0x100235ed
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
shl eax, cl
cdq
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edx
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x44]
call fcn.10001a8a
pop ecx
pop ecx
mov dword [ebp - 0x20], eax
mov ecx, dword [ebp - 0x20]
call fcn.100045ca
push eax
call fcn.1004b583
pop ecx
lea ecx, [ebp - 0x44]
call fcn.100045c0
jmp 0x100235a2
jmp 0x1002358c
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
push 1
push 0x596b
push dword [ebp + 8]
push dword [ebp + 0x10]
push 0x54be
push 0
push 0x2375
push dword [ebp + 0xc]
push 0x48da
call fcn.1002b00d
add esp, 0x24
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x2ad
jge 0x1002363a
push dword [ebp - 0x24]
call fcn.1004b583
pop ecx
jmp 0x10023656
or dword [ebp - 4], 0xffffffff
jmp 0x10023660
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002c76f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1002c7ac
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push 0
push dword [ebp - 8]
mov eax, dword [ebp - 0xc]
push dword [eax]
push 0x166f
push 0x3107
push 0xe3a
call fcn.1002cc92
add esp, 0x18
jmp 0x1002c7e3
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1002c7ca
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
jmp 0x1002c7e3
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002c7e3
push 0x14c7
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov esp, ebp
pop ebp
ret
Function at 0x10034670
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10034734
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x100346c5
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100346c3
push 0x5e0d
push 0x7395
push 0
push 0x6f6a
call fcn.100442ac
add esp, 0x10
jmp 0x10034732
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0x10
jmp 0x100346f3
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xffffffea
jge 0x10034732
push 0
push 0
push 0x5c89
push dword [ebp - 0x20]
push 0x4417
call fcn.100306b1
add esp, 0x14
mov byte [ebp - 2], 0
push 0
lea eax, [ebp - 2]
push eax
push 0x709
push 0x4588
call fcn.10038fea
add esp, 0x10
jmp 0x100346e8
jmp 0x10034769
lea eax, [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x10034753
push 0x14c7
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x10034769
push 0x19b3
push 0
push 0
push 0x205f
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
mov esp, ebp
pop ebp
ret