joyce8/EMBER2024-capa huggingface dataset:
Function at 0x579140
Capabilities:
Allocate or change rwx memory

Disassembly:
push edi
push esi
push ebx
mov ebx, eax
sub esp, 0x30
mov esi, dword [0xbcfd14]
test esi, esi
jle 0x579260
mov eax, dword [0xbcfd18]
xor ecx, ecx
add eax, 0xc
mov edx, dword [eax]
cmp edx, ebx
ja 0x579174
mov edi, dword [eax + 4]
add edx, dword [edi + 8]
cmp ebx, edx
jb 0x5791f7
add ecx, 1
add eax, 0x14
cmp ecx, esi
jne 0x579160
mov dword [esp], ebx
call dbg.__mingw_GetSectionForAddress
mov edi, eax
test eax, eax
je 0x579287
mov eax, dword [0xbcfd18]
lea ebx, [esi + esi*4]
shl ebx, 2
add eax, ebx
mov dword [eax + 0x10], edi
mov dword [eax], 0
call dbg._GetPEImageBase
mov edx, dword [0xbcfd18]
add eax, dword [edi + 0xc]
mov dword [edx + ebx + 0xc], eax
lea edx, [esp + 0x14]
mov dword [esp + 8], 0x1c
mov dword [esp + 4], edx
mov dword [esp], eax
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
sub esp, 0xc
test eax, eax
je 0x579267
mov eax, dword [esp + 0x28]
lea edx, [eax - 0x40]
and edx, 0xffffffbf
je 0x5791f0
lea edx, [eax - 4]
and edx, 0xfffffffb
jne 0x579200
add dword [0xbcfd14], 1
add esp, 0x30
pop ebx
pop esi
pop edi
ret
cmp eax, 2
mov edx, 0x40
mov eax, 4
mov ecx, dword [esp + 0x20]
cmovne eax, edx
mov edx, dword [esp + 0x14]
add ebx, dword [0xbcfd18]
mov dword [ebx + 8], ecx
mov dword [ebx + 4], edx
mov dword [esp + 0xc], ebx
mov dword [esp + 8], eax
mov dword [esp + 4], ecx
mov dword [esp], edx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
test eax, eax
jne 0x5791f0
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [esp], str.__VirtualProtect_failed_with_code_0x_x
mov dword [esp + 4], eax
call dbg.__report_error
lea esi, [esi]
lea esi, [esi]
xor esi, esi
jmp 0x57917e
mov eax, dword [0xbcfd18]
mov eax, dword [eax + ebx + 0xc]
mov dword [esp + 8], eax
mov eax, dword [edi + 8]
mov dword [esp], str.__VirtualQuery_failed_for__d_bytes_at_address__p
mov dword [esp + 4], eax
call dbg.__report_error
mov dword [esp + 4], ebx
mov dword [esp], str.Address__p_has_no_image_section
call dbg.__report_error
lea esi, [esi]
nop

Function at 0x579740
Capabilities:
Get thread local storage value

Disassembly:
push ebp
push edi
push esi
push ebx
sub esp, 0x1c
mov dword [esp], 0xbcfd30
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [0xbcfd28]
sub esp, 4
test ebx, ebx
je 0x579795
mov ebp, dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
lea esi, [esi]
mov eax, dword [ebx]
mov dword [esp], eax
call ebp
sub esp, 4
mov esi, eax
call edi
test eax, eax
jne 0x57978e
test esi, esi
je 0x57978e
mov eax, dword [ebx + 4]
mov dword [esp], esi
call eax
mov ebx, dword [ebx + 8]
test ebx, ebx
jne 0x579770
mov dword [esp], 0xbcfd30
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
sub esp, 4
add esp, 0x1c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x579ac0
Capabilities:
Parse pe header

Disassembly:
xor eax, eax
cmp word [0x400000], 0x5a4d
jne 0x579ae5
mov ecx, dword [0x40003c]
cmp dword [ecx + 0x400000], 0x4550
lea edx, [ecx + 0x400000]
je 0x579af0
ret
cmp word [ecx + 0x400018], 0x10b
jne 0x579ae5
push esi
movzx eax, word [ecx + 0x400014]
push ebx
movzx esi, word [ecx + 0x400006]
mov ebx, dword [esp + 0xc]
lea eax, [edx + eax + 0x18]
sub ebx, 0x400000
test esi, esi
je 0x579b38
xor ecx, ecx
nop
mov edx, dword [eax + 0xc]
cmp ebx, edx
jb 0x579b2e
add edx, dword [eax + 8]
cmp ebx, edx
jb 0x579b3a
add ecx, 1
add eax, 0x28
cmp ecx, esi
jne 0x579b20
xor eax, eax
pop ebx
pop esi
ret
Function at 0x10003113
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006281f
call fcn.10062184
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x1c], 0x5b92
mov edi, edx
xor esi, esi
mov dword [ebp - 0x10], esp
cmp dword [ebp - 0x1c], 0x5d39
mov dword [ebp - 0x20], edi
jle 0x1000319b
mov ebx, esi
mov edi, esi
mov dword [ebp - 0x18], esi
mov ecx, esi
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
lea eax, [esi + edi]
xor eax, ecx
mov ecx, 0x1007f278
xor eax, ebx
cdq
push edx
push eax
call fcn.1000b2a8
mov ecx, dword [ebp - 0x14]
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x3023
jl 0x1000314c
inc esi
push 0
mov dword [ebp - 0x18], esi
cmp esi, 0x53cd
pop esi
jl 0x10003144
inc edi
cmp edi, 0x2494
jl 0x10003141
inc ebx
cmp ebx, 0x78f0
jl 0x1000313f
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov edi, dword [ebp - 0x20]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x1c], 0x58b0
jge 0x100031d7
mov edx, str.ehovds_wtbm_zzuq_vtqnxzc
mov ecx, 0x1007f278
call fcn.1000ee32
jmp 0x100031d7
cmp byte [ebp + 0x14], 0
je 0x10003208
mov edx, dword [ebp + 8]
mov dword [edx], esi
cmp dword [edx], 0xfffffff5
jle 0x10003220
mov ebx, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x18]
mov dword [edi], esi
jmp 0x100031fa
mov ecx, dword [edi]
mov eax, dword [ebx]
mov dword [eax + ecx*4], esi
inc dword [edi]
cmp dword [edi], 4
jl 0x100031f1
dec dword [edx]
cmp dword [edx], 0xfffffff5
jg 0x100031ed
jmp 0x10003220
mov dword [edi], esi
cmp dword [edi], 3
jge 0x10003220
mov edx, dword [ebp + 0xc]
mov ecx, dword [edi]
mov eax, dword [edx]
mov dword [eax + ecx*4], esi
inc dword [edi]
cmp dword [edi], 3
jl 0x10003212
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10003231
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10062829
call fcn.10062184
sub esp, 0xc
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x100032f5
mov dword [ebp - 0x18], 0x2201
cmp dword [ebp - 0x18], 0x2515
jle 0x1000329a
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
mov ebx, 0x618d
xor esi, esi
mov eax, edi
mov ecx, 0x1007f278
xor eax, esi
cdq
push edx
push eax
call fcn.1000b2a8
inc esi
cmp esi, 0x759e
jl 0x1000326c
mov esi, dword [ebp - 0x14]
add edi, esi
dec ebx
jne 0x1000326a
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x360e
jl 0x10003263
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x1ed8
jge 0x100032b6
mov edx, str.rxif_yemyaoraw_xwjfiho_bglsb_exys_ovyulcno_xrywh_tbenos
mov ecx, 0x1007f278
call fcn.1000ee32
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x10003309
mov esi, dword [ebp + 0x2c]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [edx]
cmp dword [edx], 3
jl 0x100032c7
jmp 0x10003309
push 0x7f2
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100035c5
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [ebp + 0x10], 0
mov byte [ebp - 4], dl
mov byte [ebp - 8], cl
je 0x100035f4
test dl, dl
je 0x100035e1
mov eax, dword [ebp + 8]
inc dword [eax]
jmp 0x10003628
xor eax, eax
push eax
push eax
push 0x2222
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
jmp 0x10003628
test cl, cl
je 0x10003611
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x10003628
push 0x1436
xor eax, eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x10003628
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10003628
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
mov esp, ebp
pop ebp
ret
Function at 0x1000476e
Capabilities:
Get graphical window text
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 8], 0x7799
mov esi, edx
cmp dword [ebp - 8], 0x7851
mov ebx, ecx
push 0
mov dword [ebp - 0xc], esi
mov dword [ebp - 0x10], ebx
pop edi
jle 0x10004823
push edi
push edi
push edi
push edi
push edi
push edi
push edi
push 0x1fcb
push 0x4dd
push 0x1dfe
push edi
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
xor ebx, ebx
xor esi, esi
xor ecx, ecx
mov dword [ebp - 4], ecx
mov eax, esi
cdq
idiv ecx
mov eax, ebx
lea ecx, [ebp - 0x28]
sub eax, edx
or eax, edi
cdq
push edx
push eax
call fcn.10001351
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100047de
mov eax, dword [eax]
push eax
call fcn.10049280
pop ecx
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.100017dc
mov ecx, dword [ebp - 4]
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x5e0
jl 0x100047be
inc esi
cmp esi, 0x25ad
jl 0x100047b9
inc ebx
cmp ebx, 0x4f63
jl 0x100047b7
inc edi
cmp edi, 0x1338
jl 0x100047b5
mov esi, dword [ebp - 0xc]
xor edi, edi
mov ebx, dword [ebp - 0x10]
cmp dword [ebp - 8], 0x74f1
jge 0x10004837
push str.ihvpwna_oiit_rbmsonho_gwstk
call fcn.10049280
pop ecx
cmp byte [ebp + 8], 0
je 0x10004852
push 0x23f5
push edi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x10004868
mov dword [esi], edi
jmp 0x10004863
mov ecx, dword [esi]
mov eax, dword [ebx]
mov dword [eax + ecx*4], 1
inc dword [esi]
cmp dword [esi], 2
jl 0x10004856
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000486f
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006289e
call fcn.10062184
sub esp, 0x18
push ebx
push esi
mov dword [ebp - 0x18], 0x11ab
mov ebx, edx
cmp dword [ebp - 0x18], 0x14e7
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ebx
jle 0x100048e0
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
and dword [ebp - 0x20], 0
mov ebx, esi
mov esi, dword [ebp - 0x20]
mov ecx, edi
shl ebx, cl
mov eax, ebx
mov ecx, 0x1007f278
xor eax, esi
cdq
push edx
push eax
call fcn.1000b2a8
inc esi
cmp esi, 0x3803
jl 0x100048ab
mov esi, dword [ebp - 0x14]
inc edi
cmp edi, 0x313e
jl 0x1000489e
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x4602
jl 0x1000489c
mov ebx, dword [ebp - 0x1c]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x1170
jge 0x1000491b
mov edx, str.ijnyduwpk_rkxdig_persoagar_tchjlzqrv_zmtlcb_ixc
mov ecx, 0x1007f278
call fcn.1000ee32
jmp 0x1000491b
cmp byte [ebp + 8], 0
je 0x1000492f
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
mov dword [eax], ecx
mov dword [ebx], ecx
jmp 0x1000493c
push 0x75e
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004b7d
Capabilities:
Get common file path

Disassembly:
mov eax, 0x100628b2
call fcn.10062184
sub esp, 0x28
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], ecx
je 0x10004ce7
cmp byte [ebp + 8], 0
je 0x10004cc2
mov dword [ebp - 0x1c], 0x83a
cmp dword [ebp - 0x1c], 0x9af
jle 0x10004c26
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x14], edi
xor ebx, ebx
mov dword [ebp + 0xc], ebx
mov eax, edi
mov dword [ebp - 0x20], esi
cdq
mov edi, 0x218
idiv ebx
mov dword [ebp - 0x24], edx
mov ebx, edx
mov eax, esi
mov ecx, 0x1007f278
cdq
push edx
push eax
call fcn.1000b2a8
add esi, ebx
dec edi
jne 0x10004bd8
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp - 0x18]
inc ebx
mov edi, dword [ebp - 0x14]
mov dword [ebp + 0xc], ebx
cmp ebx, 0x438b
jl 0x10004bc6
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x7763
jl 0x10004bc1
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x9b3
jl 0x10004bbc
push 0x14fb
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x563
jge 0x10004c42
mov edx, str.rodzdlkvo_gbrodns_ozksgt_kncyn_nzeorzs_oix_hygmro_eniypl_uumqxil_dvq_uiqcspc
mov ecx, 0x1007f278
call fcn.1000ee32
mov eax, dword [ebp + 0x10]
or dword [ebp - 4], 0xffffffff
mov ebx, dword [ebp + 0x28]
mov edi, dword [ebp + 0x14]
mov ecx, edi
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x28]
push ebx
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x2c]
push eax
call fcn.1000bc03
mov esi, dword [ebp - 0x2c]
cmp esi, dword [edi]
je 0x10004c76
mov eax, dword [ebx]
cmp eax, dword [esi + 0x10]
jge 0x10004c9a
push ecx
lea eax, [ebp + 0xc]
mov dword [ebp + 0xc], ebx
push eax
push ecx
mov ecx, edi
call fcn.1000fa7e
push eax
add eax, 0x10
mov ecx, edi
push eax
push esi
lea eax, [ebp - 0x30]
push eax
call fcn.1000faae
mov esi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x24]
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x18], eax
jmp 0x10004d18
mov edx, dword [ebp + 0x20]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10004d18
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xd95da228
inc dword [edx]
cmp dword [edx], 2
jl 0x10004cd3
jmp 0x10004d18
cmp byte [ebp + 0x1c], 0
je 0x10004cf5
mov dword [edx], 0xfffffffc
jmp 0x10004d18
mov edx, dword [ebp + 0x24]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x10004d18
mov esi, dword [ebp + 0x2c]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 7
inc dword [edx]
cmp dword [edx], 3
jl 0x10004d06
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100057c2
Capabilities:
Query service status

Disassembly:
mov eax, 0x100628d8
call fcn.10062184
sub esp, 0x1c
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x10005800
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x100057ef
mov ecx, 0x100c
call fcn.10006ec3
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x20], 0x1531
cmp dword [ebp - 0x20], 0x1613
jle 0x1000586e
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x18], edi
xor ebx, ebx
and dword [ebp - 0x24], 0
mov eax, edi
cdq
idiv ebx
lea edi, [edx + esi]
mov esi, dword [ebp - 0x24]
mov ecx, esi
mov eax, edi
sar eax, cl
mov ecx, 0x1007f278
cdq
push edx
push eax
call fcn.1000b2a8
inc esi
cmp esi, 0x609b
jl 0x1000582b
mov esi, dword [ebp - 0x1c]
inc ebx
mov edi, dword [ebp - 0x18]
cmp ebx, 0x1304
jl 0x1000581c
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x5c49
jl 0x1000581a
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x25a0
jl 0x10005815
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x10005880
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x1364
jge 0x100057ef
mov edx, str.kkdxkmay_nzgbpwbac_qqclddlf_zguqt_rutdbv_bqwv_zrwcrt_xkmwdyf_huqi_ovrkm_yitydwhm
mov ecx, 0x1007f278
call fcn.1000ee32
jmp 0x100057ef

Function at 0x10006803
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0xc], 0
je 0x1000681e
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x10006823
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop ebp
ret
mov eax, dword [ebp + 8]
mov dword [ecx], eax
pop ebp
ret
Function at 0x10006ee7
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
cmp byte [ebp + 0x10], 0
push ebx
push esi
mov ebx, edx
mov byte [esp + 0xc], cl
push edi
mov dword [esp + 0x24], ebx
je 0x10006fc9
cmp byte [ebp + 8], 0
je 0x10006fb5
mov dword [esp + 0x14], 0x69f7
cmp dword [esp + 0x14], 0x6dba
jle 0x10006f74
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
lea ecx, [esp + 0x28]
and eax, edi
and eax, esi
cdq
push edx
push eax
call fcn.10001351
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10006f45
mov eax, dword [eax]
push eax
call fcn.10049280
pop ecx
push 0
push 1
lea ecx, [esp + 0x30]
call fcn.100017dc
inc ebx
cmp ebx, 0x5445
jl 0x10006f29
inc edi
cmp edi, 0x1ea5
jl 0x10006f27
inc esi
cmp esi, 0xa81
jl 0x10006f25
cmp dword [esp + 0x14], 0x6888
jge 0x10006f89
push str.czzg_bidjdgqt_rtmdhx_ueywrgnft_kjkezfjj_tlozesggl_bowxgx_ntmiw_qwtxbnk_jszbes
call fcn.10049280
pop ecx
mov esi, dword [ebp + 0x14]
mov eax, dword [esi]
mov dword [eax], 3
jmp 0x10006fa9
push 0x484
push ecx
xor cl, cl
call fcn.10005f2d
mov eax, dword [esi]
pop ecx
pop ecx
dec dword [eax]
mov eax, dword [esi]
cmp dword [eax], 0
jge 0x10006f96
jmp 0x100070d7
push 0xaaf
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x100070d7
test cl, cl
je 0x10006fda
push 0
call dword [sym.imp.KERNEL32.dll_ResetEvent]
jmp 0x100070d7
mov dword [esp + 0x20], 0x5bef
cmp dword [esp + 0x20], 0x5f36
jle 0x1000706b
xor edi, edi
xor esi, esi
mov dword [esp + 0x1c], esi
xor eax, eax
mov dword [esp + 0x18], 0x5073
mov dword [esp + 0x14], eax
mov esi, dword [esp + 0x14]
xor ebx, ebx
mov ecx, ebx
mov eax, esi
sar eax, cl
lea ecx, [esp + 0x40]
or eax, edi
cdq
push edx
push eax
call fcn.10001351
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10007026
mov eax, dword [eax]
push eax
call fcn.10049280
pop ecx
push 0
push 1
lea ecx, [esp + 0x48]
call fcn.100017dc
inc ebx
cmp ebx, 0x2765
jl 0x10007008
mov esi, dword [esp + 0x1c]
add dword [esp + 0x14], esi
dec dword [esp + 0x18]
jne 0x10007002
inc esi
mov dword [esp + 0x1c], esi
cmp esi, 0x1e4b
jl 0x10006ff4
inc edi
cmp edi, 0x585f
jl 0x10006fee
mov ebx, dword [esp + 0x24]
cmp dword [esp + 0x20], 0x59c9
jge 0x10007080
push str.rroixrvl_xgrb_bjikyhga_ogfvgno_omkaei_sxfozoglx_itwvdi_tbr
call fcn.10049280
pop ecx
mov esi, dword [ebp + 0x18]
xor edx, edx
mov ecx, dword [esi]
mov eax, dword [esi]
cmp ecx, eax
mov eax, dword [esi]
setge dl
imul eax, edx
test eax, eax
jne 0x10007099
mov eax, dword [esi]
mov eax, dword [esi]
xor edx, edx
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [ebp + 0xc]
mov dword [eax], 0x920a
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [esi]
mov dword [ebx], eax
mov eax, dword [ebx]
test eax, eax
mov ecx, dword [esi]
mov eax, dword [esi]
sete dl
imul ecx, edx
xor edx, edx
cmp ecx, eax
mov ecx, dword [esi]
mov eax, dword [ebp + 0x1c]
setne dl
imul ecx, edx
mov dword [eax], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100119fb
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10062da2
call fcn.10062184
sub esp, 0x14
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
cmp byte [ebp + 0x10], 0
je 0x10011a6b
mov ecx, dword [ebp + 0x18]
mov eax, dword [ecx]
cmp dword [ecx], esi
jne 0x10011a33
mov eax, dword [ecx]
mov eax, dword [ecx]
mov eax, dword [ecx]
mov eax, dword [ecx]
mov eax, dword [ecx]
mov eax, dword [ecx]
cmp dword [ecx], esi
jne 0x10011a33
mov edx, esi
jmp 0x10011a36
xor edx, edx
inc edx
xor eax, eax
cmp edx, 0xfffffff6
mov edx, dword [ebp + 8]
setne al
mov dword [edx], eax
cmp dword [edx], esi
je 0x10011a4a
xor esi, esi
inc esi
mov eax, dword [ecx]
xor ecx, ecx
cmp esi, eax
mov eax, dword [ebp + 0xc]
setl cl
mov eax, dword [eax]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x18], 0x1135
cmp dword [ebp - 0x18], 0x1309
jle 0x10011ac1
mov edi, esi
mov dword [ebp - 0x14], esi
mov ebx, esi
mov dword [ebp - 0x1c], esi
mov esi, ebx
and esi, edi
mov edi, dword [ebp - 0x1c]
mov eax, esi
mov ecx, 0x1007f278
xor eax, edi
cdq
push edx
push eax
call fcn.1000b2a8
inc edi
cmp edi, 0x1725
jl 0x10011a8c
mov edi, dword [ebp - 0x14]
inc ebx
push 0
pop esi
cmp ebx, 0x355d
jl 0x10011a82
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x22c8
jl 0x10011a80
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x10011acf
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x18], 0x10db
jge 0x10011a5a
mov edx, str.cdvquu_mkwzowg_gzmf_zlrur_wpklj_dkx_gqibtgpl_bav
mov ecx, 0x1007f278
call fcn.1000ee32
jmp 0x10011a5a
Function at 0x1001236d
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
mov dword [esp + 0xc], 0x23e5
mov eax, edx
cmp dword [esp + 0xc], 0x25ca
push esi
push edi
mov dword [esp + 0x20], eax
mov dword [esp + 0x24], ecx
jle 0x10012459
push 0
push 0x180d
push 0x160a
push 0xa33
call dword [sym.imp.KERNEL32.dll_RaiseException]
cmp byte [ebp + 0xc], 0
je 0x10012469
mov eax, dword [ecx]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x1001247d
cmp byte [eax], 0
je 0x1001247d
push 0x1436
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp dword [esp + 0x14], 0x2046
jge 0x10012492
push str.iqtgmhvt_nqkst_ccdmjf_cjoejj_bwyakly_xehp_okuv_fwtduntwq_qpraupeq_ail_kvgsx_nwihjns_ieonklnt
call fcn.10049280
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001dc47
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1001dd31
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1001dd11
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
je 0x1001dd0f
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1001dcdc
mov ecx, dword [ebp - 4]
call fcn.1002adab
movzx eax, al
test eax, eax
jne 0x1001dd0f
push dword [ebp - 4]
push 0x761e
push 0x3968
push dword [ebp - 0x34]
push 1
push 1
push dword [ebp - 8]
call fcn.1001c7d0
add esp, 0x1c
push 0
push 0x4134
push 1
push dword [ebp - 0xc]
call fcn.1001d15c
add esp, 0x10
jmp 0x1001dd2f
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x1001dd2f
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x1001dd39
push 1
call fcn.10019c50
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10037d57
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10037de9
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10037ddf
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0xfffffffb
jmp 0x10037da1
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xe
jge 0x10037ddd
mov byte [ebp - 1], 0
push 0x3134
push 0x4464
push 0x431a
push 0x2393
push 1
push 0x6b85
push 0x21e1
push 1
lea eax, [ebp - 1]
push eax
call fcn.10035dbc
add esp, 0x24
jmp 0x10037d96
jmp 0x10037de7
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x10037e05
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push 0
call fcn.1003221f
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1003ac6a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100638e3
call fcn.10062184
sub esp, 0x14
cmp byte [ebp + 8], 0
mov eax, edx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], eax
je 0x1003acc0
push 0x5227
push 0
push 0
push 0x4c3b
push 0x6a48
lea edx, [ebp - 0x11]
mov byte [ebp - 0x11], 0
mov ecx, 0x6aff
call fcn.1003c0f4
add esp, 0x14
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], 0x2d8b
cmp dword [ebp - 0x1c], 0x2f98
jle 0x1003ad0f
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov ebx, 0x619f
xor esi, esi
mov eax, edi
mov ecx, 0x1007f278
xor eax, esi
cdq
push edx
push eax
call fcn.1000b2a8
inc esi
cmp esi, 0xb63
jl 0x1003acde
mov esi, dword [ebp - 0x18]
add edi, esi
dec ebx
jne 0x1003acdc
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0xfb7
jl 0x1003acd5
mov eax, dword [ebp - 0x20]
cmp byte [eax], 0
je 0x1003ad23
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x2aac
jge 0x1003acaf
mov edx, str.buzpouwpt_dnna_sbbxyebi_dts_mjwgpfj
mov ecx, 0x1007f278
call fcn.1000ee32
jmp 0x1003acaf