joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10002eaf
Capabilities:
Get file system object information

Disassembly:
mov eax, 0x1005b1d3
call fcn.1005abe8
sub esp, 0x20
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x18], cl
test cl, cl
je 0x10002ef3
push ebx
push ebx
push 0x15c2
push 0x229a
push 0x182b
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x10002ee2
mov dword [ebp - 0x28], 0x61a5
cmp dword [ebp - 0x28], 0x62a4
jle 0x10002f82
mov edi, ebx
mov dword [ebp - 0x24], ebx
mov esi, ebx
mov eax, esi
mov dword [ebp - 0x20], 0x4c3c
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], ebx
mov ecx, eax
mov ebx, edi
mov edi, dword [ebp - 0x2c]
shl ebx, cl
mov eax, ebx
mov ecx, 0x10076fd8
and eax, edi
cdq
push edx
push eax
call fcn.100045e5
inc edi
cmp edi, 0x7571
jl 0x10002f2a
mov eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x24]
dec eax
dec dword [ebp - 0x20]
push 0
mov dword [ebp - 0x1c], eax
pop ebx
jne 0x10002f1e
inc esi
cmp esi, 0x6eb5
jl 0x10002f12
inc edi
mov dword [ebp - 0x24], edi
cmp edi, 0x48d7
jl 0x10002f10
push 0x1f70
push 0xb3
push ebx
push 0x8b5
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
push ecx
push ecx
mov cl, 1
call fcn.10001aef
pop ecx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x28], 0x603a
pop ecx
jge 0x10002ee2
mov edx, str.xwcnaprlm_kmylpdsk_wrftbeak_icvgmhj_vzaz_clbf
mov ecx, 0x10076fd8
call fcn.10006ac3
jmp 0x10002ee2
Function at 0x10004f3e
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x10004f55
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x10004f78
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x10652324
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x106526b0
jl 0x10004f86
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x10652954
jl 0x10004fc6
mov ecx, dword [0x106536a0]
xor ecx, dword [0x10652324]
and ecx, edi
xor ecx, dword [0x106536a0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x10652320], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10652954]
mov dword [0x10652ce0], eax
pop esi
ret

Function at 0x1000868c
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [ebp + 8], 0
mov eax, edx
push edi
mov dword [ebp - 8], eax
mov byte [ebp - 4], cl
je 0x100086e9
cmp byte [ebp + 0xc], 0
je 0x100086e1
mov edi, dword [ebp + 0x14]
mov dword [edi], 3
cmp dword [edi], 0
jl 0x1000870b
push ebx
mov ebx, dword [ebp + 0x18]
mov dword [ebp + 8], 1
xor edx, edx
mov ecx, dword [eax]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
add ecx, eax
mov eax, dword [ebp + 8]
cmp eax, ecx
mov eax, dword [ebp - 8]
setge dl
mov dword [ebx], edx
dec dword [edi]
cmp dword [edi], 0
jge 0x100086b8
pop ebx
jmp 0x1000870b
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x1000870b
test cl, cl
je 0x10008705
push 0
push 0
push 0x2568
push 0x10a2
push 0
call dword [sym.imp.USER32.dll_InsertMenuW]
jmp 0x1000870b
call dword [sym.imp.USER32.dll_CreatePopupMenu]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10008710
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x1005b485
call fcn.1005abe8
sub esp, 0x28
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
je 0x100087d4
mov dword [ebp - 0x18], 0x2e0a
cmp dword [ebp - 0x18], 0x2e5d
jle 0x10008798
xor esi, esi
xor edi, edi
xor ebx, ebx
mov ecx, ebx
lea eax, [edi + esi]
shl eax, cl
lea ecx, [ebp - 0x34]
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10008764
mov eax, dword [eax]
push eax
call fcn.10042b33
pop ecx
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.10004c13
inc ebx
cmp ebx, 0x2f40
jl 0x10008748
inc edi
cmp edi, 0xd08
jl 0x10008746
inc esi
cmp esi, 0x2edc
jl 0x10008744
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x100087b7
push 0x15a8
push 0x56a
push 0
push 0x21a5
call dword [sym.imp.USER32.dll_DrawEdge]
cmp dword [ebp - 0x18], 0x2b67
jge 0x1000887b
push str.yyzhbz_croqnq_gdompz_evbtjqq_fgeph_zweiyshww_jdeqjksi_iph
call fcn.10042b33
pop ecx
jmp 0x1000887b
mov dword [ebp - 0x18], 0x64d9
cmp dword [ebp - 0x18], 0x6502
jle 0x10008818
push 0x85c
call dword [sym.imp.GDI32.dll_GetStockObject]
xor edi, edi
xor ebx, ebx
mov esi, 0x1dd8
mov eax, ebx
mov ecx, 0x10076fd8
cdq
push edx
push eax
call fcn.100045e5
add ebx, edi
dec esi
jne 0x100087f8
inc edi
cmp edi, 0x2ce3
jl 0x100087f1
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x18], 0x63bd
jge 0x10008856
mov edx, str.rwznegz_nwjikhjzg_lkgho
mov ecx, 0x10076fd8
call fcn.10006ac3
jmp 0x10008856
or dword [ebp - 4], 0xffffffff
mov dword [esi], 0
jmp 0x10008876
push ecx
push ecx
push 0x59dc
push ecx
push 0
call fcn.100085ad
add esp, 0x14
inc dword [esi]
cmp dword [esi], 9
jg 0x10008862
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009060
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [esp + 0x1c], 0x17ef
cmp dword [esp + 0x1c], 0x184b
push 1
pop ebx
jle 0x100090ec
xor esi, esi
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x18], eax
xor eax, ebx
lea ecx, [edi + esi]
or eax, ecx
lea ecx, [esp + 0x20]
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100090aa
mov eax, dword [eax]
push eax
call fcn.10042b33
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.10004c13
mov eax, dword [esp + 0x18]
inc eax
mov dword [esp + 0x18], eax
cmp eax, 0x64c4
jl 0x1000908d
inc ebx
cmp ebx, 0x41a2
jl 0x10009087
inc edi
cmp edi, 0x4456
jl 0x10009085
inc esi
cmp esi, 0x595
jl 0x10009083
xor ebx, ebx
inc ebx
cmp dword [esp + 0x1c], 0x16ed
jge 0x100091e4
mov dword [esp + 0x1c], 0x16ad
cmp dword [esp + 0x1c], 0x10c5
jge 0x100091d9
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x18]
push eax
push str._ld__ld
call fcn.1004284b
add esp, 0xc
cmp dword [esp + 0x14], ebx
jne 0x10009149
push 0x100649ec
call fcn.10042d56
pop ecx
push dword [esp + 0x10]
push 0x10063a64
call fcn.10042b33
pop ecx
jmp 0x10009177
cmp dword [esp + 0x14], 2
jne 0x1000917a
cmp dword [esp + 0x10], 0
jle 0x1000916d
push 0x100649ec
call fcn.10042d56
pop ecx
push dword [esp + 0x10]
push str.0__ld_n
jmp 0x10009141
push 0x100649f8
call fcn.10042d56
pop ecx
jmp 0x100091d9
push 0x100649ec
call fcn.10042d56
mov eax, dword [esp + 0x18]
xor esi, esi
add eax, 0xfffffffd
pop ecx
test eax, eax
jle 0x100091b7
push esi
push str._ld
call fcn.10042b33
mov eax, dword [esp + 0x1c]
pop ecx
pop ecx
mov ecx, dword [esp + 0x10]
add eax, 0xfffffffd
xor ecx, esi
inc esi
mov dword [esp + 0x10], ecx
cmp esi, eax
jl 0x10009192
jmp 0x100091bb
mov ecx, dword [esp + 0x10]
push 0xc0000
push 0x80000
xor ecx, 0x40000
push ecx
push str._ld__ld__ld
call fcn.10042b33
add esp, 0x10
push str.apkxu_vcdsczlh_nofuldiwp_ekanzf_tfipur_ilzjljm_crfye_elwvj_dwkpobqj_bbmbq
call fcn.10042b33
pop ecx
cmp byte [ebp + 0xc], 0
je 0x1000920d
mov eax, dword [ebp + 0x18]
xor edx, edx
mov ecx, dword [ebp + 0x20]
mov eax, dword [eax]
mov eax, dword [ecx]
test eax, eax
mov eax, dword [ecx]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp + 0x14]
setl cl
sub ebx, ecx
mov dword [eax], ebx
jmp 0x10009215
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a6b8
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005b503
call fcn.1005abe8
sub esp, 0x14
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x1000a6fb
cmp byte [edx], 0
je 0x1000a7a5
push 0x22f
push ecx
push 0x3edb
push 0x44fb
push ecx
push 0
push ecx
call fcn.10009060
add esp, 0x1c
jmp 0x1000a7a5
mov dword [ebp - 0x1c], 0x3625
cmp dword [ebp - 0x1c], 0x3842
jle 0x1000a766
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x14], edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov edi, edx
xor esi, esi
mov eax, ebx
mov ecx, 0x10076fd8
cdq
idiv esi
xor edx, edi
mov eax, edx
cdq
push edx
push eax
call fcn.100045e5
inc esi
cmp esi, 0x5ea
jl 0x1000a720
inc ebx
cmp ebx, 0x644a
jl 0x1000a71e
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x145e
jl 0x1000a715
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x4eb3
jl 0x1000a710
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x3548
jge 0x1000a782
mov edx, str.nibvc_eaicvah_onwple_bed_imhwmr_uyrwfqq_ncsveanaj_swyfl_uvxow_eibmbdh_rxytuq_bqn_rnbg_frpx
mov ecx, 0x10076fd8
call fcn.10006ac3
mov edx, dword [ebp + 0x20]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x1000a7a5
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x3b4e1a36
inc dword [edx]
cmp dword [edx], 3
jl 0x1000a793
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a896
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1005b50d
call fcn.1005abe8
sub esp, 0x10
push ebx
push esi
mov byte [ebp - 0x14], cl
mov dword [ebp - 0x18], 0x262d
cmp dword [ebp - 0x18], 0x5a0
push edi
mov dword [ebp - 0x10], esp
jge 0x1000a917
call fcn.100431cd
push eax
push 0x100650cc
push str.input.in
call fcn.10043395
add esp, 0xc
push 0x10078120
push 0x100642e8
call fcn.1004284b
push 0x3d0904
push 0xffffffffffffffff
push 0x100811e0
call fcn.100300ef
mov ecx, dword [0x10078120]
add esp, 0x14
call fcn.1000a83c
cdq
mov ecx, 0x3b9aca07
idiv ecx
push edx
push 0x10063d00
call fcn.10042b33
pop ecx
pop ecx
cmp byte [ebp - 0x14], 0
je 0x1000a9c2
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1000a936
push 0x3b8
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [ebp - 0x18], 0x528a
cmp dword [ebp - 0x18], 0x552f
jle 0x1000a98a
xor esi, esi
xor edi, edi
xor ebx, ebx
lea ecx, [ebx + edi]
mov eax, esi
sar eax, cl
mov ecx, 0x10076fd8
cdq
push edx
push eax
call fcn.100045e5
inc ebx
cmp ebx, 0x379b
jl 0x1000a94c
inc edi
cmp edi, 0x71b9
jl 0x1000a94a
inc esi
cmp esi, 0x5358
jl 0x1000a948
push 1
push 0
push 0x1932
call dword [sym.imp.USER32.dll_InvalidateRect]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x512e
jge 0x1000a9a6
mov edx, str.dayrx_ltkkd_vuvhahpr
mov ecx, 0x10076fd8
call fcn.10006ac3
jmp 0x1000a9d7
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1000a9d7
push 0xbc1
push 0
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000b33c
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005b53b
call fcn.1005abe8
sub esp, 0xc
push ebx
push esi
mov dword [ebp - 0x14], 0x7036
mov ebx, ecx
cmp dword [ebp - 0x14], 0x73a6
push edi
mov dword [ebp - 0x10], esp
jle 0x1000b388
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x10076fd8
xor eax, esi
cdq
push edx
push eax
call fcn.100045e5
inc edi
cmp edi, 0x40d1
jl 0x1000b365
inc esi
cmp esi, 0x3d37
jl 0x1000b363
cmp byte [ebp + 8], 0
je 0x1000b3ba
mov esi, dword [ebp + 0xc]
mov dword [esi], 3
jmp 0x1000b3b3
push dword [ebp + 0x14]
mov edx, dword [ebp + 0x10]
mov cl, 1
push ebx
push dword [ebp + 0x20]
push 1
push 1
call fcn.1000868c
add esp, 0x14
dec dword [esi]
cmp dword [esi], 0
jge 0x1000b399
jmp 0x1000b3dd
mov edx, dword [ebp + 0x18]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x1000b3dd
mov esi, dword [ebp + 0x1c]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x3b4e1a36
inc dword [edx]
cmp dword [edx], 3
jl 0x1000b3cb
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x6e92
jge 0x1000b3f9
mov edx, str.qnuyxilwv_tnp_ghbppvi_gqrf_fqkagp_noayc_brqv_iixdgzs_xbtsrzy_pbiwm_vdejcx
mov ecx, 0x10076fd8
call fcn.10006ac3
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000bccd
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push esi
mov esi, edx
mov dword [ebp - 8], esi
push edi
test cl, cl
je 0x1000bdcb
cmp byte [ebp + 0x20], 0
je 0x1000bcf9
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
jne 0x1000bdd1
jmp 0x1000bdfa
mov edi, dword [ebp + 0x24]
xor eax, eax
mov dword [edi], 2
cmp dword [edi], eax
jl 0x1000bdfa
mov edx, dword [ebp + 8]
push ebx
mov ebx, dword [ebp + 0xc]
mov dword [ebp - 4], 0xe994
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], 0x65296947
mov eax, dword [edi]
mov ecx, dword [edi]
mov eax, dword [ebx]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp + 0x14]
add eax, 0xffff
mov dword [edx], eax
mov eax, dword [edx]
xor edx, edx
mov dword [ecx], eax
mov eax, dword [ecx]
mov dword [esi], eax
mov esi, dword [edi]
mov edi, dword [edi]
mov ecx, dword [ebx]
mov eax, dword [ebp - 8]
mov eax, dword [eax]
cmp eax, dword [ecx + esi*4]
mov eax, dword [ebx]
setg dl
xor ebx, ebx
cmp edx, dword [eax + edi*4]
mov edi, dword [ebp + 0x24]
setne bl
xor ecx, ecx
mov eax, dword [edi]
cmp ebx, eax
mov eax, dword [ebp - 4]
setne cl
xor edx, edx
add ecx, 6
cmp ecx, 0x457
mov ecx, 0xfff8
setl dl
imul eax, edx
mov edx, dword [ebp + 8]
sub eax, 0x3c3fa3c9
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov eax, dword [ebp - 4]
mov eax, dword [edi]
mov eax, dword [edi]
mov eax, dword [ebp - 4]
mov eax, dword [edx]
mov eax, dword [ebp - 0xc]
sub ecx, eax
jne 0x1000bdaf
mov eax, dword [edx]
mov ecx, dword [ebp + 0x18]
mov eax, dword [edi]
mov esi, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
dec dword [edi]
xor eax, eax
cmp dword [edi], eax
jge 0x1000bd10
pop ebx
jmp 0x1000bdfa
cmp byte [ebp + 0x1c], 0
je 0x1000bde0
push 0x1857
push 0
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
jmp 0x1000bdfa
push 0x1c7d
xor eax, eax
push eax
push 0x76e
push 0x1d77
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10017e7c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005ba73
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x10017f1e
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x10017ed1
push 0x3b8
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x10017f19
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x10017eff
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 3
jge 0x10017f19
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x38]
call fcn.10004925
and dword [eax], 0
jmp 0x10017ef4
jmp 0x10018038
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x50], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x10018016
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x10018014
mov dword [ebp - 0x20], 0x2bff
mov dword [ebp - 0x4c], str.ovrkxcoqx_anr_ugebhzgn_dtwfc_piktl_ulrlwssli_ubzu_iutvulii_zxpt_akplnwie_hfh
cmp dword [ebp - 0x20], 0x2e45
jle 0x10017fbe
and dword [ebp - 0x18], 0
jmp 0x10017f7c
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x453c
jge 0x10017fbe
and dword [ebp - 0x1c], 0
jmp 0x10017f92
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x5399
jge 0x10017fbc
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sar eax, cl
cdq
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], edx
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
mov ecx, 0x10076fd8
call fcn.100045e5
jmp 0x10017f8b
jmp 0x10017f75
push 0x1237
push 1
push 1
push 0x5b1b
call fcn.100163b2
add esp, 0x10
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x2bf1
jge 0x10017fee
mov edx, dword [ebp - 0x4c]
mov ecx, 0x10076fd8
call fcn.10006ac3
jmp 0x1001800a
or dword [ebp - 4], 0xffffffff
jmp 0x10018014
jmp 0x10018038
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
test eax, eax
je 0x10018038
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002023e
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005bce0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100203f3
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x100202de
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x100202d9
push 0x1b59
push 0x7baa
push 0
push 0x4b35
push 0x5726
push 0x3e51
push 0x33c7
push 0x40b3
push 1
push 0x4fbe
push 0x6254
push 1
call fcn.1001f8d5
add esp, 0x30
jmp 0x100203f1
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], 0x13f8
mov dword [ebp - 0x40], str.saawqhm_uvy_afvqf_bzurksdl_cogcrnwbj_dbgehchw_nuzvrkhs_eyaei_pve_ydadhmcxr_keiolawii_ncjc
cmp dword [ebp - 0x20], 0x14f0
jle 0x1002038b
push 0
push 0xd72
push 0x1237
push 0x44
push 0x7c
push 0x6f5
push 0x1c64
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
and dword [ebp - 0x1c], 0
jmp 0x1002032e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x22a1
jge 0x1002038b
and dword [ebp - 0x14], 0
jmp 0x10020344
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x69ea
jge 0x10020389
and dword [ebp - 0x18], 0
jmp 0x1002035a
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x3fc7
jge 0x10020387
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
shl eax, cl
or eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
push dword [ebp - 0x44]
push dword [ebp - 0x48]
mov ecx, 0x10076fd8
call fcn.100045e5
jmp 0x10020353
jmp 0x1002033d
jmp 0x10020327
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x100203b1
push 0x127a
push 0x389f
push 0
push 1
call fcn.10020157
add esp, 0x10
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x104f
jge 0x100203cb
mov edx, dword [ebp - 0x40]
mov ecx, 0x10076fd8
call fcn.10006ac3
jmp 0x100203e7
or dword [ebp - 4], 0xffffffff
jmp 0x100203f1
jmp 0x10020416
push 0x4eed
push 0xed5
push 0x418a
push 0x18d1
push 0x7ada
push 1
call fcn.1001ff89
add esp, 0x18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100341a2
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005c2e3
call fcn.1005abe8
sub esp, 0x10
push ebx
push esi
mov byte [ebp - 0x14], dl
mov dword [ebp - 0x1c], 0x6c09
cmp dword [ebp - 0x1c], 0x6d85
push edi
mov dword [ebp - 0x10], esp
jle 0x10034212
xor esi, esi
xor edi, edi
xor ebx, ebx
lea eax, [ebx + edi]
mov ecx, 0x10076fd8
xor eax, esi
cdq
push edx
push eax
call fcn.100045e5
inc ebx
cmp ebx, 0x3147
jl 0x100341ce
inc edi
cmp edi, 0x6fca
jl 0x100341cc
inc esi
cmp esi, 0x1cbd
jl 0x100341ca
push 0
push 0x1d17
push 0xbf6
push 0x69d
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
cmp byte [ebp - 0x14], 0
je 0x10034221
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
mov dword [ecx], eax
jmp 0x10034238
mov byte [ebp - 0x15], 0
cmp byte [ebp - 0x15], 0
je 0x10034238
push 0
push 0x151c
call dword [sym.imp.USER32.dll_GetSystemMenu]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x69e3
jge 0x10034254
mov edx, str.pbacmql_ascblavbm_qayq_yrkc_lqyn_cza_sstptk_bxzpqiqki_vqjzx_ljs_cbubhfej_wfptu_wmsquv
mov ecx, 0x10076fd8
call fcn.10006ac3
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10037e4c
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, 0x1005c59b
call fcn.1005abe8
sub esp, 0x18
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
cmp byte [ebp + 0x14], 0
je 0x10037f27
mov dword [ebp - 0x24], 0x2ef9
cmp dword [ebp - 0x24], 0x325b
jle 0x10037ee8
mov edi, esi
mov dword [ebp - 0x20], esi
mov ebx, esi
mov dword [ebp - 0x1c], esi
mov ecx, ebx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], esi
shl edi, cl
mov ebx, esi
mov dword [ebp - 0x14], 0x6552
mov esi, dword [ebp - 0x18]
mov ecx, ebx
mov eax, edi
sar eax, cl
mov ecx, 0x10076fd8
cdq
push edx
push eax
call fcn.100045e5
add ebx, esi
dec dword [ebp - 0x14]
jne 0x10037e9b
inc esi
push 0
mov dword [ebp - 0x18], esi
cmp esi, 0x6d7d
pop esi
jl 0x10037e8f
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
inc ebx
mov dword [ebp - 0x1c], ebx
cmp ebx, 0x2cb2
jl 0x10037e85
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x6fc5
jl 0x10037e80
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x24], 0x2b3e
jge 0x10037f03
mov edx, str.mhmp_ujwq_hxsvbvl_orzcfo_pzhojqad_axwix_nwvi
mov ecx, 0x10076fd8
call fcn.10006ac3
mov eax, dword [ebp + 0x10]
inc dword [eax]
jmp 0x10037fa4
mov edi, dword [ebp + 0x24]
mov ebx, dword [ebp + 0x18]
mov eax, dword [edi]
mov eax, dword [ebx]
cmp eax, dword [edi]
jne 0x10037f3d
cmp dword [ebx], esi
jne 0x10037f3d
mov ecx, esi
jmp 0x10037f40
xor ecx, ecx
inc ecx
mov eax, dword [ebp + 0xc]
xor edx, edx
mov dword [eax], ecx
mov eax, dword [edi]
cmp ecx, eax
mov eax, dword [edi]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebx]
setne cl
xor edx, edx
cmp ecx, 0x3cc9
setge dl
xor ecx, ecx
add eax, edx
cmp eax, 0x2891ba
mov eax, dword [ebx]
setne cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [edi]
mov eax, dword [ebp + 8]
setg dl
sub edx, 5
neg edx
mov eax, dword [eax]
sbb edx, edx
inc edx
imul ecx, edx
mov dword [eax], ecx
mov eax, dword [edi]
mov eax, dword [ebx]
cmp dword [edi], esi
jne 0x10037f9c
mov eax, dword [ebp + 0xc]
cmp dword [eax], esi
je 0x10037f9f
xor esi, esi
inc esi
mov eax, dword [ebp + 0x1c]
mov dword [eax], esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret