joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10015466
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10056061
call fcn.1005557c
sub esp, 0x20
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x2c], ecx
je 0x10015537
mov dword [ebp - 0x14], 0x6910
cmp dword [ebp - 0x14], 0x69c6
jle 0x100154f2
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, edi
cdq
idiv ebx
mov eax, esi
mov ecx, edx
shl eax, cl
mov ecx, 0x1006f688
cdq
push edx
push eax
call fcn.10002383
inc ebx
cmp ebx, 0x54f2
jl 0x100154a1
inc edi
cmp edi, 0x4e9e
jl 0x1001549f
inc esi
cmp esi, 0x6109
jl 0x1001549d
push 0x1fc0
push 0x166f
push 0x229f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
call dword [sym.imp.USER32.dll_PeekMessageA]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x67ad
jge 0x10015518
mov edx, str.suhslwkst_rcpuq_wguk_xkt_yxlbblxb_icezroni_bebgsvb_inul_iolounfh_mjq
mov ecx, 0x1006f688
call fcn.10003d52
jmp 0x10015656
mov dword [ebp - 0x1c], 0x7c7b
cmp dword [ebp - 0x1c], 0x7d00
jle 0x100155a7
xor edi, edi
xor esi, esi
mov dword [ebp - 0x18], esi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
and dword [ebp - 0x28], 0
mov ecx, ebx
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x24], esi
shl esi, cl
mov eax, esi
mov ecx, 0x1006f688
xor eax, ebx
or eax, edi
cdq
push edx
push eax
call fcn.10002383
inc ebx
cmp ebx, 0x22b8
jl 0x10015561
mov ebx, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
inc ebx
mov dword [ebp - 0x14], ebx
cmp ebx, 0x2bb9
jl 0x10015553
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x3dc
jl 0x1001554e
inc edi
cmp edi, 0x30ff
jl 0x10015549
mov edi, dword [ebp - 0x20]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x79ae
jge 0x100155e5
mov edx, str.hkbdfc_hod_scw_tpijhunf_ysjoivat_wuawucymg_tpjm_rgwr_ymodkq_hrztrdpef_rfygl_tppswi
mov ecx, 0x1006f688
call fcn.10003d52
jmp 0x100155e5
xor esi, esi
cmp dword [edi], esi
jne 0x100155f1
and dword [ebp - 0x1c], esi
inc esi
jmp 0x100155f5
inc esi
mov dword [ebp - 0x1c], esi
mov eax, dword [edi]
xor ecx, ecx
mov ebx, dword [ebp + 0x14]
test eax, eax
mov eax, dword [ebp + 0x1c]
setne cl
mov dword [eax], ecx
mov eax, 0x92085949
cmp eax, ecx
mov eax, dword [ebx]
sbb ecx, ecx
neg ecx
sub ecx, eax
mov eax, dword [edi]
add eax, ecx
xor ecx, ecx
cmp eax, 0xdd75
mov eax, dword [ebp + 0xc]
setg cl
xor edx, edx
mov dword [eax], ecx
mov ecx, dword [eax]
mov eax, dword [ebx]
add ecx, 2
cmp ecx, eax
mov eax, dword [ebp - 0x1c]
setne dl
add eax, edx
cmp dword [edi], eax
je 0x10015644
cmp dword [ebx], 0
jne 0x10015646
xor esi, esi
mov eax, dword [ebp - 0x2c]
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [ebx]
cmp esi, eax
setg cl
mov dword [ebx], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10016525
Capabilities:
Get common file path

Disassembly:
mov eax, 0x100560c3
call fcn.1005557c
sub esp, 0x18
push ebx
push esi
xor ebx, ebx
mov dword [ebp - 0x24], ecx
push edi
mov dword [ebp - 0x10], esp
cmp byte [ebp + 0xc], bl
je 0x1001663f
mov dword [ebp - 0x20], 0x3d80
cmp dword [ebp - 0x20], 0x3f9e
jle 0x100165b6
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x1c], ebx
mov ecx, ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov eax, ebx
sar eax, cl
mov ecx, 0x1006f688
and eax, edi
or eax, esi
cdq
push edx
push eax
call fcn.10002383
mov ecx, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x3159
jl 0x10016565
inc ebx
push 0
mov dword [ebp - 0x1c], ebx
cmp ebx, 0x24af
pop ebx
jl 0x1001655d
inc edi
cmp edi, 0x6f1f
jl 0x1001655a
inc esi
cmp esi, 0x9e9
jl 0x10016558
push 0x26ac
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x20], 0x3af1
jge 0x100165d1
mov edx, str.etzw_yfssh_ayxulfpt_uucfr
mov ecx, 0x1006f688
call fcn.10003d52
or dword [ebp - 4], 0xffffffff
mov edi, dword [ebp + 0x18]
cmp dword [edi], ebx
jbe 0x10016658
mov esi, dword [ebp - 0x24]
call fcn.10014261
push 0x34
pop ecx
xor edx, edx
div ecx
push 1
push 1
push 0x109b
push 1
push esi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], edx
push eax
push dword [ebp + 0x1c]
mov edx, 0x4229
mov ecx, 0x5194
push dword [ebp + 0x10]
call fcn.10015c7c
add esp, 0x20
inc ebx
cmp ebx, dword [edi]
jb 0x100165df
jmp 0x10016658
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x10016658
mov dl, 1
push ebx
push 0x2feb
mov cl, dl
call fcn.100152cd
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10016943
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov dword [0x1017d6a4], ecx
inc edx
mov esi, 0x270
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
mov dword [edx*4 + 0x1017d6a4], ecx
inc edx
cmp edx, esi
jl 0x10016958
mov dword [0x1017d6a0], esi
pop esi
pop ebp
ret 8
Function at 0x1001697e
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x1017d6a4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x1017da30
jl 0x1001698c
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x1017dcd4
jl 0x100169cc
mov ecx, dword [0x1017ea20]
xor ecx, dword [0x1017d6a4]
and ecx, edi
xor ecx, dword [0x1017ea20]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x1017d6a0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x1017dcd4]
mov dword [0x1017e060], eax
pop esi
ret

Function at 0x10016c43
Capabilities:
Get system information on windows

Disassembly:
mov eax, 0x10056131
call fcn.1005557c
sub esp, 0x1c
mov byte [ebp - 0x18], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x10016d2a
mov dword [ebp - 0x24], 0x678f
xor ebx, ebx
cmp dword [ebp - 0x24], 0x6ac9
jle 0x10016ce3
push 0x2527
push ebx
push 0x10ea
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov edi, ebx
mov esi, ebx
mov dword [ebp - 0x20], ebx
mov ecx, ebx
mov dword [ebp - 0x1c], ebx
mov eax, esi
mov dword [ebp - 0x28], ebx
cdq
idiv ecx
mov esi, edx
mov ecx, ebx
mov eax, esi
sar eax, cl
mov ecx, 0x1006f688
or eax, edi
cdq
push edx
push eax
call fcn.10002383
inc ebx
cmp ebx, 0x20dc
jl 0x10016c9b
mov ecx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
inc ecx
mov dword [ebp - 0x1c], ecx
push 0
pop ebx
cmp ecx, 0x6dc9
jl 0x10016c91
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x59f2
jl 0x10016c8c
inc edi
cmp edi, 0x8037
jl 0x10016c87
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10016cf3
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x24], 0x63e7
jge 0x10016d0e
mov edx, str.ptam_kvzy_pgpli_kiykof
mov ecx, 0x1006f688
call fcn.10003d52
jmp 0x10016d56
push 0x6a0a
push 0xda7
lea eax, [ebp - 0x12]
mov byte [ebp - 0x12], 0
push eax
push 0x4f51
push 0x1ed4
push ecx
push 0x7601
xor cl, cl
call fcn.10016aba
add esp, 0x1c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10017744
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
je 0x10017762
mov eax, dword [ebp + 8]
mov al, byte [eax]
mov byte [ecx], al
jmp 0x10017825
mov dword [esp + 0x1c], 0x487a
cmp dword [esp + 0x1c], 0x4a28
jle 0x10017801
xor edi, edi
xor esi, esi
mov dword [esp + 0x18], esi
xor ebx, ebx
mov dword [esp + 0x14], 0x16a
mov dword [esp + 0x10], ebx
mov esi, ebx
mov ebx, 0x5a50
mov eax, esi
lea ecx, [esp + 0x20]
xor eax, edi
cdq
push edx
push eax
call fcn.100042e3
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100177af
mov eax, dword [eax]
push eax
call fcn.10039f30
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.10002764
inc esi
dec ebx
jne 0x10017795
mov ebx, dword [esp + 0x10]
mov esi, dword [esp + 0x18]
add ebx, esi
dec dword [esp + 0x14]
mov dword [esp + 0x10], ebx
jne 0x1001778e
inc esi
mov dword [esp + 0x18], esi
cmp esi, 0xd91
jl 0x10017780
inc edi
cmp edi, 0x62bd
jl 0x1001777a
xor eax, eax
push eax
push 0xd8a
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
push 1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnableWindow]
cmp dword [esp + 0x1c], 0x44ff
jge 0x10017825
push str.xez_qfrymt_louhyvnxa_odmyf
call fcn.10039f30
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100178be
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10056145
call fcn.1005557c
sub esp, 0x14
push ebx
push esi
mov dword [ebp - 0x18], 0x4f55
mov eax, edx
cmp dword [ebp - 0x18], 0x50d5
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], eax
jle 0x1001792f
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
and dword [ebp - 0x1c], 0
mov ebx, esi
mov esi, dword [ebp - 0x1c]
mov ecx, edi
shl ebx, cl
mov eax, ebx
mov ecx, 0x1006f688
xor eax, esi
cdq
push edx
push eax
call fcn.10002383
inc esi
cmp esi, 0x2b3
jl 0x100178fa
mov esi, dword [ebp - 0x14]
inc edi
cmp edi, 0x68ad
jl 0x100178ed
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x5808
jl 0x100178eb
mov eax, dword [ebp - 0x20]
cmp byte [ebp + 8], 0
je 0x1001794e
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10017965
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
jmp 0x10017965
cmp byte [eax], 0
je 0x10017965
push 0x167c
push 0xf50
push 0
call dword [sym.imp.USER32.dll_DeleteMenu]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x4ce7
jge 0x10017981
mov edx, str.fwkfsw_ahyj_quafg_pboxinaum_frnhkzhf_vqagv_pfxvy_kavpvnpl_vzj_lxn_muwlvxbou_vmkhr_rtee_qsrg
mov ecx, 0x1006f688
call fcn.10003d52
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10017fd8
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x10056161
call fcn.1005557c
sub esp, 0x14
mov byte [ebp - 0x14], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x100180ee
mov dword [ebp - 0x18], 0x2ad8
cmp dword [ebp - 0x18], 0x2cc6
jle 0x10018037
push 0x1c15
call dword [sym.imp.USER32.dll_GetKeyState]
xor esi, esi
xor edi, edi
lea eax, [edi + esi]
mov ecx, 0x1006f688
cdq
push edx
push eax
call fcn.10002383
inc edi
cmp edi, 0x6026
jl 0x10018015
inc esi
cmp esi, 0x5562
jl 0x10018013
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x2a80
jge 0x10018053
mov edx, str.lhiax_tbzanjf_mosu_mpcfzwak_hfr_hix_vpospmzya_wddmahm_esekk_saygcvp_vumhco_mhqghxgmc_uzysiwj_nuatrmri
mov ecx, 0x1006f688
call fcn.10003d52
mov esi, dword [ebp + 0x14]
mov dword [esi], 0xffffffe3
cmp dword [esi], 1
jl 0x100180f3
mov ebx, dword [ebp + 0x18]
mov edi, dword [ebp + 0xc]
mov dword [ebp - 0x18], 0xc93e
mov dword [ebp - 0x1c], 0xfffffffd
mov dword [ebp - 0x20], 0x1871
cmp dword [ebp - 0x18], 0
je 0x10018093
mov eax, dword [ebp - 0x18]
mov dword [edi], eax
mov eax, dword [edi]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov dword [edi], 0x9d01078
mov eax, dword [ebp - 0x20]
cmp eax, 1
mov eax, dword [esi]
setle cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esi]
setl dl
add eax, 0x9d01078
add eax, edx
xor edx, edx
cmp eax, 0x3563
mov eax, dword [esi]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebx], ecx
inc dword [esi]
cmp dword [esi], 1
jge 0x1001806b
jmp 0x100180f3
mov eax, dword [ebp + 0x10]
inc dword [eax]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10018e49
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10056189
call fcn.1005557c
sub esp, 0x14
mov byte [ebp - 0x18], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10018f07
xor ebx, ebx
lea ecx, [ebp - 0x11]
push ebx
push 1
push 1
mov byte [ebp - 0x11], bl
mov edx, 0x5798
push 0xe9
call fcn.10018742
mov dword [ebp - 0x1c], 0x43bc
add esp, 0x10
cmp dword [ebp - 0x1c], 0x43d3
jle 0x10018ed0
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x20], ebx
mov ecx, ebx
mov eax, edi
sar eax, cl
mov ecx, 0x1006f688
xor eax, esi
cdq
push edx
push eax
call fcn.10002383
inc ebx
cmp ebx, 0xd12
jl 0x10018e9d
inc edi
push 0
pop ebx
cmp edi, 0x16ce
jl 0x10018e9a
inc esi
cmp esi, 0x7e05
jl 0x10018e98
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1c], 0x40ff
jge 0x10018eeb
mov edx, str.ymcktyztm_xbxppgzrv_cct_jmtmgxdqe_fqluaxw_nyhxwk_rupquwmaz_xqzdpfm_twvcz_wxtkhe_awsrwyjd_eowqi_zwdchvw
mov ecx, 0x1006f688
call fcn.10003d52
jmp 0x10018f0e
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10019c7f
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x100561bb
call fcn.1005557c
sub esp, 0x40
cmp byte [ebp + 0xc], 0
mov eax, edx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x18], cl
je 0x10019daf
cmp byte [ebp + 0x10], 0
je 0x10019cc4
lea eax, [ebp + 0xf]
mov byte [ebp + 0xf], 0
push 0x27b3
push eax
mov dl, 1
call fcn.10019218
pop ecx
jmp 0x10019d9d
mov dword [ebp - 0x24], 0x2d00
cmp dword [ebp - 0x24], 0x2e2b
jle 0x10019d6b
xor edi, edi
mov dword [ebp - 0x20], edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
xor eax, eax
mov dword [ebp + 0xc], eax
and dword [ebp - 0x2c], 0
lea ecx, [ebx + edi]
mov edi, dword [ebp - 0x2c]
mov dword [ebp - 0x28], ecx
mov ecx, eax
mov ebx, dword [ebp - 0x28]
sar ebx, cl
mov eax, ebx
lea ecx, [ebp - 0x48]
xor eax, edi
cdq
push edx
push eax
call fcn.100042e3
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10019d14
mov eax, dword [eax]
push eax
call fcn.10039f30
pop ecx
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.10002764
inc edi
cmp edi, 0x498a
jl 0x10019cfb
mov eax, dword [ebp + 0xc]
mov edi, dword [ebp - 0x20]
inc eax
mov ebx, dword [ebp - 0x1c]
mov dword [ebp + 0xc], eax
cmp eax, 0x4a1f
jl 0x10019ce7
inc ebx
mov dword [ebp - 0x1c], ebx
cmp ebx, 0x6bf2
jl 0x10019ce2
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x4b8f
jl 0x10019cdd
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToTzSpecificLocalTime]
mov eax, dword [ebp - 0x30]
cmp byte [eax], 0
je 0x10019d8a
push 0xddd
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp dword [ebp - 0x24], 0x2cba
jge 0x10019d9e
push str.qgfjbf_vmkko_bte_ldtlbp_abzrb_orctu_iqgdbg_ysytahw_ael
call fcn.10039f30
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
test cl, cl
je 0x10019dcc
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10019d9e
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ValidateRect]
jmp 0x10019d9e
mov dword [ebp - 0x24], 0x53ba
cmp dword [ebp - 0x24], 0x56eb
jle 0x10019e03
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x1006f688
or eax, edi
cdq
push edx
push eax
call fcn.10002383
inc ebx
cmp ebx, 0x4b56
jl 0x10019de0
inc edi
cmp edi, 0x4b0f
jl 0x10019dde
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x10019e1a
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0x5071
jge 0x10019d9e
mov edx, str.zikigmndh_lnfr_pktr_evraih_mmyyq_boqgbdc_fhyr_fylllefj_hdt_lfnwlxmu_mazmqd_jmwad_bykddqi
mov ecx, 0x1006f688
call fcn.10003d52
jmp 0x10019d9e
Function at 0x100212ab
Capabilities:
Accept command line arguments
Get system information on windows

Disassembly:
mov eax, 0x1005643d
call fcn.1005557c
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x1002141f
cmp byte [ebp + 0xc], 0
je 0x10021410
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1002135f
mov dword [ebp - 0x14], 0x1f41
cmp dword [ebp - 0x14], 0x1f68
jle 0x10021337
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegConnectRegistryW]
xor esi, esi
xor edi, edi
mov ecx, edi
mov eax, esi
shl eax, cl
mov ecx, 0x1006f688
cdq
push edx
push eax
call fcn.10002383
inc edi
cmp edi, 0x4fbd
jl 0x100212fc
inc esi
cmp esi, 0x1d6c
jl 0x100212fa
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x1ef9
jge 0x1002135b
mov edx, str.ovn_ciohsuis_kscdfntze_wrq_chmuzfl_likz_tvlyfqq_lye
mov ecx, 0x1006f688
call fcn.10003d52
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x20], 0x1ba7
cmp dword [ebp - 0x20], 0x1dae
jle 0x100213e0
call dword [sym.imp.USER32.dll_CreateMenu]
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x18], 0x47eb
xor esi, esi
mov dword [ebp - 0x14], 0x7d71
xor ebx, ebx
mov eax, esi
lea ecx, [ebp - 0x38]
and eax, ebx
cdq
push edx
push eax
call fcn.100042e3
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100213a7
mov eax, dword [eax]
push eax
call fcn.10039f30
pop ecx
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.10002764
inc ebx
cmp ebx, 0x63f2
jl 0x1002138e
add esi, edi
dec dword [ebp - 0x14]
jne 0x1002138c
mov esi, dword [ebp - 0x1c]
add edi, esi
dec dword [ebp - 0x18]
jne 0x10021383
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x5cd
jl 0x1002137a
cmp dword [ebp - 0x20], 0x1a99
jge 0x10021439
push str.oppkq_bkwkjdsqa_aqhkywe_rvb_rpxfr_krhgup_kkrecewoy_lmqmrhk_dnspmpyz_huhllt
call fcn.10039f30
pop ecx
jmp 0x10021439
cmp byte [ecx], 0
je 0x10021439
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
jmp 0x10021439
cmp byte [ebp + 0x10], 0
push 0
push 0
je 0x10021431
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x10021439
push 0
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10021492
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005644f
call fcn.1005557c
sub esp, 0x30
push ebx
push esi
mov dword [ebp - 0x1c], 0x6c70
cmp dword [ebp - 0x1c], 0x6f0c
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], ecx
jle 0x1002153c
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectClipRgn]
xor edi, edi
mov dword [ebp - 0x18], edi
xor esi, esi
mov dword [ebp - 0x14], esi
mov ecx, esi
mov dword [ebp - 0x20], edi
xor ebx, ebx
shl edi, cl
xor esi, esi
mov eax, esi
mov ecx, 0x1006f688
and eax, ebx
xor eax, edi
cdq
push edx
push eax
call fcn.10002383
inc esi
cmp esi, 0x2b4b
jl 0x100214e7
inc ebx
cmp ebx, 0x31e5
jl 0x100214e5
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x75
jl 0x100214dc
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x23cd
jl 0x100214d7
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
call esi
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_SetParent]
mov ecx, dword [ebp - 0x24]
cmp byte [ebp + 0x10], 0
je 0x1002154f
push 0x1668
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x10021578
mov eax, dword [ebp + 8]
push 0xffffffffffffffff
push dword [eax]
lea eax, [ebp - 0x3c]
push eax
call fcn.10024f0c
mov ecx, dword [ebp + 0x14]
and dword [ebp - 4], 0
push eax
call fcn.10024fba
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.10006c15
mov dword [ebp - 4], 1
cmp dword [ebp - 0x1c], 0x6aa1
jge 0x10021597
mov edx, str.jqbwgzepn_njchqi_tybzqu_zcfwkxi_lweioizka_bfnxzetb_retzvd_noze_hyzwq
mov ecx, 0x1006f688
call fcn.10003d52
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100221bb
Capabilities:
Delete directory
Encode data using xor

Disassembly:
mov eax, 0x10056484
call fcn.1005557c
sub esp, 0x1c
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], ecx
je 0x100221ee
mov eax, dword [ebp + 0x20]
and dword [eax], 0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x20], 0x1524
cmp dword [ebp - 0x20], 0x17c8
jle 0x1002226d
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
xor edi, edi
mov dword [ebp - 0x1c], edi
xor esi, esi
mov dword [ebp - 0x18], esi
mov ebx, esi
mov dword [ebp - 0x14], 0x7a58
mov ecx, ebx
mov dword [ebp - 0x24], edi
xor esi, esi
shl edi, cl
mov eax, edi
mov ecx, 0x1006f688
xor eax, esi
cdq
push edx
push eax
call fcn.10002383
inc esi
cmp esi, 0x11f1
jl 0x10022222
mov edi, dword [ebp - 0x1c]
dec ebx
dec dword [ebp - 0x14]
jne 0x10022219
mov esi, dword [ebp - 0x18]
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x663d
jl 0x10022210
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x2b8c
jl 0x1002220b
push 0xa1e
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
push ecx
push dword [ebp + 0x1c]
mov ecx, dword [ebp + 8]
call fcn.10024e02
mov ecx, dword [ebp - 0x28]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x11d8
mov dword [ecx], eax
jge 0x100221dd
mov edx, str.ftglueq_grlwt_amk
mov ecx, 0x1006f688
call fcn.10003d52
jmp 0x100221dd
Function at 0x100231b9
Capabilities:
Compare security identifiers

Disassembly:
mov eax, 0x1005653a
call fcn.1005557c
sub esp, 0x48
mov byte [ebp - 0x14], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x100232b2
mov dword [ebp - 0x20], 0x37d3
cmp dword [ebp - 0x20], 0x3b1d
jle 0x1002323e
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x18], edi
mov eax, esi
xor ebx, ebx
cdq
mov esi, 0x4e49
idiv edi
mov dword [ebp - 0x24], edx
mov edi, edx
mov eax, ebx
mov ecx, 0x1006f688
cdq
push edx
push eax
call fcn.10002383
add ebx, edi
dec esi
jne 0x10023202
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x5437
jl 0x100231f1
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x4b06
jl 0x100231ec
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x3507
jge 0x1002325a
mov edx, str.gkax_qywiew_glf_xknte_lkv_eckch_jptug_riuk_jnnzvruub_rww_yjas_wvimhiw
mov ecx, 0x1006f688
call fcn.10003d52
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
push 0x21
pop edx
call fcn.1001427a
push ecx
push ecx
mov ecx, dword [ebp + 0x10]
push eax
mov dword [ebp - 4], 2
call fcn.100256a2
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.10006c15
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x20], 0x15be
cmp dword [ebp - 0x20], 0x18d9
jle 0x100232f9
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, edi
mov ecx, 0x1006f688
cdq
idiv ebx
mov eax, esi
sub eax, edx
cdq
push edx
push eax
call fcn.10002383
inc ebx
cmp ebx, 0x3819
jl 0x100232c8
inc edi
cmp edi, 0x5409
jl 0x100232c6
inc esi
cmp esi, 0x3f85
jl 0x100232c4
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
push 0xffffffffffffffff
push dword [eax]
lea eax, [ebp - 0x54]
push eax
call fcn.10024f0c
mov ecx, dword [ebp + 0x18]
push eax
call fcn.10012a19
push 0
push 1
lea ecx, [ebp - 0x54]
call fcn.10006c15
mov dword [ebp - 4], 3
cmp dword [ebp - 0x20], 0x1358
jge 0x10023287
mov edx, str.gqeltxc_yrtenlubs_aljrh
mov ecx, 0x1006f688
call fcn.10003d52
jmp 0x10023287