joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000abfe
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10057b2c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1000ac68
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1000ac55
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [eax], 0xffffffff
jmp 0x1000ac63
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
jmp 0x1000ad55
mov dword [ebp - 0x20], 0x2709
mov dword [ebp - 0x34], str.zlp_ynwhq_vmehdocp_swn_kfqfx_qmkfkbt
cmp dword [ebp - 0x20], 0x2a60
jle 0x1000acf4
and dword [ebp - 0x14], 0
jmp 0x1000ac8c
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x223
jge 0x1000ace7
and dword [ebp - 0x18], 0
jmp 0x1000aca2
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x18a9
jge 0x1000ace5
and dword [ebp - 0x1c], 0
jmp 0x1000acb8
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x12d5
jge 0x1000ace3
mov eax, dword [ebp - 0x14]
xor eax, dword [ebp - 0x18]
or eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
push dword [ebp - 0x40]
push dword [ebp - 0x44]
mov ecx, 0x100720b8
call fcn.10001c38
jmp 0x1000acb1
jmp 0x1000ac9b
jmp 0x1000ac85
push 0x11ba
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x3c], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x248e
jge 0x1000ad14
mov edx, dword [ebp - 0x34]
mov ecx, 0x100720b8
call fcn.100035ef
jmp 0x1000ad30
or dword [ebp - 4], 0xffffffff
jmp 0x1000ad3a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
push dword [ebp - 0x38]
push 0
push dword [ebp - 0x3c]
push 0x1776
call fcn.1000c1dc
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000ddfb
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10057c27
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1000df48
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1000de66
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x1000de61
push 1
push 0x4e22
push 1
push 0x29e3
call fcn.1000a8a6
add esp, 0x10
jmp 0x1000df46
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x1000df46
mov dword [ebp - 0x20], 0x5f6b
mov dword [ebp - 0x34], str.unijhat_oghlgv_etvbsvuo_znrrfwi_zyfz_ljsqhg_rufxlnk_jgkmslkrd_vjdetpkb_zxst_aoaoz
cmp dword [ebp - 0x20], 0x6176
jle 0x1000deee
push 0
call dword [sym.imp.ole32.dll_CoTaskMemFree]
and dword [ebp - 0x18], 0
jmp 0x1000deac
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x4d6a
jge 0x1000deee
and dword [ebp - 0x1c], 0
jmp 0x1000dec2
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3766
jge 0x1000deec
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sar eax, cl
cdq
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
push dword [ebp - 0x40]
push dword [ebp - 0x44]
mov ecx, 0x100720b8
call fcn.10001c38
jmp 0x1000debb
jmp 0x1000dea5
push 0
push 0x141
push 0
push 0
push 0x1329
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x5cb3
jge 0x1000df20
mov edx, dword [ebp - 0x34]
mov ecx, 0x100720b8
call fcn.100035ef
jmp 0x1000df3c
or dword [ebp - 4], 0xffffffff
jmp 0x1000df46
jmp 0x1000df6e
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x38]
push 1
push dword [ebp - 0x3c]
push 0x5c59
push 0xa7a
call fcn.1000cf77
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10017505
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10057e3d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10017550
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
push 1
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.100176c5
add esp, 0xc
jmp 0x100176b4
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x4c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x10017673
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x24], 0x1da0
mov dword [ebp - 0x48], str.kwv_rnaodugj_lemh
cmp dword [ebp - 0x24], 0x1f89
jle 0x100175fe
and dword [ebp - 0x18], 0
jmp 0x100175b8
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x4ad3
jge 0x100175f8
and dword [ebp - 0x1c], 0
jmp 0x100175ce
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x1e37
jge 0x100175f6
mov eax, dword [ebp - 0x18]
and eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], edx
push dword [ebp - 0x60]
push dword [ebp - 0x64]
mov ecx, 0x100720b8
call fcn.10001c38
jmp 0x100175c7
jmp 0x100175b1
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x10017614
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 2
jge 0x10017631
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x44]
call fcn.10004e0f
mov dword [eax], 0x1f3403ca
jmp 0x10017609
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x1ccc
jge 0x1001764b
mov edx, dword [ebp - 0x48]
mov ecx, 0x100720b8
call fcn.100035ef
jmp 0x10017667
or dword [ebp - 4], 0xffffffff
jmp 0x10017671
jmp 0x100176b4
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x20]
mov dword [eax], 0
jmp 0x100176a1
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
mov eax, dword [ebp - 0x20]
cmp dword [eax], 0
jg 0x100176b4
mov eax, dword [ebp - 0x5c]
mov dword [eax], 0x421e0bec
jmp 0x10017696
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10020689
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100580e2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x5c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x100206eb
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x20]
push 1
push 0x4567
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.1002082a
add esp, 0x18
jmp 0x10020819
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x54], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x1c], 0x18b3
mov dword [ebp - 0x30], str.snhzm_pyh_xylsic_mngowelyz_wrxzkhc_ubs_ymx_ofmpvtpfs_srypbgfm_cvxyqznv_prhbien_wtlqpbp
cmp dword [ebp - 0x1c], 0x1a13
jle 0x10020783
push 0x11ba
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
and dword [ebp - 0x14], 0
jmp 0x10020734
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x2f6f
jge 0x10020774
and dword [ebp - 0x18], 0
jmp 0x1002074a
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x6587
jge 0x10020772
mov eax, dword [ebp - 0x14]
or eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], edx
push dword [ebp - 0x68]
push dword [ebp - 0x6c]
mov ecx, 0x100720b8
call fcn.10001c38
jmp 0x10020743
jmp 0x1002072d
push 0
push 0x8cc
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x16f4
jge 0x100207a3
mov edx, dword [ebp - 0x30]
mov ecx, 0x100720b8
call fcn.100035ef
jmp 0x100207bf
or dword [ebp - 4], 0xffffffff
jmp 0x100207c9
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x100207f7
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x10020819
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x60]
mov ecx, dword [ebp - 0x64]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10027054
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x1002706b
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x1002708d
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x10073d34
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x100740c0
jl 0x1002709b
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x10074364
jl 0x100270db
mov ecx, dword [0x100750b0]
xor ecx, dword [0x10073d34]
and ecx, edi
xor ecx, dword [0x100750b0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x10073d30], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10074364]
mov dword [0x100746f0], eax
pop esi
ret
Function at 0x1002b8ae
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10058616
call fcn.100573b8
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], edi
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], 0x69d7
cmp dword [ebp - 0x14], 0x6d70
jle 0x1002b92b
mov ebx, esi
mov edi, esi
mov dword [ebp - 0x1c], esi
mov eax, edi
mov ecx, 0x100720b8
cdq
idiv esi
xor edx, ebx
mov eax, edx
cdq
push edx
push eax
call fcn.10001c38
inc esi
cmp esi, 0x445e
jl 0x1002b8e2
inc edi
push 0
pop esi
cmp edi, 0x73b7
jl 0x1002b8df
inc ebx
cmp ebx, 0x744e
jl 0x1002b8dd
push esi
push 0x1ca9
push esi
push 0x12f1
call dword [sym.imp.USER32.dll_SetTimer]
mov edi, dword [ebp - 0x18]
push 0x2592
call fcn.10010d9a
movzx ebx, ax
mov byte [ebp - 4], 1
cmp dword [ebp - 0x14], 0x678f
pop ecx
mov dword [ebp - 0x1c], ebx
jge 0x1002b97c
mov edx, str.poljaosxl_iuelig_ywu_yqpjuh_ksusagm_bnpnndi_crwia_mzrd
mov ecx, 0x100720b8
call fcn.100035ef
jmp 0x1002b97c
movzx eax, bx
lea ecx, [ebp + 8]
push 1
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], eax
lea eax, [ebp - 0x20]
push esi
push eax
call fcn.10024a79
cmp eax, 0xffffffff
jne 0x1002b99e
movzx eax, bx
jmp 0x1002b9ac
push 0x2fee
call fcn.10010d9a
pop ecx
movzx eax, ax
push eax
push ecx
lea ecx, [ebp + 8]
call fcn.100231f1
push ecx
push 0x66b9
push ecx
push 0x5104
push 0x30e8
push ecx
lea eax, [ebp + 8]
mov edx, 0x6aa5
push eax
push 1
push ecx
mov ecx, 0x72a4
call fcn.1002b80f
add esp, 0x18
lea edx, [ebp + 8]
mov eax, esp
lea ecx, [ebp - 0x2c]
mov dword [eax], esi
mov dword [eax + 4], esi
mov dword [eax + 8], esi
call fcn.1003950a
add esp, 0xc
mov ebx, eax
cmp edi, ebx
je 0x1002ba1e
mov ecx, edi
call fcn.1002e00a
mov ecx, dword [ebx]
mov dword [edi], ecx
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov eax, dword [ebx + 8]
mov dword [edi + 8], eax
mov dword [ebx], esi
mov dword [ebx + 4], esi
mov dword [ebx + 8], esi
lea ecx, [ebp - 0x2c]
call fcn.1002e00a
push esi
push 1
lea ecx, [ebp + 8]
call fcn.1001171d
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002d30e
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005872c
call fcn.100573b8
sub esp, 0x2c
push ebx
push esi
mov dword [ebp - 0x24], 0x4000
cmp dword [ebp - 0x24], 0x435c
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x34], edx
jle 0x1002d38b
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x20], esi
mov eax, esi
mov dword [ebp - 0x1c], 0x7645
mov dword [ebp - 0x18], eax
mov esi, eax
mov dword [ebp - 0x14], 0x1653
mov eax, esi
mov ecx, 0x100720b8
and eax, ebx
cdq
push edx
push eax
call fcn.10001c38
dec esi
dec dword [ebp - 0x14]
jne 0x1002d350
mov eax, dword [ebp - 0x18]
dec eax
dec dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
jne 0x1002d347
mov esi, dword [ebp - 0x20]
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x2e18
jl 0x1002d33b
inc ebx
cmp ebx, 0x64e4
jl 0x1002d336
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x3d38
jge 0x1002d3a7
mov edx, str.wmmtug_uczlv_eogyj_egvfpjh_jmsnzmdn
mov ecx, 0x100720b8
call fcn.100035ef
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x24], 0x16bf
cmp dword [ebp - 0x24], 0x5db
jge 0x1002d430
mov esi, str._d__d
jmp 0x1002d41a
movd xmm0, dword [ebp - 0x2c]
cvtdq2pd xmm0, xmm0
call fcn.1002d29c
movsd qword [ebp - 0x28], xmm0
movd xmm0, dword [ebp - 0x30]
cvtdq2pd xmm0, xmm0
call fcn.1002d29c
movsd xmm1, qword [ebp - 0x28]
subsd xmm1, xmm0
push ecx
push ecx
movsd qword [esp], xmm1
push str._.2f_n
call fcn.1003fd76
add esp, 0xc
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x30]
push eax
push esi
call fcn.1003ffd2
add esp, 0xc
cmp eax, 2
je 0x1002d3dc
mov dword [ebp - 0x20], 0x41bf
cmp dword [ebp - 0x20], 0x4349
jle 0x1002d4a4
xor eax, eax
mov dword [ebp - 0x14], eax
xor esi, esi
mov dword [ebp - 0x24], esi
xor ebx, ebx
mov dword [ebp - 0x2c], ebx
lea eax, [ebx + esi]
mov dword [ebp - 0x30], 0x5a3f
mov esi, dword [ebp - 0x14]
mov ebx, eax
mov dword [ebp - 0x1c], eax
mov eax, ebx
mov ecx, 0x100720b8
xor eax, esi
cdq
push edx
push eax
call fcn.10001c38
dec ebx
dec dword [ebp - 0x30]
jne 0x1002d461
mov ebx, dword [ebp - 0x2c]
mov esi, dword [ebp - 0x24]
inc ebx
mov dword [ebp - 0x2c], ebx
cmp ebx, 0x4020
jl 0x1002d44f
inc esi
mov dword [ebp - 0x24], esi
cmp esi, 0x1b0f
jl 0x1002d44a
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x6b03
jl 0x1002d445
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x413c
jge 0x1002d4c3
mov edx, str.dok_ffpxdhmjn_elcdua_ygdr_ybuyba_tvyzy_xrmw_qeeegtauw
mov ecx, 0x100720b8
call fcn.100035ef
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0xc], 0
je 0x1002d4f1
mov ecx, dword [ebp + 0x1c]
call fcn.100248a8
jmp 0x1002d4fe
push ecx
push ecx
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x34]
call fcn.10024bd3
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002f474
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov byte [ebp - 8], dl
mov esi, ecx
je 0x1002f575
test dl, dl
je 0x1002f49e
mov eax, dword [ebp + 0x20]
mov dword [eax], 0
jmp 0x1002f5ae
mov dword [ebp - 0x14], 0x7817
cmp dword [ebp - 0x14], 0x7824
push 0
pop esi
jle 0x1002f540
push esi
push 0x1284
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov edi, esi
mov dword [ebp - 0x10], esi
mov ecx, edi
mov dword [ebp - 0xc], 0x32b6
mov dword [ebp + 0xc], ecx
mov ebx, esi
mov edi, esi
mov eax, ebx
cdq
idiv edi
xor edx, ecx
lea ecx, [ebp - 0x2c]
mov eax, edx
cdq
push edx
push eax
call fcn.10001a51
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002f4f5
mov eax, dword [eax]
push eax
call fcn.1003fd76
pop ecx
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.10002015
mov ecx, dword [ebp + 0xc]
inc edi
cmp edi, 0x647a
jl 0x1002f4d7
inc ebx
cmp ebx, 0x3509
jl 0x1002f4d5
dec ecx
dec dword [ebp - 0xc]
mov dword [ebp + 0xc], ecx
jne 0x1002f4d3
mov edi, dword [ebp - 0x10]
inc edi
mov dword [ebp - 0x10], edi
cmp edi, 0x7a3c
jl 0x1002f4c7
push esi
push 0x242e
call dword [sym.imp.GDI32.dll_SetTextColor]
mov edx, dword [ebp + 0x14]
mov dword [edx], esi
cmp dword [edx], 1
jge 0x1002f55f
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 1
inc dword [edx]
cmp dword [edx], 1
jl 0x1002f54d
cmp dword [ebp - 0x14], 0x765f
jge 0x1002f5ae
push str.puusb_vstu_uzlk_aoohyqeu_bxhvq_qoefkzsds_hheug_mbil_rlznrv
call fcn.1003fd76
pop ecx
jmp 0x1002f5ae
cmp byte [ebp + 8], 0
je 0x1002f59a
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0
jmp 0x1002f593
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [edx]
cmp dword [edx], 2
jl 0x1002f586
jmp 0x1002f5ae
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0x1002f5ae
xor esi, esi
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003012e
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
mov byte [ebp - 4], cl
mov dword [ebp - 0x14], 0x495c
cmp dword [ebp - 0x14], 0x4c62
push esi
push edi
jle 0x100301b3
xor esi, esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0xc], 0x4d76
xor edi, edi
xor ebx, ebx
lea ecx, [ebx + edi]
mov eax, esi
shl eax, cl
lea ecx, [ebp - 0x30]
cdq
push edx
push eax
call fcn.10001a51
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10030179
mov eax, dword [eax]
push eax
call fcn.1003fd76
pop ecx
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.10002015
inc ebx
cmp ebx, 0x27bd
jl 0x1003015d
inc edi
cmp edi, 0x16b1
jl 0x1003015b
dec esi
dec dword [ebp - 0xc]
jne 0x10030159
mov esi, dword [ebp - 0x10]
inc esi
mov dword [ebp - 0x10], esi
cmp esi, 0x5684
jl 0x1003014f
cmp dword [ebp - 0x14], 0x4895
jge 0x100301c7
push str.ynhe_zokmy_pwfif_btppiyhxo_bucc_zpqlwi
call fcn.1003fd76
pop ecx
cmp byte [ebp - 4], 0
je 0x100301e1
mov byte [ebp - 5], 0
cmp byte [ebp - 5], 0
je 0x100301fd
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x100301fd
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x100301fd
push 0
push 0x14c4
push 0
push 0x544
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100312a3
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10058858
call fcn.100573b8
push ecx
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
je 0x100312f7
cmp byte [ebp + 0x14], 0
je 0x100312e1
mov dword [esi], 0
jmp 0x100312d7
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0x593eb6b3
inc dword [esi]
cmp dword [esi], 3
jl 0x100312ca
jmp 0x100313a4
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0x100313a4
call fcn.10031b8d
jmp 0x100313a4
mov dword [ebp + 0xc], 0x2d6b
cmp dword [ebp + 0xc], 0x2f92
jle 0x10031339
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x100720b8
xor eax, esi
cdq
push edx
push eax
call fcn.10001c38
inc edi
cmp edi, 0x5905
jl 0x1003130b
inc esi
cmp esi, 0x715b
jl 0x10031309
push 0x7f6
call dword [sym.imp.USER32.dll_GetParent]
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0x2cba
jge 0x10031355
mov edx, str.lbdc_ypob_omllpqnmw
mov ecx, 0x100720b8
call fcn.100035ef
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x10], 0
je 0x10031397
mov byte [ebp + 0xf], 0
cmp byte [ebp + 0xf], 0
je 0x100313a4
push 0x59b2
mov edx, 0x6a6f
xor cl, cl
call fcn.100302bc
pop ecx
jmp 0x100313a4
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x100313a4
call fcn.10030328
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret