joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100064b8
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
cmp byte [ebp + 0x14], 0
push esi
mov esi, ecx
mov byte [ebp - 8], dl
push edi
mov dword [ebp - 0xc], esi
je 0x1000659e
test dl, dl
je 0x10006581
mov dword [ebp - 0xc], 0x39fb
cmp dword [ebp - 0xc], 0x3bee
jle 0x10006541
xor esi, esi
xor edi, edi
xor ecx, ecx
mov dword [ebp + 0x14], ecx
lea eax, [edi + esi]
sar eax, cl
lea ecx, [ebp - 0x24]
cdq
push edx
push eax
call fcn.10001aa5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000650d
mov eax, dword [eax]
push eax
call fcn.1004c12c
pop ecx
push 0
push 1
lea ecx, [ebp - 0x24]
call fcn.1000bdc4
mov ecx, dword [ebp + 0x14]
inc ecx
mov dword [ebp + 0x14], ecx
cmp ecx, 0x5cc0
jl 0x100064f3
inc edi
cmp edi, 0x1c3b
jl 0x100064ee
inc esi
cmp esi, 0x118e
jl 0x100064ec
cmp dword [ebp - 0xc], 0x3801
jge 0x10006555
push str.kgxewfgi_ckmayq_bbrsz_dbtjedzgx_hvytqwzk_vexahf_onr_xnwwm_neurznz_rqeh_jvrkj_rgwjxhhxt_xpcjeccg_eqekyuji
call fcn.1004c12c
pop ecx
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10006620
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x7bf1
inc dword [edx]
cmp dword [edx], 2
jl 0x1000656a
jmp 0x10006620
mov byte [ebp + 0x17], 0
cmp byte [ebp + 0x17], 0
je 0x10006620
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x10006620
mov dword [ebp + 0x14], 0x6a1
cmp dword [ebp + 0x14], 0xa19
jle 0x100065f2
xor esi, esi
xor edi, edi
lea eax, [edi + esi]
cdq
lea ecx, [ebp - 0x3c]
push edx
push eax
call fcn.10001aa5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100065ca
mov eax, dword [eax]
push eax
call fcn.1004c12c
pop ecx
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.1000bdc4
inc edi
cmp edi, 0x6f35
jl 0x100065b2
inc esi
cmp esi, 0x801c
jl 0x100065b0
mov esi, dword [ebp - 0xc]
cmp dword [ebp + 0x14], 0x3bc
jge 0x10006606
push str.gxcumf_mpmjgmwx_bzhqf_jusnfxuhv_yphf_zctzpnni_sivq_vhlxxg
call fcn.1004c12c
pop ecx
cmp byte [ebp + 0x18], 0
je 0x10006618
mov eax, dword [esi]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
jmp 0x10006620
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100069e4
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100649b8
call fcn.100641d4
sub esp, 0x18
mov byte [ebp - 0x14], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x10006a2b
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10006a1a
push 0
push ecx
mov edx, 0x52d3
mov ecx, 0x1d54
call fcn.10003ca0
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x20], 0x718b
cmp dword [ebp - 0x20], 0x73ef
jle 0x10006a8e
push 0
call dword [sym.imp.KERNEL32.dll_GetStartupInfoW]
xor esi, esi
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x1c], 0x1dc5
mov dword [ebp - 0x18], eax
xor eax, edi
mov ecx, 0x10080d38
or eax, esi
cdq
push edx
push eax
call fcn.1000b7ed
mov eax, dword [ebp - 0x18]
add eax, ebx
dec dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
jne 0x10006a55
inc ebx
cmp ebx, 0x82f
jl 0x10006a49
inc edi
cmp edi, 0x4a71
jl 0x10006a47
inc esi
cmp esi, 0x6a98
jl 0x10006a45
push 0x2600
push 0x417
push 0
call dword [sym.imp.USER32.dll_InflateRect]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x70a2
jge 0x10006a1a
mov edx, str.rzzvyc_ialjcdcn_gnox_rfthnl_tloz_tyauhgwdd_kyfdmvw_thhqoz_efv_qvolypewi_wxouyvvx_xgemmsz
mov ecx, 0x10080d38
call fcn.1000da64
jmp 0x10006a1a

Function at 0x10006b0a
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x100649c2
call fcn.100641d4
sub esp, 0x10
mov byte [ebp - 0x14], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x10006c18
test dl, dl
je 0x10006b5c
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x10006c48
push 0
push 0x5018
push 0x4d03
push ecx
push 0x1e9a
mov edx, 0x511f
call fcn.10004c74
add esp, 0x14
jmp 0x10006c48
mov dword [ebp - 0x18], 0x499b
xor esi, esi
cmp dword [ebp - 0x18], 0x4a66
jle 0x10006b94
mov edi, esi
mov ebx, esi
lea eax, [ebx + edi]
mov ecx, 0x10080d38
cdq
push edx
push eax
call fcn.1000b7ed
inc ebx
cmp ebx, 0x31dc
jl 0x10006b72
inc edi
cmp edi, 0x6c9c
jl 0x10006b70
mov dword [ebp - 4], esi
cmp dword [ebp - 0x18], 0x4985
jge 0x10006bcd
mov edx, str.thrld_domn_ctealbqjq_pfvwm
mov ecx, 0x10080d38
call fcn.1000da64
jmp 0x10006bcd
mov edi, dword [ebp + 0x24]
mov eax, dword [edi]
mov ecx, dword [eax]
xor eax, eax
inc eax
sub eax, ecx
imul eax, ecx
test eax, eax
je 0x10006bec
mov eax, dword [ebp + 0x14]
cmp dword [eax], esi
je 0x10006bec
xor edx, edx
inc edx
jmp 0x10006bee
mov edx, esi
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov eax, dword [eax]
cmp edx, eax
mov eax, dword [ebp + 0x1c]
setge cl
cmp dword [eax], ecx
mov eax, dword [ebp + 8]
je 0x10006c08
cmp dword [eax], esi
je 0x10006c0b
xor esi, esi
inc esi
mov ecx, dword [eax]
sub ecx, dword [eax]
mov eax, dword [edi]
imul ecx, esi
mov dword [eax], ecx
jmp 0x10006c48
cmp byte [ebp + 0x20], 0
je 0x10006c30
push 0x9f
xor esi, esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x10006c48
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0x10006c48
push 0x65d3
mov ecx, 0x2722
call fcn.10002912
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000722e
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x100649e6
call fcn.100641d4
push ecx
push ecx
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
je 0x100072bb
cmp byte [ebp + 0x10], 0
je 0x1000729c
mov byte [ebp + 0xf], 0
cmp byte [ebp + 0xf], 0
je 0x1000736f
push 0x2e66
push 0x335b
push 0x64c1
push 0x7d9e
push 0x1e9c
push 0x1edb
push 0x2c9f
push 1
push 0x6208
push 1
mov edx, 0x6a16
xor cl, cl
call fcn.10003fe6
add esp, 0x28
jmp 0x1000736f
mov dword [esi], 0
jmp 0x100072b1
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0x5378470e
inc dword [esi]
cmp dword [esi], 2
jl 0x100072a4
jmp 0x1000736f
mov dword [ebp + 0xc], 0x72a1
cmp dword [ebp + 0xc], 0x760c
jle 0x10007303
push 0x16ad
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
xor esi, esi
xor edi, edi
mov ecx, edi
mov eax, esi
sar eax, cl
mov ecx, 0x10080d38
cdq
push edx
push eax
call fcn.1000b7ed
inc edi
cmp edi, 0x43d2
jl 0x100072de
inc esi
cmp esi, 0x56e8
jl 0x100072dc
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0x70df
jge 0x1000731f
mov edx, str.ffkju_lvej_ijjdv_qqjered_jey_lrxwmo_awnkar_oesjeei_xeiuf_kiru_oucovlct_xakjw_cfimrkoh_pngdin
mov ecx, 0x10080d38
call fcn.1000da64
cmp byte [ebp + 0x14], 0
je 0x10007347
mov eax, dword [ebp + 8]
mov byte [eax], 1
jmp 0x1000736f
push 0x25da
push 0x1b36
push 0x9b4
push 0x253a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000e78d
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov byte [esp + 0x10], dl
mov ebx, ecx
je 0x1000e7d0
test dl, dl
je 0x1000e7c1
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x1000e870
xor cl, cl
call fcn.1000ea08
jmp 0x1000e870
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
add dword [eax], ecx
jmp 0x1000e870
mov dword [esp + 0x14], 0x2987
cmp dword [esp + 0x14], 0x2cd1
jle 0x1000e826
xor esi, esi
xor edi, edi
mov eax, edi
lea ecx, [esp + 0x18]
or eax, esi
cdq
push edx
push eax
call fcn.10001aa5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000e800
mov eax, dword [eax]
push eax
call fcn.1004c12c
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.1000bdc4
inc edi
cmp edi, 0x14f
jl 0x1000e7e6
inc esi
cmp esi, 0x1f50
jl 0x1000e7e4
cmp dword [esp + 0x14], 0x2754
jge 0x1000e83b
push str.lnorpqj_xhvwzj_ajhycdp_hhf_qpbjuyyv_kfzca_xanrwkdsd_yhaeeyxi_fmc_ffbigua
call fcn.1004c12c
pop ecx
cmp byte [ebp + 0xc], 0
je 0x1000e859
cmp byte [ebx], 0
je 0x1000e870
push 0x9f
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x1000e870
mov eax, dword [ebp + 0x1c]
cmp byte [eax], 0
je 0x1000e870
push 0
push 0
push 0x1e90
call dword [sym.imp.ADVAPI32.dll_CopySid]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000eb70
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x10064d2c
call fcn.100641d4
sub esp, 0x10
mov byte [ebp - 0x14], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x1000ebb1
cmp byte [ecx], 0
je 0x1000eba0
push 0x248a
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], 0x532d
cmp dword [ebp - 0x1c], 0x5536
jle 0x1000ebff
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov ebx, 0x20a8
xor esi, esi
mov ecx, esi
mov eax, edi
sar eax, cl
mov ecx, 0x10080d38
cdq
push edx
push eax
call fcn.1000b7ed
inc esi
cmp esi, 0x7fad
jl 0x1000ebcf
mov esi, dword [ebp - 0x18]
add edi, esi
dec ebx
jne 0x1000ebcd
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x7366
jl 0x1000ebc6
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1000ec16
push 0
push 0x1469
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x509a
jge 0x1000eba0
mov edx, str.byebshp_vaiy_ommkskuk_hgha_kekmfqlns_wyru_wwd_oudmbi_hraqie_jlylxgkv_ngxu_tlsoevb
mov ecx, 0x10080d38
call fcn.1000da64
jmp 0x1000eba0
Function at 0x1000ef08
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x10064d4a
call fcn.100641d4
sub esp, 0x18
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], ecx
je 0x1000f024
cmp byte [ebp + 0x20], 0
je 0x1000ef3c
mov eax, dword [ebp + 0x28]
and dword [eax], 0
jmp 0x1000f111
mov dword [ebp - 0x18], 0x81e
cmp dword [ebp - 0x18], 0xaf3
jle 0x1000efad
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
mov dword [ebp + 0xc], edi
xor ebx, ebx
mov eax, edi
and dword [ebp - 0x1c], 0
cdq
mov edi, esi
idiv ebx
mov esi, dword [ebp - 0x1c]
mov ecx, edx
shl edi, cl
mov ecx, esi
mov eax, edi
shl eax, cl
mov ecx, 0x10080d38
cdq
push edx
push eax
call fcn.1000b7ed
inc esi
cmp esi, 0x5962
jl 0x1000ef6a
mov esi, dword [ebp - 0x14]
inc ebx
mov edi, dword [ebp + 0xc]
cmp ebx, 0x4b47
jl 0x1000ef58
inc edi
mov dword [ebp + 0xc], edi
cmp edi, 0xf7c
jl 0x1000ef56
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x1416
jl 0x1000ef51
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x437
jge 0x1000efc9
mov edx, str.ogjbtgyor_mbjrpfzq_hkdksv_rymvj_lmasklbc_luxfvoz_csvwy_rrs_yvbafdx
mov ecx, 0x10080d38
call fcn.1000da64
mov ebx, dword [ebp + 0x10]
mov eax, dword [ebp - 0x20]
mov edi, dword [ebx]
mov esi, dword [eax]
mov ecx, dword [ebx]
mov eax, dword [eax]
mov edx, dword [eax + ecx*4]
mov dword [esi + edi*4], edx
mov esi, dword [ebp - 0x24]
mov eax, dword [esi]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x14]
imul ecx, edx
mov dword [eax], ecx
mov eax, dword [eax]
mov eax, dword [ebx]
mov ecx, dword [esi]
xor eax, eax
cmp dword [ecx + 0xc], eax
setge al
imul eax, dword [ecx]
imul eax, eax, 0x672a
mov dword [ecx], eax
jmp 0x1000f111
cmp byte [ebp + 0x24], 0
je 0x1000f0fb
mov dword [ebp - 0x14], 0x571e
cmp dword [ebp - 0x14], 0x5ae9
jle 0x1000f0a0
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp + 0xc], edi
xor ebx, ebx
mov eax, edi
mov dword [ebp - 0x1c], esi
cdq
mov edi, 0x276e
idiv ebx
sub esi, edx
mov eax, esi
mov ecx, 0x10080d38
cdq
push edx
push eax
call fcn.1000b7ed
inc esi
dec edi
jne 0x1000f059
mov esi, dword [ebp - 0x18]
inc ebx
mov edi, dword [ebp + 0xc]
cmp ebx, 0x5bea
jl 0x1000f04a
inc edi
mov dword [ebp + 0xc], edi
cmp edi, 0x5e59
jl 0x1000f048
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x3cca
jl 0x1000f043
push 0
push 0x2694
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp + 0x18]
mov dword [ecx], 3
cmp dword [ecx], 0
jl 0x1000f0c0
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov dword [eax], 0x462751c7
dec dword [ecx]
cmp dword [ecx], 0
jge 0x1000f0b1
mov dword [ebp - 4], 2
cmp dword [ebp - 0x14], 0x56d5
jge 0x1000f0df
mov edx, str.yxyyrodvh_xejfsvl_cdfebon_eqh_tlrnwcjui
mov ecx, 0x10080d38
call fcn.1000da64
jmp 0x1000f111
mov eax, dword [ebp + 0x2c]
push dword [ebp + 0xc]
mov ecx, dword [ebp + 0x1c]
push dword [eax + 4]
push dword [eax]
push dword [ecx + 4]
call fcn.10012512
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10015beb
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10015c75
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10015c62
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10015c43
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10015c60
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.1000baa4
mov dword [eax], 8
jmp 0x10015c38
jmp 0x10015c73
push 0x9f
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x10015c89
push 0x76ca
push 0
push 0x688a
call fcn.10015bd3
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1001ca77
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1001caab
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
push 1
push dword [ebp - 0xc]
push 0x2cfd
push dword [ebp - 0x10]
call fcn.1001cb35
add esp, 0x10
jmp 0x1001cb31
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1001cae6
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001cae4
push 0x9f
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
jmp 0x1001cb31
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1001cb14
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 1
jge 0x1001cb31
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x28]
call fcn.1000baa4
mov dword [eax], 0x4b71808a
jmp 0x1001cb09
mov esp, ebp
pop ebp
ret
Function at 0x100266d9
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x1002676b
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10026749
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x14]
call fcn.1001cdda
pop ecx
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
push dword [eax]
push dword [ebp - 0x1c]
call fcn.10026673
pop ecx
pop ecx
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
jmp 0x10026787
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10026769
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
jmp 0x10026787
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push 0
call fcn.100136af
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1002bdc9
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10065627
call fcn.100641d4
sub esp, 0x2c
and dword [ebp - 0x2c], 0
push ebx
push esi
mov dword [ebp - 0x1c], 0x6fac
cmp dword [ebp - 0x1c], 0x6fe2
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], ecx
jle 0x1002be58
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x14], edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov eax, edx
mov dword [ebp - 0x20], eax
mov esi, eax
mov ecx, ebx
xor edi, edi
sar esi, cl
mov eax, esi
mov ecx, 0x10080d38
xor eax, edi
cdq
push edx
push eax
call fcn.1000b7ed
inc edi
cmp edi, 0x713
jl 0x1002be14
mov eax, dword [ebp - 0x20]
inc ebx
cmp ebx, 0x100
jl 0x1002be0c
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x1ed0
jl 0x1002be00
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x67ad
jl 0x1002bdfb
push 0x1002ff95
push fcn.10011f26
xor ebx, ebx
lea eax, [ebp - 0x38]
inc ebx
push ebx
push 0xc
push eax
call fcn.1004c270
mov dword [ebp - 4], ebx
mov byte [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x6e2d
jge 0x1002beaf
mov edx, str.immriz_gnqtp_zhd_xjbwpms_yfvhpjt_vny_abrcdq_oot_chdlkes_ovd
mov ecx, 0x10080d38
call fcn.1000da64
jmp 0x1002beaf
push dword [ebp - 0x24]
mov dl, bl
mov dword [ebp - 4], ebx
push ecx
push ecx
push 0x27a4
push 0x4f1e
push ecx
push 0x1d38
push dword [ebp + 8]
lea ecx, [ebp - 0x38]
push 0x6a5e
push 0x1a5
call fcn.1002b757
mov ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x38]
add esp, 0x28
push eax
call fcn.1002feaf
push 0x1002ff95
push ebx
push 0xc
lea eax, [ebp - 0x38]
mov dword [ebp - 0x2c], ebx
push eax
mov byte [ebp - 4], 0
call fcn.1004becb
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002bfd2
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10065631
call fcn.100641d4
sub esp, 0x34
mov dword [ebp - 0x28], edx
mov byte [ebp - 0x14], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x1002c011
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [eax + ecx*4], 0x321a0783
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x20], 0xe73
cmp dword [ebp - 0x20], 0x1001
jle 0x1002c09b
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x18], edi
and dword [ebp - 0x24], 0
mov eax, esi
cdq
idiv edi
mov esi, dword [ebp - 0x24]
mov edi, edx
mov ecx, esi
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0x40]
xor eax, ebx
cdq
push edx
push eax
call fcn.10001aa5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002c058
mov eax, dword [eax]
push eax
call fcn.1004c12c
pop ecx
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.1000bdc4
inc esi
cmp esi, 0x1f5e
jl 0x1002c03b
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x5962
jl 0x1002c02d
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x1595
jl 0x1002c028
inc ebx
cmp ebx, 0x6583
jl 0x1002c023
cmp dword [ebp - 0x20], 0xbea
jge 0x1002c0af
push str.akmzxvn_urg_qpg_bel
call fcn.1004c12c
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], 0x142c
cmp dword [ebp - 0x1c], 0x17a3
jle 0x1002c169
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0x2412
push 0x1abb
push 0x927
push 0
push 0x756
push 0x21c9
call edi
mov esi, dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
push 0xf49
push 0x1319
push 0x1094
push 0x215f
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
xor ebx, ebx
xor esi, esi
xor edi, edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
mov eax, edi
cdq
idiv ecx
mov eax, esi
mov ecx, edx
sar eax, cl
mov ecx, 0x10080d38
xor eax, ebx
cdq
push edx
push eax
call fcn.1000b7ed
mov ecx, dword [ebp - 0x20]
inc ecx
mov dword [ebp - 0x20], ecx
cmp ecx, 0x769d
jl 0x1002c11f
inc edi
cmp edi, 0x17af
jl 0x1002c11a
inc esi
cmp esi, 0x9ab
jl 0x1002c118
inc ebx
cmp ebx, 0x608a
jl 0x1002c116
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
mov ebx, dword [ebp - 0x28]
mov eax, dword [ebp + 0x14]
mov edi, dword [ebx]
mov esi, dword [eax]
mov ecx, dword [ebx]
mov eax, dword [eax]
mov edx, dword [eax + ecx*4]
mov dword [esi + edi*4], edx
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x1c]
imul ecx, edx
mov dword [eax], ecx
mov eax, dword [eax]
mov eax, dword [ebx]
mov edx, dword [esi]
xor eax, eax
cmp dword [edx + 0xc], eax
setge al
imul eax, dword [edx]
mov dword [ebp - 4], 2
imul eax, eax, 0x672a
cmp dword [ebp - 0x1c], 0x1335
mov dword [edx], eax
jge 0x1002c000
mov edx, str.btmuaccvk_vdnndp_jvgyapzpy_nyhc_wefor_mmvaacdvq_jne
mov ecx, 0x10080d38
call fcn.1000da64
jmp 0x1002c000