joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10025ff6
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10065a9b
call fcn.10064760
sub esp, 0x34
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x10026153
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x100260d9
mov dword [ebp - 0x24], 0x18bf
cmp dword [ebp - 0x24], 0x1c5f
jle 0x100260af
xor esi, esi
mov dword [ebp - 0x20], esi
xor edi, edi
mov dword [ebp - 0x1c], edi
and dword [ebp - 0x28], 0
mov eax, esi
cdq
idiv edi
mov esi, dword [ebp - 0x28]
mov dword [ebp - 0x18], edx
xor edi, edi
mov ecx, edi
mov eax, esi
shl eax, cl
lea ecx, [ebp - 0x40]
xor eax, edx
cdq
push edx
push eax
call fcn.10001ac9
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10026069
mov eax, dword [eax]
push eax
call fcn.1004e1ed
pop ecx
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.100073ae
mov edx, dword [ebp - 0x18]
inc edi
cmp edi, 0x7572
jl 0x1002604c
inc esi
cmp esi, 0xbc2
jl 0x1002604a
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x2f28
jl 0x1002603b
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x4aeb
jl 0x10026036
push 0x6f07
mov edx, 0x137f
xor cl, cl
call fcn.10027836
cmp dword [ebp - 0x24], 0x17e6
pop ecx
jge 0x100260d5
push str.axnpltty_ttchsoxu_nqm_jadt_iuszenqpk_xmv_pzgjhkaos_uebqtcsiq_euvchn_znwrxovip_yboxbvmt_bgjcxzyc_bsnqao
call fcn.1004e1ed
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x24], 0x4796
cmp dword [ebp - 0x24], 0x4a17
jle 0x10026118
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x100809d8
xor eax, esi
cdq
push edx
push eax
call fcn.10006801
inc edi
cmp edi, 0x67e4
jl 0x100260f5
inc esi
cmp esi, 0x19a1
jl 0x100260f3
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0x4690
jge 0x10026137
mov edx, str.dyzyebj_xlg_wrnwpp_idsbxqygb
mov ecx, 0x100809d8
call fcn.1000b005
jmp 0x10026155
inc dword [edx]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10026f03
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x18], 0x481c
mov esi, edx
cmp dword [ebp - 0x18], 0x49f9
mov edi, ecx
push 1
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], edi
pop ebx
jle 0x10026fcb
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
mov dword [ebp - 0x10], edi
mov ecx, edi
mov dword [ebp - 8], esi
xor eax, eax
mov edi, esi
shl edi, cl
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], edi
mov ecx, eax
mov dword [ebp - 0x1c], edi
xor esi, esi
sar edi, cl
mov eax, edi
lea ecx, [ebp - 0x3c]
xor eax, esi
cdq
push edx
push eax
call fcn.10001ac9
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10026f6a
mov eax, dword [eax]
push eax
call fcn.1004e1ed
pop ecx
push 0
push ebx
lea ecx, [ebp - 0x3c]
call fcn.100073ae
inc esi
cmp esi, 0x2529
jl 0x10026f51
mov eax, dword [ebp - 0xc]
mov edi, dword [ebp - 8]
inc eax
mov dword [ebp - 0xc], eax
cmp eax, 0x8010
jl 0x10026f48
mov edi, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
inc edi
mov dword [ebp - 0x10], edi
cmp edi, 0x1c2e
jl 0x10026f37
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x142d
jl 0x10026f32
push 0
push 0x454
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
cmp dword [ebp - 0x18], 0x4496
jge 0x10026fdf
push str.ozitq_kdbzp_mcnri_ppkatpwms
call fcn.1004e1ed
pop ecx
cmp byte [ebp + 0x18], 0
je 0x10027004
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
jmp 0x10026ffd
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x13b91020
inc dword [edx]
cmp dword [edx], 2
jl 0x10026ff0
jmp 0x10027049
mov eax, dword [ebp + 0x28]
mov esi, dword [ebp + 0x1c]
cmp dword [eax], 0
jne 0x1002701c
mov eax, dword [ebp + 0x20]
mov ecx, dword [esi]
cmp dword [eax], ecx
jne 0x1002701c
xor eax, eax
jmp 0x1002701e
mov eax, ebx
neg eax
xor edx, edx
cmp eax, 0x58a13c44
mov eax, dword [edi]
setge dl
xor ecx, ecx
cmp edx, eax
setge cl
cmp ecx, dword [esi]
je 0x1002703f
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
jne 0x10027041
xor ebx, ebx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [eax + 4], ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10027861
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
cmp byte [ebp + 0x14], 0
push esi
mov byte [esp + 4], dl
mov esi, ecx
je 0x100278ab
test dl, dl
je 0x100278a1
mov esi, dword [ebp + 0xc]
mov dword [esi], 0
jmp 0x1002789a
mov edx, dword [ebp + 0x1c]
push ecx
push 1
push ecx
push 0x611d
call fcn.1002528d
add esp, 0x10
inc dword [esi]
cmp dword [esi], 0
jle 0x10027884
jmp 0x100278eb
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x100278eb
cmp byte [ebp + 0x20], 0
je 0x100278d0
mov edx, dword [ebp + 0x18]
mov dword [edx], 0
jmp 0x100278c9
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xa11c1574
inc dword [edx]
cmp dword [edx], 1
jl 0x100278bc
jmp 0x100278eb
mov edx, dword [ebp + 8]
mov ecx, dword [edx]
lea eax, [ecx + 2]
mov dword [edx], eax
call fcn.100235ca
mov ecx, dword [ebp + 0x10]
movzx eax, ax
push eax
call fcn.1002cd64
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10030f6b
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10030fec
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10030fe2
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10030fc3
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x10030fe0
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.10006b8e
mov dword [eax], 0xa11c1574
jmp 0x10030fb8
jmp 0x10030fea
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x10031017
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
push 0x52b8
push 0xa04
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 0
push 0xeb5
call fcn.10032937
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x10034030
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10065f79
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100340aa
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x10034080
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x100340a5
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
push dword [eax]
mov ecx, dword [ebp - 0x38]
call fcn.10022eb9
jmp 0x1003417c
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x1c], 0x507f
mov dword [ebp - 0x44], str.ndnlg_kavx_tsmnu_ndedkvr_zumtvbrd_pdwkpzle_spdsbedsi_shal_ugrsovi_dnys_ltmpbc_iluinsv_poyec
cmp dword [ebp - 0x1c], 0x52a9
jle 0x10034122
and dword [ebp - 0x14], 0
jmp 0x100340da
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x57a4
jge 0x1003411a
and dword [ebp - 0x18], 0
jmp 0x100340f0
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x50c1
jge 0x10034118
mov eax, dword [ebp - 0x14]
or eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
mov ecx, 0x100809d8
call fcn.10006801
jmp 0x100340e9
jmp 0x100340d3
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
push 0x3eee
push 0x71d
push 1
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
call fcn.1003297b
add esp, 0x14
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x4d72
jge 0x10034156
mov edx, dword [ebp - 0x44]
mov ecx, 0x100809d8
call fcn.1000b005
jmp 0x10034172
or dword [ebp - 4], 0xffffffff
jmp 0x1003417c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10036075
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100360e5
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x100360c5
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
push 0
mov ecx, dword [ebp - 0x18]
call fcn.10006b8e
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x100360e3
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x100360e3
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x10036156
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1003614e
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1003612f
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1003614c
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x3c]
call fcn.10006b8e
mov dword [eax], 6
jmp 0x10036124
jmp 0x10036156
push 0
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esp, ebp
pop ebp
ret
Function at 0x1003e7a5
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
cmp byte [ebp + 0x10], 0
push esi
push edi
mov byte [ebp - 8], cl
je 0x1003e89b
test cl, cl
je 0x1003e7e5
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1003e8ce
push ecx
push 1
push 0xbfd
push ecx
mov ecx, 0x2cf1
call fcn.1003e62e
add esp, 0x10
jmp 0x1003e8ce
mov dword [ebp - 0x10], 0x7a73
cmp dword [ebp - 0x10], 0x7cb9
jle 0x1003e862
xor esi, esi
mov dword [ebp - 0xc], esi
xor edi, edi
mov dword [ebp + 0x10], edi
and dword [ebp - 0x18], 0
mov ecx, edi
mov edi, esi
mov dword [ebp - 0x14], esi
mov esi, dword [ebp - 0x18]
shl edi, cl
mov eax, edi
lea ecx, [ebp - 0x30]
or eax, esi
cdq
push edx
push eax
call fcn.10001ac9
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003e828
mov eax, dword [eax]
push eax
call fcn.1004e1ed
pop ecx
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.100073ae
inc esi
cmp esi, 0x1775
jl 0x1003e80f
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp - 0xc]
inc edi
mov dword [ebp + 0x10], edi
cmp edi, 0x409d
jl 0x1003e7ff
inc esi
mov dword [ebp - 0xc], esi
cmp esi, 0x5871
jl 0x1003e7fa
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x1003e885
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [edx]
cmp dword [edx], 1
jl 0x1003e873
cmp dword [ebp - 0x10], 0x7908
jge 0x1003e8ce
push str.yujnrrb_rbongffjj_fnbjoz_njlnhgw_sacpfac_wyocqyb_chufoxxir_lxuanfnnr_omhxh_qdjrhc_zezxsjqaa_wyb_xzjkmvlsr_vvau
call fcn.1004e1ed
pop ecx
jmp 0x1003e8ce
cmp byte [ebp + 0x18], 0
je 0x1003e8ba
cmp byte [edx], 0
je 0x1003e8ce
push 0x18c0
push 0x1a22
push 0x18
call dword [sym.imp.GDI32.dll_LineTo]
jmp 0x1003e8ce
mov byte [ebp + 0x13], 0
cmp byte [ebp + 0x13], 0
je 0x1003e8ce
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003eae8
Capabilities:
Delete file

Disassembly:
mov eax, 0x10065a87
call fcn.10064760
sub esp, 0x30
cmp byte [ebp + 8], 0
push ebx
push esi
je 0x1003ec0a
xor esi, esi
mov dword [ebp - 0x10], 4
inc esi
mov dword [ebp - 0x14], 0xd850270f
mov dword [ebp - 0x18], esi
lea ecx, [ebp - 0x2c]
push esi
call fcn.10006b10
and dword [ebp - 4], 0
lea edx, [ebp - 0x2c]
push 0x777f
mov eax, 0xc7fd579d
xor cl, cl
push esi
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x38], eax
push 0x1215
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
lea eax, [ebp - 0x20]
push 0x767e
push 0
push eax
call fcn.1003e9e6
add esp, 0x18
mov dword [ebp - 0x10], 0x13
jmp 0x1003eb87
lea eax, [ebp - 0x18]
mov dword [ebp - 0x1c], 8
push eax
lea eax, [ebp - 0x14]
push eax
push 0x2981
push esi
push ecx
lea eax, [ebp - 0x10]
push eax
lea edx, [ebp - 0x1c]
call fcn.1003e1a4
add esp, 0x18
dec dword [ebp - 0x10]
cmp dword [ebp - 0x10], 7
je 0x1003eb5f
mov eax, dword [ebp - 0x14]
mov ecx, 0x9531defc
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x38]
cmp ecx, eax
mov ecx, dword [ebp - 0x2c]
sbb eax, eax
xor edx, edx
inc eax
cmp eax, dword [ecx]
mov eax, dword [ebp - 0x38]
setle dl
sub edx, 0x1c1d
neg edx
sbb edx, edx
inc edx
mov dword [ecx], edx
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setge cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x18]
setge bl
xor edx, edx
sub ebx, eax
mov eax, dword [ebp - 0x30]
cmp ebx, eax
mov eax, dword [ebp - 0x10]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x38]
setle cl
xor edx, edx
add ecx, 3
cmp ecx, eax
lea ecx, [ebp - 0x2c]
setle dl
sub edx, 0xd905
mov dword [ebp - 0x10], edx
call fcn.10006b72
jmp 0x1003ec12
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0xc]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004340e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
push ebx
push esi
mov dword [ebp - 0xc], 0x2423
mov esi, edx
cmp dword [ebp - 0xc], 0x27e5
mov ebx, ecx
push edi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], ebx
jle 0x100434c4
xor ebx, ebx
xor esi, esi
mov dword [ebp - 8], esi
xor edi, edi
mov dword [ebp - 4], edi
and dword [ebp - 0x14], 0
mov ecx, edi
mov edi, esi
mov dword [ebp - 0x10], esi
mov esi, dword [ebp - 0x14]
sar edi, cl
mov ecx, esi
mov eax, edi
shl eax, cl
lea ecx, [ebp - 0x34]
or eax, ebx
cdq
push edx
push eax
call fcn.10001ac9
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1004346e
mov eax, dword [eax]
push eax
call fcn.1004e1ed
pop ecx
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.100073ae
inc esi
cmp esi, 0x4cee
jl 0x10043451
mov edi, dword [ebp - 4]
mov esi, dword [ebp - 8]
inc edi
mov dword [ebp - 4], edi
cmp edi, 0xa8e
jl 0x10043441
inc esi
mov dword [ebp - 8], esi
cmp esi, 0x44ba
jl 0x1004343c
inc ebx
cmp ebx, 0x4a37
jl 0x10043437
push 0x1a7d
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
cmp dword [ebp - 0xc], 0x2322
jge 0x100434d8
push str.uzm_kpfm_kompxghx_bpkll_ivjpyvvsj_fhjhotjp_karr_ciyhgpk_ppqjdurp
call fcn.1004e1ed
pop ecx
cmp byte [ebp + 0xc], 0
je 0x10043500
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x10043528
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
and dword [eax + ecx*4], 0
inc dword [edx]
cmp dword [edx], 3
jl 0x100434ef
jmp 0x10043528
mov eax, dword [ebp + 0x18]
push 0x1a
pop edi
mov ecx, dword [eax]
cmp ecx, edi
jge 0x10043516
mov eax, dword [ebp + 0x1c]
movzx edx, word [eax]
add edx, ecx
jmp 0x10043520
mov eax, ecx
cdq
idiv edi
movzx eax, word [esi]
add edx, eax
push edx
mov ecx, ebx
call fcn.1002cd64
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10043907
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x100439d0
mov dword [esp + 0xc], 0x33b4
cmp dword [esp + 0xc], 0x34cb
jle 0x10043978
xor esi, esi
xor edi, edi
mov eax, esi
lea ecx, [esp + 0x10]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001ac9
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10043952
mov eax, dword [eax]
push eax
call fcn.1004e1ed
pop ecx
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.100073ae
inc edi
cmp edi, 0x7aad
jl 0x10043935
inc esi
cmp esi, 0x4372
jl 0x10043933
cmp dword [esp + 0xc], 0x3105
jge 0x1004398d
push str.nubuiz_urzsskjj_hrgsppel_vwajumtwo_nabiqegqj
call fcn.1004e1ed
pop ecx
mov esi, dword [ebp + 0xc]
xor edx, edx
mov edi, dword [ebp + 0x18]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [esi]
mov dword [ebx], eax
mov eax, dword [esi]
mov ecx, dword [edi]
sub ecx, eax
mov eax, dword [ebx]
cmp ecx, eax
mov eax, dword [esi]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp + 8]
setg cl
xor edx, edx
cmp ecx, 0xb66f
mov eax, dword [eax]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [edi], ecx
jmp 0x100439d8
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004456c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x1c], ecx
je 0x100446c2
mov dword [ebp - 0x14], 0x43e1
cmp dword [ebp - 0x14], 0x44fc
jle 0x10044609
xor edi, edi
mov dword [ebp - 0x10], edi
xor esi, esi
mov dword [ebp - 0xc], esi
mov ebx, esi
mov dword [ebp - 8], 0x4da7
and dword [ebp - 0x18], 0
mov esi, ebx
and esi, edi
mov edi, dword [ebp - 0x18]
mov eax, esi
lea ecx, [ebp - 0x34]
xor eax, edi
cdq
push edx
push eax
call fcn.10001ac9
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100445c9
mov eax, dword [eax]
push eax
call fcn.1004e1ed
pop ecx
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.100073ae
inc edi
cmp edi, 0x479b
jl 0x100445b0
mov edi, dword [ebp - 0x10]
dec ebx
dec dword [ebp - 8]
jne 0x100445a5
mov esi, dword [ebp - 0xc]
inc esi
mov dword [ebp - 0xc], esi
cmp esi, 0x7420
jl 0x1004459c
inc edi
mov dword [ebp - 0x10], edi
cmp edi, 0x12de
jl 0x10044597
cmp dword [ebp - 0x14], 0x436c
jge 0x1004461d
push str.vfzt_majqdrhqp_bbzsox_hlhhcjijw_gpjx_rllcdhbtk_qzi_ddlk_nld_xzufexof
call fcn.1004e1ed
pop ecx
mov dword [ebp - 0xc], 0x4fb8
cmp dword [ebp - 0xc], 0x52e7
jle 0x1004469f
xor edi, edi
xor esi, esi
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [ebp - 0x14], 0x5b87
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
xor ebx, ebx
mov eax, esi
lea ecx, [ebp - 0x4c]
cdq
idiv ebx
or edx, edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001ac9
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10044663
mov eax, dword [eax]
push eax
call fcn.1004e1ed
pop ecx
push 0
push 1
lea ecx, [ebp - 0x4c]
call fcn.100073ae
inc ebx
cmp ebx, 0x60d9
jl 0x10044645
mov esi, dword [ebp - 0x10]
add dword [ebp - 8], esi
dec dword [ebp - 0x14]
jne 0x10044640
inc esi
mov dword [ebp - 0x10], esi
cmp esi, 0x1244
jl 0x10044634
inc edi
cmp edi, 0x318a
jl 0x1004462f
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp + 0x14]
push dword [eax]
call fcn.1000be87
cmp dword [ebp - 0xc], 0x4c0c
jge 0x100446d4
push str.ivxzws_ngxt_hqw
call fcn.1004e1ed
pop ecx
jmp 0x100446d4
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x100446d4
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004540a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100665d9
call fcn.10064760
sub esp, 0x10
cmp byte [ebp + 0x28], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, edx
je 0x10045484
cmp byte [ebp + 0x1c], 0
je 0x10045458
mov eax, dword [ebp + 0x30]
push 0x1a
pop ebx
mov esi, dword [eax]
cmp esi, ebx
jge 0x10045441
mov eax, dword [ebp + 8]
movsx edx, byte [eax]
add edx, esi
jmp 0x1004544b
mov eax, esi
cdq
idiv ebx
movsx eax, byte [ecx]
add edx, eax
push edx
mov ecx, edi
call fcn.1003d14d
jmp 0x1004556e
mov edx, dword [ebp + 0x20]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x1004556e
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 1
inc dword [edx]
cmp dword [edx], 3
jl 0x1004546d
jmp 0x1004556e
cmp byte [ebp + 0xc], 0
je 0x100454c8
mov ecx, dword [ebp + 0x2c]
mov eax, dword [ecx]
and dword [eax], 0
mov eax, dword [ecx]
cmp dword [eax], 0xc
jg 0x1004556e
mov edx, dword [ebp + 0x24]
mov esi, dword [ebp + 0x14]
mov dword [ebp + 0x28], 0xcc590f02
cmp dword [ebp + 0x28], 0
jne 0x1004556e
mov eax, dword [edx]
mov dword [esi], eax
mov eax, dword [ecx]
inc dword [eax]
mov eax, dword [ecx]
cmp dword [eax], 0xc
jle 0x100454a3
jmp 0x1004556e
mov dword [ebp - 0x18], 0x753d
cmp dword [ebp - 0x18], 0x76ed
jle 0x1004552f
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
xor edi, edi
xor esi, esi
mov dword [ebp - 0x14], esi
xor ebx, ebx
mov dword [ebp + 0x28], 0x1c39
xor esi, esi
mov ecx, esi
mov eax, ebx
shl eax, cl
mov ecx, 0x100809d8
xor eax, edi
cdq
push edx
push eax
call fcn.10006801
inc esi
cmp esi, 0x2cc
jl 0x100454f2
mov esi, dword [ebp - 0x14]
add ebx, esi
dec dword [ebp + 0x28]
jne 0x100454f0
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x196b
jl 0x100454e7
inc edi
cmp edi, 0x5f6a
jl 0x100454e2
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x71d1
jge 0x1004554b
mov edx, str.uwsgmm_ogqe_nslzuhyvs_akecuohtc_bkqsdu_czg_com_oqbdf_ddrrc
mov ecx, 0x100809d8
call fcn.1000b005
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x1004556e
mov esi, dword [ebp + 0x34]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xa11c1574
inc dword [edx]
cmp dword [edx], 1
jl 0x1004555c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10045a3b
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x10045a52
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8
Function at 0x10045a74
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x1009a3e4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x1009a770
jl 0x10045a82
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x1009aa14
jl 0x10045ac2
mov ecx, dword [0x1009b760]
xor ecx, dword [0x1009a3e4]
and ecx, edi
xor ecx, dword [0x1009b760]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x1009a3e0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x1009aa14]
mov dword [0x1009ada0], eax
pop esi
ret