joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001477d
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060e17
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x70
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001491a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1001482e
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
cmp dword [eax], 6
jae 0x10014829
mov eax, dword [ebp - 0x48]
mov eax, dword [eax]
mov dword [ebp - 0x50], eax
push dword [ebp - 0x4c]
lea eax, [ebp - 0x50]
push eax
mov ecx, dword [ebp - 0x54]
call fcn.1001a41c
mov ecx, eax
call fcn.1000630e
jmp 0x10014918
mov dword [ebp - 0x1c], 0x1f7f
mov dword [ebp - 0x5c], str.azaqbg_nseaope_khsdnaq_nrmch_cgxv_pkluwapdz_rqzvpyipv_sdvr_htpormzzp_xwquod
cmp dword [ebp - 0x1c], 0x225b
jle 0x100148d6
push 0x26f6
push 0x17cf
push 0x1a04
push 0x186d
push 0
call dword [sym.imp.USER32.dll_PeekMessageA]
and dword [ebp - 0x14], 0
jmp 0x10014872
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x46c5
jge 0x100148cc
and dword [ebp - 0x18], 0
jmp 0x10014888
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2f8b
jge 0x100148ca
mov eax, dword [ebp - 0x14]
or eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], edx
push dword [ebp - 0x64]
push dword [ebp - 0x68]
lea ecx, [ebp - 0x80]
call fcn.10001a84
pop ecx
pop ecx
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x58]
call fcn.1000614a
push eax
call fcn.1004823d
pop ecx
lea ecx, [ebp - 0x80]
call fcn.10006140
jmp 0x10014881
jmp 0x1001486b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x1c92
jge 0x100148f2
push dword [ebp - 0x5c]
call fcn.1004823d
pop ecx
jmp 0x1001490e
or dword [ebp - 4], 0xffffffff
jmp 0x10014918
jmp 0x10014937
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x60], eax
push 0x6f8a
push 0x6247
push 0
push dword [ebp - 0x60]
call fcn.10019b5c
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001bfd4
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10061036
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
push 0x4d50
push 0x3258
push 0xe2
push 0
push dword [ebp + 8]
lea eax, [ebp - 0x28]
push eax
push 0x6e11
push 1
call fcn.1001d772
add esp, 0x20
mov dword [ebp - 0x24], 0x21b0
mov dword [ebp - 0x2c], str.dctyyqlmd_hjsze_czlfdest_nxsqm_snudj_xkhcxc_tqckyja_eot
cmp dword [ebp - 0x24], 0x2541
jle 0x1001c0c8
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
and dword [ebp - 0x1c], 0
jmp 0x1001c04b
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x5235
jge 0x1001c0c8
and dword [ebp - 0x14], 0
jmp 0x1001c061
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x5f38
jge 0x1001c0c3
and dword [ebp - 0x18], 0
jmp 0x1001c077
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x59db
jge 0x1001c0c1
and dword [ebp - 0x20], 0
jmp 0x1001c08d
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x201c
jge 0x1001c0bf
mov ecx, dword [ebp - 0x14]
add ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
shl eax, cl
mov ecx, dword [ebp - 0x20]
shl eax, cl
cdq
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
push dword [ebp - 0x30]
push dword [ebp - 0x34]
mov ecx, 0x1007b9d8
call fcn.1000616a
jmp 0x1001c086
jmp 0x1001c070
jmp 0x1001c05a
jmp 0x1001c044
push 4
pop eax
imul eax, eax, 0
mov eax, dword [ebp + eax - 0x28]
jmp 0x1001c114
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002009a
Capabilities:
Get disk information
Query service status

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1002012d
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x100200e0
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100200de
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
jmp 0x1002012b
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1002010e
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x1002012b
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.100067a4
mov dword [eax], 9
jmp 0x10020103
jmp 0x10020161
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1002014d
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x10020161
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov eax, dword [eax]
and dword [eax], 0
mov esp, ebp
pop ebp
ret
Function at 0x10020bfe
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100610ff
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10020d40
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x24], 0x502a
mov dword [ebp - 0x30], str.cpdsle_bhpce_uteantwl_uewpsiewq_gxdjo_jvq_lsraaiup_bogm_jod_eru_jst_vwg_jyqacwaj
cmp dword [ebp - 0x24], 0x5404
jle 0x10020ce9
and dword [ebp - 0x1c], 0
jmp 0x10020c60
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x13a1
jge 0x10020cdd
and dword [ebp - 0x20], 0
jmp 0x10020c76
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x12aa
jge 0x10020cd8
and dword [ebp - 0x14], 0
jmp 0x10020c8c
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x3ae1
jge 0x10020cd6
and dword [ebp - 0x18], 0
jmp 0x10020ca2
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x6375
jge 0x10020cd4
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sar eax, cl
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x20]
and eax, ecx
cdq
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
push dword [ebp - 0x44]
push dword [ebp - 0x48]
mov ecx, 0x1007b9d8
call fcn.1000616a
jmp 0x10020c9b
jmp 0x10020c85
jmp 0x10020c6f
jmp 0x10020c59
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
push dword [ebp - 0x28]
push 0x276
push 1
push dword [ebp - 0x2c]
call fcn.10020d81
add esp, 0x10
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x4f2b
jge 0x10020d18
mov edx, dword [ebp - 0x30]
mov ecx, 0x1007b9d8
call fcn.10008de6
jmp 0x10020d34
or dword [ebp - 4], 0xffffffff
jmp 0x10020d3e
jmp 0x10020d70
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x10020d6a
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
and dword [eax], 0
jmp 0x10020d70
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100212d5
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10061113
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002143d
lea eax, [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1002141d
mov dword [ebp - 0x20], 0x4ea5
mov dword [ebp - 0x2c], str.etfk_ngzukkff_zjodjnqm_nqlenslhf_bwspiwem_zaync_yikiujxxt_sea_ssfpizab
cmp dword [ebp - 0x20], 0x5021
jle 0x100213aa
and dword [ebp - 0x1c], 0
jmp 0x10021347
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x244d
jge 0x100213a2
and dword [ebp - 0x14], 0
jmp 0x1002135d
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x5a6c
jge 0x100213a0
and dword [ebp - 0x18], 0
jmp 0x10021373
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1e07
jge 0x1002139e
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
or eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
push dword [ebp - 0x44]
push dword [ebp - 0x48]
mov ecx, 0x1007b9d8
call fcn.1000616a
jmp 0x1002136c
jmp 0x10021356
jmp 0x10021340
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x4afa
jge 0x100213ca
mov edx, dword [ebp - 0x2c]
mov ecx, 0x1007b9d8
call fcn.10008de6
jmp 0x100213e6
or dword [ebp - 4], 0xffffffff
jmp 0x100213f0
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x1002141b
push 0x7302
push 0x7463
push 0
push 0
push 0x570f
call fcn.10020bfe
add esp, 0x14
jmp 0x1002143b
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x1002143b
push 0
call dword [sym.imp.COMDLG32.dll_GetSaveFileNameW]
jmp 0x10021451
push 0x4706
push 1
push 0x782c
call fcn.10020e82
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10025308
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100611d7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002545a
lea eax, [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10025363
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov byte [eax], 1
jmp 0x10025458
mov byte [ebp - 0x11], 0
push 0x5ec1
lea eax, [ebp - 0x11]
push eax
push 0x7c20
push 0x3663
push 0
call fcn.1002d254
add esp, 0x14
mov dword [ebp - 0x24], 0x1961
mov dword [ebp - 0x38], str.ewophidyo_hxvnbvwcb_tih_bctgxfdi
cmp dword [ebp - 0x24], 0x1c13
jle 0x10025418
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
and dword [ebp - 0x20], 0
jmp 0x100253b0
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x2738
jge 0x10025410
and dword [ebp - 0x18], 0
jmp 0x100253c6
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x4755
jge 0x1002540e
and dword [ebp - 0x1c], 0
jmp 0x100253dc
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x95e
jge 0x1002540c
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
sub ecx, eax
mov eax, ecx
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
mov ecx, 0x1007b9d8
call fcn.1000616a
jmp 0x100253d5
jmp 0x100253bf
jmp 0x100253a9
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x180f
jge 0x10025432
mov edx, dword [ebp - 0x38]
mov ecx, 0x1007b9d8
call fcn.10008de6
jmp 0x1002544e
or dword [ebp - 4], 0xffffffff
jmp 0x10025458
jmp 0x10025478
push 0x48fd
push 1
push 0x5a51
push 0x5589
push 0x4585
call fcn.1002098c
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002f50f
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061506
call fcn.10060104
sub esp, 0x1c
mov byte [ebp - 0x18], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x1002f544
push dword [edx]
mov ecx, dword [ebp + 0x14]
call fcn.1001a053
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x24], 0x2aec
cmp dword [ebp - 0x24], 0x2c63
jle 0x1002f58e
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, ebx
mov ecx, 0x1007b9d8
xor eax, edi
cdq
push edx
push eax
call fcn.1000616a
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x41ae
jl 0x1002f55d
inc ebx
cmp ebx, 0x5173
jl 0x1002f558
inc edi
cmp edi, 0x60ab
jl 0x1002f556
mov dword [ebp - 0x20], 0x7868
cmp dword [ebp - 0x20], 0x788b
jle 0x1002f5e0
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov eax, ebx
cdq
idiv ecx
mov eax, edi
mov ecx, edx
sar eax, cl
mov ecx, 0x1007b9d8
cdq
push edx
push eax
call fcn.1000616a
mov ecx, dword [ebp - 0x1c]
inc ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x26d9
jl 0x1002f5a7
inc ebx
cmp ebx, 0x7dad
jl 0x1002f5a2
inc edi
cmp edi, 0xd74
jl 0x1002f5a0
mov edi, dword [ebp + 0x1c]
mov dword [edi], 0
jmp 0x1002f61b
push ecx
push 0x13d2
push 0x753f
push 1
push ecx
lea eax, [ebp - 0x11]
mov byte [ebp - 0x11], 0
push eax
push 0x2cfd
push ecx
push 1
push ecx
mov edx, 0x7006
xor cl, cl
call fcn.1002e437
add esp, 0x28
inc dword [edi]
cmp dword [edi], 0x3c
jle 0x1002f5eb
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x7812
jge 0x1002f63c
mov edx, str.wgncqgks_gvbvabkl_vtw
mov ecx, 0x1007b9d8
call fcn.10008de6
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0x27a3
jge 0x1002f533
mov edx, str.uhb_zngptj_rgisg_ivlqyhyz_swdczv_ouidvdt_ysagow_fayurwipa_lrcpdxpci_wrlc_psu_mugcgolsg
mov ecx, 0x1007b9d8
call fcn.10008de6
jmp 0x1002f533
Function at 0x1002f93e
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x10061510
call fcn.10060104
sub esp, 0x34
push ebx
mov byte [ebp - 0x10], 0
mov dword [ebp - 0x14], 0x164e
cmp dword [ebp - 0x14], 0x1a32
push esi
push edi
jle 0x1002f9c5
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov esi, edx
mov eax, esi
lea ecx, [ebp - 0x3c]
or eax, ebx
cdq
push edx
push eax
call fcn.10001a84
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002f98b
mov eax, dword [eax]
push eax
call fcn.1004823d
pop ecx
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.10006cdf
inc ebx
cmp ebx, 0x7cdd
jl 0x1002f972
mov esi, dword [ebp - 0x18]
inc edi
cmp edi, 0x7924
jl 0x1002f969
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x570d
jl 0x1002f967
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp dword [ebp - 0x14], 0x136a
jge 0x1002f9d9
push str.zrgeykvkr_uzwyidxgr_xecbkho
call fcn.1004823d
pop ecx
mov esi, dword [ebp + 0x20]
mov dword [esi], 0xfffffffe
cmp dword [esi], 0x15
jl 0x1002fae5
mov ebx, dword [ebp + 0x24]
mov edi, dword [ebp + 0x10]
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0xfffffffd
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0
je 0x1002fa3e
mov eax, dword [esi]
xor ecx, ecx
cmp eax, 0x65e3
mov eax, dword [esi]
sete cl
cmp ecx, 0xfffe
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [esi]
sete cl
xor edx, edx
add ecx, 0x57ce14dd
cmp ecx, eax
sete dl
cmp edx, dword [edi]
jg 0x1002fa3e
xor eax, eax
inc eax
jmp 0x1002fa40
xor eax, eax
add eax, 0xfffffffb
imul eax, dword [ebp - 0x14]
test eax, eax
je 0x1002faab
mov dword [ebp - 0x18], 4
mov dword [ebp - 0x18], 0
jmp 0x1002fa69
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x24], 1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1002fa5b
mov edx, dword [ebp - 0x14]
mov eax, dword [edi]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
setge cl
imul eax, ecx, 0xe5f5
test eax, eax
je 0x1002fa96
cmp dword [ebp - 0x24], 0
jne 0x1002fa96
xor edx, edx
jmp 0x1002fa99
xor edx, edx
inc edx
mov eax, dword [ebp - 0x14]
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x14]
jmp 0x1002fada
mov dword [ebp - 0x18], 9
mov eax, dword [ebp - 0x18]
mov dword [ebx], eax
mov eax, dword [ebx]
mov eax, dword [ebp - 0x18]
inc eax
je 0x1002fad5
mov eax, dword [ebp - 0x18]
xor ecx, ecx
cmp eax, 0x3c394a73
setle cl
sub ecx, dword [edi]
je 0x1002fad5
xor eax, eax
inc eax
jmp 0x1002fad7
xor eax, eax
mov dword [ebp - 0x18], eax
inc dword [esi]
cmp dword [esi], 0x15
jge 0x1002f9f1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002faf6
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x1002fb0d
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8
Function at 0x1002fb2f
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x100ada44
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x100addd0
jl 0x1002fb3d
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x100ae074
jl 0x1002fb7d
mov ecx, dword [0x100aedc0]
xor ecx, dword [0x100ada44]
and ecx, edi
xor ecx, dword [0x100aedc0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x100ada40], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x100ae074]
mov dword [0x100ae400], eax
pop esi
ret

Function at 0x1002fbef
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, 0x100ada44
mov ecx, dword [esi + 4]
xor ecx, dword [esi]
and ecx, 0x7fffffff
xor ecx, dword [esi]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
add esi, 4
cmp esi, 0x100ae404
jl 0x1002fbf5
pop esi
ret
Function at 0x10031abc
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov byte [ebp - 8], cl
push ebx
mov ebx, edx
push esi
push edi
test cl, cl
je 0x10031adb
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x10031b90
mov dword [ebp - 0xc], 0x6313
cmp dword [ebp - 0xc], 0x6445
jle 0x10031b2c
xor esi, esi
xor edi, edi
lea eax, [edi + esi]
cdq
lea ecx, [ebp - 0x24]
push edx
push eax
call fcn.10001a84
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10031b07
mov eax, dword [eax]
push eax
call fcn.1004823d
pop ecx
push 0
push 1
lea ecx, [ebp - 0x24]
call fcn.10006cdf
inc edi
cmp edi, 0x3e42
jl 0x10031aef
inc esi
cmp esi, 0xeb4
jl 0x10031aed
cmp dword [ebp - 0xc], 0x628a
jge 0x10031b40
push str.svoxtr_hgbydd_xgpqyxq_fcgpxpnux_kynqi_educqi_ftuv_ihj_bry
call fcn.1004823d
pop ecx
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0xc]
mov eax, dword [eax]
add eax, dword [ecx]
jne 0x10031b54
mov eax, dword [ebp + 0x18]
cmp dword [eax], 0
je 0x10031b56
mov eax, dword [ecx]
mov eax, dword [ecx]
xor edx, edx
mov eax, dword [ecx]
test eax, eax
mov eax, dword [ecx]
setne dl
xor ecx, ecx
sub edx, eax
mov eax, dword [ebx]
cmp edx, eax
mov eax, 0xf2fdad5a
setg cl
cmp eax, ecx
sbb eax, eax
inc eax
mov dword [ebx], eax
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov ecx, dword [eax + 0xc]
mov eax, dword [ebp + 0x14]
inc ecx
mov eax, dword [eax]
mov dword [eax + 4], ecx
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10032634
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
mov eax, 0x10061611
call fcn.10060104
sub esp, 0x1c
push ebx
push esi
mov byte [ebp - 0x14], cl
mov dword [ebp - 0x20], 0x4abc
cmp dword [ebp - 0x20], 0x4e52
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edx
jle 0x100326a8
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov eax, ebx
shl eax, cl
lea ecx, [edi + esi]
xor eax, ecx
mov ecx, 0x1007b9d8
cdq
push edx
push eax
call fcn.1000616a
mov ecx, dword [ebp - 0x1c]
inc ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x6c2e
jl 0x10032668
inc ebx
cmp ebx, 0x2309
jl 0x10032663
inc edi
cmp edi, 0x4746
jl 0x10032661
inc esi
cmp esi, 0x40b8
jl 0x1003265f
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x46fb
jge 0x100326c4
mov edx, str.mnfvn_qwvukfre_lsigq_kswqiaxkk_ajtxs_mttsfqe_ttsrszazk_bojgueysq_riqsv_hib_qtvdxih_rdjwgv
mov ecx, 0x1007b9d8
call fcn.10008de6
cmp byte [ebp - 0x14], 0
je 0x10032700
mov ecx, dword [ebp + 0x20]
mov eax, dword [ecx]
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
mov eax, dword [ecx]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov eax, dword [ebp - 0x24]
mov dword [eax], 0x4361a6b7
jmp 0x10032710
mov byte [ebp - 0x15], 0
cmp byte [ebp - 0x15], 0
je 0x10032710
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret