joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001e600
Capabilities:
Get process heap force flags

Disassembly:
call fcn.1001e530
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov edx, dword [ecx + 0xa4]
shl edx, 0x10
or edx, dword [ecx + 0xa8]
cmp edx, 0x50001
jae 0x1001e62a
add eax, 0x74
ret
cmp edx, 0x60000
jae 0x1001e636
add eax, 0x78
ret
add eax, 0x88
ret

Function at 0x1001e640
Capabilities:
Get process heap force flags

Disassembly:
call fcn.1001e530
mov ecx, dword fs:[0x18]
mov ecx, dword [ecx + 0x30]
mov edx, dword [ecx + 0xa4]
shl edx, 0x10
or edx, dword [ecx + 0xa8]
cmp edx, 0x60000
jae 0x1001e66a
add eax, 0x7c
ret
add eax, 0x8c
ret

Function at 0x1001e900
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x328
mov eax, dword [0x10034100]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x1001e927
mov ecx, 5
int 0x29
push 2
call fcn.1001deca
push 0x50
lea eax, [ebp - 0x320]
push 0
push eax
call sub.msvcrt.dll_memset
push 0x2cc
lea eax, [ebp - 0x2d0]
push 0
push eax
call sub.msvcrt.dll_memset
lea eax, [ebp - 0x320]
add esp, 0x1c
mov dword [ebp - 0x328], eax
lea eax, [ebp - 0x2d0]
mov dword [ebp - 0x324], eax
mov dword [ebp - 0x220], eax
mov dword [ebp - 0x224], ecx
mov dword [ebp - 0x228], edx
mov dword [ebp - 0x22c], ebx
mov dword [ebp - 0x230], esi
mov dword [ebp - 0x234], edi
mov word [ebp - 0x208], ss
mov word [ebp - 0x214], cs
mov word [ebp - 0x238], ds
mov word [ebp - 0x23c], es
mov word [ebp - 0x240], fs
mov word [ebp - 0x244], gs
pushfd
pop dword [ebp - 0x210]
mov eax, dword [ebp + 4]
mov dword [ebp - 0x218], eax
lea eax, [ebp + 4]
mov dword [ebp - 0x20c], eax
mov dword [ebp - 0x2d0], 0x10001
mov eax, dword [eax - 4]
mov dword [ebp - 0x21c], eax
mov eax, dword [ebp + 4]
mov dword [ebp - 0x320], 0xc0000417
mov dword [ebp - 0x31c], 1
mov dword [ebp - 0x314], eax
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
push 0
mov esi, eax
call dword [sym.imp.KERNEL32.dll_SetUnhandledExceptionFilter]
lea eax, [ebp - 0x328]
push eax
call dword [sym.imp.KERNEL32.dll_UnhandledExceptionFilter]
test eax, eax
jne 0x1001ea32
test esi, esi
jne 0x1001ea32
push 2
call fcn.1001deca
add esp, 4
push 0xc0000417
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1001d576
mov esp, ebp
pop ebp
ret
Function at 0x10022120
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push esi
call fcn.10022150
mov esi, dword [ebp + 8]
test al, al
je 0x1002213e
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push esi
call fcn.10022160
add esp, 4
push esi
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x100265d0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x100265fd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x100265fd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x10004114
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x1000412b
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x1000414d
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x100ffef4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x10100280
jl 0x1000415b
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x10100524
jl 0x1000419b
mov ecx, dword [0x10101270]
xor ecx, dword [0x100ffef4]
and ecx, edi
xor ecx, dword [0x10101270]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x100ffef0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10100524]
mov dword [0x101008b0], eax
pop esi
ret
Function at 0x1000671d
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f230
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
and dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0x1f
jmp 0x10006753
mov eax, dword [ebp - 0x1c]
dec eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0
jl 0x100068fc
xor eax, eax
inc eax
mov ecx, dword [ebp - 0x1c]
shl eax, cl
and eax, dword [ebp + 8]
je 0x10006770
mov byte [ebp - 0x11], 1
jmp 0x10006774
mov byte [ebp - 0x11], 0
mov al, byte [ebp - 0x11]
mov byte [ebp - 0x13], al
mov dword [ebp - 0x34], 0x430b
mov dword [ebp - 0x40], str.mgsnbp_obmlv_sqpenybf_dyzcp_cksh_sybv_zallfxbzy_ody
cmp dword [ebp - 0x34], 0x455c
jle 0x10006867
and dword [ebp - 0x30], 0
jmp 0x100067a2
mov eax, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x30], 0x21d6
jge 0x1000683f
and dword [ebp - 0x2c], 0
jmp 0x100067bc
mov eax, dword [ebp - 0x2c]
inc eax
mov dword [ebp - 0x2c], eax
cmp dword [ebp - 0x2c], 0x4a70
jge 0x1000683a
and dword [ebp - 0x24], 0
jmp 0x100067d2
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x679d
jge 0x10006835
and dword [ebp - 0x28], 0
jmp 0x100067e8
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x6f54
jge 0x10006833
mov ecx, dword [ebp - 0x24]
imul ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
sar eax, cl
xor eax, dword [ebp - 0x30]
cdq
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
push dword [ebp - 0x44]
push dword [ebp - 0x48]
lea ecx, [ebp - 0x60]
call fcn.10001a95
pop ecx
pop ecx
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
call fcn.10003731
push eax
call fcn.10047ad3
pop ecx
lea ecx, [ebp - 0x60]
call fcn.10003727
jmp 0x100067e1
jmp 0x100067cb
jmp 0x100067b5
jmp 0x1000679b
push 0
push 0x14c6
push 0x384
push 0x228c
push 0x213a
push 0x729
push 0x24f5
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
xor eax, eax
inc eax
mov ecx, dword [ebp - 0x1c]
shl eax, cl
and eax, dword [ebp + 0xc]
je 0x1000687a
mov byte [ebp - 0x12], 1
jmp 0x1000687e
mov byte [ebp - 0x12], 0
mov al, byte [ebp - 0x12]
mov byte [ebp - 0x14], al
and dword [ebp - 4], 0
cmp dword [ebp - 0x34], 0x41c3
jge 0x1000689a
push dword [ebp - 0x40]
call fcn.10047ad3
pop ecx
jmp 0x100068b6
or dword [ebp - 4], 0xffffffff
jmp 0x100068c0
movzx eax, byte [ebp - 0x13]
movzx ecx, byte [ebp - 0x14]
and eax, ecx
je 0x100068d2
and dword [ebp - 0x38], 0
jmp 0x100068df
movzx eax, byte [ebp - 0x13]
movzx ecx, byte [ebp - 0x14]
or eax, ecx
mov dword [ebp - 0x38], eax
mov al, byte [ebp - 0x38]
mov byte [ebp - 0x15], al
mov eax, dword [ebp - 0x20]
shl eax, 1
mov dword [ebp - 0x20], eax
movzx eax, byte [ebp - 0x15]
or eax, dword [ebp - 0x20]
mov dword [ebp - 0x20], eax
jmp 0x1000674c
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d31e
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp dword [ebp + 0x10], 2
jle 0x1000d32f
jmp 0x1000d44c
imul eax, dword [ebp + 8], 0xab
mov ecx, dword [ebp + 0xc]
movsx eax, byte [eax + ecx + 0x100d1ab0]
cmp eax, 0x54
jne 0x1000d358
push 0x10068d28
call fcn.10047d92
pop ecx
push 0
call fcn.100482d4
and dword [ebp - 4], 0
jmp 0x1000d365
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x1000d44c
mov eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x100775e0]
add eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax*4 + 0x100775d0]
add eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
cmp dword [ebp - 0xc], 0
jl 0x1000d447
mov eax, dword [ebp - 0xc]
cmp eax, dword [0x100d8d7c]
jge 0x1000d447
cmp dword [ebp - 8], 0
jl 0x1000d447
mov eax, dword [ebp - 8]
cmp eax, dword [0x100d8d34]
jge 0x1000d447
imul eax, dword [ebp - 0xc], 0xab
mov ecx, dword [ebp - 8]
movsx eax, byte [eax + ecx + 0x100d1ab0]
cmp eax, 0x2a
je 0x1000d447
imul eax, dword [ebp - 0xc], 0x804
imul ecx, dword [ebp - 8], 0xc
lea eax, [eax + ecx + 0x1007c000]
mov ecx, dword [ebp + 0x10]
lea eax, [eax + ecx*4]
mov ecx, dword [ebp - 4]
movzx eax, byte [eax + ecx]
test eax, eax
jne 0x1000d447
imul eax, dword [ebp - 0xc], 0x804
imul ecx, dword [ebp - 8], 0xc
lea eax, [eax + ecx + 0x1007c000]
mov ecx, dword [ebp + 0x10]
lea eax, [eax + ecx*4]
mov ecx, dword [ebp - 4]
mov byte [eax + ecx], 1
mov eax, dword [ebp - 4]
cmp eax, dword [ebp + 0x14]
je 0x1000d42b
mov dword [ebp - 0x10], 1
jmp 0x1000d42f
and dword [ebp - 0x10], 0
push dword [ebp - 4]
mov eax, dword [ebp + 0x10]
add eax, dword [ebp - 0x10]
push eax
push dword [ebp - 8]
push dword [ebp - 0xc]
call fcn.1000d31e
add esp, 0x10
jmp 0x1000d35e
mov esp, ebp
pop ebp
ret
Function at 0x10011427
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f539
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x64
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100115cf
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10011582
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x10011580
mov dword [ebp - 0x24], 0xecb
mov dword [ebp - 0x30], str.slyp_uwceoj_refalmuii_yuow_yibr_ecmmmp_htoqktb_ybvtzjwsg_llucfooch_dxtbkuk_hrbnze_anysuinf
cmp dword [ebp - 0x24], 0xed9
jle 0x10011527
push 0
push 0x960
push 0x109
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
and dword [ebp - 0x1c], 0
jmp 0x100114cd
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x9be
jge 0x10011527
and dword [ebp - 0x20], 0
jmp 0x100114e3
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x2eed
jge 0x10011525
mov eax, dword [ebp - 0x1c]
or eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edx
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x74]
call fcn.10001a95
pop ecx
pop ecx
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
call fcn.10003731
push eax
call fcn.10047ad3
pop ecx
lea ecx, [ebp - 0x74]
call fcn.10003727
jmp 0x100114dc
jmp 0x100114c6
push 0
push 0
push 0
push 0
push 0x23da
push 1
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0xe60
jge 0x1001155a
push dword [ebp - 0x30]
call fcn.10047ad3
pop ecx
jmp 0x10011576
or dword [ebp - 4], 0xffffffff
jmp 0x10011580
jmp 0x100115cd
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
jmp 0x100115b0
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax], 3
jge 0x100115cd
mov eax, dword [ebp - 0x18]
push dword [eax]
mov ecx, dword [ebp - 0x44]
call fcn.10003ac4
mov dword [eax], 0xfffffff6
jmp 0x100115a5
jmp 0x1001160b
lea eax, [ebp + 0x18]
mov dword [ebp - 0x48], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
push dword [eax]
mov eax, dword [ebp - 0x4c]
push dword [eax]
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push 0
push 0x199
push 0x5d1
call fcn.1000a491
add esp, 0x1c
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100176ec
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1005f705
call fcn.1005ea30
sub esp, 0x38
push ebx
push esi
mov byte [ebp - 0x18], cl
mov eax, edx
mov dword [ebp - 0x24], 0x31f6
cmp dword [ebp - 0x24], 0x348c
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], eax
jle 0x1001776b
push 0xee8
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
and dword [ebp - 0x20], 0
mov ebx, edi
xor ebx, esi
mov esi, dword [ebp - 0x20]
mov eax, ebx
mov ecx, 0x1007aeb8
or eax, esi
cdq
push edx
push eax
call fcn.10003751
inc esi
cmp esi, 0x20cb
jl 0x10017736
mov esi, dword [ebp - 0x1c]
inc edi
cmp edi, 0x1459
jl 0x1001772b
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x2d1
jl 0x10017729
mov eax, dword [ebp - 0x28]
cmp byte [ebp - 0x18], 0
je 0x1001777c
mov dword [eax], 1
jmp 0x1001780b
mov dword [ebp - 0x20], 0x1f2e
cmp dword [ebp - 0x20], 0x20b3
jle 0x100177e5
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov eax, esi
mov esi, 0x3c37
cdq
idiv edi
mov ebx, edx
mov eax, ebx
lea ecx, [ebp - 0x40]
cdq
push edx
push eax
call fcn.10001a95
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100177b6
mov eax, dword [eax]
push eax
call fcn.10047ad3
pop ecx
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.10003d9b
dec ebx
dec esi
jne 0x1001779f
mov esi, dword [ebp - 0x1c]
inc edi
cmp edi, 0x4717
jl 0x10017793
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x26f8
jl 0x10017791
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x100177f7
push 0
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
cmp dword [ebp - 0x20], 0x1eb7
jge 0x1001780b
push str.qklpsrmez_saqoa_gkfwsu_gtxgfck_hehxu
call fcn.10047ad3
pop ecx
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0x2e77
jge 0x1001782a
mov edx, str.igzxy_nfklsu_hgwpem
mov ecx, 0x1007aeb8
call fcn.10005cf1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10017bc1
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005f719
call fcn.1005ea30
sub esp, 0x14
cmp byte [ebp + 0x20], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x10017c89
mov dword [ebp - 0x1c], 0x1844
cmp dword [ebp - 0x1c], 0x1b8b
jle 0x10017c3a
xor edi, edi
xor esi, esi
mov dword [ebp - 0x18], esi
xor ebx, ebx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x14], 0x113d
mov eax, esi
mov ecx, 0x1007aeb8
xor eax, edi
cdq
push edx
push eax
call fcn.10003751
add esi, ebx
dec dword [ebp - 0x14]
jne 0x10017c01
mov esi, dword [ebp - 0x18]
dec ebx
cmp ebx, 0xffff8b83
jg 0x10017bf7
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x7156
jl 0x10017bf5
inc edi
cmp edi, 0x672b
jl 0x10017bf0
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x155d
jge 0x10017c56
mov edx, str.ptof_nvffl_hkfftgk
mov ecx, 0x1007aeb8
call fcn.10005cf1
mov eax, dword [ebp + 0x2c]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
cmp dword [eax + ecx*4], 1
mov eax, dword [ebp + 0x24]
sbb ecx, ecx
neg ecx
mov dword [eax], ecx
jmp 0x10017cac
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10017cac
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [edx]
cmp dword [edx], 2
jl 0x10017c9a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10017da1
Capabilities:
Create process on windows

Disassembly:
cmp byte [ecx], 0
je 0x10017dbd
xor eax, eax
push eax
push eax
push eax
push eax
push 0x23da
push 1
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
ret
Function at 0x10017e2b
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005f72d
call fcn.1005ea30
sub esp, 0x10
push ebx
push esi
mov dword [ebp - 0x1c], edx
xor ebx, ebx
mov edx, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], edx
cmp byte [ebp + 0x10], bl
je 0x10017f25
mov esi, dword [ebp + 0x14]
mov eax, dword [esi]
mov edi, dword [esi]
mov esi, dword [edx]
mov eax, dword [esi + eax*4]
cmp eax, dword [esi + edi*4]
mov edi, dword [ebp + 0x14]
jge 0x10017e6c
mov dword [ebp - 0x18], ebx
cmp dword [edi], ebx
je 0x10017e73
mov dword [ebp - 0x18], 1
mov ecx, dword [edi]
xor eax, eax
mov esi, dword [edi]
mov edx, dword [edx]
mov edi, dword [ebp - 0x18]
cmp edi, dword [edx + ecx*4]
mov edi, dword [ebp + 0x14]
setne al
xor ecx, ecx
cmp eax, dword [edx]
setg cl
xor eax, eax
cmp ecx, dword [edx]
setne al
cmp eax, dword [edx + esi*4]
je 0x10017e9e
cmp dword [edi], ebx
je 0x10017ea1
xor ebx, ebx
inc ebx
mov edx, dword [edi]
xor ecx, ecx
mov edi, dword [edi]
mov esi, dword [ebp - 0x14]
mov esi, dword [esi]
mov eax, dword [esi]
imul eax, ebx
cmp dword [esi + edx*4], eax
mov edx, dword [ebp + 0x14]
setle cl
xor eax, eax
cmp ecx, dword [esi + edi*4]
mov ecx, dword [ebp - 0x1c]
setne al
add eax, 0x7fb
mov dword [ecx], eax
mov eax, dword [edx]
mov eax, dword [edx]
mov eax, dword [edx]
mov ecx, dword [edx]
mov esi, dword [edx]
mov edi, dword [edx]
mov eax, dword [ebp - 0x14]
mov edx, dword [eax]
xor eax, eax
cmp dword [edx + ecx*4], 1
setg al
xor ebx, ebx
cmp eax, dword [edx + esi*4]
mov eax, dword [ebp + 0xc]
mov esi, dword [ebp + 0x14]
setl bl
xor ecx, ecx
mov eax, dword [eax]
cmp ebx, eax
mov eax, dword [esi]
setle cl
xor edx, edx
add ecx, 0x66e5
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setle dl
mov eax, dword [eax]
mov dword [eax + edi*4], edx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x18], 0x3b36
cmp dword [ebp - 0x18], 0x3cd2
jle 0x10017f71
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectObject]
mov esi, ebx
mov edi, ebx
mov eax, edi
mov ecx, 0x1007aeb8
xor eax, esi
cdq
push edx
push eax
call fcn.10003751
inc edi
cmp edi, 0x73df
jl 0x10017f4e
inc esi
cmp esi, 0x71ee
jl 0x10017f4c
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x3893
jge 0x10017f14
mov edx, str.fui_rndkjho_ojzehfbzv_btqjj_eoouw_rcgfsjrv_igb
mov ecx, 0x1007aeb8
call fcn.10005cf1
jmp 0x10017f14
Function at 0x10019b27
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov dword [esp + 0xc], 0x1d4b
mov eax, ecx
cmp dword [esp + 0xc], 0x1115
push esi
push edi
mov dword [esp + 0x10], eax
jge 0x10019b9e
lea eax, [esp + 0x18]
mov ecx, 0x1007afd8
push eax
xor esi, esi
xor ebx, ebx
call fcn.1001fd80
mov edi, dword [esp + 0x18]
test edi, edi
jle 0x10019b86
lea eax, [esp + 0x1c]
mov ecx, 0x1007afd8
push eax
call fcn.1001fd80
mov eax, dword [esp + 0x1c]
test eax, eax
js 0x10019b81
add esi, eax
jmp 0x10019b83
add ebx, eax
dec edi
jne 0x10019b66
sub esi, ebx
mov ecx, 0x1007aeb8
push esi
call fcn.1001ff79
push eax
call fcn.10021f62
mov eax, dword [esp + 0x14]
pop ecx
cmp byte [ebp + 0x14], 0
je 0x10019bc4
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
jmp 0x10019bbd
mov ecx, dword [edx]
mov eax, dword [eax]
and dword [eax + ecx*4], 0
inc dword [edx]
mov eax, dword [esp + 0x10]
cmp dword [edx], 4
jl 0x10019baf
jmp 0x10019bce
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001bfd8
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1005f852
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
push ebx
push esi
xor ebx, ebx
mov byte [esp + 0x10], dl
push edi
test dl, dl
je 0x1001c0f5
mov dword [esp + 0x18], 0x7e2799ac
mov dword [esp + 0x18], ebx
jmp 0x1001c0e1
push 2
lea ecx, [esp + 0x28]
call fcn.100039f2
mov dword [esp + 0x54], ebx
mov dword [esp + 0x1c], 0x2511
cmp dword [esp + 0x1c], 0x2552
jle 0x1001c07e
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
shl eax, cl
lea ecx, [esp + 0x30]
cdq
push edx
push eax
call fcn.10001a95
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001c059
mov eax, dword [eax]
push eax
call fcn.10047ad3
pop ecx
push ebx
push 1
lea ecx, [esp + 0x38]
call fcn.10003d9b
inc edi
cmp edi, 0x7627
jl 0x1001c03d
inc esi
cmp esi, 0x72df
jl 0x1001c03b
cmp dword [esp + 0x1c], 0x2413
jge 0x1001c093
push str.qbe_pxykizgso_oixprgipu_ulfcutjp_geuosbr_fdhz_mszb_zkj_qagzs
call fcn.10047ad3
pop ecx
lea eax, [esp + 0x20]
mov dword [esp + 0x54], ebx
push eax
sub esp, 0xc
lea ecx, [esp + 0x34]
mov dl, 1
push 0x46ad
sub esp, 0xc
call fcn.1001b440
mov byte [esp + 0x33], bl
add esp, 0x20
cmp byte [esp + 0x13], 0
je 0x1001c0c7
mov dl, 1
call fcn.10019907
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x24]
cmp dword [eax], ebx
jne 0x1001c0ee
or dword [esp + 0x54], 0xffffffff
call fcn.10003a4f
inc dword [esp + 0x18]
cmp dword [esp + 0x18], 0xe
jge 0x1001c018
jmp 0x1001c107
call fcn.10003a4f
jmp 0x1001c107
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x1001c107
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret