joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001eec
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10064dbd
call fcn.10064760
sub esp, 0x48
push ebx
push esi
mov byte [ebp - 0x18], cl
mov ebx, edx
mov dword [ebp - 0x1c], 0x71d9
cmp dword [ebp - 0x1c], 0x7298
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], ebx
jle 0x10001f41
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x100809d8
xor eax, edi
cdq
push edx
push eax
call fcn.10006801
inc ebx
cmp ebx, 0x1a9e
jl 0x10001f1b
inc edi
cmp edi, 0x713f
jl 0x10001f19
mov ebx, dword [ebp - 0x20]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x6f8a
jge 0x10001f7c
mov edx, str.pnxfivr_ukmla_jse_gfeave_yikwst_lynlzra_yoi_aqhwkz_silqku_biwpqiqm_xxe_tqsdhmsv_ahrkg
mov ecx, 0x100809d8
call fcn.1000b005
jmp 0x10001f7c
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x18], 0
je 0x10001fa5
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
jmp 0x10001f9b
mov ecx, dword [edx]
mov eax, dword [ebx]
and dword [eax + ecx*4], 0
inc dword [edx]
cmp dword [edx], 1
jl 0x10001f91
jmp 0x10002042
mov dword [ebp - 0x1c], 0x2e5e
cmp dword [ebp - 0x1c], 0x2f01
jle 0x10002004
xor edi, edi
xor ebx, ebx
mov eax, ebx
lea ecx, [ebp - 0x38]
xor eax, edi
cdq
push edx
push eax
call fcn.10001ac9
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10001fd2
mov eax, dword [eax]
push eax
call fcn.1004e1ed
pop ecx
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.100073ae
inc ebx
cmp ebx, 0x2eb2
jl 0x10001fb9
inc edi
cmp edi, 0x6685
jl 0x10001fb7
push 0
push 0x26c5
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0x14]
mov eax, dword [eax]
inc eax
push eax
push 0
lea eax, [ebp - 0x50]
push eax
call fcn.10006ad8
mov ecx, dword [ebp + 0x14]
push eax
call fcn.10006976
push 0
push 1
lea ecx, [ebp - 0x50]
call fcn.1000783e
cmp dword [ebp - 0x1c], 0x2a87
jge 0x10002042
push str.xolfpmvwf_kxtql_busy_ffgiie_atrynlq_bbymflvs_ovyazna_bxes_sdqu_yjxsvzjr_kqhckktu_fxrz_nlecnjvgv_rnp
call fcn.1004e1ed
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004eb2
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10064fc6
call fcn.10064760
sub esp, 0x2c
cmp byte [ebp + 0x24], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, ecx
je 0x10004f80
mov dword [ebp - 0x1c], 0x7b6c
cmp dword [ebp - 0x1c], 0x7c94
jle 0x10004f52
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x14], edi
xor ebx, ebx
mov dword [ebp - 0x20], edi
xor edi, esi
xor esi, esi
mov eax, edi
lea ecx, [ebp - 0x38]
or eax, esi
or eax, ebx
cdq
push edx
push eax
call fcn.10001ac9
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10004f0f
mov eax, dword [eax]
push eax
call fcn.1004e1ed
pop ecx
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.100073ae
inc esi
cmp esi, 0x1d99
jl 0x10004ef4
inc ebx
cmp ebx, 0x2b94
jl 0x10004ef2
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x2cac
jl 0x10004eeb
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x3a33
jl 0x10004ee6
mov eax, dword [ebp + 0x2c]
mov dword [eax], 1
cmp dword [ebp - 0x1c], 0x79e4
jge 0x10004f6f
push str.wqkislq_wkfa_vwjlnu
call fcn.1004e1ed
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], 0x36a1
cmp dword [ebp - 0x1c], 0x38f7
jle 0x10004fb7
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x100809d8
xor eax, esi
cdq
push edx
push eax
call fcn.10006801
inc edi
cmp edi, 0x2af4
jl 0x10004f94
inc esi
cmp esi, 0x1c95
jl 0x10004f92
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
jmp 0x10004fcf
mov ecx, dword [edx]
mov eax, dword [ebx]
mov dword [eax + ecx*4], 0x2062
inc dword [edx]
cmp dword [edx], 1
jl 0x10004fc2
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x32eb
jge 0x10004f6f
mov edx, str.aobdks_rldiounpi_gqqfxfl_zrwpalkgp_mbi_obk_xiisopgj_fqaxw_wmyrgj_kofqunn_yaywy_uvkly_hnhuume
mov ecx, 0x100809d8
call fcn.1000b005
jmp 0x10004f6f
Function at 0x1000528b
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10064ffa
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov byte [esp + 0x14], cl
je 0x100053d1
test cl, cl
je 0x100053c9
sub esp, 0x18
mov ecx, esp
push edx
call fcn.10006916
lea ecx, [esp + 0x34]
call fcn.10004591
add esp, 0x18
xor ebx, ebx
mov dword [esp + 0x64], ebx
mov eax, dword [esp + 0x20]
cmp dword [esp + 0x1c], eax
je 0x1000534c
push dword [esp + 0x18]
xor ecx, ecx
mov dword [esp + 0x40], 7
push eax
push dword [esp + 0x24]
mov word [esp + 0x34], cx
lea ecx, [esp + 0x34]
mov dword [esp + 0x44], ebx
call fcn.1000bcd4
mov ecx, dword [ebp + 0x1c]
lea edx, [esp + 0x28]
mov byte [esp + 0x64], 1
call fcn.1000526b
lea ecx, [esp + 0x28]
push ebx
push 1
test eax, eax
jns 0x10005343
mov eax, dword [ebp + 8]
mov byte [eax], 1
call fcn.1000783e
lea ecx, [esp + 0x1c]
call fcn.10007ae9
jmp 0x10005420
mov byte [esp + 0x6c], bl
call fcn.1000783e
mov eax, dword [ebp + 8]
mov byte [eax], bl
mov dword [esp + 0x18], 0x17a5
cmp dword [esp + 0x18], 0x1a1d
jle 0x10005335
push 0x11e4
push 0x13ca
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov esi, ebx
mov edi, ebx
mov eax, esi
lea ecx, [esp + 0x40]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001ac9
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10005394
mov eax, dword [eax]
push eax
call fcn.1004e1ed
pop ecx
push ebx
push 1
lea ecx, [esp + 0x48]
call fcn.100073ae
inc edi
cmp edi, 0x339d
jl 0x10005377
inc esi
cmp esi, 0x4134
jl 0x10005375
push 0x1ec8
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
jmp 0x10005335
mov eax, dword [ebp + 0xc]
and dword [eax], 0
jmp 0x10005420
cmp byte [ebp + 0x14], 0
je 0x1000540e
push 1
push 0x53e
push 0x16ae
push 0x774b
push 0xba8
xor ebx, ebx
lea ecx, [esp + 0x27]
push 1
push ebx
push 0x74a8
mov edx, 0x3120
mov byte [esp + 0x33], bl
call fcn.100058b7
add esp, 0x20
jmp 0x10005420
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x10005420
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov ecx, dword [esp + 0x5c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000c94c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov byte [ebp - 8], cl
push esi
mov esi, edx
test cl, cl
je 0x1000c96f
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x1000c98c
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x1000c98c
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
jmp 0x1000c987
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 2
inc dword [edx]
cmp dword [edx], 3
jl 0x1000c97a
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000df69
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
push ebx
push esi
xor eax, eax
mov dword [ebp - 8], 0xdcec3d7d
inc eax
mov esi, ecx
mov dword [ebp - 0x1c], eax
lea ecx, [ebp - 0x2c]
push edi
mov dword [ebp - 0xc], 0xc7be0218
xor ebx, ebx
mov dword [ebp - 0x18], 0x7a912e75
mov edi, edx
mov dword [ebp - 0x10], 9
push eax
mov dword [ebp - 0x20], ebx
call fcn.10006b10
mov eax, 0xe3f50e16
xor edx, edx
mov dword [ebp - 0x3c], eax
inc edx
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0xc], ebx
jmp 0x1000dfcf
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 0x2c]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], edx
jl 0x1000dfbf
cmp dword [ebp - 8], ebx
je 0x1000e071
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x18], 0xbf199314
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0xc], ebx
jmp 0x1000e001
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x4c], 0x7a8cf1d6
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 4
jl 0x1000dff3
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
dec eax
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x44], eax
jne 0x1000e021
dec dword [ebp - 0x10]
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x18]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, 0x3cf
setle cl
mov dword [ebp - 0x18], ecx
xor ecx, ecx
mov eax, dword [ebp - 0x18]
test eax, eax
sets cl
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
mov edx, dword [ebp - 0x1c]
sub edx, eax
mov eax, dword [ebp - 0x2c]
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
mov dword [eax], edx
mov eax, dword [ebp - 0x14]
cmp eax, edx
setle cl
mov dword [ebp - 0xc], ecx
jmp 0x1000e0b5
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x1c], 0xcbaa6f4e
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], ebx
jmp 0x1000e0b0
mov dword [ebp - 0x1c], 0xdfe1602a
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x1000e09d
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 0xc], ebx
jmp 0x1000e0a8
inc dword [ebp - 0x1c]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], ebx
jle 0x1000e0a2
inc dword [ebp - 8]
cmp dword [ebp - 8], ebx
jle 0x1000e086
lea ecx, [ebp - 0x2c]
call fcn.10006b72
push ecx
mov edx, edi
mov ecx, esi
call fcn.1002c93f
pop ecx
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000eb1f
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1000ebb4
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1000eb51
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x1000ebb2
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1000eb73
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0xfffffff0
jg 0x1000ebb2
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0xc], 0xd
jmp 0x1000eb92
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jg 0x1000ebb0
push 0
push 0
push 0x6b23
push 0x1bb2
call fcn.1000e371
add esp, 0x10
jmp 0x1000eb8b
jmp 0x1000eb68
jmp 0x1000ec28
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1000ebdd
push 0x1ec8
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
jmp 0x1000ec28
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1000ec0b
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x1000ec28
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x30]
call fcn.10006b8e
mov dword [eax], 1
jmp 0x1000ec00
mov esp, ebp
pop ebp
ret
Function at 0x10010e91
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100654d0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10010f1b
lea eax, [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10010ef6
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x10010ef4
push 0x6a2b
push 1
push 0x5329
push 1
push 1
push 0x49d7
call fcn.1000eb1f
add esp, 0x18
jmp 0x10010f16
mov byte [ebp - 0x12], 0
movzx eax, byte [ebp - 0x12]
test eax, eax
je 0x10010f16
push 0x7275
push 0
push 0x3a08
call fcn.10017ccb
add esp, 0xc
jmp 0x1001104e
mov dword [ebp - 0x28], 0x7bd
mov dword [ebp - 0x34], str.uhqota_ghtpzu_mpvgvcb_mxpcsnlqj_vtwaaccgn_qfbvoss_idg_nygqctgi_pprzykabe_sxqdl_srzxjj_tosw_phirfaer
cmp dword [ebp - 0x28], 0xb66
jle 0x10010fec
push 0x1a7d
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
and dword [ebp - 0x18], 0
jmp 0x10010f50
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1a75
jge 0x10010fec
and dword [ebp - 0x1c], 0
jmp 0x10010f6a
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x1f9f
jge 0x10010fe7
and dword [ebp - 0x20], 0
jmp 0x10010f80
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x16ff
jge 0x10010fe2
and dword [ebp - 0x24], 0
jmp 0x10010f96
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x5039
jge 0x10010fe0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
shl eax, cl
cdq
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
push dword [ebp - 0x40]
push dword [ebp - 0x44]
lea ecx, [ebp - 0x5c]
call fcn.10001ac9
pop ecx
pop ecx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
call fcn.10006659
push eax
call fcn.1004e1ed
pop ecx
lea ecx, [ebp - 0x5c]
call fcn.1000664f
jmp 0x10010f8f
jmp 0x10010f79
jmp 0x10010f63
jmp 0x10010f49
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x3e6
jge 0x10011008
push dword [ebp - 0x34]
call fcn.1004e1ed
pop ecx
jmp 0x10011024
or dword [ebp - 4], 0xffffffff
jmp 0x1001102e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
push 0x4e92
push dword [ebp - 0x38]
push 0x33ad
push dword [ebp - 0x3c]
push 1
call fcn.1000fa77
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10011261
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100654e4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10011373
lea eax, [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x100112bd
mov byte [ebp - 0x11], 0
push 1
push 0x6741
push 0
lea eax, [ebp - 0x11]
push eax
call fcn.1000ff07
add esp, 0x10
jmp 0x10011371
mov dword [ebp - 0x20], 0x50f4
mov dword [ebp - 0x28], str.vpcmmssxk_jjtaq_ptr_dbvtllnn_wuvwav_jpzbtpys_uygh_nyxvv_dckeaoty_kbms_pfnlkgw_tnps
cmp dword [ebp - 0x20], 0x5304
jle 0x10011329
push 0
call dword [sym.imp.KERNEL32.dll_EncodePointer]
and dword [ebp - 0x18], 0
jmp 0x100112e9
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x42b4
jge 0x10011329
and dword [ebp - 0x1c], 0
jmp 0x100112ff
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x51c0
jge 0x10011327
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
push dword [ebp - 0x34]
push dword [ebp - 0x38]
mov ecx, 0x100809d8
call fcn.10006801
jmp 0x100112f8
jmp 0x100112e2
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x502e
jge 0x1001134b
mov edx, dword [ebp - 0x28]
mov ecx, 0x100809d8
call fcn.1000b005
jmp 0x10011367
or dword [ebp - 4], 0xffffffff
jmp 0x10011371
jmp 0x1001138f
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
push 0
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
call fcn.10011e92
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10011d2f
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10011dcf
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10011dad
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10011d91
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x10011dab
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.10006b8e
and dword [eax], 0
jmp 0x10011d86
jmp 0x10011dcd
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10011dcd
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x10011deb
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 0
call fcn.1000e3e0
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10024400
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
mov dword [ebp - 4], 0x79f0
mov esi, ecx
cmp dword [ebp - 4], 0x7b3f
push edi
jle 0x10024465
xor edi, edi
xor ebx, ebx
mov eax, ebx
lea ecx, [ebp - 0x1c]
and eax, edi
cdq
push edx
push eax
call fcn.10001ac9
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10024438
mov eax, dword [eax]
push eax
call fcn.1004e1ed
pop ecx
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.100073ae
inc ebx
cmp ebx, 0x1771
jl 0x1002441f
inc edi
cmp edi, 0x2e34
jl 0x1002441d
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
cmp dword [ebp - 4], 0x78e5
jge 0x10024479
push str.whepfb_kjfw_azv_zastjpzl
call fcn.1004e1ed
pop ecx
cmp byte [ebp + 0x18], 0
je 0x100244a4
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x100244c4
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [edx]
cmp dword [edx], 1
jl 0x10024490
jmp 0x100244c4
mov dword [esi], 0
cmp dword [esi], 1
jge 0x100244c4
mov edx, dword [ebp + 0x1c]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0x2062
inc dword [esi]
cmp dword [esi], 1
jl 0x100244b2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10024aa3
Capabilities:
Encode data using xor
Get session user name

Disassembly:
mov eax, 0x10065a1c
call fcn.10064760
sub esp, 0x18
mov byte [ebp - 0x14], cl
push ebx
push esi
mov esi, edx
mov dword [ebp - 0x20], esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x10024ad9
push 0x111b
push 0x1d4c
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
jmp 0x10024b95
mov dword [ebp - 0x1c], 0x5e8b
cmp dword [ebp - 0x1c], 0x5fd2
jle 0x10024b3a
xor edi, edi
mov dword [ebp - 0x18], edi
xor ebx, ebx
and dword [ebp - 0x24], 0
mov esi, ebx
and esi, edi
mov edi, dword [ebp - 0x24]
mov eax, esi
mov ecx, 0x100809d8
xor eax, edi
cdq
push edx
push eax
call fcn.10006801
inc edi
cmp edi, 0x6cc5
jl 0x10024afb
mov edi, dword [ebp - 0x18]
inc ebx
cmp ebx, 0x5d35
jl 0x10024af0
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x3ce2
jl 0x10024aee
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov esi, dword [ebp - 0x20]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x5b79
jge 0x10024b75
mov edx, str.tibkgwtnc_zafejijdd_qmklovwcr_kxmn_ibuw_qguigk_tyydde_jnyvdeqy_ithqf_xqugaq_lrgw_pwevto_aowwu
mov ecx, 0x100809d8
call fcn.1000b005
jmp 0x10024b75
mov dword [esi], 0
cmp dword [esi], 3
jge 0x10024b95
mov edx, dword [ebp + 0x14]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 2
inc dword [esi]
cmp dword [esi], 3
jl 0x10024b83
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002528d
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10065a61
call fcn.10064760
sub esp, 0x18
cmp byte [ebp + 0x10], 0
mov eax, edx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], eax
je 0x10025350
mov dword [ebp - 0x1c], 0x22b3
cmp dword [ebp - 0x1c], 0x2428
jle 0x1002530f
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x18], 0x1f8e
mov dword [ebp - 0x14], ecx
mov eax, edi
sar eax, cl
mov ecx, 0x100809d8
and eax, esi
cdq
push edx
push eax
call fcn.10006801
mov ecx, dword [ebp - 0x14]
add ecx, ebx
dec dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jne 0x100252d1
inc ebx
cmp ebx, 0x57c7
jl 0x100252c5
inc edi
cmp edi, 0x5eb7
jl 0x100252c3
inc esi
cmp esi, 0x6404
jl 0x100252c1
mov eax, dword [ebp - 0x20]
mov dword [eax], 5
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x21cb
jge 0x10025331
mov edx, str.ksum_eihkh_ggvwqxax_xulxhui_mjylopol_bhfzwf_komaekkdx_iygxgsuw
mov ecx, 0x100809d8
call fcn.1000b005
jmp 0x100253bb
mov dword [ebp - 0x1c], 0x5734
cmp dword [ebp - 0x1c], 0x59ac
jle 0x10025393
xor esi, esi
xor edi, edi
xor ebx, ebx
lea eax, [ebx + edi]
mov ecx, 0x100809d8
xor eax, esi
cdq
push edx
push eax
call fcn.10006801
inc ebx
cmp ebx, 0x16ff
jl 0x10025366
inc edi
cmp edi, 0x559f
jl 0x10025364
inc esi
cmp esi, 0xf9c
jl 0x10025362
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x54f1
jge 0x100253b2
mov edx, str.uux_exxs_gup_vpqdqco_iuuly_ypuj_ndxzmhvgg_askarylgn_ftpcao_frdkdymp_yxfxmuqo_vjmdjeg
mov ecx, 0x100809d8
call fcn.1000b005
mov eax, dword [ebp + 8]
mov dword [eax], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002593c
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
je 0x100259aa
mov eax, dword [edx]
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
mov ecx, edi
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
push ebx
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
call fcn.1002ce8f
mov esi, dword [ebp - 4]
cmp esi, dword [edi]
je 0x10025978
mov eax, dword [ebx]
cmp eax, dword [esi + 0x10]
jge 0x1002599c
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], ebx
push eax
push ecx
mov ecx, edi
call fcn.1002cff6
push eax
add eax, 0x10
mov ecx, edi
push eax
push esi
lea eax, [ebp - 4]
push eax
call fcn.1002d026
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x18], eax
jmp 0x100259b4
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10025e20
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10065a91
call fcn.10064760
sub esp, 0x10
push ebx
push esi
mov byte [ebp - 0x14], dl
mov dword [ebp - 0x1c], 0x2deb
cmp dword [ebp - 0x1c], 0x3048
push edi
mov dword [ebp - 0x10], esp
jle 0x10025e6d
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x100809d8
xor eax, esi
cdq
push edx
push eax
call fcn.10006801
inc edi
cmp edi, 0x5308
jl 0x10025e4a
inc esi
cmp esi, 0x4a74
jl 0x10025e48
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x2db1
jge 0x10025e89
mov edx, str.nhydh_tmssm_bpaoxcx_rbru_psa_tbrmfu_gclu_dghg_qovwdxh_pmgvxc_yigkh_mnhaghh
mov ecx, 0x100809d8
call fcn.1000b005
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x14], 0
je 0x10025ec7
push ecx
lea eax, [ebp - 0x15]
mov byte [ebp - 0x15], 0
push eax
push 0
mov ecx, 0x403c
call fcn.10024261
add esp, 0xc
jmp 0x10025eea
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x10025eea
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x9d19ac19
inc dword [edx]
cmp dword [edx], 3
jl 0x10025ed8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret