joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002d2f8
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10062f3d
call fcn.10061bc4
sub esp, 0xc
cmp byte [ebp + 0x2c], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
je 0x1002d3d0
mov eax, dword [ebp + 0x18]
mov dword [eax], 0xfffffffe
cmp dword [eax], 0xffffffed
jne 0x1002d342
mov edi, dword [ebp + 0x30]
xor esi, esi
cmp dword [eax], esi
je 0x1002d337
cmp dword [edx], esi
je 0x1002d337
lea ecx, [esi + 1]
jmp 0x1002d339
xor ecx, ecx
mov dword [edi], ecx
dec dword [eax]
cmp dword [eax], 0xffffffed
je 0x1002d32a
mov dword [ebp - 0x14], 0x37a5
cmp dword [ebp - 0x14], 0x3b7c
jle 0x1002d398
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x1007f138
xor eax, edi
xor eax, esi
cdq
push edx
push eax
call fcn.10002c1c
inc ebx
cmp ebx, 0x2e62
jl 0x1002d358
inc edi
cmp edi, 0x45c6
jl 0x1002d356
inc esi
cmp esi, 0x3859
jl 0x1002d354
push 0xcab
push 0x20f8
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x361e
jge 0x1002d3b4
mov edx, str.mjr_qnf_sfarovp_mrgxoxrq_zmf_ogkulofh_fyfhpkt_abi
mov ecx, 0x1007f138
call fcn.100045d3
jmp 0x1002d420
mov eax, dword [ebp + 0x20]
xor esi, esi
mov ebx, dword [ebp + 0x10]
inc esi
cmp dword [eax], 0
jne 0x1002d409
mov eax, dword [ebp + 0x28]
xor ecx, ecx
mov eax, dword [eax]
mov eax, dword [ebx]
cmp eax, esi
setl cl
xor edx, edx
mov dword [edi], ecx
mov ecx, dword [edi]
mov edi, dword [ebp + 0xc]
mov eax, dword [edi]
add ecx, eax
mov eax, dword [edi]
cmp ecx, eax
mov eax, dword [ebp + 8]
setg dl
xor ecx, ecx
mov dword [eax], edx
jmp 0x1002d40e
mov edi, dword [ebp + 0xc]
mov ecx, esi
mov eax, dword [edi]
add eax, ecx
je 0x1002d419
cmp dword [ebx], 0
jne 0x1002d41b
xor esi, esi
mov eax, dword [ebp + 0x1c]
mov dword [eax], esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002d431
Capabilities:
Set environment variable

Disassembly:
mov eax, 0x10062f47
call fcn.10061bc4
sub esp, 0x18
mov byte [ebp - 0x14], cl
push ebx
mov ebx, edx
mov dword [ebp - 0x20], ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x1002d46d
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1002d504
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
jmp 0x1002d504
mov dword [ebp - 0x1c], 0x580b
cmp dword [ebp - 0x1c], 0x5a08
jle 0x1002d4ba
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov ebx, esi
mov esi, 0x7df1
mov eax, ebx
mov ecx, 0x1007f138
cdq
push edx
push eax
call fcn.10002c1c
add ebx, edi
dec esi
jne 0x1002d48b
mov esi, dword [ebp - 0x18]
inc edi
cmp edi, 0x5bb6
jl 0x1002d484
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x586d
jl 0x1002d482
mov ebx, dword [ebp - 0x20]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x574b
jge 0x1002d4f5
mov edx, str.mjizl_gwjrq_tjmt_ticcxao_tsotlkv_fahpyilfg_hppmesrkj_gjvibwoug_vbxly_azfepioyz_pwb_speqazgz
mov ecx, 0x1007f138
call fcn.100045d3
jmp 0x1002d4f5
cmp byte [ebx], 0
je 0x1002d504
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002d6d2
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
mov esi, edx
test cl, cl
je 0x1002d72b
cmp byte [ebp + 0x18], 0
je 0x1002d718
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
and dword [eax], 0
jmp 0x1002d70f
lea eax, [esp + 4]
mov dword [esp + 4], 0x65ab3e90
push eax
push 0x3e01
mov cl, 1
call fcn.1002cd8f
mov eax, dword [esi]
pop ecx
pop ecx
dec dword [eax]
mov eax, dword [esi]
cmp dword [eax], 0xfffffffc
je 0x1002d6f0
jmp 0x1002d763
xor eax, eax
push eax
push eax
push 0x1309
push eax
push eax
call dword [sym.imp.USER32.dll_DialogBoxParamA]
jmp 0x1002d763
cmp byte [ebp + 0xc], 0
je 0x1002d750
mov edx, dword [ebp + 8]
mov dword [edx], 0
jmp 0x1002d749
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x28ea3888
inc dword [edx]
cmp dword [edx], 2
jl 0x1002d73c
jmp 0x1002d763
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x1002d763
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10031329
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006312f
call fcn.10061bc4
sub esp, 0x1c
push ebx
push esi
mov dword [ebp - 0x20], 0x3302
mov eax, ecx
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
cmp dword [ebp - 0x20], 0x3455
mov dword [ebp - 0x24], eax
jle 0x100313ad
mov ebx, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], 0x46b0
mov edi, esi
mov esi, dword [ebp - 0x14]
mov ecx, edi
mov eax, esi
shl eax, cl
mov ecx, 0x1007f138
xor eax, ebx
cdq
push edx
push eax
call fcn.10002c1c
inc edi
cmp edi, 0x4489
jl 0x10031367
mov edi, dword [ebp - 0x1c]
add esi, edi
dec dword [ebp - 0x18]
push 0
mov dword [ebp - 0x14], esi
pop esi
jne 0x10031362
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x168c
jl 0x10031358
inc ebx
cmp ebx, 0x5d8c
jl 0x10031355
mov eax, dword [ebp - 0x24]
cmp byte [ebp + 8], 0
je 0x100313c3
cmp byte [eax], 0
je 0x100313d2
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
jmp 0x100313d2
push esi
push esi
push 0x1309
push esi
push esi
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x20], 0x318c
jge 0x100313ed
mov edx, str.hqst_rhjt_rhtvcx
mov ecx, 0x1007f138
call fcn.100045d3
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10031f5e
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
mov dword [esp + 8], 0x227b
cmp dword [esp + 8], 0x22fb
push edi
mov edi, edx
jle 0x10031fce
xor esi, esi
xor ebx, ebx
mov eax, ebx
lea ecx, [esp + 0x10]
and eax, esi
cdq
push edx
push eax
call fcn.10002a23
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10031f9c
mov eax, dword [eax]
push eax
call fcn.10049a06
pop ecx
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.10002ff9
inc ebx
cmp ebx, 0x75c1
jl 0x10031f82
inc esi
cmp esi, 0x7483
jl 0x10031f80
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
cmp dword [esp + 0xc], 0x224f
jge 0x10031fe3
push str.dwhdsykh_njhudos_kxar_argnlaht_myavh_jnbxbvtrd
call fcn.10049a06
pop ecx
cmp byte [ebp + 0x18], 0
je 0x10032015
mov dword [edi], 1
cmp dword [edi], 0
jl 0x10032027
mov ebx, dword [ebp + 0xc]
mov ecx, dword [edi]
xor eax, eax
mov esi, dword [edi]
mov edx, dword [ebx]
cmp dword [edx + ecx*4], 0xd0b5486b
sete al
mov dword [edx + esi*4], eax
dec dword [edi]
cmp dword [edi], 0
jge 0x10031ff7
jmp 0x10032027
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x10032027
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100320f9
Capabilities:
Start service

Disassembly:
mov eax, 0x100631cd
call fcn.10061bc4
sub esp, 0x2c
mov byte [ebp - 0x18], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x100322ad
mov dword [ebp - 0x30], 0x7ad
xor ebx, ebx
cmp dword [ebp - 0x30], 0xb06
mov dword [ebp - 0x34], str.tuswefbmo_xqi_zzbltutun
jle 0x10032190
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], 0x64c0
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x24], ebx
mov eax, ebx
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
add eax, ebx
mov ecx, 0x1007f138
and eax, esi
cdq
push edx
push eax
call fcn.10002c1c
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x17c8
jl 0x1003214b
inc ebx
push 0
mov dword [ebp - 0x24], ebx
cmp ebx, 0x2385
pop ebx
jl 0x10032143
mov esi, dword [ebp - 0x2c]
add dword [ebp - 0x1c], esi
dec dword [ebp - 0x28]
jne 0x1003213d
inc esi
mov dword [ebp - 0x2c], esi
cmp esi, 0xc22
jl 0x10032133
mov esi, dword [ebp + 0x10]
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x20], eax
mov dword [esi], 1
cmp dword [esi], ebx
jl 0x10032274
push 0x274c
push ebx
mov edx, eax
mov ecx, 0x6a9a
call fcn.10033e6d
mov dword [ebp - 0x2c], 0x2777
cmp dword [ebp - 0x2c], 0x27c2
pop ecx
pop ecx
jle 0x10032209
push ebx
push ebx
push 0x65
push ebx
call dword [sym.imp.KERNEL32.dll_SetFilePointer]
mov esi, ebx
mov dword [ebp - 0x28], ebx
mov ecx, ebx
mov eax, esi
shl eax, cl
mov ecx, 0x1007f138
cdq
push edx
push eax
call fcn.10002c1c
inc ebx
cmp ebx, 0x1254
jl 0x100321de
inc esi
push 0
pop ebx
cmp esi, 0x6034
jl 0x100321db
mov esi, dword [ebp + 0x10]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1003221d
sub esp, 0x10
call fcn.1003311c
add esp, 0x10
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x2c], 0x2726
jge 0x10032238
mov edx, str.ksszwpg_mhcytql_ydzyafaq
mov ecx, 0x1007f138
call fcn.100045d3
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0x18]
dec dword [esi]
jmp 0x100321a2
mov dword [ebp - 4], 2
cmp dword [ebp - 0x30], 0x4db
jge 0x10032291
mov edx, dword [ebp - 0x34]
mov ecx, 0x1007f138
call fcn.100045d3
jmp 0x100322c0
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x100322c0
xor ebx, ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100338ba
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1006328a
call fcn.10061bc4
sub esp, 0x18
push ebx
push esi
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], 0x344f
cmp dword [ebp - 0x20], 0x36a6
push edi
mov dword [ebp - 0x10], esp
jle 0x10033940
xor esi, esi
mov dword [ebp - 0x1c], esi
xor ebx, ebx
mov dword [ebp - 0x18], 0x6aa7
mov dword [ebp - 0x14], ebx
xor edi, edi
lea esi, [ebx + edi]
mov ebx, 0x2305
mov eax, esi
mov ecx, 0x1007f138
cdq
push edx
push eax
call fcn.10002c1c
dec esi
dec ebx
jne 0x100338fb
mov ebx, dword [ebp - 0x14]
inc edi
cmp edi, 0x5443
jl 0x100338f3
mov esi, dword [ebp - 0x1c]
add ebx, esi
dec dword [ebp - 0x18]
mov dword [ebp - 0x14], ebx
jne 0x100338f1
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x43ca
jl 0x100338e5
push 0x10c9
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x310d
jge 0x1003395c
mov edx, str.jsbeivd_yqv_fio_oguhuf_ikfyx_rqivzdux_xwkxxv_tgjtw_nox_nwf_ehbsn_tahp_jkb
mov ecx, 0x1007f138
call fcn.100045d3
cmp byte [ebp + 0x14], 0
je 0x100339a1
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x100339c4
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x758b39d2
inc dword [edx]
cmp dword [edx], 2
jl 0x10033973
jmp 0x100339c4
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x100339c4
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x801465ee
inc dword [edx]
cmp dword [edx], 2
jl 0x100339b2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10033d84
Capabilities:
Set environment variable

Disassembly:
mov eax, 0x100632c6
call fcn.10061bc4
sub esp, 0x18
push ebx
push esi
mov dword [ebp - 0x1c], 0x5589
mov esi, ecx
cmp dword [ebp - 0x1c], 0x57b2
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], esi
jle 0x10033de7
xor edi, edi
mov ebx, edi
mov dword [ebp - 0x18], 0x2b80
xor esi, esi
mov ecx, esi
mov eax, ebx
sar eax, cl
mov ecx, 0x1007f138
cdq
push edx
push eax
call fcn.10002c1c
inc esi
cmp esi, 0x2f4c
jl 0x10033db9
dec ebx
dec dword [ebp - 0x18]
jne 0x10033db7
inc edi
cmp edi, 0x1907
jl 0x10033dae
mov esi, dword [ebp - 0x20]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x54aa
jge 0x10033e22
mov edx, str.jypnsflhp_vkrwzal_ozmfsgnj
mov ecx, 0x1007f138
call fcn.100045d3
jmp 0x10033e22
cmp byte [ebp + 0x10], 0
je 0x10033e48
mov dword [esi], 0
cmp dword [esi], 2
jg 0x10033e5c
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov dword [eax + 4], 0x5e81a7ec
inc dword [esi]
cmp dword [esi], 2
jle 0x10033e36
jmp 0x10033e5c
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x10033e5c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10034058
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov dword [0x10080fd4], ecx
inc edx
mov esi, 0x270
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
mov dword [edx*4 + 0x10080fd4], ecx
inc edx
cmp edx, esi
jl 0x1003406d
mov dword [0x10080fd0], esi
pop esi
pop ebp
ret 8

Function at 0x10034093
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x10080fd4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x10081360
jl 0x100340a1
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x10081604
jl 0x100340e1
mov ecx, dword [0x10082350]
xor ecx, dword [0x10080fd4]
and ecx, edi
xor ecx, dword [0x10082350]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x10080fd0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10081604]
mov dword [0x10081990], eax
pop esi
ret
Function at 0x10035fc7
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10063436
push eax
mov dword fs:[0], esp
sub esp, 0x34
cmp byte [ebp + 0x1c], 0
push esi
push edi
mov edi, edx
je 0x10036033
cmp byte [ebp + 0x18], 0
je 0x1003601f
push 0x21
pop edx
lea ecx, [esp + 0x20]
call fcn.100319f9
push ecx
push ecx
xor esi, esi
mov ecx, edi
push eax
mov dword [esp + 0x50], esi
call fcn.1002cd04
push esi
push 1
lea ecx, [esp + 0x28]
call fcn.1001231a
jmp 0x10036088
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10036088
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x10036088
cmp byte [ebp + 0x24], 0
je 0x10036049
push ecx
push dword [ebp + 0x10]
call fcn.100393b7
mov ecx, dword [ebp + 0x20]
mov dword [ecx], eax
jmp 0x10036088
mov ecx, dword [ebp + 8]
xor esi, esi
mov dword [ecx], esi
cmp dword [ecx], esi
jg 0x10036088
mov edx, dword [ebp + 0x14]
mov dword [esp + 0xc], esi
jmp 0x1003606d
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x10], 0xffffffff
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 4
jl 0x1003605d
mov dword [edx], esi
jmp 0x1003607e
inc dword [esp + 0x18]
inc dword [edx]
cmp dword [edx], esi
jle 0x10036078
inc dword [ecx]
cmp dword [ecx], esi
jle 0x10036057
mov ecx, dword [esp + 0x3c]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10036843
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100634e5
call fcn.10061bc4
sub esp, 0x30
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], edi
je 0x10036929
mov dword [ebp - 0x1c], 0x4304
cmp dword [ebp - 0x1c], 0x445f
jle 0x100368cb
xor edi, edi
xor esi, esi
mov dword [ebp - 0x18], esi
mov ebx, esi
mov dword [ebp + 8], 0x560c
xor esi, esi
mov ecx, esi
mov eax, ebx
sar eax, cl
mov ecx, 0x1007f138
and eax, edi
cdq
push edx
push eax
call fcn.10002c1c
inc esi
cmp esi, 0x21d7
jl 0x1003688c
dec ebx
dec dword [ebp + 8]
jne 0x1003688a
mov esi, dword [ebp - 0x18]
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x4773
jl 0x10036881
inc edi
cmp edi, 0x1838
jl 0x1003687c
mov ebx, dword [ebp - 0x20]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x40b6
jge 0x10036906
mov edx, str.xtrtf_jnjpuss_kdgeypc_fcmafzq_sbyvk_jduwovaz_dlgtzrfuc
mov ecx, 0x1007f138
call fcn.100045d3
jmp 0x10036906
mov eax, dword [ebp + 0x18]
mov edx, dword [ebx]
mov esi, dword [eax]
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, dword [edx + esi*4]
cmp eax, dword [ecx + esi*4]
jge 0x10036a8c
mov eax, dword [ebp + 0x1c]
or dword [eax], 0xffffffff
jmp 0x10036a8c
mov dword [ebp + 8], 0x55c2
cmp dword [ebp + 8], 0x592f
jle 0x10036960
xor esi, esi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x1007f138
xor eax, esi
cdq
push edx
push eax
call fcn.10002c1c
inc ebx
cmp ebx, 0x354f
jl 0x1003693d
inc esi
cmp esi, 0x4250
jl 0x1003693b
mov dword [ebp - 4], 2
cmp dword [ebp + 8], 0x531d
jge 0x1003699e
mov edx, str.svbc_hgfgw_oltxa_vcbfmatty_hhihqfd_yyo_hcf_czklw_efxdbks_btb
mov ecx, 0x1007f138
call fcn.100045d3
jmp 0x1003699e
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x20], 0
je 0x10036a6f
mov dword [ebp + 8], 0x73
cmp dword [ebp + 8], 0xd4
jle 0x100369f1
xor esi, esi
xor edi, edi
xor ebx, ebx
mov ecx, ebx
lea eax, [edi + esi]
sar eax, cl
mov ecx, 0x1007f138
cdq
push edx
push eax
call fcn.10002c1c
inc ebx
cmp ebx, 0x60fa
jl 0x100369c2
inc edi
cmp edi, 0x25ce
jl 0x100369c0
inc esi
cmp esi, 0x1d3c
jl 0x100369be
mov dword [ebp - 4], 4
cmp dword [ebp + 8], 0xffffffd5
jge 0x10036a0d
mov edx, str.gcch_eucy_kztlqxxo_nqrheegs_kvytchvy_jhdchxt_kkxmewde_fmk_mikbjthpk_ratkudauy_hsi_avkr
mov ecx, 0x1007f138
call fcn.100045d3
mov esi, dword [ebp + 0x10]
or dword [ebp - 4], 0xffffffff
push 0x18
pop ecx
mov eax, dword [esi + 4]
sub eax, dword [esi]
cdq
idiv ecx
mov ebx, eax
test ebx, ebx
je 0x10036a8c
xor edi, edi
mov edx, dword [esi]
lea ecx, [ebp - 0x3c]
push dword [ebp + 0x24]
add edx, edi
call fcn.10034411
pop ecx
mov ecx, dword [esi]
push eax
add ecx, edi
call fcn.1001185c
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.1001231a
add edi, 0x18
dec ebx
jne 0x10036a27
jmp 0x10036a8c
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
jmp 0x10036a87
mov ecx, dword [edx]
mov eax, dword [edi]
mov dword [eax + ecx*4], 0x758b39d2
inc dword [edx]
cmp dword [edx], 2
jl 0x10036a7a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003abf4
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 4], cl
push esi
test cl, cl
je 0x1003ac1f
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1003ac2a
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
or dword [eax + ecx*4], 0xffffffff
inc dword [edx]
cmp dword [edx], 2
jl 0x1003ac0e
jmp 0x1003ac2a
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1003c6cf
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
push ebx
push esi
mov dword [esp + 0xc], 0x2751
mov ebx, ecx
cmp dword [esp + 0xc], 0x2a72
mov esi, edx
push edi
mov dword [esp + 0x14], ebx
jle 0x1003c74d
push 0x3d6
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor edi, edi
xor ebx, ebx
mov eax, edi
lea ecx, [esp + 0x18]
cdq
idiv ebx
mov eax, edx
cdq
push edx
push eax
call fcn.10002a23
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003c723
mov eax, dword [eax]
push eax
call fcn.10049a06
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.10002ff9
inc ebx
cmp ebx, 0x5c15
jl 0x1003c706
inc edi
cmp edi, 0x5467
jl 0x1003c704
mov ebx, dword [esp + 0x14]
cmp dword [esp + 0x10], 0x25ce
jge 0x1003c762
push str.zufy_mkjor_cmanumtq_qdu_nfxzzp
call fcn.10049a06
pop ecx
cmp byte [ebp + 0xc], 0
je 0x1003c78a
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
jmp 0x1003c780
mov ecx, dword [edx]
mov eax, dword [ebx]
mov dword [eax + ecx*4], 0x25260
inc dword [edx]
cmp dword [edx], 2
jl 0x1003c773
jmp 0x1003c827
mov dword [esp + 0x10], 0x1c04
cmp dword [esp + 0x10], 0x1ed9
jle 0x1003c7f2
push 0x1f8f
push 0
push 0x6b0
call dword [sym.imp.GDI32.dll_Polyline]
xor edi, edi
xor ebx, ebx
mov eax, ebx
lea ecx, [esp + 0x30]
xor eax, edi
cdq
push edx
push eax
call fcn.10002a23
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003c7cc
mov eax, dword [eax]
push eax
call fcn.10049a06
pop ecx
push 0
push 1
lea ecx, [esp + 0x38]
call fcn.10002ff9
inc ebx
cmp ebx, 0x2541
jl 0x1003c7b2
inc edi
cmp edi, 0x5a65
jl 0x1003c7b0
mov dword [esi], 0
cmp dword [esi], 2
jge 0x1003c812
mov edx, dword [ebp + 0x18]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 4
inc dword [esi]
cmp dword [esi], 2
jl 0x1003c800
cmp dword [esp + 0x10], 0x1931
jge 0x1003c827
push str.lmy_jtbgu_fytbuatv_fbwfe_jijkbgom_xzeikt_hsgxbzg_vmsb_mnj_vgbu_bqefj_een_fosauu_uyd
call fcn.10049a06
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003d890
Capabilities:
Get disk size
Get system information on windows

Disassembly:
mov eax, 0x1006380d
call fcn.10061bc4
sub esp, 0x2c
cmp byte [ebp + 0xc], 0
mov eax, edx
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x1c], esi
je 0x1003da29
cmp byte [ebp + 0x14], 0
je 0x1003d985
mov dword [ebp + 0xc], 0x55d4
xor ebx, ebx
cmp dword [ebp + 0xc], 0x58cb
jle 0x1003d91b
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov edi, ebx
mov esi, ebx
mov dword [ebp - 0x18], ebx
lea eax, [ebx + esi]
mov ecx, 0x1007f138
or eax, edi
cdq
push edx
push eax
call fcn.10002c1c
inc ebx
cmp ebx, 0x443e
jl 0x1003d8e5
inc esi
push 0
pop ebx
cmp esi, 0x1efa
jl 0x1003d8e2
inc edi
cmp edi, 0x111e
jl 0x1003d8e0
mov esi, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov dword [esi], ebx
jmp 0x1003d946
push 0x1252
push ebx
push 1
push 0x4421
push eax
push 0x43d0
mov edx, 0x34a
mov cl, 1
call fcn.1003ad8a
mov eax, dword [ebp - 0x14]
add esp, 0x18
inc dword [esi]
cmp dword [esi], 3
jle 0x1003d91f
mov dword [ebp - 4], ebx
cmp dword [ebp + 0xc], 0x5365
jge 0x1003d966
mov edx, str.mhrqm_hcnot_oly_pkdbdt_chmjvm_axfopg_cgabvh_hmqsg_chcffivob_nfx_womft_jbfh_wgszmg_tedbrkvj
mov ecx, 0x1007f138
call fcn.100045d3
jmp 0x1003da5f
mov dword [ebp - 0x18], 0x5a9c
cmp dword [ebp - 0x18], 0x5ab2
jle 0x1003da00
xor ebx, ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov esi, ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp + 0xc], 0xee1
mov edi, ebx
mov eax, esi
lea ecx, [ebp - 0x34]
and eax, edi
cdq
push edx
push eax
call fcn.10002a23
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003d9c8
mov eax, dword [eax]
push eax
call fcn.10049a06
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x34]
call fcn.10002ff9
inc edi
cmp edi, 0xb22
jl 0x1003d9af
dec esi
dec dword [ebp + 0xc]
jne 0x1003d9ad
mov esi, dword [ebp - 0x14]
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x7300
jl 0x1003d9a3
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
cmp dword [ebp - 0x18], 0x57c6
jge 0x1003da14
push str.zyr_fdwnp_knmezhuh_tdxogjx_jjwaownhg_wkjhahj_hcfqalnb_zsbvc_igjvqndsy_smdwm_ccjo_rfe_zvzj
call fcn.10049a06
pop ecx
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1003da5f
push 0x632
call dword [sym.imp.USER32.dll_MessageBeep]
jmp 0x1003da5f
cmp byte [ebp + 8], 0
je 0x1003da4d
xor ebx, ebx
mov byte [ebp + 0xf], bl
cmp byte [ebp + 0xf], bl
je 0x1003da5f
push ebx
push ebx
push 0xaf6
push 0xd28
call dword [sym.imp.USER32.dll_DefWindowProcA]
jmp 0x1003da5f
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0x1003da5f
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret