joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010d60
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
mov esi, eax
push ebx
mov ebx, edx
sub esp, 0x214
mov eax, dword [0x1001d0c0]
test eax, eax
je 0x10010e18
mov dword [esp], ebx
call eax
mov dword [ebx + 8], eax
sub esp, 4
test eax, eax
jns 0x10010da0
mov eax, dword [ebx]
lea esp, [ebp - 0xc]
pop ebx
pop esi
pop edi
pop ebp
ret
lea edi, [ebp - 0x214]
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], esi
call dword [sym.imp.kernel32.dll_GetModuleFileNameW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.MODULE
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
mov dword [esp + 8], 0x104
mov dword [esp + 4], edi
mov dword [esp], str.SystemRoot
call dword [sym.imp.kernel32.dll_GetEnvironmentVariableW]
mov eax, dword [ebx]
sub esp, 0xc
mov edx, dword [eax]
mov dword [esp + 8], edi
mov dword [esp + 4], str.SystemRoot
mov dword [esp], eax
call dword [edx + 0xc]
sub esp, 0xc
jmp 0x10010d8c
mov dword [esp], str.atl100.dll
call dword [sym.imp.kernel32.dll_LoadLibraryW]
sub esp, 4
test eax, eax
je 0x10010e4d
mov dword [esp + 4], str.AtlCreateRegistrar
mov dword [esp], eax
call dword [sym.imp.kernel32.dll_GetProcAddress]
mov dword [0x1001d0c0], eax
sub esp, 8
test eax, eax
jne 0x10010d7d
mov dword [ebx + 8], 0x80004002
xor eax, eax
jmp 0x10010d8e
Function at 0x100030dd
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
mov byte [esp + 4], dl
test dl, dl
je 0x100030ff
push 0x1070
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x10003125
mov byte [esp + 3], 0
cmp byte [esp + 3], 0
je 0x10003125
push 0x4ee2
push 0x576
push 0x28b0
push ecx
xor cl, cl
call fcn.1000321d
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10003a79
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
push ebx
push esi
xor esi, esi
mov byte [esp + 8], dl
push edi
test dl, dl
je 0x10003a9f
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x10003c12
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], 9
mov dword [esp + 0x20], 0x97b09b37
mov dword [esp + 0x2c], 0x4f4cc511
mov dword [esp + 0x18], 0x477ae27
mov dword [esp + 0x28], 0x7f18
cmp dword [esp + 0x28], 0x80db
jle 0x10003b49
mov edi, esi
mov dword [esp + 0x24], esi
mov dword [esp + 0x2c], edi
mov dword [esp + 0x10], 0x35af
mov ebx, esi
mov eax, edi
lea ecx, [esp + 0x40]
xor eax, ebx
cdq
push edx
push eax
call fcn.10002548
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10003b03
mov eax, dword [eax]
push eax
call fcn.10040f4c
pop ecx
push esi
push 1
lea ecx, [esp + 0x48]
call fcn.1000afb2
inc ebx
cmp ebx, 0x512b
jl 0x10003ae9
dec edi
dec dword [esp + 0x10]
jne 0x10003ae7
mov edi, dword [esp + 0x24]
inc edi
mov dword [esp + 0x24], edi
cmp edi, 0x9cb
jl 0x10003adb
push 0x1b6b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowLongW]
cmp dword [esp + 0x28], 0x7cb3
jge 0x10003b5e
push str.enusvnafo_rvjssk_gwvwijt_rdoata_dlwfnzj_lbraeve_djz_vtie_nabcoxgyu_drntg_thlyd
call fcn.10040f4c
pop ecx
mov dword [esp + 0x10], esi
jmp 0x10003b70
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x30], esi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 4
jl 0x10003b64
mov eax, dword [esp + 0x14]
xor ecx, ecx
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x1c]
cmp eax, 0x168f928d
setg cl
xor edx, edx
cmp ecx, 0xfffffffc
setg dl
xor ecx, ecx
add edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
cmp eax, edx
setge cl
mov dword [esp + 0x38], ecx
lea eax, [ecx + 0x1c77]
test eax, eax
jne 0x10003bb6
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x20]
xor ecx, ecx
cmp eax, 1
setle cl
xor edx, edx
mov dword [esp + 0x2c], ecx
mov ecx, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
cmp eax, ecx
mov eax, dword [esp + 0x18]
setg dl
xor ecx, ecx
cmp edx, eax
setge cl
xor eax, eax
cmp ecx, 0x6082
setne al
add eax, dword [esp + 0x18]
add eax, dword [esp + 0x14]
neg eax
sbb eax, eax
xor edx, edx
neg eax
cmp eax, 0x13638ecf
mov eax, dword [esp + 0x18]
setle dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [esp + 0x18], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004f95
Capabilities:
Create thread

Disassembly:
mov eax, 0x10057b14
call fcn.100574a0
sub esp, 0x14
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], dl
mov byte [ebp - 0x18], cl
je 0x10005098
xor ebx, ebx
test dl, dl
je 0x10005082
mov dword [ebp - 0x20], 0x6245
cmp dword [ebp - 0x20], 0x65af
jle 0x10005030
mov edi, ebx
mov esi, ebx
mov dword [ebp - 0x1c], ebx
mov ecx, ebx
mov dword [ebp + 0xc], ebx
mov eax, esi
mov esi, 0x7246
cdq
idiv ecx
mov ebx, edx
mov eax, ebx
mov ecx, 0x10072d38
or eax, edi
cdq
push edx
push eax
call fcn.1000aa66
inc ebx
dec esi
jne 0x10004fea
mov ecx, dword [ebp + 0xc]
mov esi, dword [ebp - 0x1c]
inc ecx
mov dword [ebp + 0xc], ecx
cmp ecx, 0x4cd4
jl 0x10004fde
inc esi
mov dword [ebp - 0x1c], esi
push 0
pop ebx
cmp esi, 0x4c61
jl 0x10004fd9
inc edi
cmp edi, 0x5103
jl 0x10004fd4
push ebx
call dword [sym.imp.KERNEL32.dll_FlushFileBuffers]
mov byte [ebp + 0xf], bl
cmp byte [ebp + 0xf], 0
je 0x1000504b
push 0x253
xor dl, dl
mov ecx, 0x6c17
call fcn.1000682b
pop ecx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x20], 0x5ec8
jge 0x10005066
mov edx, str.crzxtxlt_itqtki_jdo_ejlhwv_xyiozqnka_cxmjuodsq_lbdtbw_ajo_qjiewjk_hfekdd_xjjxi_nrlnsj_eyeixdpdt
mov ecx, 0x10072d38
call fcn.1000cc60
jmp 0x100050ca
push ebx
push 0x8d2
push ebx
push ebx
push 0xd8c
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x100050ca
test cl, cl
je 0x100050ba
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
cmp dword [ecx], 0xffffffee
jge 0x100050ca
mov edx, dword [ebp + 8]
mov eax, dword [ecx]
mov dword [edx], eax
dec dword [ecx]
cmp dword [ecx], 0xffffffee
jl 0x100050ad
jmp 0x100050ca
xor ebx, ebx
push ebx
push ebx
push 0x13eb
push ebx
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100050db
Capabilities:
Encode data using xor
Suspend thread

Disassembly:
mov eax, 0x10057b1e
call fcn.100574a0
sub esp, 0x38
cmp byte [ebp + 0x1c], 0
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], ecx
je 0x100051cb
mov dword [ebp - 0x18], 0x7e92
cmp dword [ebp - 0x18], 0x8118
jle 0x1000516c
xor edi, edi
xor esi, esi
xor ebx, ebx
mov dword [ebp + 0x1c], 0x27a8
mov ecx, ebx
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0x40]
cdq
push edx
push eax
call fcn.10002548
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10005138
mov eax, dword [eax]
push eax
call fcn.10040f4c
pop ecx
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.1000afb2
add ebx, esi
dec dword [ebp + 0x1c]
jne 0x1000511d
inc esi
cmp esi, 0x46f8
jl 0x10005114
inc edi
cmp edi, 0x57e7
jl 0x10005112
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
cmp dword [ebp - 0x18], 0x7e2f
jge 0x10005180
push str.ycoaluhom_tciemkv_sls_botwhorw_mzj_ghhnzhoo_dqbrqeu_hpm_zbsqcyp_svmpqvtn
call fcn.10040f4c
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x14], 0
je 0x100051a2
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0x100052d1
xor dl, dl
call fcn.10005992
jmp 0x100052d1
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x100052d1
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
or dword [eax + ecx*4], 0xffffffff
inc dword [edx]
cmp dword [edx], 2
jl 0x100051b7
jmp 0x100052d1
mov dword [ebp - 0x1c], 0x1f5d
cmp dword [ebp - 0x1c], 0x21a7
jle 0x10005261
push 0
push 0x26b3
push 0xeb5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
xor ebx, ebx
mov dword [ebp - 0x18], ebx
xor edi, edi
mov dword [ebp + 0x1c], edi
xor esi, esi
mov eax, edi
and dword [ebp - 0x24], 0
cdq
mov edi, ebx
idiv esi
mov ebx, dword [ebp - 0x24]
mov ecx, edx
sar edi, cl
mov eax, edi
mov ecx, 0x10072d38
xor eax, ebx
cdq
push edx
push eax
call fcn.1000aa66
inc ebx
cmp ebx, 0x6e64
jl 0x1000521d
mov edi, dword [ebp + 0x1c]
inc esi
mov ebx, dword [ebp - 0x18]
cmp esi, 0x7498
jl 0x1000520b
inc edi
mov dword [ebp + 0x1c], edi
cmp edi, 0x6ad2
jl 0x10005209
inc ebx
mov dword [ebp - 0x18], ebx
cmp ebx, 0x1e59
jl 0x10005204
mov esi, dword [ebp - 0x20]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x1dd6
jge 0x1000529f
mov edx, str.zdezosea_bgdsz_iso_mynofm_fkkcgf_vkovqxlmw
mov ecx, 0x10072d38
call fcn.1000cc60
jmp 0x1000529f
cmp byte [ebp + 0xc], 0
je 0x100052b1
push 0
push 0x18
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
jmp 0x100052d1
mov dword [esi], 0
cmp dword [esi], 4
jge 0x100052d1
mov edx, dword [ebp - 0x28]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 6
inc dword [esi]
cmp dword [esi], 4
jl 0x100052bf
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100055fd
Capabilities:
Create directory
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov byte [esp], cl
push ebx
push esi
push edi
test cl, cl
je 0x10005624
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x1000571b
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1000571b
mov dword [esp + 0x1c], 0x6c9f
cmp dword [esp + 0x1c], 0x7026
jle 0x100056cf
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
xor esi, esi
mov dword [esp + 0x18], esi
xor ebx, ebx
mov dword [esp + 0x14], 0x6df3
xor edi, edi
xor esi, esi
mov dword [esp + 0x10], 0x61e
mov eax, ebx
lea ecx, [esp + 0x20]
or eax, esi
cdq
push edx
push eax
call fcn.10002548
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10005686
mov eax, dword [eax]
push eax
call fcn.10040f4c
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.1000afb2
add esi, edi
dec dword [esp + 0x10]
jne 0x1000566c
inc edi
cmp edi, 0x4673
jl 0x10005662
mov esi, dword [esp + 0x18]
add ebx, esi
dec dword [esp + 0x14]
jne 0x10005660
inc esi
mov dword [esp + 0x18], esi
cmp esi, 0x462b
jl 0x10005656
push 0x4e1
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
push 0
push 0x5389
push ecx
push 0x2138
push 0
push 0x7bb9
push 0x43ec
push 0x4580
push 0x36ec
push 0x591c
mov dl, 1
mov ecx, 0x6c8c
call fcn.10005ec3
add esp, 0x28
cmp dword [esp + 0x1c], 0x6b65
jge 0x1000571b
push str.tqrhkbo_xakdymzs_cmrq_esmjuzgjo
call fcn.10040f4c
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10005ad2
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
cmp byte [ebp + 0x10], 0
push esi
push edi
mov byte [esp + 8], cl
je 0x10005ba4
test cl, cl
je 0x10005b7a
mov dword [esp + 0xc], 0x40d2
cmp dword [esp + 0xc], 0x4323
jle 0x10005b5d
push 0x1989
push 1
push 0x1be0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
xor esi, esi
xor edi, edi
mov ecx, edi
mov eax, esi
sar eax, cl
lea ecx, [esp + 0x10]
cdq
push edx
push eax
call fcn.10002548
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10005b37
mov eax, dword [eax]
push eax
call fcn.10040f4c
pop ecx
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.1000afb2
inc edi
cmp edi, 0x2509
jl 0x10005b1b
inc esi
cmp esi, 0x6b51
jl 0x10005b19
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp dword [esp + 0xc], 0x403c
jge 0x10005bca
push str.iom_rxxsztix_ohbu_mmojcqjp_ybdiqvojp_ptbfr_mum_bmzsjhmwv_zbz_katpxucs_pdtzqic_rejp_xoerbd_itochoq
call fcn.10040f4c
pop ecx
jmp 0x10005bca
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10005bca
push 0
push 0xc1d
push 0
push 0xc2a
push 0x7af
push 0
push 0x1eed
call dword [sym.imp.KERNEL32.dll_FormatMessageW]
jmp 0x10005bca
cmp byte [ebp + 0x14], 0
je 0x10005bc5
cmp byte [edx], 0
je 0x10005bca
push 0
push 0x190f
push 0xf0a
push 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
jmp 0x10005bca
mov eax, dword [ebp + 0xc]
inc dword [eax]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1000641a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10057b62
call fcn.100574a0
sub esp, 0x18
mov byte [ebp - 0x14], dl
push ebx
mov ebx, ecx
mov dword [ebp - 0x20], ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x100064ea
mov dword [ebp - 0x1c], 0x2403
cmp dword [ebp - 0x1c], 0x246f
jle 0x10006496
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
and dword [ebp - 0x24], 0
mov ebx, esi
mov esi, dword [ebp - 0x24]
mov ecx, edi
sar ebx, cl
mov eax, ebx
mov ecx, 0x10072d38
xor eax, esi
cdq
push edx
push eax
call fcn.1000aa66
inc esi
cmp esi, 0x53d8
jl 0x10006461
mov esi, dword [ebp - 0x18]
inc edi
cmp edi, 0x77c4
jl 0x10006454
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x59fa
jl 0x10006452
mov ebx, dword [ebp - 0x20]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x231a
jge 0x100064d1
mov edx, str.eytz_ktwblipfr_zuleaixn_egov_voc_kjbunbjod_lbq_jtsml_qehcn
mov ecx, 0x10072d38
call fcn.1000cc60
jmp 0x100064d1
cmp byte [ebx], 0
je 0x100064f4
push 0x1989
push 1
push 0x1be0
call dword [sym.imp.KERNEL32.dll_OpenProcess]
jmp 0x100064f4
mov eax, dword [ebp + 0x10]
mov cl, byte [eax]
mov eax, dword [ebp + 0x14]
mov byte [eax], cl
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000672b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov ebx, edx
mov edi, ecx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], edi
je 0x100067ec
mov dword [esp + 0x14], 0x3c9a
cmp dword [esp + 0x14], 0x3f4b
push 0
pop esi
jle 0x100067bf
push esi
push esi
call dword [sym.imp.USER32.dll_LoadMenuW]
mov ebx, esi
mov dword [esp + 0x10], esi
mov edi, ebx
mov ebx, 0x7f17
mov eax, edi
lea ecx, [esp + 0x20]
cdq
push edx
push eax
call fcn.10002548
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000678f
mov eax, dword [eax]
push eax
call fcn.10040f4c
pop ecx
push esi
push 1
lea ecx, [esp + 0x28]
call fcn.1000afb2
dec edi
dec ebx
jne 0x10006777
mov ebx, dword [esp + 0x10]
inc ebx
mov dword [esp + 0x10], ebx
cmp ebx, 0x1f27
jl 0x10006770
mov edi, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
cmp dword [esp + 0x14], 0x3c8e
jge 0x100067d4
push str.dzgoggvs_yxvrhaltb_udpq_ajqwxu_kwhnpvck
call fcn.10040f4c
pop ecx
mov dword [edi], esi
jmp 0x100067e5
mov ecx, dword [edi]
mov eax, dword [ebx]
mov dword [eax + ecx*4], 6
inc dword [edi]
cmp dword [edi], 3
jl 0x100067d8
jmp 0x10006802
xor esi, esi
push esi
push 0x8d2
push esi
push esi
push 0xd8c
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006b2b
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
cmp byte [ebp + 0x10], 0
push ebx
push esi
mov ebx, edx
push edi
mov dword [esp + 0x24], ebx
je 0x10006c3c
cmp byte [ebp + 8], 0
je 0x10006b71
cmp byte [ecx], 0
je 0x10006c7b
push 0x34dc
push ecx
push 0x385
push ecx
mov dl, 1
call fcn.10006809
add esp, 0x10
jmp 0x10006c7b
mov dword [esp + 0x18], 0x1598
cmp dword [esp + 0x18], 0x16d0
jle 0x10006c20
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
xor ebx, ebx
xor esi, esi
mov dword [esp + 0x14], esi
xor edi, edi
mov dword [esp + 0x10], edi
and dword [esp + 0x20], 0
mov ecx, edi
mov edi, esi
mov dword [esp + 0x1c], esi
mov esi, dword [esp + 0x20]
shl edi, cl
mov ecx, esi
mov eax, edi
shl eax, cl
lea ecx, [esp + 0x28]
and eax, ebx
cdq
push edx
push eax
call fcn.10002548
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10006bd0
mov eax, dword [eax]
push eax
call fcn.10040f4c
pop ecx
push 0
push 1
lea ecx, [esp + 0x30]
call fcn.1000afb2
inc esi
cmp esi, 0x52a3
jl 0x10006bb2
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
inc edi
mov dword [esp + 0x10], edi
cmp edi, 0x9cb
jl 0x10006b9f
inc esi
mov dword [esp + 0x14], esi
cmp esi, 0x677d
jl 0x10006b99
inc ebx
cmp ebx, 0x1e03
jl 0x10006b93
mov ebx, dword [esp + 0x24]
cmp dword [esp + 0x18], 0x1223
jge 0x10006c35
push str.jzcwhvxm_rsbbpbjkt_cmukr_slngf_kdll_gls_brwl_xegmqi_cqol_riuoywv_fsnv_gxb_oyqfb_saeaisqza
call fcn.10040f4c
pop ecx
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
jmp 0x10006c7b
cmp byte [ebp + 0x14], 0
je 0x10006c5b
mov byte [esp + 0xf], 0
cmp byte [esp + 0xf], 0
je 0x10006c7b
push 0x2286
call dword [sym.imp.KERNEL32.dll_SetLastError]
jmp 0x10006c7b
push 0
push 0x2388
push 0x1a07
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000febd
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1000ff5b
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1000ff35
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1000ff19
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 3
jge 0x1000ff33
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.10001c3d
or dword [eax], 0xffffffff
jmp 0x1000ff0e
jmp 0x1000ff59
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1000ff59
push 0
push 0x8d2
push 0
push 0
push 0xd8c
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1000ff77
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x24], eax
push 1
push 0x69c6
mov edx, 0x5e56
mov ecx, dword [ebp - 0x24]
call fcn.1000fcac
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x100100b3
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10057f63
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100100f6
push 0x598d
push 0x1aba
push 1
call fcn.100101dd
add esp, 0xc
jmp 0x100101cc
lea eax, [ebp + 8]
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], 0x25c
mov dword [ebp - 0x24], str.wkz_pivjtq_qonff_vrkgko_jcuda_fmttlgapp
cmp dword [ebp - 0x1c], 0x4d7
jle 0x10010160
and dword [ebp - 0x14], 0
jmp 0x10010120
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x2b8
jge 0x10010160
and dword [ebp - 0x18], 0
jmp 0x10010136
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2863
jge 0x1001015e
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edx
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
mov ecx, 0x10072d38
call fcn.1000aa66
jmp 0x1001012f
jmp 0x10010119
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x10010184
push 0
push 0x8d2
push 0
push 0
push 0xd8c
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1001018c
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x9b
jge 0x100101a6
mov edx, dword [ebp - 0x24]
mov ecx, 0x10072d38
call fcn.1000cc60
jmp 0x100101c2
or dword [ebp - 4], 0xffffffff
jmp 0x100101cc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10025a86
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
mov byte [esp + 8], cl
mov ebx, edx
mov dword [esp + 0xc], 0x6e82
cmp dword [esp + 0xc], 0x725c
push esi
push edi
jle 0x10025af7
xor esi, esi
xor edi, edi
lea eax, [edi + esi]
cdq
lea ecx, [esp + 0x18]
push edx
push eax
call fcn.10002548
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10025ac7
mov eax, dword [eax]
push eax
call fcn.10040f4c
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.1000afb2
inc edi
cmp edi, 0x3a93
jl 0x10025aae
inc esi
cmp esi, 0x39d7
jl 0x10025aac
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp dword [esp + 0x14], 0x6adb
jge 0x10025b0c
push str.namd_qtjjdt_vrxnbimsw_myw_gmezicjcq_sjwx
call fcn.10040f4c
pop ecx
cmp byte [esp + 0x10], 0
je 0x10025b2f
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
jmp 0x10025b28
mov ecx, dword [edx]
mov eax, dword [ebx]
or dword [eax + ecx*4], 0xffffffff
inc dword [edx]
cmp dword [edx], 3
jl 0x10025b1e
jmp 0x10025b45
push 0x2161
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MessageBoxW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10025c1c
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov byte [ebp - 8], dl
test dl, dl
je 0x10025c3b
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x10025c59
xor cl, cl
call fcn.10025d27
jmp 0x10025c59
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x10025c59
push eax
push 0x8d2
push eax
push eax
push 0xd8c
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret

Function at 0x10025ff6
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x10058476
call fcn.100574a0
sub esp, 0xc
mov byte [ebp - 0x14], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10026024
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowTextW]
jmp 0x100260aa
mov dword [ebp - 0x18], 0x7399
cmp dword [ebp - 0x18], 0x74d9
jle 0x1002606b
push 0x1b70
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
xor esi, esi
xor edi, edi
lea eax, [edi + esi]
mov ecx, 0x10072d38
cdq
push edx
push eax
call fcn.1000aa66
inc edi
cmp edi, 0x72dd
jl 0x10026049
inc esi
cmp esi, 0x7e12
jl 0x10026047
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x713a
jge 0x10026087
mov edx, str.tihsuovkh_glpr_mvgldktcx
mov ecx, 0x10072d38
call fcn.1000cc60
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x100260aa
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xea75c96
inc dword [edx]
cmp dword [edx], 2
jl 0x10026098
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret