joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001155d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10058c42
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x94
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100117a3
lea eax, [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x1001177e
push 2
lea ecx, [ebp - 0x90]
call fcn.100013fd
and dword [ebp - 4], 0
mov dword [ebp - 0x24], 0
mov dword [ebp - 0x20], 0
mov dword [ebp - 0x1c], 0
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x60], 0xc7af5af8
mov dword [ebp - 0x98], 0xae7b79f6
mov dword [ebp - 0x84], 0xbdb979cd
mov dword [ebp - 0x50], 0x2b82c447
push 3
lea ecx, [ebp - 0x7c]
call fcn.100013fd
mov byte [ebp - 4], 1
mov dword [ebp - 0x4c], 1
mov dword [ebp - 0x48], 1
mov dword [ebp - 0x44], 1
mov dword [ebp - 0x40], 1
lea ecx, [ebp - 0x11]
call fcn.10001770
push eax
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0xa0]
call fcn.100042f2
push dword [eax + 4]
push dword [eax]
lea ecx, [ebp - 0x6c]
call fcn.100042cc
mov byte [ebp - 4], 2
mov dword [ebp - 0x10], 0
jmp 0x10011657
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 2
jge 0x10011673
push dword [ebp - 0x10]
lea ecx, [ebp - 0x90]
call fcn.10001455
mov dword [eax], 0xfffffffe
jmp 0x10011650
lea eax, [ebp - 0x7c]
push eax
push 0
lea eax, [ebp - 0x10]
push eax
call fcn.100149e4
add esp, 0xc
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x24], 1
jmp 0x100116aa
push 4
pop eax
imul eax, eax, 3
mov eax, dword [ebp + eax - 0x24]
dec eax
push 4
pop ecx
imul ecx, ecx, 3
mov dword [ebp + ecx - 0x24], eax
push 4
pop eax
imul eax, eax, 3
cmp dword [ebp + eax - 0x24], 0
jl 0x10011747
mov dword [ebp - 0x34], 0xccbad86e
mov dword [ebp - 0x80], 0xfffffffb
mov dword [ebp - 0x70], 0xa92bd42c
push 1
lea ecx, [ebp - 0x5c]
call fcn.100013fd
mov byte [ebp - 4], 3
push 0
lea eax, [ebp - 0x94]
push eax
push 0x44c8
push 0x6068
push 0x59b0
push 0x5212
lea eax, [ebp - 0x5c]
push eax
call fcn.100119e7
add esp, 0x1c
lea eax, [ebp - 0x34]
push eax
push 0
push 0x62ee
call fcn.10015499
add esp, 0xc
push 1
push 0xfd2
push 1
lea eax, [ebp - 0x6c]
push eax
push 0x1b99
push 0
call fcn.1001284e
add esp, 0x18
mov byte [ebp - 4], 2
lea ecx, [ebp - 0x5c]
call fcn.10001439
jmp 0x10011695
push 4
pop eax
imul eax, eax, 3
mov dword [ebp + eax - 0x24], 0x752570e
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x6c]
call fcn.10001439
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x7c]
call fcn.10001439
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x90]
call fcn.10001439
jmp 0x100117a1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x100117a1
push 0x1dae
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x100117b1
push 0x4e7c
push 1
call fcn.10011548
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x100145c8
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x1001467a
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1001462d
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1001462b
push 0x1654
push 0x11d5
push 0
push 0
push 0x1578
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
jmp 0x10014678
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001465b
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x10014678
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x2c]
call fcn.10001455
mov dword [eax], 0xfffffffe
jmp 0x10014650
jmp 0x100146eb
lea eax, [ebp + 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x100146a0
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x100146eb
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x100146ce
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 4
jge 0x100146eb
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x44]
call fcn.10001455
mov dword [eax], 0x7909b792
jmp 0x100146c3
mov esp, ebp
pop ebp
ret
Function at 0x10014706
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10058da5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001484b
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x10014843
mov dword [ebp - 0x20], 0x53a1
mov dword [ebp - 0x2c], str.gfl_mqguj_qxejnlh_ucpfgjwql_cbaqnv_yiy_kvpjpn_tis_nvqf_tihvawkf
cmp dword [ebp - 0x20], 0x56f1
jle 0x100147ea
push 0x258a
push 0x644
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawFrameControl]
and dword [ebp - 0x18], 0
jmp 0x10014790
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x7d23
jge 0x100147ea
and dword [ebp - 0x1c], 0
jmp 0x100147a6
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x710
jge 0x100147e8
mov eax, dword [ebp - 0x18]
or eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
push dword [ebp - 0x34]
push dword [ebp - 0x38]
lea ecx, [ebp - 0x50]
call fcn.10002811
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
call fcn.10004172
push eax
call fcn.100402ca
pop ecx
lea ecx, [ebp - 0x50]
call fcn.1000137e
jmp 0x1001479f
jmp 0x10014789
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x10014805
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowRect]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x5180
jge 0x1001481b
push dword [ebp - 0x2c]
call fcn.100402ca
pop ecx
jmp 0x10014837
or dword [ebp - 4], 0xffffffff
jmp 0x10014841
jmp 0x10014849
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x10014868
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
push 0x3552
push 1
push 0x2eb9
push dword [ebp - 0x30]
call fcn.100145a1
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10016a9b
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10058e26
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x6c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x10016c1d
mov dword [ebp - 0x20], 0x7e55
mov dword [ebp - 0x24], str.gkkzz_nlii_rdcleo_jjcvj
cmp dword [ebp - 0x20], 0x7f55
jle 0x10016b4c
and dword [ebp - 0x14], 0
jmp 0x10016aed
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x64fd
jge 0x10016b4c
and dword [ebp - 0x18], 0
jmp 0x10016b03
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2bde
jge 0x10016b4a
and dword [ebp - 0x1c], 0
jmp 0x10016b19
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x35c0
jge 0x10016b48
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x18]
cdq
idiv dword [ebp - 0x1c]
mov eax, edx
cdq
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], edx
push dword [ebp - 0x60]
push dword [ebp - 0x64]
mov ecx, 0x10073b38
call fcn.10004192
jmp 0x10016b12
jmp 0x10016afc
jmp 0x10016ae6
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x7dbc
jge 0x10016b6c
mov edx, dword [ebp - 0x24]
mov ecx, 0x10073b38
call fcn.10005a51
jmp 0x10016b88
or dword [ebp - 4], 0xffffffff
jmp 0x10016b92
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10016c15
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x4c]
mov eax, dword [ebp - 0x50]
push dword [eax]
mov eax, dword [ebp - 0x54]
push dword [eax]
lea eax, [ebp - 0x7c]
push eax
call fcn.10012414
add esp, 0x10
mov dword [ebp - 0x58], eax
push dword [ebp - 0x58]
mov ecx, dword [ebp - 0x5c]
call fcn.100013c3
lea ecx, [ebp - 0x7c]
call fcn.100013e8
jmp 0x10016c1b
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x10016c3b
push 0x731b
push 0x2550
push 0
push 0x24fc
push 0x7fe1
call fcn.10016a7d
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001d23b
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10059024
call fcn.10057d24
sub esp, 0x10
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x14], 0x3da8
cmp dword [ebp - 0x14], 0x3fa4
mov edi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], edi
jle 0x1001d292
xor ebx, ebx
xor esi, esi
mov eax, esi
mov ecx, 0x10073b38
xor eax, ebx
cdq
push edx
push eax
call fcn.10004192
inc esi
cmp esi, 0x2614
jl 0x1001d26c
inc ebx
cmp ebx, 0x2e6b
jl 0x1001d26a
mov esi, dword [ebp - 0x18]
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x3d69
jge 0x1001d2d0
mov edx, str.nayww_hrt_uyv_wbmpfg_qdd_orhgjfkts_flzf_tugqf_tvvvogr_erkkjdeie_ruoy_pietfvr
mov ecx, 0x10073b38
call fcn.10005a51
jmp 0x1001d2d0
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 8], 0
je 0x1001d2ee
push dword [ebp - 0x14]
mov ecx, esi
push dword [edi + 4]
push dword [edi]
push dword [esi + 4]
call fcn.100200e2
jmp 0x1001d307
push 0x1654
push 0x11d5
push 0
push 0
push 0x1578
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001d7a8
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1005904a
call fcn.10057d24
sub esp, 0x38
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x28], esi
je 0x1001d8bb
mov dword [ebp - 0x18], 0x569
cmp dword [ebp - 0x18], 0x8f8
jle 0x1001d826
xor esi, esi
mov dword [ebp + 0x14], esi
xor edi, edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov esi, edx
mov ecx, ebx
mov eax, esi
sar eax, cl
mov ecx, 0x10073b38
cdq
push edx
push eax
call fcn.10004192
inc ebx
cmp ebx, 0x22df
jl 0x1001d7ef
mov esi, dword [ebp + 0x14]
inc edi
cmp edi, 0x7c2
jl 0x1001d7e6
inc esi
mov dword [ebp + 0x14], esi
cmp esi, 0x499
jl 0x1001d7e4
mov ebx, dword [ebp - 0x1c]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x534
jge 0x1001d861
mov edx, str.lty_orfrpuz_bkrek_gshfziiw_eri_scl_cgu_qcufvkhc_avhy_btdme
mov ecx, 0x10073b38
call fcn.10005a51
jmp 0x1001d861
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x1c], 0
je 0x1001d899
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1001d98d
push 1
push 0x6e7a
push 0
push 0x4593
mov dl, 1
mov ecx, 0xe60
call fcn.1001d651
add esp, 0x10
jmp 0x1001d98d
mov edx, dword [ebp + 8]
mov dword [edx], 0
jmp 0x1001d8b1
mov ecx, dword [edx]
mov eax, dword [ebx]
mov dword [eax + ecx*4], 2
inc dword [edx]
cmp dword [edx], 3
jl 0x1001d8a4
jmp 0x1001d98d
mov dword [ebp - 0x24], 0x735f
cmp dword [ebp - 0x24], 0x762d
jle 0x1001d953
push 0x42e
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
xor esi, esi
mov dword [ebp - 0x20], esi
xor eax, eax
mov dword [ebp - 0x18], 0xad3
mov dword [ebp + 0x14], eax
mov esi, dword [ebp + 0x14]
xor edi, edi
xor ebx, ebx
mov eax, edi
cdq
idiv ebx
mov eax, esi
mov ecx, edx
sar eax, cl
lea ecx, [ebp - 0x40]
cdq
push edx
push eax
call fcn.10002811
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001d914
mov eax, dword [eax]
push eax
call fcn.100402ca
pop ecx
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.10001571
inc ebx
cmp ebx, 0x3cb1
jl 0x1001d8f4
inc edi
cmp edi, 0x46af
jl 0x1001d8f2
mov esi, dword [ebp - 0x20]
add dword [ebp + 0x14], esi
dec dword [ebp - 0x18]
jne 0x1001d8ed
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x4861
jl 0x1001d8e1
mov esi, dword [ebp - 0x28]
cmp dword [ebp - 0x24], 0x7285
jge 0x1001d967
push str.tolnnv_izds_dnlkqe_etlsowxw_tohdxvz_rmkzax_aydb
call fcn.100402ca
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x10], 0
je 0x1001d97e
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x1001d98d
and dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
mov ecx, esi
call fcn.1000e1fb
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001dcb9
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov byte [ebp - 8], cl
mov dword [ebp - 0xc], 0x58fa
cmp dword [ebp - 0xc], 0x59a6
push esi
push edi
jle 0x1001dd44
push 0
push 0x1c60
push 0x2549
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportOrgEx]
xor esi, esi
xor edi, edi
mov ebx, 0x3fee
mov eax, edi
lea ecx, [ebp - 0x28]
cdq
push edx
push eax
call fcn.10002811
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001dd15
mov eax, dword [eax]
push eax
call fcn.100402ca
pop ecx
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.10001571
add edi, esi
dec ebx
jne 0x1001dcfe
inc esi
cmp esi, 0x4e4e
jl 0x1001dcf7
push 0x2c8
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreatePipe]
cmp byte [ebp - 8], 0
je 0x1001dd5c
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x10]
and dword [ebp - 0x10], 0
push eax
call fcn.1000e1fb
jmp 0x1001dd69
push 0
push 0x25cb
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
cmp dword [ebp - 0xc], 0x5765
jge 0x1001dd7d
push str.eqhygrqwc_vfwvixe_iyleni_jfiwemyad_snmxnkoo_tsjrv_umrisbj_bmeqjiw_zilexvwz_buwandtn_vneefji_swrpjo_jlm_slr
call fcn.100402ca
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10020700
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
push edi
mov edi, ecx
xor esi, esi
mov ebx, esi
mov dword [esp + 0x18], ebx
mov eax, dword [edi + 0x10]
mov ecx, eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x1c], ecx
test ecx, ecx
je 0x10020809
mov dword [esp + 0x10], 0x3479
cmp dword [esp + 0x10], 0x3601
jle 0x1002079b
xor ebx, ebx
mov ecx, ebx
mov eax, esi
sar eax, cl
lea ecx, [esp + 0x20]
cdq
push edx
push eax
call fcn.10002811
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002075b
mov eax, dword [eax]
push eax
call fcn.100402ca
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.10001571
inc ebx
cmp ebx, 0x31dc
jl 0x1002073f
inc esi
cmp esi, 0x3653
jl 0x1002073d
xor esi, esi
push esi
push esi
push esi
push esi
push 0x1252
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ebx, dword [esp + 0x18]
cmp dword [edi + 0x10], ebx
jbe 0x10020810
cmp dword [edi + 0x14], 8
jb 0x100207aa
mov eax, dword [edi]
jmp 0x100207ac
mov eax, edi
cmp dword [esp + 0x10], 0x326b
movzx esi, word [eax + ebx*2]
mov dword [esp + 0x18], esi
jge 0x100207c9
push str.dhjxnkgx_ypaee_wafjbhx_kejtwd
call fcn.100402ca
pop ecx
lea edx, [ebx - 0x6772]
mov ecx, esi
call fcn.10033c22
movzx esi, ax
xor edx, edx
mov eax, dword [esp + 0x18]
movzx eax, ax
add eax, ebx
push 0x19
pop ecx
div ecx
mov eax, dword [esp + 0x14]
mov ecx, edx
shl esi, cl
add eax, esi
inc ebx
push 0
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
pop esi
cmp ebx, dword [esp + 0x1c]
jb 0x1002072b
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.ffBoAPhyAwUijiNwnHXQqSV
call fcn.1003d505
int3
Function at 0x10021717
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10059248
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], 0x7690
mov dword [ebp - 0x40], str.fnmvynoa_goaciq_fxdndngm_mvbncckjt_byiq
cmp dword [ebp - 0x28], 0x7702
jle 0x100217d8
and dword [ebp - 0x18], 0
jmp 0x10021761
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x4cbe
jge 0x100217d8
and dword [ebp - 0x1c], 0
jmp 0x10021777
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x4dd4
jge 0x100217d6
and dword [ebp - 0x20], 0
jmp 0x1002178d
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x33e5
jge 0x100217d4
and dword [ebp - 0x24], 0
jmp 0x100217a3
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x5ee3
jge 0x100217d2
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c]
sub eax, dword [ebp - 0x20]
or eax, dword [ebp - 0x24]
cdq
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
push dword [ebp - 0x44]
push dword [ebp - 0x48]
mov ecx, 0x10073b38
call fcn.10004192
jmp 0x1002179c
jmp 0x10021786
jmp 0x10021770
jmp 0x1002175a
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10021858
lea eax, [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1002184e
mov byte [ebp - 0x11], 0
push 0x653a
push 0x23d5
push 0x5c02
push 0
push 0x74ee
push 0x6db
push 0x619e
push 0x9e7
push 0x7a7f
push 0x29ca
push 0x25d7
push 0x165e
push 1
push 0x33dd
push 1
push 0x98c
lea eax, [ebp - 0x11]
push eax
push 0x288d
call fcn.100244db
add esp, 0x48
jmp 0x10021856
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x1002189c
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x10021878
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
jmp 0x1002189c
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x1002189c
push 0
push 0x3cad
call fcn.100208a7
pop ecx
pop ecx
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x72d8
jge 0x100218b6
mov edx, dword [ebp - 0x40]
mov ecx, 0x10073b38
call fcn.10005a51
jmp 0x100218d2
or dword [ebp - 4], 0xffffffff
jmp 0x100218dc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003780c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x10], 0
mov edx, ecx
push esi
je 0x10037820
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10037840
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [edx]
cmp dword [edx], 2
jl 0x1003782e
pop esi
pop ebp
ret

Function at 0x1003825a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100598f5
call fcn.10057d24
sub esp, 0x20
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], esi
je 0x1003832e
mov dword [ebp + 0x14], 0x4a44
cmp dword [ebp + 0x14], 0x4bf7
jle 0x100382e0
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, edi
cdq
idiv ebx
mov eax, esi
mov ecx, edx
shl eax, cl
lea ecx, [ebp - 0x2c]
cdq
push edx
push eax
call fcn.10002811
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100382b2
mov eax, dword [eax]
push eax
call fcn.100402ca
pop ecx
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.10001571
inc ebx
cmp ebx, 0x4133
jl 0x10038292
inc edi
cmp edi, 0x314e
jl 0x10038290
inc esi
cmp esi, 0x2a49
jl 0x1003828e
cmp byte [ebp + 0x10], 0
je 0x1003830b
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x10038311
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [edx]
cmp dword [edx], 1
jl 0x100382f7
jmp 0x10038311
mov eax, dword [ebp + 8]
add dword [eax], 4
cmp dword [ebp + 0x14], 0x4716
jge 0x1003840a
push str.cjpvs_gltlpm_kibro_jebs_whnbqhe_axkl_xlpcu_tbuxkes_uruwaxa_fckwcmsx
call fcn.100402ca
pop ecx
jmp 0x1003840a
cmp byte [ebp + 0xc], 0
je 0x10038357
cmp byte [ecx], 0
je 0x1003840a
push 0x4cf
push 1
push ecx
mov ecx, 0x5d1b
call fcn.10037f1b
add esp, 0xc
jmp 0x1003840a
mov dword [ebp + 0x14], 0x316a
cmp dword [ebp + 0x14], 0x3446
jle 0x100383ac
push 0
push 0x10ac
push 0x18d3
push 0x1014
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollRange]
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x10073b38
xor eax, edi
cdq
push edx
push eax
call fcn.10004192
inc ebx
cmp ebx, 0x674a
jl 0x10038389
inc edi
cmp edi, 0x57f7
jl 0x10038387
mov dword [ebp - 4], 2
cmp dword [ebp + 0x14], 0x2da1
jge 0x100383ea
mov edx, str.txvzos_gzmwtg_jhcbf_gkglgl_gwcot_caz_rdsxun_uyeaem_vhahwo_kdojf_bulh_jcow
mov ecx, 0x10073b38
call fcn.10005a51
jmp 0x100383ea
mov dword [esi], 0
cmp dword [esi], 3
jge 0x1003840a
mov edx, dword [ebp + 0x20]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0xb110c93b
inc dword [esi]
cmp dword [esi], 3
jl 0x100383f8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret