joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5c2630
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x51c
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x204]
push 0x100
push 0
push eax
call fcn.005e3180
add esp, 0xc
cmp byte [ebp - 0x204], 0
jne 0x5c266a
xor ecx, ecx
jmp 0x5c267c
lea ecx, [ebp - 0x204]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5c2673
sub ecx, edx
push ecx
lea eax, [ebp - 0x204]
mov ecx, esi
push eax
call fcn.0047c3b0
push 0x100
lea eax, [ebp - 0x104]
push 0
push eax
call fcn.005e3180
add esp, 0xc
lea eax, [ebp - 0x308]
push 0x104
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemDirectoryA]
push 0xfa
lea eax, [ebp - 0x305]
push 0
push eax
call fcn.005e3180
add esp, 0xc
lea eax, [ebp - 0x40c]
push 0x104
push eax
lea eax, [ebp - 0x518]
push eax
lea eax, [ebp - 0x51c]
push eax
lea eax, [ebp - 0x514]
push eax
push 0x104
lea eax, [ebp - 0x510]
push eax
lea eax, [ebp - 0x308]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVolumeInformationA]
test eax, eax
jne 0x5c271a
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c978e
mov esp, ebp
pop ebp
ret 4
push dword [ebp - 0x514]
lea eax, [ebp - 0x104]
push 0x64353c
push eax
call fcn.0047f4b0
add esp, 0xc
cmp byte [ebp - 0x104], 0
jne 0x5c2741
xor ecx, ecx
jmp 0x5c2759
lea ecx, [ebp - 0x104]
lea edx, [ecx + 1]
nop word [eax + eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5c2750
sub ecx, edx
push ecx
lea eax, [ebp - 0x104]
mov ecx, esi
push eax
call fcn.004918c0
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.005c978e
mov esp, ebp
pop ebp
ret 4
Function at 0x5c82b0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov dword [0x6cdf64], eax
mov eax, dword [ebp + 0xc]
mov dword [0x6cdf68], eax
mov eax, dword [ebp + 0x10]
mov dword [0x6cdf6c], eax
mov eax, dword [ebp + 0x14]
push 0x1bc
mov dword [0x6cdf70], eax
call fcn.005c9a55
add esp, 4
test eax, eax
je 0x5c82ed
mov ecx, eax
call fcn.005bf270
jmp 0x5c82ef
xor eax, eax
push 0
push 0
push 0
push 0x5c3380
push 0
push 0
mov dword [0x6cdf60], eax
call dword [sym.imp.KERNEL32.DLL_CreateThread]
xor eax, eax
pop ebp
ret

Function at 0x5c8da0
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x617190
mov eax, dword fs:[0]
push eax
sub esp, 0x38
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 0x10], eax
push ebx
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, dword [ebp + 8]
xor eax, eax
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x2c], 7
mov dword [ebp - 0x30], 0
mov word [ebp - 0x40], ax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x44]
push eax
push 0
call dword [sym.imp.KERNEL32.DLL_GetComputerNameW]
mov eax, dword [ebp - 0x44]
xor ecx, ecx
mov edx, 2
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.005c9dac
add esp, 4
mov edi, eax
lea eax, [ebp - 0x44]
push eax
push edi
call dword [sym.imp.KERNEL32.DLL_GetComputerNameW]
test eax, eax
je 0x5c8e4c
cmp word [edi], 0
jne 0x5c8e2e
xor ecx, ecx
jmp 0x5c8e42
mov ecx, edi
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x5c8e33
sub ecx, edx
sar ecx, 1
push ecx
push edi
lea ecx, [ebp - 0x40]
call fcn.0047e220
push edi
call fcn.005c9b6f
mov eax, dword [ebp - 0x30]
lea ecx, [ebp - 0x28]
add esp, 4
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
lea eax, [eax + eax*2]
push 0x20
push eax
call fcn.004917a0
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
push 0
cmovae ecx, dword [ebp - 0x28]
lea eax, [ebp - 0x40]
cmp dword [ebp - 0x2c], 8
push 0
push dword [ebp - 0x18]
cmovae eax, dword [ebp - 0x40]
push ecx
push dword [ebp - 0x30]
mov byte [ebp - 4], 1
push eax
push 0
push 0xfde9
call dword [sym.imp.KERNEL32.DLL_WideCharToMultiByte]
mov ecx, dword [ebp - 0x18]
cmp eax, ecx
ja 0x5c8ec6
cmp dword [ebp - 0x14], 0x10
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x18], eax
cmovae ecx, dword [ebp - 0x28]
mov byte [ecx + eax], 0
jmp 0x5c8ed3
sub eax, ecx
lea ecx, [ebp - 0x28]
push 0
push eax
call fcn.00491830
lea eax, [ebp - 0x28]
cmp ebx, eax
je 0x5c8ee6
push 0xffffffffffffffff
push 0
push eax
mov ecx, ebx
call fcn.0047c430
mov eax, dword [ebp - 0x14]
cmp eax, 0x10
jb 0x5c8efb
inc eax
lea ecx, [ebp - 0x28]
push eax
push dword [ebp - 0x28]
call fcn.0047c5e0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
mov dword [ebp - 0x18], 0
mov byte [ebp - 0x28], 0
cmp eax, 8
jb 0x5c8f22
inc eax
lea ecx, [ebp - 0x40]
push eax
push dword [ebp - 0x40]
call fcn.0047e530
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop ebx
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.005c978e
mov esp, ebp
pop ebp
ret 4
Function at 0x5c8f50
Capabilities:
Initialize winsock library
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x194
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x194]
push eax
push 0x101
mov esi, ecx
call dword [sym.imp.WS2_32.dll_WSAStartup]
push 0x6a6e08
call dword [sym.imp.WS2_32.dll_gethostbyname]
test eax, eax
je 0x5c8fd3
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
push dword [eax]
call dword [sym.imp.WS2_32.dll_inet_ntoa]
mov edx, eax
cmp byte [edx], 0
jne 0x5c8fa3
xor ecx, ecx
jmp 0x5c8fba
mov ecx, edx
push ebx
lea ebx, [ecx + 1]
nop dword [eax]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5c8fb0
sub ecx, ebx
pop ebx
push ecx
push edx
mov ecx, esi
call fcn.0047c3b0
cmp edi, esi
je 0x5c8fd3
push 0xffffffffffffffff
push 0
push esi
mov ecx, edi
call fcn.0047c430
call dword [sym.imp.WS2_32.dll_WSACleanup]
mov ecx, dword [ebp - 4]
xor eax, eax
pop edi
xor ecx, ebp
pop esi
call fcn.005c978e
mov esp, ebp
pop ebp
ret 4
Function at 0x5c8ff0
Capabilities:
Check os version
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x358
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, dword [ebp + 8]
lea eax, [ebp - 0x358]
push eax
call dword [sym.imp.KERNEL32.DLL_GetSystemInfo]
push str.RtlGetVersion
push 0x66b210
mov dword [ebp - 0x220], 0x11c
call dword [sym.imp.KERNEL32.DLL_GetModuleHandleA]
push eax
call dword [sym.imp.KERNEL32.DLL_GetProcAddress]
push 0x110
mov esi, eax
lea eax, [ebp - 0x330]
push 0
push eax
call fcn.005e3180
add esp, 0xc
mov dword [ebp - 0x334], 0x114
lea eax, [ebp - 0x334]
push eax
call esi
push 0x18
push str.unknown_OperatingSystem.
mov ecx, edi
mov esi, eax
call fcn.0047c3b0
lea eax, [ebp - 0x220]
push eax
call dword [sym.imp.KERNEL32.DLL_GetVersionExW]
test eax, eax
je case.0x5c90de.7
test esi, esi
jne case.0x5c90de.7
push 0x100
lea eax, [ebp - 0x104]
push esi
push eax
call fcn.005e3180
push dword [ebp - 0x218]
lea eax, [ebp - 0x104]
push dword [ebp - 0x21c]
push str._d__d
push eax
call fcn.0047f4b0
lea eax, [ebp - 0x104]
push eax
call fcn.004cbdf0
mov eax, dword [ebp - 0x330]
add esp, 0x20
add eax, 0xfffffffc
cmp eax, 6
ja case.0x5c90de.7
jmp dword [eax*4 + 0x5c92a8]
mov eax, dword [ebp - 0x32c]
test eax, eax
je 0x5c9111
cmp eax, 0xa
je 0x5c9107
cmp eax, 0x5a
jne case.0x5c90de.7
push 0x66b28c
jmp 0x5c928d
push str.Microsoft_Windows_98
jmp 0x5c928d
mov eax, dword [ebp - 0x210]
cmp eax, 2
jne 0x5c9126
push str.Microsoft_Windows_NT_4.0
jmp 0x5c928d
cmp eax, 1
jne case.0x5c90de.7
push str.Microsoft_Windows_95
jmp 0x5c928d
mov eax, dword [ebp - 0x32c]
sub eax, 0
je 0x5c91a7
sub eax, 1
je 0x5c919d
sub eax, 1
jne case.0x5c90de.7
cmp byte [ebp - 0x106], 1
jne 0x5c916f
cmp word [ebp - 0x358], 9
jne 0x5c916f
push 0x66b2c0
jmp 0x5c928d
mov esi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0x59
call esi
test eax, eax
jne 0x5c9187
push 0x66b2e4
jmp 0x5c928d
push 0x59
call esi
test eax, eax
je case.0x5c90de.7
push 0x66b2f8
jmp 0x5c928d
push 0x66b2b4
jmp 0x5c928d
push 0x66b2a4
jmp 0x5c928d
mov eax, dword [ebp - 0x32c]
cmp eax, 3
ja case.default.0x5c91c0
jmp dword [eax*4 + 0x5c92c4]
cmp byte [ebp - 0x106], 1
mov ecx, edi
jne 0x5c91d9
push 0x66b310
jmp 0x5c9255
push 0x66b320
jmp 0x5c9255
cmp byte [ebp - 0x106], 1
mov ecx, edi
jne 0x5c91f2
push 0x66b334
jmp 0x5c9255
push 0x66b340
jmp 0x5c9255
cmp byte [ebp - 0x106], 1
jne 0x5c9237
push 0
push 0
push 0xa
call fcn.005c95f0
add esp, 0xc
test al, al
je 0x5c9230
cmp dword [ebp - 0x328], 0x55f0
mov ecx, edi
jb 0x5c9229
push 0x66b358
jmp 0x5c9255
push 0x66b364
jmp 0x5c9255
push 0x66b370
jmp 0x5c9253
push 0x66b37c
jmp 0x5c9253
cmp byte [ebp - 0x106], 1
jne 0x5c924e
push 0x66b390
jmp 0x5c9253
push str.Windows_Server_2012_R2
mov ecx, edi
call fcn.004a9090
cmp dword [ebp - 0x32c], 0
jne case.0x5c90de.7
cmp byte [ebp - 0x106], 1
jne 0x5c9288
cmp dword [ebp - 0x328], 0x55f0
mov ecx, edi
jb 0x5c9281
push 0x66b358
jmp 0x5c928f
push 0x66b364
jmp 0x5c928f
push str.Windows_Server_2016_Technical_Preview
mov ecx, edi
call fcn.004a9090
mov ecx, dword [ebp - 4]
pop edi
xor ecx, ebp
pop esi
call fcn.005c978e
mov esp, ebp
pop ebp
ret 4
Function at 0x5c9420
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x114
mov eax, dword [0x6c6f60]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
lea eax, [ebp - 0x114]
push esi
mov esi, dword [ebp + 0xc]
push eax
push 1
push 0
push str.SOFTWAREGuidGuidold
push reloc.OLEAUT32.dll_SysReAllocString
mov dword [ebp - 0x110], 1
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x5c9564
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0x104
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push str.guid
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5c9564
push str._n_CPU_INFO:
call fcn.004cbdf0
lea eax, [ebp - 0x108]
push eax
push str._s_n
call fcn.004cbdf0
add esp, 0xc
cmp byte [ebp - 0x108], 0
jne 0x5c94cd
xor ecx, ecx
jmp 0x5c94df
lea ecx, [ebp - 0x108]
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x5c94d6
sub ecx, edx
push ecx
lea eax, [ebp - 0x108]
mov ecx, ebx
push eax
call fcn.0047c3b0
lea eax, [ebp - 0x10c]
mov dword [ebp - 0x10c], 0x104
push eax
lea eax, [ebp - 0x108]
push eax
lea eax, [ebp - 0x110]
push eax
push 0
push str.user_id
push dword [ebp - 0x114]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x5c9564
push str._n_CPU_INFO:
call fcn.004cbdf0
lea eax, [ebp - 0x108]
push eax
push str._s_n
call fcn.004cbdf0
add esp, 0xc
lea eax, [ebp - 0x108]
mov ecx, esi
push eax
call fcn.004a9090
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.005c978e
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop esi
xor ecx, ebp
pop ebx
call fcn.005c978e
mov esp, ebp
pop ebp
ret 8

Function at 0x5c96a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
lea eax, [ebp - 8]
mov dword [ebp - 8], 2
push eax
lea eax, [ebp - 4]
push eax
push 0
push 0xf003f
push 0
push 0
push 0
push str.SOFTWAREGuidGuidold
push reloc.OLEAUT32.dll_SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegCreateKeyExA]
test eax, eax
je 0x5c96dc
or esi, 0xffffffff
jmp 0x5c9749
push dword [ebp + 0x18]
cmp dword [ebp + 0x1c], 0x10
lea eax, [ebp + 8]
mov esi, dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmovae eax, dword [ebp + 8]
push eax
push 1
push 0
push str.guid
push dword [ebp - 4]
call esi
test eax, eax
jne 0x5c9710
push str._self_run_success_n
call fcn.004cbdf0
add esp, 4
push dword [ebp + 0x30]
cmp dword [ebp + 0x34], 0x10
lea eax, [ebp + 0x20]
cmovae eax, dword [ebp + 0x20]
push eax
push 1
push 0
push str.user_id
push dword [ebp - 4]
call esi
test eax, eax
jne 0x5c973e
push str._self_run_success_n
call fcn.004cbdf0
add esp, 4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
xor esi, esi
mov eax, dword [ebp + 0x1c]
cmp eax, 0x10
jb 0x5c975e
inc eax
lea ecx, [ebp + 8]
push eax
push dword [ebp + 8]
call fcn.0047c5e0
mov ecx, dword [ebp + 0x34]
mov dword [ebp + 0x1c], 0xf
mov dword [ebp + 0x18], 0
mov byte [ebp + 8], 0
cmp ecx, 0x10
jb 0x5c9785
inc ecx
push ecx
push dword [ebp + 0x20]
lea ecx, [ebp + 0x20]
call fcn.0047c5e0
mov eax, esi
pop esi
mov esp, ebp
pop ebp
ret 0x30
Function at 0x5ccb2d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push dword [ebp + 0x1c]
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.DLL_CreateThread]
pop ebp
ret

Function at 0x602043
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00601d06

Function at 0x60204e
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00601e87

Function at 0x6062b7
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00605f77
Function at 0x10005cf6
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x10055a2b
call fcn.100553f0
sub esp, 0x34
push ebx
push esi
mov byte [ebp - 0x14], cl
xor esi, esi
mov dword [ebp - 0x18], 0x7b4a
cmp dword [ebp - 0x18], 0x7cc7
push edi
mov dword [ebp - 0x10], esp
jle 0x10005d6c
push 0x15cf
push esi
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov edi, esi
mov ebx, esi
mov eax, ebx
lea ecx, [ebp - 0x3c]
and eax, edi
cdq
push edx
push eax
call fcn.10002769
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10005d48
mov eax, dword [eax]
push eax
call fcn.1003ed0a
pop ecx
push esi
push 1
lea ecx, [ebp - 0x3c]
call fcn.10001539
inc ebx
cmp ebx, 0x2b33
jl 0x10005d2f
inc edi
cmp edi, 0x4afe
jl 0x10005d2d
cmp dword [ebp - 0x18], 0x77d7
jge 0x10005d80
push str.mvcvxe_otyewqae_cmhkgm
call fcn.1003ed0a
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x14], 0
je 0x10005e3d
mov dword [ebp - 0x20], 0x16a1
cmp dword [ebp - 0x20], 0x1870
jle 0x10005dfa
mov edi, esi
mov dword [ebp - 0x1c], esi
mov ebx, esi
mov eax, esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
lea ecx, [eax + ebx]
mov esi, edi
mov edi, dword [ebp - 0x24]
sar esi, cl
mov eax, esi
mov ecx, 0x1006f038
and eax, edi
cdq
push edx
push eax
call fcn.10003f1c
inc edi
cmp edi, 0x5e64
jl 0x10005db7
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x18], eax
push 0
pop esi
cmp eax, 0x6d53
jl 0x10005daa
inc ebx
cmp ebx, 0x4c3d
jl 0x10005da5
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x1548
jl 0x10005da3
push esi
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x14f3
jge 0x10005e21
mov edx, str.puvfgkgy_dlgd_wihqwra_asyku_pwc_svza_pobjwsu_pmadzqbdh_fbwlpgvj_mpq
mov ecx, 0x1006f038
call fcn.1000567a
jmp 0x10005e42
mov eax, dword [ebp + 8]
mov dword [eax], esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009357
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10055b8f
call fcn.100553f0
sub esp, 0x10
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], esi
je 0x1000938c
push 0x15ad
push 0xf03
push 0
call dword [sym.imp.GDI32.dll_OffsetRgn]
jmp 0x1000942c
mov dword [ebp - 0x14], 0x41dc
cmp dword [ebp - 0x14], 0x4597
jle 0x100093d5
xor edi, edi
xor ebx, ebx
xor esi, esi
mov ecx, esi
mov eax, ebx
sar eax, cl
mov ecx, 0x1006f038
xor eax, edi
cdq
push edx
push eax
call fcn.10003f1c
inc esi
cmp esi, 0x1ba8
jl 0x100093a2
inc ebx
cmp ebx, 0x5abf
jl 0x100093a0
inc edi
cmp edi, 0xb68
jl 0x1000939e
mov esi, dword [ebp - 0x18]
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x415d
jge 0x10009410
mov edx, str.eyea_rzq_fjimk_gebgi_exokpv_ucphe_ddafol
mov ecx, 0x1006f038
call fcn.1000567a
jmp 0x10009410
cmp byte [esi], 0
je 0x1000942c
push 0xf7e
push 0x47c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10009a1f
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
test cl, cl
je 0x10009a32
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
pop ebp
ret
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
mov dword [eax], ecx
pop ebp
ret
Function at 0x10009f41
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x10055bc2
call fcn.100553f0
sub esp, 0x18
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], esi
je 0x10009f6e
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x1000a02a
mov dword [ebp - 0x1c], 0x65d1
cmp dword [ebp - 0x1c], 0x672d
jle 0x10009fd5
xor edi, edi
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
xor esi, esi
lea eax, [ebx + edi]
mov ebx, 0x7664
mov dword [ebp - 0x24], eax
mov edi, eax
mov eax, edi
mov ecx, 0x1006f038
cdq
push edx
push eax
call fcn.10003f1c
add edi, esi
dec ebx
jne 0x10009f97
mov edi, dword [ebp - 0x18]
inc esi
mov ebx, dword [ebp - 0x14]
cmp esi, 0x52d6
jl 0x10009f8a
inc ebx
mov dword [ebp - 0x14], ebx
cmp ebx, 0x2211
jl 0x10009f88
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x6634
jl 0x10009f83
mov esi, dword [ebp - 0x20]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x62a3
jge 0x1000a010
mov edx, str.muoaicktc_dauozcy_bbzzatwda_bbt_emgulbd
mov ecx, 0x1006f038
call fcn.1000567a
jmp 0x1000a010
mov dword [esi], 0x11
cmp dword [esi], 0xffffffe9
jne 0x1000a02a
mov eax, dword [ebp + 8]
cmp dword [eax], 0
jne 0x1000a02a
dec dword [esi]
cmp dword [esi], 0xffffffe9
je 0x1000a01e
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a03b
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x10055bcc
call fcn.100553f0
sub esp, 0x1c
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x1000a06b
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1000a153
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x1000a153
mov dword [ebp - 0x24], 0x5a14
xor ebx, ebx
cmp dword [ebp - 0x24], 0x5db9
jle 0x1000a0d2
mov edi, ebx
mov dword [ebp - 0x20], ebx
mov eax, ebx
mov dword [ebp - 0x1c], 0x484c
mov dword [ebp - 0x18], eax
mov ebx, eax
mov esi, 0x3c7e
mov eax, ebx
mov ecx, 0x1006f038
or eax, edi
cdq
push edx
push eax
call fcn.10003f1c
dec ebx
dec esi
jne 0x1000a095
mov eax, dword [ebp - 0x18]
mov esi, dword [ebp - 0x20]
add eax, esi
dec dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
jne 0x1000a08e
inc esi
mov dword [ebp - 0x20], esi
push 0
pop ebx
cmp esi, 0x4134
jl 0x1000a082
inc edi
cmp edi, 0x32a8
jl 0x1000a07f
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x24], 0x584b
jge 0x1000a10b
mov edx, str.jksyu_vnsn_metpxqmex
mov ecx, 0x1006f038
call fcn.1000567a
jmp 0x1000a10b
mov esi, dword [ebp + 0x10]
mov dword [esi], ebx
jmp 0x1000a14e
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1000a14c
push 0x1370
push 0x345
push 0x1e99
push 0x217f
push 0x19c
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
inc dword [esi]
cmp dword [esi], 2
jle 0x1000a112
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a6c4
Capabilities:
Get file attributes

Disassembly:
mov eax, 0x10055bea
call fcn.100553f0
sub esp, 0x10
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x1000a780
mov dword [ebp - 0x18], 0x5e42
cmp dword [ebp - 0x18], 0x6016
jle 0x1000a72b
xor esi, esi
mov dword [ebp - 0x14], esi
mov edi, esi
mov ebx, 0x2943
xor esi, esi
mov ecx, esi
mov eax, edi
shl eax, cl
mov ecx, 0x1006f038
cdq
push edx
push eax
call fcn.10003f1c
inc esi
cmp esi, 0x4ad5
jl 0x1000a6ff
dec edi
dec ebx
jne 0x1000a6fd
mov esi, dword [ebp - 0x14]
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x6c
jl 0x1000a6f6
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x5e03
jge 0x1000a747
mov edx, str.lrmojq_mhvsfed_actghrqdc_vemuwaefn_zxmhltdmc_qeqz_bfij_ptkotcqqn
mov ecx, 0x1006f038
call fcn.1000567a
mov eax, dword [ebp + 8]
mov dword [eax], 0xffffffec
cmp dword [eax], 0xffffffed
je 0x1000a788
mov ecx, dword [ebp + 0x10]
cmp dword [ecx], 0
jne 0x1000a788
inc dword [eax]
cmp dword [eax], 0xffffffed
jne 0x1000a758
jmp 0x1000a788
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000b222
Capabilities:
Encode data using xor
Get common file path

Disassembly:
mov eax, 0x10055bfe
call fcn.100553f0
sub esp, 0x18
mov byte [ebp - 0x18], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x1000b2ef
mov dword [ebp - 0x1c], 0x32ae
cmp dword [ebp - 0x1c], 0x34c8
jle 0x1000b286
xor esi, esi
xor edi, edi
xor ebx, ebx
mov ecx, ebx
mov eax, edi
shl eax, cl
mov ecx, 0x1006f038
xor eax, esi
cdq
push edx
push eax
call fcn.10003f1c
inc ebx
cmp ebx, 0x2dd4
jl 0x1000b256
inc edi
cmp edi, 0x5421
jl 0x1000b254
inc esi
cmp esi, 0x1a6c
jl 0x1000b252
push 0xe74
push 1
push 0
mov byte [ebp - 0x11], 0
lea ecx, [ebp - 0x11]
push 0x237f
mov edx, 0xbe0
call fcn.10009f1c
and dword [ebp - 4], 0
add esp, 0x10
cmp dword [ebp - 0x1c], 0x3078
jge 0x1000b2c4
mov edx, str.cnwjgmp_zkkgtroc_uhwjlb_lgfpgx_mhcloyote_viuhcfbh_ajka_kvsub_sau_huq_yucniqa_gsx_njs
mov ecx, 0x1006f038
call fcn.1000567a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [ebp - 0x12], 0
cmp byte [ebp - 0x12], 0
je 0x1000b2c4
mov dword [ebp - 0x20], 0x2336
cmp dword [ebp - 0x20], 0x2407
jle 0x1000b34f
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
and dword [ebp - 0x24], 0
mov ebx, esi
mov esi, dword [ebp - 0x24]
mov ecx, edi
sar ebx, cl
mov eax, ebx
mov ecx, 0x1006f038
and eax, esi
cdq
push edx
push eax
call fcn.10003f1c
inc esi
cmp esi, 0x5e48
jl 0x1000b31d
mov esi, dword [ebp - 0x1c]
inc edi
cmp edi, 0x3db9
jl 0x1000b310
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x3638
jl 0x1000b30e
push 0x1798
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x2046
jge 0x1000b2c4
mov edx, str.syiyjk_dmjfeh_mkod
mov ecx, 0x1006f038
call fcn.1000567a
jmp 0x1000b2c4

Function at 0x1000b759
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp byte [ebp + 0x1c], 0
push ebx
push esi
push edi
je 0x1000b7e1
mov dword [ebp - 4], 0x15e2
cmp dword [ebp - 4], 0x171b
jle 0x1000b7b8
xor esi, esi
mov edi, esi
mov ebx, 0x6163
mov eax, edi
lea ecx, [ebp - 0x1c]
cdq
push edx
push eax
call fcn.10002769
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000b798
mov eax, dword [eax]
push eax
call fcn.1003ed0a
pop ecx
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.10001539
dec edi
dec ebx
jne 0x1000b781
inc esi
cmp esi, 0x3a79
jl 0x1000b77a
cmp dword [ebp - 4], 0x15ca
jge 0x1000b7cc
push str.tljesjey_ondyid_ntivqcwuc_gba_ikunil_joju_ahad_vlmiqbacf
call fcn.1003ed0a
pop ecx
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, dword [edx]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
test eax, eax
setg cl
mov dword [edx], ecx
jmp 0x1000b7ec
cmp byte [edx], 0
je 0x1000b7ec
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret