joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100151ff
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005e845
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001524a
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
push 1
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call fcn.1001537a
add esp, 0xc
jmp 0x10015369
lea eax, [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10015279
push 0x50a
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x10015369
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x10015369
mov dword [ebp - 0x20], 0x7cdc
mov dword [ebp - 0x30], str.kaeopmjti_jjlngq_fulig_krtsjyuyp_xeold_dlkwiv_rdxp_yasf
cmp dword [ebp - 0x20], 0x8047
jle 0x10015315
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetSystemMenu]
and dword [ebp - 0x18], 0
jmp 0x100152bc
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x6c47
jge 0x100152ff
and dword [ebp - 0x1c], 0
jmp 0x100152d2
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x4bd5
jge 0x100152fd
mov eax, dword [ebp - 0x18]
cdq
idiv dword [ebp - 0x1c]
mov eax, edx
cdq
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
push dword [ebp - 0x34]
push dword [ebp - 0x38]
mov ecx, 0x100792d8
call fcn.10004ea6
jmp 0x100152cb
jmp 0x100152b5
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_EndDoc]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x7b14
jge 0x10015343
mov edx, dword [ebp - 0x30]
mov ecx, 0x100792d8
call fcn.10008ec9
jmp 0x1001535f
or dword [ebp - 4], 0xffffffff
jmp 0x10015369
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001a048
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
cmp byte [ebp + 8], 0
push ebx
push esi
mov byte [ebp - 4], dl
je 0x1001a14d
cmp byte [ebp + 0x18], 0
je 0x1001a143
mov dword [ebp - 0x18], 0x23e2
cmp dword [ebp - 0x18], 0x27a6
push 0
pop esi
jle 0x1001a10d
mov dword [ebp - 8], esi
mov ebx, esi
mov dword [ebp - 0x14], esi
mov eax, esi
mov dword [ebp - 0x10], esi
mov ecx, eax
mov dword [ebp + 8], ebx
mov eax, ebx
mov edx, esi
mov ebx, dword [ebp - 8]
sar eax, cl
mov dword [ebp - 0xc], edx
mov dword [ebp + 8], eax
mov ecx, edx
shl eax, cl
lea ecx, [ebp - 0x30]
or eax, ebx
cdq
push edx
push eax
call fcn.10001aaa
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001a0ba
mov eax, dword [eax]
push eax
call fcn.10046fe3
pop ecx
push esi
push 1
lea ecx, [ebp - 0x30]
call fcn.100055ae
mov edx, dword [ebp - 0xc]
mov eax, dword [ebp + 8]
inc edx
mov dword [ebp - 0xc], edx
cmp edx, 0x280e
jl 0x1001a09f
mov eax, dword [ebp - 0x10]
mov ebx, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x10], eax
cmp eax, 0x2477
jl 0x1001a08b
inc ebx
mov dword [ebp - 0x14], ebx
cmp ebx, 0xec7
jl 0x1001a086
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, 0x5556
jl 0x1001a081
mov edx, dword [ebp + 0x1c]
mov dword [edx], esi
cmp dword [edx], 1
jge 0x1001a12c
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 1
inc dword [edx]
cmp dword [edx], 1
jl 0x1001a11a
cmp dword [ebp - 0x18], 0x21fe
jge 0x1001a20b
push str.qzwc_nybn_nxvclib_xptw_kivdhgcr
jmp 0x1001a1d4
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
jmp 0x1001a20b
test dl, dl
je 0x1001a1dc
mov eax, dword [ebp + 0x10]
push 0
pop esi
cmp byte [eax], 0
je 0x1001a167
push esi
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
mov dword [ebp - 0x18], 0x4aac
cmp dword [ebp - 0x18], 0x4d63
jle 0x1001a1c6
mov ebx, esi
mov eax, esi
mov dword [ebp + 8], esi
and eax, ebx
lea ecx, [ebp - 0x48]
cdq
push edx
push eax
call fcn.10001aaa
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001a195
mov eax, dword [eax]
push eax
call fcn.10046fe3
pop ecx
push esi
push 1
lea ecx, [ebp - 0x48]
call fcn.100055ae
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
cmp eax, 0x2347
jl 0x1001a17e
inc ebx
cmp ebx, 0x44b9
jl 0x1001a179
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp dword [ebp - 0x18], 0x4966
jge 0x1001a20b
push str.hfaufwr_lymfr_mbq_pnayedntd_yifg_ndbi_yagjnph
call fcn.10046fe3
pop ecx
jmp 0x1001a20b
mov byte [ebp + 0xb], 0
cmp byte [ebp + 0xb], 0
je 0x1001a20b
push 0x11e
push 0x31
push 0x1bbc
push 0xa61
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001a5b3
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005ea0d
call fcn.1005dc20
sub esp, 0x10
push ebx
push esi
mov dword [ebp - 0x14], 0x5dae
mov eax, ecx
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
cmp dword [ebp - 0x14], 0x5e80
mov dword [ebp - 0x1c], eax
jle 0x1001a617
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x18], esi
lea eax, [ebx + edi]
mov ecx, 0x100792d8
xor eax, esi
cdq
push edx
push eax
call fcn.10004ea6
inc esi
cmp esi, 0x513a
jl 0x1001a5e4
inc ebx
push 0
pop esi
cmp ebx, 0x2c4c
jl 0x1001a5e1
inc edi
cmp edi, 0x6212
jl 0x1001a5df
mov eax, dword [ebp - 0x1c]
cmp byte [ebp + 0xc], 0
je 0x1001a628
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
jmp 0x1001a62a
mov dword [eax], esi
mov dword [ebp - 4], esi
cmp dword [ebp - 0x14], 0x5d59
jge 0x1001a645
mov edx, str.hpmpg_lfuvhjerb_slb_twsb_xifliqgbb_ncwuekizl_huyltr_cfi_mrdvc_udcrr_qoc
mov ecx, 0x100792d8
call fcn.10008ec9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001b949
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005ea59
call fcn.1005dc20
sub esp, 0x34
cmp byte [ebp + 0x14], 0
mov eax, ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], dl
mov dword [ebp - 0x24], eax
je 0x1001ba60
mov dword [ebp + 0x14], 0x394
xor esi, esi
cmp dword [ebp + 0x14], 0x4c4
jle 0x1001b9d1
push 0x10d7
push esi
push esi
push 0x1ba1
call dword [sym.imp.USER32.dll_SetWindowsHookExA]
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x20], esi
mov eax, esi
mov ecx, 0x100792d8
xor eax, ebx
or eax, edi
cdq
push edx
push eax
call fcn.10004ea6
inc esi
cmp esi, 0x2117
jl 0x1001b999
inc ebx
push 0
pop esi
cmp ebx, 0x4b64
jl 0x1001b996
inc edi
cmp edi, 0x19be
jl 0x1001b994
push esi
call dword [sym.imp.GDI32.dll_CreateFontIndirectA]
mov dword [ebp - 4], esi
cmp dword [ebp + 0x14], 0x11b
jge 0x1001ba0a
mov edx, str.qjxvk_bptnw_pdhzwyktp
mov ecx, 0x100792d8
call fcn.10008ec9
jmp 0x1001ba0a
cmp byte [ebp + 0x10], 0
je 0x1001ba38
mov edx, dword [ebp + 0x18]
mov dword [edx], esi
cmp dword [edx], 1
jge 0x1001bb0a
mov esi, dword [ebp + 0x20]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x5b57fd54
inc dword [edx]
cmp dword [edx], 1
jl 0x1001ba21
jmp 0x1001bb0a
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1001bb0a
push 1
push esi
push 0x24e5
mov edx, 0x5b71
mov cl, 1
call fcn.1001e5a2
add esp, 0xc
jmp 0x1001bb0a
mov dword [ebp - 0x20], 0xfe7
cmp dword [ebp - 0x20], 0x11b6
jle 0x1001bae2
push 0x21f4
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov edi, esi
mov dword [ebp - 0x1c], esi
mov ebx, edi
mov dword [ebp - 0x18], 0x23c4
mov dword [ebp + 0x14], ebx
mov edi, ebx
mov ebx, 0x56ce
mov eax, edi
lea ecx, [ebp - 0x3c]
cdq
push edx
push eax
call fcn.10001aaa
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001baae
mov eax, dword [eax]
push eax
call fcn.10046fe3
pop ecx
push esi
push 1
lea ecx, [ebp - 0x3c]
call fcn.100055ae
dec edi
dec ebx
jne 0x1001ba97
mov ebx, dword [ebp + 0x14]
dec ebx
dec dword [ebp - 0x18]
mov dword [ebp + 0x14], ebx
jne 0x1001ba90
mov edi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x17ad
jl 0x1001ba84
mov eax, dword [ebp - 0x24]
cmp byte [ebp - 0x14], 0
je 0x1001baf1
mov ecx, dword [eax]
mov eax, dword [ebp + 0x1c]
mov dword [eax], ecx
jmp 0x1001baf6
mov eax, dword [ebp + 0xc]
inc dword [eax]
cmp dword [ebp - 0x20], 0xd22
jge 0x1001bb0a
push str.qokwc_srjuon_lgtyhm_dxzmwmai_nqsammx_ukqpbrrjm_hpojsjskq_utprnscvi_bktyexfxt
call fcn.10046fe3
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001bf0c
Capabilities:
Encode data using xor
Identify system language via api

Disassembly:
mov eax, 0x1005ea63
call fcn.1005dc20
sub esp, 0x24
push ebx
push esi
mov dword [ebp - 0x2c], 0x4324
xor ebx, ebx
cmp dword [ebp - 0x2c], 0x4398
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x30], ecx
jle 0x1001bf93
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], 0x4098
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], 0x706a
mov esi, ebx
mov ebx, dword [ebp - 0x18]
mov eax, ebx
mov ecx, 0x100792d8
xor eax, esi
cdq
push edx
push eax
call fcn.10004ea6
inc esi
cmp esi, 0x54c4
jl 0x1001bf50
mov eax, dword [ebp - 0x20]
add ebx, eax
dec dword [ebp - 0x1c]
push 0
mov dword [ebp - 0x18], ebx
pop ebx
jne 0x1001bf4b
mov esi, dword [ebp - 0x28]
add eax, esi
dec dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
jne 0x1001bf41
inc esi
mov dword [ebp - 0x28], esi
cmp esi, 0x4170
jl 0x1001bf37
mov dword [ebp - 0x24], 0x3a3a
cmp dword [ebp - 0x24], 0x3db2
jle 0x1001bfd1
mov esi, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], 0x5de3
mov eax, ebx
mov ecx, 0x100792d8
cdq
push edx
push eax
call fcn.10004ea6
add ebx, esi
dec dword [ebp - 0x28]
jne 0x1001bfaf
inc esi
push 0
pop ebx
cmp esi, 0x56fd
jl 0x1001bfa5
cmp byte [ebp + 0xc], 0
je 0x1001bff5
mov esi, dword [ebp + 0x10]
mov dword [esi], ebx
jmp 0x1001bfef
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001bfed
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
dec dword [esi]
cmp dword [esi], ebx
jge 0x1001bfde
jmp 0x1001c014
mov edx, dword [ebp + 8]
mov dword [edx], ebx
cmp dword [edx], 4
jge 0x1001c014
mov esi, dword [ebp - 0x30]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfabe4bca
inc dword [edx]
cmp dword [edx], 4
jl 0x1001c002
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x24], 0x385c
jge 0x1001c02f
mov edx, str.oavzeqet_fzpuiskcw_kozjswhv_ysd_btotfiimj_zdjkeu_pgfjluajo_cvvhyyk_zdktvr
mov ecx, 0x100792d8
call fcn.10008ec9
mov dword [ebp - 4], 2
cmp dword [ebp - 0x2c], 0x42b4
jge 0x1001c04e
mov edx, str.zkszidnp_hsxjculfs_ecslkmp_zuasduh_geigowbza_mcgbxtlz_nzjbgesuk_ccbal_asnzbdvy_nwthouxmq_gxnqcqujn_gwqcc
mov ecx, 0x100792d8
call fcn.10008ec9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001c183
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005ea6d
call fcn.1005dc20
sub esp, 0x1c
push ebx
push esi
mov dword [ebp - 0x20], 0x5f2f
mov ebx, edx
cmp dword [ebp - 0x20], 0x5f4f
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x28], ecx
jle 0x1001c204
xor edi, edi
xor esi, esi
mov dword [ebp - 0x1c], esi
mov eax, esi
mov dword [ebp - 0x18], 0x773d
mov dword [ebp - 0x14], eax
mov ebx, eax
mov esi, 0x7ab0
mov eax, ebx
mov ecx, 0x100792d8
xor eax, edi
cdq
push edx
push eax
call fcn.10004ea6
dec ebx
dec esi
jne 0x1001c1c8
mov eax, dword [ebp - 0x14]
dec eax
dec dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
jne 0x1001c1c1
mov esi, dword [ebp - 0x1c]
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x14b1
jl 0x1001c1b5
inc edi
cmp edi, 0x56b2
jl 0x1001c1b0
mov ebx, dword [ebp - 0x24]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x5ddb
jge 0x1001c23f
mov edx, str.szvuamx_ptu_xpfnro_htwyz_bmht
mov ecx, 0x100792d8
call fcn.10008ec9
jmp 0x1001c23f
cmp byte [ebp + 8], 0
je 0x1001c254
cmp byte [ebx], 0
je 0x1001c277
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
jmp 0x1001c277
mov eax, dword [ebp - 0x28]
cmp byte [eax], 0
je 0x1001c277
push 0
push 0
push 0x1db
push 0x26b
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_ScrollWindow]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001cb86
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
test cl, cl
je 0x1001cbd2
cmp byte [ebp + 8], 0
je 0x1001cbb0
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x1001cbf2
push 1
push ecx
mov ecx, 0x51b6
call fcn.1001a5b3
pop ecx
pop ecx
jmp 0x1001cbf2
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x1001cbf2
push 0x50a
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1001cbf2
cmp byte [ebp + 0xc], 0
je 0x1001cbdc
inc dword [edx]
jmp 0x1001cbf2
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x1001cbf2
push 0x1be1
push eax
call dword [sym.imp.USER32.dll_CharLowerBuffW]
mov esp, ebp
pop ebp
ret
Function at 0x1001e5a2
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0xc], 0
je 0x1001e5e2
cmp byte [ebp + 0x10], 0
je 0x1001e5d7
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1001e600
push 0x22df
push 0x10d
push 0x25d
push 0x15f5
push 0
call dword [sym.imp.USER32.dll_SetRect]
pop ebp
ret
mov eax, dword [edx]
mov dword [eax + 0xc], 7
pop ebp
ret
test cl, cl
je 0x1001e5f5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_HideCaret]
pop ebp
ret
push 0xa92
call dword [sym.imp.USER32.dll_GetKeyState]
pop ebp
ret

Function at 0x1001e602
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005eaf6
call fcn.1005dc20
sub esp, 0x38
push ebx
push esi
mov byte [ebp - 0x18], dl
mov dword [ebp - 0x28], 0x6876
cmp dword [ebp - 0x28], 0x6b8c
push edi
mov dword [ebp - 0x10], esp
jle 0x1001e680
xor edi, edi
xor esi, esi
mov dword [ebp - 0x20], esi
mov ebx, esi
mov esi, 0x7838
mov ecx, ebx
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0x40]
cdq
push edx
push eax
call fcn.10001aaa
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001e651
mov eax, dword [eax]
push eax
call fcn.10046fe3
pop ecx
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.100055ae
dec ebx
dec esi
jne 0x1001e636
mov esi, dword [ebp - 0x20]
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x6e9f
jl 0x1001e62f
inc edi
cmp edi, 0x6daf
jl 0x1001e62a
cmp byte [ebp - 0x18], 0
je 0x1001e749
mov dword [ebp - 0x24], 0x210a
cmp dword [ebp - 0x24], 0x24e4
jle 0x1001e6ee
push 0xd71
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
xor edi, edi
xor esi, esi
mov dword [ebp - 0x20], esi
mov ebx, esi
mov esi, 0x1f10
mov eax, ebx
mov ecx, 0x100792d8
xor eax, edi
cdq
push edx
push eax
call fcn.10004ea6
dec ebx
dec esi
jne 0x1001e6c1
mov esi, dword [ebp - 0x20]
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x6c1f
jl 0x1001e6ba
inc edi
cmp edi, 0x2cfc
jl 0x1001e6b5
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x2044
jge 0x1001e70a
mov edx, str.qhevsg_ady_orekm_edwgx_rdzd_kqnc_wpmrtpi_svp_wkdupxtsf_oiaxdocl_wjpc_lphdfjlqr_ircmpbfg
mov ecx, 0x100792d8
call fcn.10008ec9
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x1001e764
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 4
inc dword [edx]
cmp dword [edx], 3
jl 0x1001e71b
jmp 0x1001e764
mov byte [ebp - 0x19], 0
cmp byte [ebp - 0x19], 0
je 0x1001e764
push ecx
push ecx
push 0x5965
xor dl, dl
call fcn.1001a952
add esp, 0xc
cmp dword [ebp - 0x28], 0x682a
jge 0x1001e778
push str.xdj_xewj_bau
call fcn.10046fe3
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10022d8c
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005ece1
call fcn.1005dc20
sub esp, 0x2c
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x10022e6a
cmp byte [ecx], 0
je 0x10022e4b
mov dword [ebp - 0x18], 0xf58
cmp dword [ebp - 0x18], 0x12c9
jle 0x10022e22
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
mov dword [ebp + 8], edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov eax, edx
mov dword [ebp - 0x1c], eax
mov esi, eax
xor edi, edi
and esi, ebx
mov eax, esi
mov ecx, 0x100792d8
xor eax, edi
cdq
push edx
push eax
call fcn.10004ea6
inc edi
cmp edi, 0x4133
jl 0x10022dde
mov eax, dword [ebp - 0x1c]
inc ebx
cmp ebx, 0x2a95
jl 0x10022dd8
mov edi, dword [ebp + 8]
mov esi, dword [ebp - 0x14]
inc edi
mov dword [ebp + 8], edi
cmp edi, 0x3b86
jl 0x10022dcc
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x6a5c
jl 0x10022dc7
push 0x1be1
push 0
call dword [sym.imp.USER32.dll_CharLowerBuffW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0xdda
jge 0x10022e4b
mov edx, str.udzmiypvu_zzlxbkew_pboyjgk_pgnv_hqgislz_pjeooxya_irjwg_mno_jtg_jopfdhwkz_mrsgum
mov ecx, 0x100792d8
call fcn.10008ec9
jmp 0x10022ee1
cmp byte [edx], 0
je 0x10022ee1
mov dword [ebp + 8], 0x5cd9
cmp dword [ebp + 8], 0x5ecf
jle 0x10022ec0
xor esi, esi
xor edi, edi
lea eax, [edi + esi]
cdq
lea ecx, [ebp - 0x34]
push edx
push eax
call fcn.10001aaa
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10022e9b
mov eax, dword [eax]
push eax
call fcn.10046fe3
pop ecx
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.100055ae
inc edi
cmp edi, 0x477c
jl 0x10022e83
inc esi
cmp esi, 0x478
jl 0x10022e81
push 0x13b9
push 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
cmp dword [ebp + 8], 0x5961
jge 0x10022ee1
push str.xjvdddr_ozq_gmo_zkccu_zwiqrkb
call fcn.10046fe3
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10022f9a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005eceb
call fcn.1005dc20
sub esp, 0x2c
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], cl
je 0x10022ff5
cmp byte [ebp + 0xc], 0
je 0x10022fdc
and dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
mov ecx, edx
call fcn.10026242
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0xe99
push 0
push 0x1e7
push 0x4b1
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
jmp 0x10022fcb
test cl, cl
je 0x10023004
mov eax, dword [ebp + 0x14]
push 0xb
pop ecx
mov word [eax], cx
jmp 0x10022fcb
mov edi, dword [ebp + 0x18]
xor esi, esi
mov dword [edi], esi
cmp dword [edi], 3
jg 0x100230d5
mov dword [ebp + 8], 0xbacc5d9b
mov dword [ebp + 8], 9
mov dword [ebp + 8], 3
cmp dword [ebp + 8], esi
jl 0x100230cb
mov dword [ebp - 0x1c], 0xfffffffd
mov dword [ebp - 0x1c], 0xfffffffa
mov dword [ebp - 0x1c], 0x7c43
cmp dword [ebp - 0x1c], 0x7cb9
jle 0x100230a6
mov ebx, esi
mov edi, esi
mov ecx, esi
mov dword [ebp - 0x18], esi
lea eax, [edi + ebx]
and eax, ecx
lea ecx, [ebp - 0x38]
cdq
push edx
push eax
call fcn.10001aaa
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10023073
mov eax, dword [eax]
push eax
call fcn.10046fe3
pop ecx
push esi
push 1
lea ecx, [ebp - 0x38]
call fcn.100055ae
mov ecx, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x3f91
jl 0x10023059
inc edi
cmp edi, 0x5540
jl 0x10023054
inc ebx
cmp ebx, 0x4304
jl 0x10023052
mov eax, dword [ebp + 0x10]
inc dword [eax]
cmp dword [ebp - 0x1c], 0x7b56
jge 0x100230bf
push str.bptwshs_zepqp_horp_sancdcwvk
call fcn.10046fe3
pop ecx
or dword [ebp - 4], 0xffffffff
dec dword [ebp + 8]
jmp 0x10023029
mov edi, dword [ebp + 0x18]
inc dword [edi]
jmp 0x1002300b
mov dword [ebp - 0x1c], 0x2a03
cmp dword [ebp - 0x1c], 0x2c25
jle 0x1002312b
mov edi, esi
mov dword [ebp + 8], esi
mov ebx, esi
mov dword [ebp - 0x20], esi
mov esi, ebx
and esi, edi
mov edi, dword [ebp - 0x20]
mov eax, esi
mov ecx, 0x100792d8
xor eax, edi
cdq
push edx
push eax
call fcn.10004ea6
inc edi
cmp edi, 0x7df8
jl 0x100230f6
mov edi, dword [ebp + 8]
inc ebx
push 0
pop esi
cmp ebx, 0x61dc
jl 0x100230ec
inc edi
mov dword [ebp + 8], edi
cmp edi, 0x343a
jl 0x100230ea
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x27d3
jge 0x10022fcb
mov edx, str.bfjaxoqzm_tkac_wntstude_kpsnqzk_vda_hptqimig_mdzx_tweax_dtyje_gbzre_rjbokxc_ggqulipkt_ogmozonmh
mov ecx, 0x100792d8
call fcn.10008ec9
jmp 0x10022fcb
Function at 0x10023d89
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0x14], 0
mov byte [ebp - 4], dl
je 0x10023db0
test dl, dl
je 0x10023da7
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x10023df5
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax]
add dword [ecx], eax
jmp 0x10023df5
cmp byte [ebp + 0x18], 0
je 0x10023dd0
push 0x50a
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x10023df5
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 4
jge 0x10023df5
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfabe4bca
inc dword [edx]
cmp dword [edx], 4
jl 0x10023de2
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10026051
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005ee52
call fcn.1005dc20
sub esp, 0x2c
and dword [ebp - 0x2c], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x28], ecx
xor ebx, ebx
inc ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], 0x1333
cmp dword [ebp - 0x1c], 0x1716
jle 0x100260e6
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x14], edi
xor ebx, ebx
mov eax, edi
and dword [ebp - 0x20], 0
cdq
mov edi, esi
idiv ebx
mov esi, dword [ebp - 0x20]
mov ecx, edx
sar edi, cl
mov eax, edi
mov ecx, 0x100792d8
xor eax, esi
cdq
push edx
push eax
call fcn.10004ea6
inc esi
cmp esi, 0x19f1
jl 0x100260a2
mov esi, dword [ebp - 0x18]
inc ebx
mov edi, dword [ebp - 0x14]
cmp ebx, 0x581c
jl 0x10026090
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x2d7b
jl 0x1002608e
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x1ed5
jl 0x10026089
xor ebx, ebx
inc ebx
push 0x100262dd
push fcn.100180e7
push ebx
push 0xc
lea eax, [ebp - 0x38]
push eax
call fcn.10047130
mov byte [ebp - 4], 3
cmp dword [ebp - 0x1c], 0x11b3
jge 0x10026137
mov edx, str.doyokx_jhnl_nsjlbz_csts_mko_hypapzkwj
mov ecx, 0x100792d8
call fcn.10008ec9
jmp 0x10026137
sub esp, 0xc
mov dword [ebp - 4], 2
lea eax, [ebp + 8]
mov ecx, esp
lea esi, [ebp - 0x38]
push eax
call fcn.10026199
mov ecx, dword [ebp - 0x24]
mov edx, esi
call fcn.10023e60
mov ecx, dword [ebp - 0x28]
add esp, 0xc
mov eax, esi
push eax
call fcn.10026297
push 0x100262dd
push ebx
push 0xc
mov eax, esi
mov dword [ebp - 0x2c], ebx
push eax
mov byte [ebp - 4], bl
call fcn.10046d9b
lea ecx, [ebp + 8]
call fcn.10026397
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10027d0e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
test cl, cl
je 0x10027d34
cmp byte [edx], 0
je 0x10027d55
push 0x50a
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
pop ebp
ret
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x10027d55
push 0xebb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
pop ebp
ret