joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005f80
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100546a6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100060d1
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x100060bb
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x24], 0x35a3
mov dword [ebp - 0x3c], str.wolj_jfu_ucz_zcmawhtyr_sjab_bykxxcqw
cmp dword [ebp - 0x24], 0x3667
jle 0x10006061
and dword [ebp - 0x18], 0
jmp 0x10006004
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x52f0
jge 0x10006061
and dword [ebp - 0x1c], 0
jmp 0x1000601a
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x7f4
jge 0x1000605f
and dword [ebp - 0x20], 0
jmp 0x10006030
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x38c1
jge 0x1000605d
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
sar eax, cl
cdq
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], edx
push dword [ebp - 0x64]
push dword [ebp - 0x68]
mov ecx, 0x1006d158
call fcn.100021b6
jmp 0x10006029
jmp 0x10006013
jmp 0x10005ffd
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x3324
jge 0x10006081
mov edx, dword [ebp - 0x3c]
mov ecx, 0x1006d158
call fcn.100037d8
jmp 0x1000609d
or dword [ebp - 4], 0xffffffff
jmp 0x100060a7
mov eax, dword [ebp - 0x40]
mov dword [eax], 6
mov eax, dword [ebp - 0x44]
mov dword [eax], 6
jmp 0x100060cf
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x100060cf
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x10006125
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x58], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x10006101
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
and dword [eax], 0
jmp 0x10006125
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
movzx eax, byte [eax]
test eax, eax
je 0x10006125
push 0x6b6d
push 0
call fcn.100066e9
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100061e4
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1000620c
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 1
push 0x67e0
call fcn.1000626b
add esp, 0xc
jmp 0x10006267
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10006249
push 0
push 0x21df
push 0x1766
push 0x2214
push 0x59
push 0xfe6
push 0x17f1
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x10006267
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10006267
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
mov esp, ebp
pop ebp
ret

Function at 0x10006700
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1000674f
lea eax, [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10006738
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov byte [eax], 1
jmp 0x1000674d
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogParamA]
jmp 0x10006771
lea eax, [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10006769
push 0
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
jmp 0x10006771
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esp, ebp
pop ebp
ret
Function at 0x10015e41
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
mov byte [esp + 8], cl
push ebx
push esi
mov esi, edx
mov dword [esp + 0x18], esi
push edi
test cl, cl
je 0x10015eed
mov dword [esp + 0x18], 0x5a51
cmp dword [esp + 0x18], 0x5c4c
push 0
pop ebx
jle 0x10015ec3
call dword [sym.imp.KERNEL32.dll_GetACP]
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
sar eax, cl
lea ecx, [esp + 0x20]
cdq
push edx
push eax
call fcn.10001311
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10015e9a
mov eax, dword [eax]
push eax
call fcn.1003bcd0
pop ecx
push ebx
push 1
lea ecx, [esp + 0x28]
call fcn.10001623
inc edi
cmp edi, 0x5599
jl 0x10015e7e
inc esi
cmp esi, 0x6f2c
jl 0x10015e7c
mov esi, dword [esp + 0x1c]
cmp dword [esp + 0x18], 0x57e7
jge 0x10015ed8
push str.dttc_uhptx_qsxo_rduuji_xym_dewd_madbrr_yzuf_becgfvl_etw_xidibgv
call fcn.1003bcd0
pop ecx
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebp + 0x10]
mov eax, dword [eax]
mov dword [ecx], eax
cmp dword [ecx], ebx
je 0x10015ee9
xor ebx, ebx
inc ebx
mov dword [esi], ebx
jmp 0x10015f00
xor ebx, ebx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x10015f00
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100160c3
Capabilities:
Allocate thread local storage
Encode data using xor

Disassembly:
mov eax, 0x100548d7
call fcn.10053f54
sub esp, 0x10
cmp byte [ebp + 0x14], 0
mov eax, edx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x14], cl
je 0x1001611b
test cl, cl
je 0x10016101
mov byte [ebp + 0x17], 0
cmp byte [ebp + 0x17], 0
je 0x100161d5
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x100161d5
xor ebx, ebx
mov byte [ebp + 0x17], bl
cmp byte [ebp + 0x17], bl
je 0x100161d5
push ebx
call dword [sym.imp.GDI32.dll_CreateSolidBrush]
jmp 0x100161d5
cmp byte [ebp + 8], 0
je 0x100161cd
mov dword [ebp + 0x14], 0x26fb
xor ebx, ebx
cmp dword [ebp + 0x14], 0x295d
jle 0x10016180
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x18], ebx
lea eax, [ebx + edi]
mov ecx, 0x1006d158
xor eax, esi
cdq
push edx
push eax
call fcn.100021b6
inc ebx
cmp ebx, 0x5950
jl 0x1001613e
inc edi
push 0
pop ebx
cmp edi, 0x4970
jl 0x1001613b
inc esi
cmp esi, 0x3d31
jl 0x10016139
push ebx
push ebx
push 0x1aec
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, dword [ebp - 0x1c]
cmp byte [eax], 0
je 0x10016196
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push ebx
push ebx
call dword [sym.imp.USER32.dll_CreateDialogParamA]
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x14], 0x237e
jge 0x100161b1
mov edx, str.dudlfmum_dngistgj_jub_mgymwjl_obgwxw_chyobs_nchogoarh_xtatc_fpn_senbvda_hdbdecjji_pilypiuu
mov ecx, 0x1006d158
call fcn.100037d8
jmp 0x100161d5
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10016e11
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
mov byte [esp], dl
push esi
mov esi, ecx
push edi
test dl, dl
je 0x10016e9d
mov dword [esp + 0xc], 0x2ecf
cmp dword [esp + 0xc], 0x30e6
jle 0x10016e7b
xor esi, esi
xor edi, edi
mov eax, edi
lea ecx, [esp + 0x20]
or eax, esi
cdq
push edx
push eax
call fcn.10001311
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10016e55
mov eax, dword [eax]
push eax
call fcn.1003bcd0
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.10001623
inc edi
cmp edi, 0xbfe
jl 0x10016e3b
inc esi
cmp esi, 0x1546
jl 0x10016e39
push 0x17ad
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
cmp dword [esp + 0xc], 0x2c82
jge 0x10016ed4
push str.bld_pccjy_xofnxz
call fcn.1003bcd0
pop ecx
jmp 0x10016ed4
mov ecx, dword [ebp + 8]
mov dword [ecx], 0
cmp dword [ecx], 0x1a
jle 0x10016ed4
mov edx, 0x5764361a
mov dword [esp + 0x10], edx
mov dword [esp + 0x14], edx
mov dword [esp + 0x18], edx
mov dword [esp + 0x1c], edx
cmp dword [esp + 0x1c], 0
jne 0x10016ed4
mov eax, dword [esp + 0x1c]
mov dword [esi], eax
inc dword [ecx]
cmp dword [ecx], 0x1a
jg 0x10016eb0
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10016eda
Capabilities:
Get file attributes

Disassembly:
mov eax, 0x100548ff
call fcn.10053f54
sub esp, 0x10
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], edi
mov byte [ebp - 0x14], cl
je 0x10016f92
cmp byte [ebp + 0x10], 0
je 0x10016f82
mov dword [ebp + 0xc], 0x3667
cmp dword [ebp + 0xc], 0x3998
jle 0x10016f3e
xor esi, esi
xor ebx, ebx
mov edi, 0xb0b
mov eax, ebx
mov ecx, 0x1006d158
cdq
push edx
push eax
call fcn.100021b6
add ebx, esi
dec edi
jne 0x10016f1e
inc esi
cmp esi, 0x302a
jl 0x10016f17
mov edi, dword [ebp - 0x18]
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0x34f0
jge 0x10016f79
mov edx, str.vdunvd_vytfokqqk_pkmss_qkumpodg_zgpshthm_uwmgbpkr_zctxludvy_rpzmap_vxewbcipa_scegl_uuq_bujriyv
mov ecx, 0x1006d158
call fcn.100037d8
jmp 0x10016f79
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov dword [edi], eax
jmp 0x10016fb3
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10016fb3
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
jmp 0x10016fb3
push 0
test cl, cl
je 0x10016fad
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
push 0
push 0
call dword [sym.imp.USER32.dll_CreateDialogParamA]
jmp 0x10016fb3
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100172c4
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov byte [ebp - 4], dl
test dl, dl
je 0x10017335
mov dword [ebp - 8], 0
mov dword [ebp - 0xc], 0xafe01bd9
mov dword [ebp - 0xc], 0xdae8c9f3
mov dword [ebp - 0xc], 0x6092
mov dword [ebp - 0xc], 0xfffffffb
mov dword [ebp - 0xc], 3
mov dword [ebp - 8], 0xfffffff3
jmp 0x1001732d
lea eax, [ebp - 0x10]
mov dword [ebp - 0x10], 5
push eax
push ecx
push 0x4285
mov dword [ebp - 0x14], 0x735e4b78
xor dl, dl
push ecx
call fcn.1001737e
add esp, 0x10
dec dword [ebp - 0xc]
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x15
jne 0x10017304
jmp 0x1001735a
push 0
push 0x21df
push 0x1766
push 0x2214
push 0x59
push 0xfe6
push 0x17f1
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov esp, ebp
pop ebp
ret

Function at 0x100180ba
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005493b
call fcn.10053f54
sub esp, 0x14
mov byte [ebp - 0x18], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10018114
mov esi, dword [ebp + 0x1c]
mov dword [esi], 0
jmp 0x1001810a
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x10018108
push 0x51d0
push ecx
push 0x199f
push 0
push 0x437f
mov ecx, 0x57c0
call fcn.1001832c
add esp, 0x14
inc dword [esi]
cmp dword [esi], 0
jle 0x100180df
jmp 0x10018194
mov dword [ebp - 0x20], 0x3c8b
cmp dword [ebp - 0x20], 0x3d35
jle 0x1001816e
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov eax, ebx
sar eax, cl
mov ecx, 0x1006d158
and eax, edi
xor eax, esi
cdq
push edx
push eax
call fcn.100021b6
mov ecx, dword [ebp - 0x1c]
inc ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x482e
jl 0x1001812f
inc ebx
cmp ebx, 0x653e
jl 0x1001812a
inc edi
cmp edi, 0x45cc
jl 0x10018128
inc esi
cmp esi, 0x3950
jl 0x10018126
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x3c71
jge 0x1001818a
mov edx, str.azr_kxvdybd_nyleberer
mov ecx, 0x1006d158
call fcn.100037d8
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001832c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov edi, ecx
je 0x1001839c
mov eax, dword [ebp + 8]
mov ebx, dword [ebp + 0x10]
mov ecx, ebx
push edi
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
lea eax, [ebp - 4]
push eax
call fcn.1001cb59
mov esi, dword [ebp - 4]
cmp esi, dword [ebx]
je 0x1001836a
mov eax, dword [edi]
cmp eax, dword [esi + 0x10]
jge 0x1001838e
push ecx
lea eax, [ebp - 4]
mov dword [ebp - 4], edi
push eax
push ecx
mov ecx, ebx
call fcn.1001edc1
push eax
add eax, 0x10
mov ecx, ebx
push eax
push esi
lea eax, [ebp - 4]
push eax
call fcn.1001edf1
mov esi, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [esi + 0x18], eax
jmp 0x100183a9
push 0x936
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100183e4
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
cmp byte [ebp + 0x18], 0
push ebx
push esi
je 0x10018444
cmp byte [ebp + 0x14], 0
je 0x1001840e
mov eax, dword [ebp + 0x24]
cmp byte [eax], 0
je 0x1001848d
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x1001848d
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [esi], 1
jmp 0x1001843e
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], bl
je 0x1001843c
push 1
push 0x212d
push ebx
mov dl, 1
mov ecx, 0x4ff4
call fcn.10016b7b
add esp, 0xc
dec dword [esi]
cmp dword [esi], ebx
jge 0x1001841b
jmp 0x1001848d
cmp byte [ebp + 0x1c], 0
je 0x10018486
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
inc dword [esi]
test eax, eax
jne 0x1001847e
mov eax, dword [esi]
mov ecx, dword [ebp + 0x10]
mov dword [edx], eax
xor edx, edx
mov eax, dword [ecx]
mov dword [ecx], eax
mov ecx, dword [ecx]
mov eax, dword [esi]
cmp ecx, eax
setg dl
xor eax, eax
cmp edx, 0x54fd
setl al
cmp eax, dword [esi]
jg 0x1001847e
xor ecx, ecx
jmp 0x10018481
xor ecx, ecx
inc ecx
mov eax, dword [ebp + 0x20]
jmp 0x1001848b
mov ecx, dword [ecx]
mov eax, dword [ebp + 0x28]
mov dword [eax], ecx
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100234e4
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10054c6e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10023631
lea eax, [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0x62e9
mov dword [ebp - 0x2c], str.iww_mns_flflkc_wjf_hkmjj_asrk_tpg_fve_clvgnpiab_hhol
cmp dword [ebp - 0x24], 0x666e
jle 0x100235b6
and dword [ebp - 0x14], 0
jmp 0x10023540
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x195c
jge 0x100235b6
and dword [ebp - 0x18], 0
jmp 0x10023556
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x15af
jge 0x100235b4
and dword [ebp - 0x1c], 0
jmp 0x1002356c
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x6a2
jge 0x100235b2
and dword [ebp - 0x20], 0
jmp 0x10023582
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xd74
jge 0x100235b0
mov eax, dword [ebp - 0x14]
and eax, dword [ebp - 0x18]
and eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
push dword [ebp - 0x44]
push dword [ebp - 0x48]
mov ecx, 0x1006d158
call fcn.100021b6
jmp 0x1002357b
jmp 0x10023565
jmp 0x1002354f
jmp 0x10023539
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x100235e7
push 0
push 0x21df
push 0x1766
push 0x2214
push 0x59
push 0xfe6
push 0x17f1
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x100235ef
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x5f94
jge 0x10023609
mov edx, dword [ebp - 0x2c]
mov ecx, 0x1006d158
call fcn.100037d8
jmp 0x10023625
or dword [ebp - 4], 0xffffffff
jmp 0x1002362f
jmp 0x10023672
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push 0
push dword [ebp - 0x38]
push 0x68a6
push 0xe39
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
call fcn.10029fcb
add esp, 0x20
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10025404
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10054d2a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10025537
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1002552b
mov dword [ebp - 0x20], 0x280b
mov dword [ebp - 0x2c], str.mjufrcmti_tejfxuszm_ajlo_murybgtqo_elzyxpyhp_mtpjvdkkf
cmp dword [ebp - 0x20], 0x2928
jle 0x100254e7
and dword [ebp - 0x14], 0
jmp 0x1002546e
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x1a9
jge 0x100254e7
and dword [ebp - 0x18], 0
jmp 0x10025484
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x3160
jge 0x100254e5
and dword [ebp - 0x1c], 0
jmp 0x1002549a
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x4f54
jge 0x100254e3
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
shl eax, cl
mov ecx, dword [ebp - 0x1c]
shl eax, cl
cdq
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
push dword [ebp - 0x34]
push dword [ebp - 0x38]
lea ecx, [ebp - 0x50]
call fcn.10001311
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
call fcn.1000150b
push eax
call fcn.1003bcd0
pop ecx
lea ecx, [ebp - 0x50]
call fcn.10001501
jmp 0x10025493
jmp 0x1002547d
jmp 0x10025467
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x248a
jge 0x10025503
push dword [ebp - 0x2c]
call fcn.1003bcd0
pop ecx
jmp 0x1002551f
or dword [ebp - 4], 0xffffffff
jmp 0x10025529
jmp 0x10025535
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
jmp 0x1002554f
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x30]
push 0
push 0x49f8
call fcn.10027d53
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100280a3
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100280cb
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
push 0x59cf
push 1
push dword [ebp - 8]
call fcn.10028107
add esp, 0xc
jmp 0x10028103
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x100280ea
push 0x936
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x10028103
mov byte [ebp - 1], 0
push 0
push 0x4d59
push 1
lea eax, [ebp - 1]
push eax
call fcn.10022db7
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x10029e55
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10029f0f
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10029ed2
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x24]
push eax
mov ecx, dword [ebp - 0x28]
call fcn.1002a74f
mov ecx, dword [ebp - 0x2c]
mov cx, word [ecx]
mov word [eax], cx
jmp 0x10029f0d
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x10029f0d
push 0
push 0x21df
push 0x1766
push 0x2214
push 0x59
push 0xfe6
push 0x17f1
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x10029f36
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
push 0x67d1
push 1
push dword [ebp - 0x3c]
push 0x24aa
push 0x7cfb
push 0x5ae4
call fcn.10022fe5
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x1002b058
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10054e93
call fcn.10053f54
sub esp, 0x18
mov byte [ebp - 0x14], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x1002b112
mov dword [ebp - 0x20], 0x3f3b
cmp dword [ebp - 0x20], 0x429a
jle 0x1002b0d4
xor esi, esi
mov dword [ebp - 0x1c], esi
mov ebx, esi
mov dword [ebp - 0x18], 0x1031
xor edi, edi
xor esi, esi
mov ecx, esi
mov eax, edi
sar eax, cl
mov ecx, 0x1006d158
xor eax, ebx
cdq
push edx
push eax
call fcn.100021b6
inc esi
cmp esi, 0x3dfc
jl 0x1002b098
inc edi
cmp edi, 0x6752
jl 0x1002b096
dec ebx
dec dword [ebp - 0x18]
jne 0x1002b094
mov esi, dword [ebp - 0x1c]
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x64e
jl 0x1002b08b
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x3f31
jge 0x1002b0f0
mov edx, str.dddyq_anvuof_aufxfus_jhady_akg
mov ecx, 0x1006d158
call fcn.100037d8
mov eax, dword [ebp + 0x10]
and dword [eax], 0
jmp 0x1002b119
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002b2dd
Capabilities:
Create pipe
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov byte [ebp - 8], dl
test dl, dl
je 0x1002b318
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x1002b320
push eax
push 0x21df
push 0x1766
push 0x2214
push 0x59
push 0xfe6
push 0x17f1
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x1002b320
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov esp, ebp
pop ebp
ret

Function at 0x1002b49f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
test dl, dl
je 0x1002b4c4
cmp byte [ebp + 0x10], 0
je 0x1002b4bd
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
dec dword [eax]
jmp 0x1002b4b9
cmp byte [ebp + 0x14], 0
je 0x1002b4de
cmp byte [ecx], 0
je 0x1002b4b9
sub esp, 0xc
xor dl, dl
call fcn.1002b2dd
add esp, 0xc
jmp 0x1002b4b9
push 0x1df4
call dword [sym.imp.KERNEL32.dll_ExitProcess]