joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001b19c
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
mov byte [esp + 4], cl
push ebx
push esi
push edi
test dl, dl
je 0x1001b360
mov dword [esp + 0x20], 0x1a97
cmp dword [esp + 0x20], 0x849
jge 0x1001b31b
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x3c]
push eax
lea eax, [esp + 0x38]
push eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x60]
push eax
lea eax, [esp + 0x54]
push eax
push str._lld__lld__lld__lld__lld__lld
call fcn.1004835b
mov eax, dword [esp + 0x44]
add esp, 0x1c
sub eax, dword [esp + 0x40]
mov edi, dword [esp + 0x38]
mov esi, dword [esp + 0x3c]
mov ecx, dword [esp + 0x48]
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x2c]
sbb eax, dword [esp + 0x44]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x30]
sub eax, dword [esp + 0x50]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x34]
sbb eax, dword [esp + 0x54]
sub edi, dword [esp + 0x28]
mov dword [esp + 0x14], eax
sbb esi, dword [esp + 0x2c]
sub ecx, dword [esp + 0x30]
mov eax, dword [esp + 0x4c]
sbb eax, dword [esp + 0x34]
push eax
push ecx
push eax
push ecx
mov byte [esp + 0x1f], 1
call fcn.1004c770
push esi
push edi
push esi
push edi
mov ebx, eax
mov dword [esp + 0x34], edx
call fcn.1004c770
mov ecx, dword [esp + 0x14]
add ebx, eax
mov eax, dword [esp + 0x18]
mov edi, dword [esp + 0x24]
push ecx
push eax
push ecx
push eax
adc edi, edx
call fcn.1004c770
mov ecx, dword [esp + 0x1c]
mov esi, eax
mov eax, dword [esp + 0x20]
push ecx
push eax
push ecx
push eax
mov dword [esp + 0x34], edx
call fcn.1004c770
add esi, eax
mov eax, dword [esp + 0x24]
adc eax, edx
cmp esi, ebx
jne 0x1001b2a2
cmp eax, edi
je 0x1001b2a6
xor bl, bl
jmp 0x1001b2aa
mov bl, byte [esp + 0xf]
push dword [esp + 0x14]
mov eax, dword [esp + 0x3c]
sub eax, dword [esp + 0x44]
push dword [esp + 0x1c]
mov ecx, dword [esp + 0x44]
sbb ecx, dword [esp + 0x4c]
push ecx
push eax
call fcn.1004c770
push dword [esp + 0x1c]
mov ecx, dword [esp + 0x50]
mov edi, eax
mov eax, dword [esp + 0x4c]
mov esi, edx
sub eax, dword [esp + 0x54]
push dword [esp + 0x24]
sbb ecx, dword [esp + 0x5c]
push ecx
push eax
call fcn.1004c770
cmp eax, edi
jne 0x1001b2f4
cmp edx, esi
je 0x1001b303
neg edi
adc esi, 0
neg esi
cmp eax, edi
jne 0x1001b305
cmp edx, esi
jne 0x1001b305
xor bl, bl
test bl, bl
mov ecx, 0x1006d928
mov eax, 0x1006d924
cmove eax, ecx
push eax
call fcn.10048d88
pop ecx
cmp byte [ebp + 0x14], 0
je 0x1001b330
push ecx
push ecx
push dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
call fcn.10017d4a
jmp 0x1001b382
mov edi, dword [ebp + 0x1c]
mov esi, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x18]
mov eax, dword [edi + 4]
sub eax, dword [edi]
sar eax, 2
mov dword [esi], eax
jmp 0x1001b35a
and dword [esp + 0x24], 0
lea eax, [esp + 0x24]
push eax
mov ecx, edi
call fcn.1001ce26
inc dword [esi]
mov eax, dword [esi]
cmp eax, dword [ebx]
jl 0x1001b345
jmp 0x1001b382
test cl, cl
je 0x1001b37a
xor eax, eax
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], al
je 0x1001b382
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x1001b382
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001f6a4
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100628e1
call fcn.10061438
sub esp, 0x28
mov dword [ebp - 0x18], 0xb90d
push ebx
mov dword [ebp - 0x18], 0xb13638ec
mov dword [ebp - 0x18], 0x2906c902
push esi
mov dword [ebp - 0x18], 0x7c7
cmp dword [ebp - 0x18], 0x808
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], ecx
jle 0x1001f728
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
lea eax, [ebx + edi]
shl eax, cl
mov ecx, 0x1007fdb8
xor eax, esi
cdq
push edx
push eax
call fcn.1000e5de
mov ecx, dword [ebp - 0x14]
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x4d18
jl 0x1001f6ea
inc ebx
cmp ebx, 0x6030
jl 0x1001f6e5
inc edi
cmp edi, 0x63b3
jl 0x1001f6e3
inc esi
cmp esi, 0x55cd
jl 0x1001f6e1
mov dword [ebp - 0x14], 0
jmp 0x1001f73f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x34], 0xed23b618
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001f731
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x451
jge 0x1001f761
mov edx, str.ogbmdw_krppdzkl_lxyjctnxd_usbnjlz_zwwirymzt_xrbedctoz_wylymqyl_ttrfeizn_yboewl_jbtw_hythw
mov ecx, 0x1007fdb8
call fcn.100113ff
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], 0
jmp 0x1001f796
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x28], 0xfffffffa
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 2
jl 0x1001f788
mov dword [ebp - 0x14], 0
jmp 0x1001f7b3
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x1c], 0x722ba7b7
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 1
jl 0x1001f7a5
push dword [ebp - 0x20]
inc dword [ebp - 0x1c]
push 0x10417
push 0xfca9
call fcn.10035d0f
pop ecx
pop ecx
call eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001f826
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x44
push ebx
mov dword [ebp - 0xc], 0x669
mov ebx, ecx
cmp dword [ebp - 0xc], 0x75d
push esi
push edi
mov dword [ebp - 0x10], ebx
jle 0x1001f8a8
xor esi, esi
xor edi, edi
mov ecx, edi
mov eax, esi
shl eax, cl
lea ecx, [ebp - 0x28]
cdq
push edx
push eax
call fcn.10001a7f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001f863
mov eax, dword [eax]
push eax
call fcn.10048643
pop ecx
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.1000f099
inc edi
cmp edi, 0x514a
jl 0x1001f848
inc esi
cmp esi, 0x2b39
jl 0x1001f846
push 0
push 0x1a
push 0x2113
push 0x1f72
push 0x2703
push 0x25ec
push 0
call dword [sym.imp.USER32.dll_TrackPopupMenu]
cmp byte [ebp + 0xc], 0
je 0x1001f947
mov dword [ebp - 8], 0x1e0f
cmp dword [ebp - 8], 0x20c3
jle 0x1001f92a
xor esi, esi
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 4], eax
lea ecx, [eax + ebx]
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0x40]
or eax, esi
cdq
push edx
push eax
call fcn.10001a7f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001f8eb
mov eax, dword [eax]
push eax
call fcn.10048643
pop ecx
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.1000f099
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, 0x7037
jl 0x1001f8cd
inc ebx
cmp ebx, 0x2948
jl 0x1001f8c8
inc edi
cmp edi, 0x4a30
jl 0x1001f8c6
inc esi
cmp esi, 0x6180
jl 0x1001f8c4
mov ebx, dword [ebp - 0x10]
cmp dword [ebp - 8], 0x1d0a
jge 0x1001f93e
push str.flggj_fohb_nnm_sseukf_kqqrofo
call fcn.10048643
pop ecx
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
sub dword [ebx], eax
jmp 0x1001f952
push 0x257d
call dword [sym.imp.USER32.dll_GetKeyState]
cmp dword [ebp - 0xc], 0x3fc
jge 0x1001f966
push str.jtjfe_gghd_dtlejp_ewlguzplf_reiiqejb_igllbvtmg
call fcn.10048643
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001f96d
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
je 0x1001f9a8
cmp byte [ebp + 0x1c], 0
je 0x1001f99c
mov eax, dword [ebp + 0x28]
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
cmp ecx, dword [eax]
je 0x1001faca
mov eax, dword [edx]
mov dword [edx + 4], eax
jmp 0x1001faca
mov eax, dword [ebp + 0x14]
mov ecx, dword [ecx]
add dword [eax], ecx
jmp 0x1001faca
mov dword [ebp + 8], 0x3b83
cmp dword [ebp + 8], 0x3bb6
push 0
pop ebx
jle 0x1001f9ff
mov esi, ebx
mov edi, ebx
mov eax, esi
lea ecx, [ebp - 0x18]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001a7f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001f9db
mov eax, dword [eax]
push eax
call fcn.10048643
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x18]
call fcn.1000f099
inc edi
cmp edi, 0x1bf4
jl 0x1001f9bf
inc esi
cmp esi, 0x1904
jl 0x1001f9bd
cmp dword [ebp + 8], 0x394b
jge 0x1001fa13
push str.deqozq_gvaqmvbs_sivddjp_bkvtwkin_tir_pkudeybmi
call fcn.10048643
pop ecx
cmp byte [ebp + 0x10], 0
je 0x1001faab
mov dword [ebp + 8], 0x25ca
cmp dword [ebp + 8], 0x2788
jle 0x1001fa76
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
shl eax, cl
lea ecx, [ebp - 0x30]
cdq
push edx
push eax
call fcn.10001a7f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001fa4c
mov eax, dword [eax]
push eax
call fcn.10048643
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.1000f099
inc edi
cmp edi, 0x32eb
jl 0x1001fa31
inc esi
cmp esi, 0x3052
jl 0x1001fa2f
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov edx, dword [ebp + 0x2c]
mov dword [edx], ebx
cmp dword [edx], 4
jge 0x1001fa95
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [edx]
cmp dword [edx], 4
jl 0x1001fa83
cmp dword [ebp + 8], 0x25a9
jge 0x1001faca
push str.zcfe_xymwindt_sxaugzgz_uxgfye_xlndborcv_zqkopngir_rez_xzhzc
call fcn.10048643
pop ecx
jmp 0x1001faca
mov edx, dword [ebp + 0x20]
mov dword [edx], ebx
cmp dword [edx], 1
jge 0x1001faca
mov esi, dword [ebp + 0x24]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [edx]
cmp dword [edx], 1
jl 0x1001fab8
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001fdf5
Capabilities:
Create directory
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
cmp byte [ebp + 8], 0
mov eax, ecx
push ebx
push esi
push edi
mov dword [esp + 0x14], eax
je 0x1001fe1c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x1001feb9
mov dword [esp + 0x10], 0x28c5
cmp dword [esp + 0x10], 0x2bc6
jle 0x1001fe94
push 0x1afa
push 0
push 0x1860
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor esi, esi
xor edi, edi
xor ebx, ebx
lea eax, [ebx + edi]
add eax, esi
lea ecx, [esp + 0x18]
cdq
push edx
push eax
call fcn.10001a7f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001fe61
mov eax, dword [eax]
push eax
call fcn.10048643
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.1000f099
inc ebx
cmp ebx, 0x62e6
jl 0x1001fe46
inc edi
cmp edi, 0x5572
jl 0x1001fe44
inc esi
cmp esi, 0x7ddb
jl 0x1001fe42
mov eax, dword [esp + 0x14]
cmp byte [eax], 0
je 0x1001fea4
push 0x1b4
call dword [sym.imp.USER32.dll_ShowCaret]
cmp dword [esp + 0x10], 0x2721
jge 0x1001feb9
push str.etenxrbj_kpy_mlyfsew_ysq_chgbko_blyke_wylb_omyt
call fcn.10048643
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002053b
Capabilities:
Encode data using xor
Get disk information

Disassembly:
mov eax, 0x10062909
call fcn.10061438
sub esp, 0x50
mov eax, edx
mov dword [ebp - 0x2c], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x100206b4
mov dword [ebp - 0x24], 0x6635
cmp dword [ebp - 0x24], 0x6867
jle 0x100205e5
xor esi, esi
mov dword [ebp - 0x20], esi
xor edi, edi
mov dword [ebp - 0x1c], edi
mov ecx, edi
mov dword [ebp - 0x28], esi
mov edi, esi
xor ebx, ebx
sar edi, cl
xor esi, esi
mov ecx, esi
mov eax, ebx
sar eax, cl
lea ecx, [ebp - 0x44]
or eax, edi
cdq
push edx
push eax
call fcn.10001a7f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002059f
mov eax, dword [eax]
push eax
call fcn.10048643
pop ecx
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.1000f099
inc esi
cmp esi, 0x7cdb
jl 0x10020582
inc ebx
cmp ebx, 0x7914
jl 0x10020580
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x28ff
jl 0x10020575
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x2c5e
jl 0x10020570
mov eax, dword [ebp - 0x2c]
cmp byte [ebp + 8], 0
je 0x100205f3
and dword [eax], 0
jmp 0x1002068f
mov dword [ebp - 0x1c], 0x2c2e
cmp dword [ebp - 0x1c], 0x2fe7
jle 0x10020666
call dword [sym.imp.KERNEL32.dll_GetLastError]
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x20], 0x5f59
xor edi, edi
mov eax, ebx
lea ecx, [ebp - 0x5c]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001a7f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10020632
mov eax, dword [eax]
push eax
call fcn.10048643
pop ecx
push 0
push 1
lea ecx, [ebp - 0x5c]
call fcn.1000f099
inc edi
cmp edi, 0x224
jl 0x10020616
add ebx, esi
dec dword [ebp - 0x20]
jne 0x10020614
inc esi
cmp esi, 0x7657
jl 0x1002060b
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp dword [ebp - 0x1c], 0x2c0e
jge 0x1002067a
push str.hcgxemubz_jqc_mrmzgm_jnptkxy_pkdqx_bxfuuz_jlez
call fcn.10048643
pop ecx
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1002068f
push 1
push 0xf33
call dword [sym.imp.USER32.dll_GetSystemMenu]
cmp dword [ebp - 0x24], 0x6595
jge 0x100206a3
push str.uozkov_pnlizokyp_dcftjbh_thiidath_lqpe_uoyon_ovqp_kszpatpz_hfwiyjp_dgwy_skt_okvguk_drv
call fcn.10048643
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0xc], 0
je 0x100206ce
mov byte [ebp - 0x15], 0
cmp byte [ebp - 0x15], 0
je 0x100206a3
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
jmp 0x100206a3
mov dword [ebp - 0x24], 0xa02
cmp dword [ebp - 0x24], 0xcc1
jle 0x10020710
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x1007fdb8
xor eax, esi
cdq
push edx
push eax
call fcn.1000e5de
inc edi
cmp edi, 0x29a5
jl 0x100206e2
inc esi
cmp esi, 0x7139
jl 0x100206e0
push 0x1fca
call dword [sym.imp.USER32.dll_IsZoomed]
mov eax, dword [ebp + 0x14]
and dword [eax], 0
mov dword [ebp - 4], 4
cmp dword [ebp - 0x24], 0x693
jge 0x100206a3
mov edx, str.wbkslctfk_lpv_erainmq_nksr_swwbtstr_rcrtpnntb_bmuzqegir_laja_pqonjbmhp_kodmxfqmc_vjg_bwzf_fcpffyzv
mov ecx, 0x1007fdb8
call fcn.100113ff
jmp 0x100206a3
Function at 0x1002554a
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10062b2d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], 0x4c90
mov dword [ebp - 0x38], str.wpsonm_rjzzulc_ljsn_ezzzp_aejafylq
cmp dword [ebp - 0x24], 0x4d05
jle 0x100255d1
and dword [ebp - 0x18], 0
jmp 0x10025590
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x7c68
jge 0x100255d1
and dword [ebp - 0x1c], 0
jmp 0x100255a6
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x16f8
jge 0x100255cf
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
mov ecx, 0x1007fdb8
call fcn.1000e5de
jmp 0x1002559f
jmp 0x10025589
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10025662
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10025600
push 0x257d
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x10025660
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [eax], 0
jmp 0x10025622
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
mov eax, dword [ebp - 0x20]
cmp dword [eax], 3
jg 0x10025660
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x11]
push eax
push 0
push 0
call fcn.100253a9
add esp, 0xc
push 0xb7d
push 0x473c
push 0x3bc0
push 0
push 1
push 0x3676
call fcn.10024ef0
add esp, 0x18
jmp 0x10025617
jmp 0x1002567f
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
push 0x23a1
push 1
push 0x6589
push dword [ebp - 0x34]
call fcn.10024fb5
add esp, 0x10
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x4af4
jge 0x10025699
mov edx, dword [ebp - 0x38]
mov ecx, 0x1007fdb8
call fcn.100113ff
jmp 0x100256b5
or dword [ebp - 4], 0xffffffff
jmp 0x100256bf
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002681a
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1002685e
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1002684a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x1002685c
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
and dword [eax], 0
jmp 0x10026876
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push 0x256a
push 1
call fcn.10024323
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1002b419
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10062d05
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], 0x644a
mov dword [ebp - 0x4c], str.the_vbannsgc_uenabxg_sezg_wvdhsvzxd_nsvnr_yekfb_yargasbm_hiodspqz_klvlstp_htrbfoo_xsmpbday
cmp dword [ebp - 0x2c], 0x647f
jle 0x1002b49f
and dword [ebp - 0x14], 0
jmp 0x1002b45f
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x304a
jge 0x1002b49f
and dword [ebp - 0x18], 0
jmp 0x1002b475
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x845
jge 0x1002b49d
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], edx
push dword [ebp - 0x50]
push dword [ebp - 0x54]
mov ecx, 0x1007fdb8
call fcn.1000e5de
jmp 0x1002b46e
jmp 0x1002b458
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002b5a6
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x1002b598
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x28], 0x1ae9
mov dword [ebp - 0x40], str.igfywma_dfvqegx_bnff_idorp_rylit_pzi_qej_rorehint_ovcoi_brhyxb_boj_chbz_zymqnzm_tgbqhpv
cmp dword [ebp - 0x28], 0x1dc6
jle 0x1002b550
and dword [ebp - 0x24], 0
jmp 0x1002b4f5
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x72e6
jge 0x1002b550
and dword [ebp - 0x1c], 0
jmp 0x1002b50b
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x465
jge 0x1002b54e
and dword [ebp - 0x20], 0
jmp 0x1002b521
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x112
jge 0x1002b54c
mov eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x20]
or eax, dword [ebp - 0x24]
cdq
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edx
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
mov ecx, 0x1007fdb8
call fcn.1000e5de
jmp 0x1002b51a
jmp 0x1002b504
jmp 0x1002b4ee
mov eax, dword [ebp - 0x3c]
mov byte [eax], 1
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x19da
jge 0x1002b570
mov edx, dword [ebp - 0x40]
mov ecx, 0x1007fdb8
call fcn.100113ff
jmp 0x1002b58c
or dword [ebp - 4], 0xffffffff
jmp 0x1002b596
jmp 0x1002b5a4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
jmp 0x1002b5d1
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x44], eax
push dword [ebp - 0x44]
push dword [ebp - 0x48]
push 1
push 0x3713
push 0x1f2f
push 0x768f
call fcn.10024fe4
add esp, 0x18
mov dword [ebp - 4], 2
cmp dword [ebp - 0x2c], 0x6171
jge 0x1002b5ee
mov edx, dword [ebp - 0x4c]
mov ecx, 0x1007fdb8
call fcn.100113ff
jmp 0x1002b60a
or dword [ebp - 4], 0xffffffff
jmp 0x1002b614
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10037e51
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x1006303b
call fcn.10061438
sub esp, 0x14
push ebx
push esi
mov byte [ebp - 0x14], cl
xor esi, esi
mov dword [ebp - 0x1c], 0x6073
cmp dword [ebp - 0x1c], 0x6304
push edi
mov dword [ebp - 0x10], esp
jle 0x10037ec3
mov edi, esi
mov dword [ebp - 0x18], esi
mov ebx, esi
mov dword [ebp - 0x20], esi
mov ecx, ebx
mov esi, edi
mov edi, dword [ebp - 0x20]
sar esi, cl
mov ecx, edi
mov eax, esi
sar eax, cl
mov ecx, 0x1007fdb8
cdq
push edx
push eax
call fcn.1000e5de
inc edi
cmp edi, 0x517f
jl 0x10037e8c
mov edi, dword [ebp - 0x18]
inc ebx
push 0
pop esi
cmp ebx, 0x4197
jl 0x10037e80
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x58f5
jl 0x10037e7e
cmp byte [ebp - 0x14], 0
je 0x10037ed6
push 0x257d
call dword [sym.imp.USER32.dll_GetKeyState]
jmp 0x10037ee1
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x1c], 0x5ec8
jge 0x10037efc
mov edx, str.zrfkkdflw_zpegrz_satm_khfz_awiavm_kil_yom_zswusolxr_hdg_jxsro_rvwtkwllz_akcukn
mov ecx, 0x1007fdb8
call fcn.100113ff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10038e9e
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 8], cl
test cl, cl
je 0x10038ec4
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x10038ece
push 0x8ee
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x10038ece
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret

Function at 0x10038f1a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10063090
call fcn.10061438
sub esp, 0x3c
push ebx
push esi
mov byte [ebp - 0x14], dl
mov eax, ecx
mov dword [ebp - 0x24], 0x702e
cmp dword [ebp - 0x24], 0x73a2
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], eax
jle 0x10038fa7
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x18], edi
xor ebx, ebx
and dword [ebp - 0x28], 0
mov eax, ebx
and eax, edi
mov edi, dword [ebp - 0x28]
and eax, esi
mov dword [ebp - 0x20], eax
mov esi, eax
mov eax, esi
mov ecx, 0x1007fdb8
xor eax, edi
cdq
push edx
push eax
call fcn.1000e5de
inc edi
cmp edi, 0x77dd
jl 0x10038f63
mov esi, dword [ebp - 0x1c]
inc ebx
mov edi, dword [ebp - 0x18]
cmp ebx, 0x123c
jl 0x10038f51
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x60e0
jl 0x10038f4f
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x3823
jl 0x10038f4a
mov eax, dword [ebp - 0x2c]
cmp byte [ebp - 0x14], 0
je 0x1003906c
cmp byte [eax], 0
je 0x10039081
mov dword [ebp - 0x20], 0x70cf
cmp dword [ebp - 0x20], 0x711b
jle 0x10039046
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x1c], edi
and dword [ebp - 0x28], 0
mov ecx, edi
mov edi, esi
mov dword [ebp - 0x2c], esi
mov esi, dword [ebp - 0x28]
sar edi, cl
mov ecx, esi
mov eax, edi
shl eax, cl
lea ecx, [ebp - 0x44]
xor eax, ebx
cdq
push edx
push eax
call fcn.10001a7f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10039003
mov eax, dword [eax]
push eax
call fcn.10048643
pop ecx
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.1000f099
inc esi
cmp esi, 0xa35
jl 0x10038fe6
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x154c
jl 0x10038fd6
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x10f9
jl 0x10038fd1
inc ebx
cmp ebx, 0x7a7d
jl 0x10038fcc
push 0x733
push 0x16b1
call dword [sym.imp.GDI32.dll_SetTextAlign]
cmp dword [ebp - 0x20], 0x6f8a
jge 0x10039081
push str.xavoqwu_tcpj_sjijbuuk
call fcn.10048643
pop ecx
jmp 0x10039081
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10039081
push 0
push 0x144c
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0x6fbe
jge 0x100390a0
mov edx, str.cglqvvwk_iclu_hxmgiao_pbqhohg_dpicrdj_zocnx
mov ecx, 0x1007fdb8
call fcn.100113ff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret