joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000862d
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x100589c8
call fcn.100582b8
sub esp, 0x4c
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], dl
mov byte [ebp - 0x18], cl
je 0x1000867d
xor esi, esi
push esi
test dl, dl
je 0x10008669
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
jmp 0x100087fa
push 0x1567
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x100087fa
test cl, cl
je 0x100087ce
push 3
lea ecx, [ebp - 0x54]
call fcn.10001bdd
xor esi, esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x38], 0x40f2fdad
mov dword [ebp - 0x44], 0x7d1afd06
mov dword [ebp - 0x40], 0x829ed890
mov dword [ebp - 0x24], 0x602e
cmp dword [ebp - 0x24], 0x608a
jle 0x1000871d
mov edi, esi
mov dword [ebp - 0x20], esi
mov ebx, esi
mov dword [ebp - 0x1c], esi
mov ecx, ebx
mov dword [ebp - 0x28], edi
mov dword [ebp + 8], esi
shl edi, cl
mov ebx, esi
mov esi, dword [ebp + 8]
mov ecx, ebx
mov eax, esi
sar eax, cl
mov ecx, 0x10072ab8
or eax, edi
cdq
push edx
push eax
call fcn.10001ac8
inc ebx
cmp ebx, 0x7d14
jl 0x100086d2
inc esi
push 0
mov dword [ebp + 8], esi
cmp esi, 0x7183
pop esi
jl 0x100086cd
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
inc ebx
mov dword [ebp - 0x1c], ebx
cmp ebx, 0x70c
jl 0x100086c3
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x4e75
jl 0x100086be
mov dword [ebp - 0x30], 0xffffffff
mov byte [ebp - 4], 1
cmp dword [ebp - 0x24], 0x5ff9
jge 0x1000875e
mov edx, str.gkokjpqm_mmdwudcf_nppchxbci
mov ecx, 0x10072ab8
call fcn.1000350a
jmp 0x1000875e
mov dword [ebp - 4], esi
lea eax, [ebp - 0x54]
push 0x6a55
push eax
mov dword [ebp - 0x3c], 0xd70cadd6
lea edx, [ebp - 0x48]
mov dword [ebp - 0x34], esi
xor cl, cl
push 0x59e6
mov dword [ebp - 0x2c], 0xffffffff
call fcn.10005873
add esp, 0xc
lea eax, [ebp - 0x2c]
lea edx, [ebp - 0x44]
xor cl, cl
push 1
push 0x7c2e
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
push 0x374c
lea eax, [ebp - 0x3c]
push eax
lea eax, [ebp - 0x40]
push eax
push 1
call fcn.10008275
add esp, 0x2c
lea ecx, [ebp - 0x54]
call fcn.10001c3a
jmp 0x100087fa
mov byte [ebp + 0xb], 0
cmp byte [ebp + 0xb], 0
je 0x100087fa
push 0x3992
push 1
push 1
push 0x14c5
push 0x1acd
mov edx, 0x4994
mov cl, 1
call fcn.10003dac
add esp, 0x14
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d653
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [ebp + 8], 0
je 0x1000d6a0
mov dword [ebp - 8], 3
mov dword [ebp - 8], 0xffffffe3
jmp 0x1000d698
mov dword [ebp - 4], 7
mov dword [ebp - 0xc], 0xfffe
mov dword [ebp - 4], 0xffffffea
jmp 0x1000d68f
cmp dword [ebp - 0xc], 0
jne 0x1000d695
inc dword [ebp - 4]
cmp dword [ebp - 4], 0xfffffff2
jge 0x1000d686
inc dword [ebp - 8]
cmp dword [ebp - 8], 0x1d
jle 0x1000d66f
jmp 0x1000d6b2
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1000d6b2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov esp, ebp
pop ebp
ret
Function at 0x100101cd
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp byte [ebp + 0x28], 0
push ebx
push esi
push edi
mov ebx, edx
mov edi, ecx
je 0x10010291
cmp byte [ebp + 0x10], 0
je 0x100101fc
push ecx
push ecx
push dword [ebp + 0x2c]
mov ecx, dword [ebp + 0x18]
call fcn.10011c09
jmp 0x10010313
mov dword [ebp + 0x28], 0xceafd94
xor edi, edi
mov dword [ebp - 8], 0x6f6dd8d1
inc edi
mov dword [ebp + 0x28], edi
xor esi, esi
mov dword [ebp + 0x28], 0x3d1bca9d
mov dword [ebp - 4], 0xffff
mov dword [ebp + 0x28], esi
jmp 0x10010233
mov eax, dword [ebp + 0x28]
mov dword [ebp + eax*4 - 0x18], 0x7a98815
inc dword [ebp + 0x28]
cmp dword [ebp + 0x28], 4
jl 0x10010225
dec dword [ebp - 4]
jne 0x10010277
mov eax, dword [ebp - 0x14]
xor ebx, ebx
mov ecx, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
cmp ecx, eax
mov eax, dword [ebp - 4]
setg bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp - 4]
sete dl
xor ecx, ecx
cmp eax, edx
mov eax, 0xc4365dea
setle cl
cmp eax, ecx
sbb eax, eax
neg eax
cmp eax, dword [ebp - 8]
jne 0x10010279
cmp dword [ebp - 8], esi
je 0x10010279
mov esi, edi
mov dword [ebp + 0x28], esi
mov eax, dword [ebp + 0x28]
sub eax, 0xc809
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 8], eax
jmp 0x10010313
cmp byte [ebp + 0x24], 0
je 0x10010304
cmp dword [edi], 0x81479b69
mov eax, dword [edi]
mov esi, dword [ebp + 0x30]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
sete cl
xor edx, edx
mov dword [ebx], ecx
mov eax, dword [ebx]
mov ecx, dword [esi]
mov ebx, dword [ebp + 0x14]
add eax, dword [ecx + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [edi]
mov ecx, dword [ecx]
sub ecx, eax
mov dword [ebx], ecx
mov ecx, dword [edi]
mov eax, dword [ebx]
cmp eax, ecx
mov eax, 0xc7e43439
setl dl
cmp eax, edx
mov eax, dword [ebp + 0x20]
sbb ecx, ecx
neg ecx
mov dword [eax], ecx
mov ecx, dword [ebp + 0x1c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ecx]
mov eax, dword [esi]
cmp dword [eax + 8], 0xfbb9cf7d
jb 0x100102fa
xor esi, esi
cmp dword [ebx], esi
je 0x100102fd
xor esi, esi
inc esi
mov eax, dword [ebp + 8]
mov dword [eax], esi
jmp 0x10010313
push 0x1916
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10012685
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov byte [ebp - 8], dl
test dl, dl
je 0x100126ae
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x100126c0
push 0x540
push ecx
push ecx
xor dl, dl
call fcn.100124ed
add esp, 0xc
jmp 0x100126c0
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x100126c0
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov esp, ebp
pop ebp
ret
Function at 0x10016b38
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
and dword [esp + 0x20], 0
mov dword [esp + 0x14], 5
push ebx
mov byte [esp + 0xb], 0
mov dword [esp + 0x14], 0xb9c
cmp dword [esp + 0x14], 0xd31
push esi
push edi
mov dword [esp + 0x24], edx
mov dword [esp + 0x28], ecx
jle 0x10016bed
xor esi, esi
mov dword [esp + 0x18], esi
xor edi, edi
mov dword [esp + 0x14], edi
mov ecx, edi
mov dword [esp + 0x20], esi
mov edi, esi
xor ebx, ebx
shl edi, cl
xor esi, esi
lea eax, [esi + ebx]
xor eax, edi
lea ecx, [esp + 0x30]
cdq
push edx
push eax
call fcn.10001a11
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10016ba5
mov eax, dword [eax]
push eax
call fcn.100400a6
pop ecx
push 0
push 1
lea ecx, [esp + 0x38]
call fcn.10001eb4
inc esi
cmp esi, 0x15c1
jl 0x10016b8a
inc ebx
cmp ebx, 0x3c2e
jl 0x10016b88
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x18]
inc edi
mov dword [esp + 0x14], edi
cmp edi, 0x1699
jl 0x10016b7c
inc esi
mov dword [esp + 0x18], esi
cmp esi, 0x3eb
jl 0x10016b76
cmp byte [esp + 0x13], 0
je 0x10016bfe
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
cmp dword [esp + 0x1c], 0x7fd
jge 0x10016c13
push str.bstynv_bbbx_qumyt_xkh_qthl_qmy_nndtp_hjcwtbt_fmg_pmalmuy
call fcn.100400a6
pop ecx
mov byte [esp + 0x13], 0
mov dword [esp + 0x20], 0x6984
cmp dword [esp + 0x20], 0x6be8
jle 0x10016cb1
xor esi, esi
mov dword [esp + 0x14], esi
xor edi, edi
mov dword [esp + 0x18], edi
mov eax, edi
xor ebx, ebx
and eax, esi
mov dword [esp + 0x1c], eax
mov esi, eax
xor edi, edi
mov dword [esp + 0x1c], 0x326a
mov eax, edi
lea ecx, [esp + 0x48]
or eax, esi
cdq
push edx
push eax
call fcn.10001a11
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10016c6a
mov eax, dword [eax]
push eax
call fcn.100400a6
pop ecx
push 0
push 1
lea ecx, [esp + 0x50]
call fcn.10001eb4
add edi, ebx
dec dword [esp + 0x1c]
jne 0x10016c50
inc ebx
cmp ebx, 0x385b
jl 0x10016c46
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x14]
inc edi
mov dword [esp + 0x18], edi
cmp edi, 0x31d5
jl 0x10016c3a
inc esi
mov dword [esp + 0x14], esi
cmp esi, 0x1f6b
jl 0x10016c34
cmp byte [esp + 0x13], 0
je 0x10016ce0
push 0x445
push 0xbe3
push 0x22c8
push 0x232f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Ellipse]
cmp dword [esp + 0x20], 0x65b1
jge 0x10016cf5
push str.wiyc_nnc_duoptxpy_lqlioaq_spxcr_gtynxjo_yldpvuv_cqeyhits_dnoda_klijw_izigfjgv_mgjxer
call fcn.100400a6
pop ecx
mov edx, dword [esp + 0x24]
push ecx
mov ecx, dword [esp + 0x2c]
call fcn.1000c4be
mov eax, dword [esp + 0x2c]
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10018ba6
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10018bf5
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10018bde
push 0x1577
push 0
push 0
push 0
push 0x1dca
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
jmp 0x10018bf3
push 0
push 0x1567
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x10018c18
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
push 0
mov eax, dword [ebp - 8]
push dword [eax]
push 0x48df
push dword [ebp - 0xc]
call fcn.1001ca7a
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x1001ada5
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001ae2d
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001ae1c
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1001adfd
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x1001ae1a
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.10001c56
mov dword [eax], 0x91a049fe
jmp 0x1001adf2
jmp 0x1001ae2b
push 0x1916
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x1001ae55
lea eax, [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
push 0x714f
push 0x7039
push 0
push dword [ebp - 0x20]
mov eax, dword [ebp - 0x24]
push dword [eax]
call fcn.100230a0
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x1001c6be
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100592f7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x64
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001c883
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1001c864
mov dword [ebp - 0x28], 0x4362
mov dword [ebp - 0x38], str.abqe_qqfcgn_cmrmczftc_pgkbnqbi_udu_lwz_wlj
cmp dword [ebp - 0x28], 0x43b6
jle 0x1001c7de
and dword [ebp - 0x18], 0
jmp 0x1001c734
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x5706
jge 0x1001c7d1
and dword [ebp - 0x1c], 0
jmp 0x1001c74e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3deb
jge 0x1001c7cc
and dword [ebp - 0x20], 0
jmp 0x1001c764
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x76eb
jge 0x1001c7c7
and dword [ebp - 0x24], 0
jmp 0x1001c77a
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x1b90
jge 0x1001c7c5
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x24]
add eax, ecx
cdq
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edx
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x74]
call fcn.10001a11
pop ecx
pop ecx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
call fcn.10001aa8
push eax
call fcn.100400a6
pop ecx
lea ecx, [ebp - 0x74]
call fcn.10001a9e
jmp 0x1001c773
jmp 0x1001c75d
jmp 0x1001c747
jmp 0x1001c72d
push 0xe4b
push 0
call dword [sym.imp.OLEAUT32.dll_SysReAllocStringLen]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x40b8
jge 0x1001c7fa
push dword [ebp - 0x38]
call fcn.100400a6
pop ecx
jmp 0x1001c816
or dword [ebp - 4], 0xffffffff
jmp 0x1001c820
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x1001c848
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 2
jge 0x1001c862
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x48]
call fcn.10001c56
and dword [eax], 0
jmp 0x1001c83d
jmp 0x1001c881
push 0
push 0
push 0
push 0
push 0x17f6
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x1001c8b2
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x50], eax
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push 0
push 0x5861
push 0x5094
call fcn.1001ab7c
add esp, 0x18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001e741
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10059355
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x6c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x1001e7a3
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x30]
push 0xd7e
push 1
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
call fcn.1001e92f
add esp, 0x18
jmp 0x1001e91e
lea eax, [ebp + 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x1001e7d8
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x1001e7d3
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1001e91e
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x2c], 0x1912
mov dword [ebp - 0x50], str.jmccq_bswi_ssn
cmp dword [ebp - 0x2c], 0x1abd
jle 0x1001e89d
and dword [ebp - 0x1c], 0
jmp 0x1001e806
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x70d6
jge 0x1001e89d
and dword [ebp - 0x20], 0
jmp 0x1001e820
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x3547
jge 0x1001e898
and dword [ebp - 0x24], 0
jmp 0x1001e836
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x6a86
jge 0x1001e896
and dword [ebp - 0x28], 0
jmp 0x1001e84c
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x7b7f
jge 0x1001e894
mov eax, dword [ebp - 0x1c]
add eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x24]
add eax, dword [ebp - 0x28]
cdq
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], edx
push dword [ebp - 0x60]
push dword [ebp - 0x64]
lea ecx, [ebp - 0x7c]
call fcn.10001a11
pop ecx
pop ecx
mov dword [ebp - 0x48], eax
mov ecx, dword [ebp - 0x48]
call fcn.10001aa8
push eax
call fcn.100400a6
pop ecx
lea ecx, [ebp - 0x7c]
call fcn.10001a9e
jmp 0x1001e845
jmp 0x1001e82f
jmp 0x1001e819
jmp 0x1001e7ff
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x58], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x2c], 0x15fc
jge 0x1001e8b9
push dword [ebp - 0x50]
call fcn.100400a6
pop ecx
jmp 0x1001e8d5
or dword [ebp - 4], 0xffffffff
jmp 0x1001e8df
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
jmp 0x1001e901
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax], 1
jge 0x1001e91e
mov eax, dword [ebp - 0x18]
push dword [eax]
mov ecx, dword [ebp - 0x5c]
call fcn.10001c56
mov dword [eax], 1
jmp 0x1001e8f6
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10025cf1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10025d88
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10025d38
push 0
push 0
push 0
push 0
push 0x17f6
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x10025d86
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0xffffffe6
jmp 0x10025d5a
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
je 0x10025d86
push 0x157d
push 0x4019
push 0xf20
push 0x572f
push 0
push 0
push 1
call fcn.10025a8f
add esp, 0x1c
jmp 0x10025d4f
jmp 0x10025d9a
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push 0
call fcn.10024a25
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10031f88
Capabilities:
Connect pipe
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100598af
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x74
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1003211f
lea eax, [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10032013
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x44]
mov ecx, dword [ebp - 0x48]
call fcn.10034836
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x1003211d
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x1003211d
push 0x4034
push 1
push 0x4297
push 0
call fcn.1002663b
add esp, 0x10
mov dword [ebp - 0x24], 0x364d
mov dword [ebp - 0x54], str.qdskgv_pxf_nncsp_fxncvjxo_ztb_teakbjd_ntlpfey_oxxc_vtj_enlfq_lin_zxzpnb_omwconc
cmp dword [ebp - 0x24], 0x37b1
jle 0x100320e1
and dword [ebp - 0x20], 0
jmp 0x10032061
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x2673
jge 0x100320e1
and dword [ebp - 0x18], 0
jmp 0x10032077
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x4b4
jge 0x100320dc
and dword [ebp - 0x1c], 0
jmp 0x1003208d
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3395
jge 0x100320da
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
shl eax, cl
and eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x6c], eax
mov dword [ebp - 0x68], edx
push dword [ebp - 0x68]
push dword [ebp - 0x6c]
lea ecx, [ebp - 0x84]
call fcn.10001a11
pop ecx
pop ecx
mov dword [ebp - 0x50], eax
mov ecx, dword [ebp - 0x50]
call fcn.10001aa8
push eax
call fcn.100400a6
pop ecx
lea ecx, [ebp - 0x84]
call fcn.10001a9e
jmp 0x10032086
jmp 0x10032070
jmp 0x1003205a
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x343a
jge 0x100320f7
push dword [ebp - 0x54]
call fcn.100400a6
pop ecx
jmp 0x10032113
or dword [ebp - 4], 0xffffffff
jmp 0x1003211d
jmp 0x10032166
lea eax, [ebp + 8]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x58]
movzx eax, byte [eax]
test eax, eax
je 0x10032146
push 0x1916
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x10032166
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x64]
movzx eax, byte [eax]
test eax, eax
je 0x10032166
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10036ba3
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x10059a24
call fcn.100582b8
sub esp, 0x10
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ebx
je 0x10036c74
mov dword [ebp - 0x14], 0x1b9
xor esi, esi
cmp dword [ebp - 0x14], 0x4b0
jle 0x10036c12
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x18], esi
mov eax, esi
mov ecx, 0x10072ab8
and eax, ebx
or eax, edi
cdq
push edx
push eax
call fcn.10001ac8
inc esi
cmp esi, 0x270f
jl 0x10036bde
inc ebx
push 0
pop esi
cmp ebx, 0x7c01
jl 0x10036bdb
inc edi
cmp edi, 0x2def
jl 0x10036bd9
mov ebx, dword [ebp - 0x1c]
mov edi, esi
cmp dword [ebx], esi
jbe 0x10036c3d
mov esi, dword [ebp + 0x14]
call fcn.100351cc
push 0xa
pop ecx
xor edx, edx
div ecx
mov ecx, dword [ebp + 0xc]
add dx, word [esi]
movzx eax, dx
push eax
call fcn.1000c786
inc edi
cmp edi, dword [ebx]
jb 0x10036c1b
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [ebp - 0x14], 0xfffffe72
jge 0x10036c58
mov edx, str.aouxlzu_tws_bgwh_smvxa_ivde
mov ecx, 0x10072ab8
call fcn.1000350a
jmp 0x10036c92
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10036c92
xor esi, esi
push esi
push esi
push esi
push esi
push 0x17f6
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10036e70
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x10036e87
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x10036ea9
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x10099b14
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x10099ea0
jl 0x10036eb7
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x1009a144
jl 0x10036ef7
mov ecx, dword [0x1009ae90]
xor ecx, dword [0x10099b14]
and ecx, edi
xor ecx, dword [0x1009ae90]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x10099b10], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x1009a144]
mov dword [0x1009a4d0], eax
pop esi
ret