joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100049ed
Capabilities:
Create directory
Encode data using xor

Disassembly:
mov eax, 0x1005b5fc
call fcn.1005b080
sub esp, 0x18
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov byte [ebp - 0x14], dl
je 0x10004b62
test dl, dl
je 0x10004a87
mov edi, dword [ebp + 8]
xor ecx, ecx
mov esi, dword [ebp + 0x2c]
push 7
mov edx, dword [edi]
mov eax, dword [edi]
cmp edx, eax
pop eax
setle cl
cmp eax, ecx
mov eax, dword [edi]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [edi]
setg dl
xor ecx, ecx
sub edx, eax
mov eax, dword [edi]
add edx, eax
mov eax, dword [esi]
mov dword [eax + 4], edx
mov eax, dword [edi]
cmp edx, eax
mov eax, dword [edi]
setge cl
imul eax, ecx
test eax, eax
jne 0x10004a5e
mov eax, dword [esi]
xor esi, esi
cmp dword [eax + 4], esi
je 0x10004a61
xor esi, esi
inc esi
mov eax, dword [edi]
xor ecx, ecx
cmp eax, esi
mov eax, dword [edi]
setge cl
imul eax, ecx
xor ecx, ecx
cmp eax, 0xe75c
mov eax, dword [ebp + 0x10]
setl cl
mov dword [eax], ecx
mov eax, dword [eax]
mov dword [ebx], eax
jmp 0x10004b75
mov dword [ebp - 0x1c], 0x10e5
xor esi, esi
cmp dword [ebp - 0x1c], 0x1293
jle 0x10004afb
mov edi, esi
mov dword [ebp - 0x18], esi
mov ebx, esi
mov eax, esi
mov dword [ebp + 0x18], esi
lea ecx, [eax + ebx]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], esi
sar edi, cl
mov eax, edi
mov ecx, 0x10077178
xor eax, esi
cdq
push edx
push eax
call fcn.1000b0cd
inc esi
cmp esi, 0x6de8
jl 0x10004ab0
mov eax, dword [ebp + 0x18]
mov edi, dword [ebp - 0x18]
inc eax
mov dword [ebp + 0x18], eax
push 0
pop esi
cmp eax, 0x1426
jl 0x10004aa5
inc ebx
cmp ebx, 0x2afc
jl 0x10004aa0
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x773d
jl 0x10004a9e
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x1c], 0xf70
jge 0x10004b34
mov edx, str.qnh_rahs_sze_odsovrb_bvfwnjzn
mov ecx, 0x10077178
call fcn.1000ca72
jmp 0x10004b34
mov eax, dword [ebp + 0x20]
mov edx, dword [ebp + 0x14]
cmp dword [eax], 0x78d8ef06
jle 0x10004b50
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov eax, dword [edx]
mov eax, dword [ecx]
cmp dword [ecx], 1
jne 0x10004b53
xor esi, esi
inc esi
xor eax, eax
cmp esi, 0x76fbfcc0
sete al
mov dword [edx], eax
jmp 0x10004b75
cmp byte [ebp + 0x28], 0
je 0x10004b6f
mov eax, dword [ebp + 0x1c]
inc dword [eax]
jmp 0x10004b75
mov eax, dword [ebp + 0x24]
mov byte [eax], 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005a3f
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005b62c
call fcn.1005b080
sub esp, 0x3c
cmp byte [ebp + 0x1c], 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x30], ecx
mov byte [ebp - 0x14], 1
je 0x10005b4c
cmp byte [ebp + 0xc], 0
je 0x10005b3e
mov dword [ebp - 0x28], 0x3476
xor ebx, ebx
cmp dword [ebp - 0x28], 0x37aa
jle 0x10005afc
mov edi, ebx
mov dword [ebp - 0x18], ebx
mov esi, ebx
mov dword [ebp - 0x24], ebx
mov ecx, esi
mov dword [ebp - 0x20], 0x5ce2
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov eax, esi
sar eax, cl
lea ecx, [ebp - 0x48]
or eax, edi
cdq
push edx
push eax
call fcn.10002a51
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10005ab8
mov eax, dword [eax]
push eax
call fcn.1004498a
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.10001643
mov ecx, dword [ebp - 0x1c]
dec ecx
dec dword [ebp - 0x20]
mov dword [ebp - 0x1c], ecx
jne 0x10005a9d
mov esi, dword [ebp - 0x24]
inc esi
mov dword [ebp - 0x24], esi
cmp esi, 0x2774
jl 0x10005a8e
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x24e0
jl 0x10005a89
inc edi
cmp edi, 0x119f
jl 0x10005a86
push ecx
push ecx
push ebx
push 0x269b
push 0xa2a
mov byte [ebp + 0x1f], bl
lea ecx, [ebp + 0x1f]
push 0xdb3
mov edx, 0x688
call fcn.10004f8e
add esp, 0x18
cmp dword [ebp - 0x28], 0x32d5
jge 0x10005c15
push str.gdi_hllh_ivnnvur_tpdk_ehehdnw_kqhiex_rgkmnsjd_ceo_lnipnj_jflax_flfvh_ybv_ooodwhhy_atlktx
call fcn.1004498a
pop ecx
jmp 0x10005c15
mov eax, dword [ebp + 8]
mov dword [eax], 0x76715f0e
jmp 0x10005c15
mov dword [ebp - 0x28], 0x6274
cmp dword [ebp - 0x28], 0x62e1
jle 0x10005ba3
xor ebx, ebx
push ebx
push ebx
push 0x2419
push 0x1a97
call dword [sym.imp.USER32.dll_DefWindowProcA]
mov esi, ebx
mov edi, ebx
mov eax, edi
mov ecx, 0x10077178
xor eax, esi
cdq
push edx
push eax
call fcn.1000b0cd
inc edi
cmp edi, 0x390d
jl 0x10005b74
inc esi
cmp esi, 0x58e3
jl 0x10005b72
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetSystemTimeAdjustment]
mov edi, dword [ebp - 0x2c]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x28], 0x625f
jge 0x10005be1
mov edx, str.augokxou_kcumbt_oqoo_pyqbngchw_rum_kpavr_fwbaygzg_uahnwim_teaeyebdj_gpugtmuc_htn
mov ecx, 0x10077178
call fcn.1000ca72
jmp 0x10005be1
mov esi, dword [ebp + 0x18]
xor edx, edx
mov ebx, dword [ebp - 0x30]
mov eax, dword [esi]
mov eax, dword [esi]
mov dword [edi], eax
mov ecx, dword [esi]
mov eax, dword [esi]
cmp ecx, eax
mov eax, dword [ebx]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [edi]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [esi]
setge dl
xor ecx, ecx
cmp eax, edx
setg cl
mov dword [ebx], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005df4
Capabilities:
Create thread
Encode data using xor
Start service

Disassembly:
mov eax, 0x1005b640
call fcn.1005b080
sub esp, 0x14
mov byte [ebp - 0x14], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10005ea8
mov dword [ebp - 0x18], 0x230d
xor esi, esi
cmp dword [ebp - 0x18], 0x23e5
jle 0x10005e68
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x1c], esi
mov eax, esi
mov ecx, 0x10077178
and eax, ebx
xor eax, edi
cdq
push edx
push eax
call fcn.1000b0cd
inc esi
cmp esi, 0x51b5
jl 0x10005e37
inc ebx
push 0
pop esi
cmp ebx, 0x605c
jl 0x10005e34
inc edi
cmp edi, 0x4331
jl 0x10005e32
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x18], 0x2132
jge 0x10005e8c
mov edx, str.nluoet_estsjwt_qup_picnkn
mov ecx, 0x10077178
call fcn.1000ca72
jmp 0x10005ebc
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x10005ebc
xor esi, esi
push esi
push 1
push esi
call dword [sym.imp.KERNEL32.dll_OpenProcess]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006dc7
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov byte [ebp - 8], cl
je 0x10006ea4
test cl, cl
je 0x10006e89
mov dword [ebp - 0x14], 0xa06
cmp dword [ebp - 0x14], 0xd0b
push 0
pop ebx
jle 0x10006e52
mov edi, ebx
mov esi, ebx
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0xc], 0x4a7b
mov eax, esi
lea ecx, [ebp - 0x38]
and eax, edi
cdq
push edx
push eax
call fcn.10002a51
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10006e22
mov eax, dword [eax]
push eax
call fcn.1004498a
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x38]
call fcn.10001643
dec esi
dec dword [ebp - 0xc]
jne 0x10006e09
mov esi, dword [ebp - 0x10]
inc esi
mov dword [ebp - 0x10], esi
cmp esi, 0x67b
jl 0x10006dff
inc edi
cmp edi, 0x2be1
jl 0x10006dfa
push ecx
push ecx
lea eax, [ebp + 0x17]
mov byte [ebp + 0x17], bl
push 0x1360
push eax
mov edx, 0x497e
mov cl, 1
call fcn.10006f05
add esp, 0x10
cmp dword [ebp - 0x14], 0x775
jge 0x10006efe
push str.gwjnp_cacixdez_crhz_zqinkev_ozplugfox_cdfd
call fcn.1004498a
pop ecx
jmp 0x10006efe
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10006efe
push 0
push ecx
push ecx
mov ecx, 0x6c36
call fcn.10003448
add esp, 0xc
jmp 0x10006efe
cmp byte [ebp + 0xc], 0
je 0x10006eba
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0xf34fda0e
jmp 0x10006efe
xor ebx, ebx
mov dword [ebp - 0xc], 0xffffffff
mov dword [ebp - 0xc], ebx
jmp 0x10006ed6
mov eax, dword [ebp - 0xc]
mov dword [ebp + eax*4 - 0x20], 0xfffffffd
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 2
jl 0x10006ec8
mov dword [ebp - 0xc], ebx
jmp 0x10006ef8
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10006ef5
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
inc dword [ebp - 0xc]
cmp dword [ebp - 0xc], 1
jle 0x10006ee1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000fa30
Capabilities:
Delete registry key

Disassembly:
mov eax, 0x1005bae9
call fcn.1005b080
sub esp, 0x38
push ebx
push esi
mov dword [ebp - 0x2c], 0x8b2
xor ebx, ebx
cmp dword [ebp - 0x2c], 0x8de
push edi
mov dword [ebp - 0x10], esp
jle 0x1000fa9d
mov esi, ebx
mov edi, ebx
lea eax, [edi + esi]
cdq
lea ecx, [ebp - 0x44]
push edx
push eax
call fcn.10002a51
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000fa71
mov eax, dword [eax]
push eax
call fcn.1004498a
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x44]
call fcn.10001643
inc edi
cmp edi, 0x2994
jl 0x1000fa59
inc esi
cmp esi, 0x52fb
jl 0x1000fa57
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
cmp byte [ebp + 0x10], 0
je 0x1000fbfe
mov dword [ebp - 0x28], 0x45b0
mov esi, 0x10077178
cmp dword [ebp - 0x28], 0x48f6
jle 0x1000fb0c
mov edi, ebx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x20], 0x4f3
mov edi, ebx
mov ebx, dword [ebp - 0x1c]
lea eax, [ebx + edi]
mov ecx, esi
cdq
push edx
push eax
call fcn.1000b0cd
inc edi
cmp edi, 0x5a88
jl 0x1000fad0
dec ebx
dec dword [ebp - 0x20]
push 0
mov dword [ebp - 0x1c], ebx
pop ebx
jne 0x1000facb
mov edi, dword [ebp - 0x24]
inc edi
mov dword [ebp - 0x24], edi
cmp edi, 0x2ccc
jl 0x1000fac1
push 0x12d8
call dword [sym.imp.USER32.dll_PostQuitMessage]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x28], 0x4268
jge 0x1000fb24
mov edx, str.qefoks_dzb_poto_zqueen
mov ecx, esi
call fcn.1000ca72
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x24], 0x2f6f
cmp dword [ebp - 0x24], 0x3308
jle 0x1000fb79
push ebx
push 0xd6
push 0x181d
push 0xb00
call dword [sym.imp.GDI32.dll_MoveToEx]
mov edi, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x28], 0x326f
mov eax, ebx
mov ecx, esi
cdq
push edx
push eax
call fcn.1000b0cd
add ebx, edi
dec dword [ebp - 0x28]
jne 0x1000fb5a
inc edi
push 0
pop ebx
cmp edi, 0x2b4f
jl 0x1000fb50
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0x2e46
jge 0x1000fbdd
mov edx, str.ltch_dbimi_vuymirlaz_eufb_xkcyl_edz_dziqwynvo
mov ecx, esi
call fcn.1000ca72
jmp 0x1000fbdd
mov edx, dword [ebp + 0x14]
mov dword [edx], ebx
cmp dword [edx], 1
jge 0x1000fc40
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 1
inc dword [edx]
cmp dword [edx], 1
jl 0x1000fbea
jmp 0x1000fc40
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1000fc40
push 0x19ed
push 0x521b
push 0x4461
push 0x466c
push 1
push ebx
push 0x689f
push 0x192
push 0x62b5
push ebx
mov edx, 0x78cc
mov ecx, 0x1819
call fcn.1000f5ce
add esp, 0x28
cmp dword [ebp - 0x2c], 0x79b
jge 0x1000fc54
push str.yrh_oslkkbnj_ngyin_gvvvsf_dsvrst_iet_uafmyirbo_schrag_vvsmyo_uguoxyi_fvcovq_foglhwbe_qkdkul
call fcn.1004498a
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000fc65
Capabilities:
Get session user name

Disassembly:
mov eax, 0x1005baf3
call fcn.1005b080
sub esp, 0x28
cmp byte [ebp + 8], 0
push esi
push edi
mov esi, ecx
mov byte [ebp - 0x10], 1
je 0x1000fd30
mov dword [ebp - 0x1c], 0x6069
cmp dword [ebp - 0x1c], 0x6377
jle 0x1000fd11
xor edi, edi
push ebx
xor esi, esi
mov dword [ebp - 0x18], esi
xor ebx, ebx
mov dword [ebp - 0x14], 0x1053
mov dword [ebp + 8], ebx
mov esi, ebx
mov ebx, 0x70dc
mov ecx, esi
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0x34]
cdq
push edx
push eax
call fcn.10002a51
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000fcca
mov eax, dword [eax]
push eax
call fcn.1004498a
pop ecx
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.10001643
dec esi
dec ebx
jne 0x1000fcaf
mov ebx, dword [ebp + 8]
mov esi, dword [ebp - 0x18]
add ebx, esi
dec dword [ebp - 0x14]
mov dword [ebp + 8], ebx
jne 0x1000fca8
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x7943
jl 0x1000fc9c
inc edi
cmp edi, 0x20a6
jl 0x1000fc97
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
pop ebx
cmp dword [ebp - 0x1c], 0x5e53
jge 0x1000fd25
push str.ebx_djugf_xvajosauk_fqyajykqc_vzjdnrll
call fcn.1004498a
pop ecx
mov eax, dword [ebp + 0x14]
mov dword [eax], 0x2d5e48d3
jmp 0x1000fd69
cmp byte [ebp + 0xc], 0
je 0x1000fd3e
push 0
call dword [sym.imp.KERNEL32.dll_ExitThread]
mov eax, dword [ebp + 0x10]
push 0x1a
pop edi
mov ecx, dword [eax]
cmp ecx, edi
jge 0x1000fd54
mov eax, dword [ebp + 0x24]
movzx edx, word [eax]
add edx, ecx
jmp 0x1000fd61
mov eax, ecx
cdq
idiv edi
mov eax, dword [ebp + 0x20]
movzx eax, word [eax]
add edx, eax
push edx
mov ecx, esi
call fcn.1000b225
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10010cf1
Capabilities:
Create thread

Disassembly:
mov eax, 0x1005bb43
call fcn.1005b080
sub esp, 0x1c
push ebx
push esi
mov dword [ebp - 0x20], 0x24bd
mov eax, edx
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
xor ebx, ebx
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x20], 0x2560
mov dword [ebp - 0x24], esi
jle 0x10010d7c
push ebx
push ebx
push 0x18aa
push 0x142c
push ebx
push 0xa07
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x18], ebx
mov ebx, edi
mov edi, 0x36e8
mov eax, ebx
mov ecx, 0x10077178
or eax, esi
cdq
push edx
push eax
call fcn.1000b0cd
dec ebx
dec edi
jne 0x10010d46
mov edi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x4d0f
jl 0x10010d3f
inc esi
push 0
pop ebx
cmp esi, 0x7fe6
jl 0x10010d3a
mov esi, dword [ebp - 0x24]
mov eax, dword [ebp - 0x1c]
cmp byte [ebp + 0x14], 0
je 0x10010e7b
mov esi, dword [ebp + 8]
mov dword [esi], ebx
jmp 0x10010de8
push 1
push 0x623d
push 0x78f6
push 0x150e
push 1
push 0x761a
push 0x1af4
push 0x7bc2
push 0x79fb
push 0x30de
push 0x10b8
push 1
push 0x5271
push esi
push 0x25a9
push 0x15d6
push eax
mov edx, 0x2f08
mov ecx, 0x44d4
call fcn.1000fdc0
mov eax, dword [ebp - 0x1c]
add esp, 0x44
inc dword [esi]
cmp dword [esi], ebx
jle 0x10010d8d
mov dword [ebp - 0x18], 0x5109
cmp dword [ebp - 0x18], 0x5288
jle 0x10010e44
mov esi, ebx
mov dword [ebp - 0x1c], ebx
mov edi, ebx
mov dword [ebp - 0x24], ebx
mov ecx, edi
mov ebx, esi
mov esi, dword [ebp - 0x24]
shl ebx, cl
mov eax, ebx
mov ecx, 0x10077178
and eax, esi
cdq
push edx
push eax
call fcn.1000b0cd
inc esi
cmp esi, 0x6ebc
jl 0x10010e0f
mov esi, dword [ebp - 0x1c]
inc edi
push 0
pop ebx
cmp edi, 0x78ac
jl 0x10010e03
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x7aa1
jl 0x10010e01
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x4fe1
jge 0x10010e5f
mov edx, str.ipslzlx_yaxgob_nxzbnb_safvpd_nulwvmmhk_jhpwkgno_axiyxmki_veui_pmr_vidnijvr_wqxc
mov ecx, 0x10077178
call fcn.1000ca72
jmp 0x10010e9b
mov dword [esi], ebx
jmp 0x10010e96
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x10010e94
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
inc dword [esi]
cmp dword [esi], 1
jle 0x10010e7f
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x220d
jge 0x10010eba
mov edx, str.csfwd_myfkdgdv_kae_rsluussg_mzkun_rdwgc_koatjkowu
mov ecx, 0x10077178
call fcn.1000ca72
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100112b9
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov dword [0x101a4254], ecx
inc edx
mov esi, 0x270
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
mov dword [edx*4 + 0x101a4254], ecx
inc edx
cmp edx, esi
jl 0x100112ce
mov dword [0x101a4250], esi
pop esi
pop ebp
ret 8
Function at 0x100112f4
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x101a4254
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x101a45e0
jl 0x10011302
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x101a4884
jl 0x10011342
mov ecx, dword [0x101a55d0]
xor ecx, dword [0x101a4254]
and ecx, edi
xor ecx, dword [0x101a55d0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x101a4250], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x101a4884]
mov dword [0x101a4c10], eax
pop esi
ret
Function at 0x10017793
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005bdfe
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10017920
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x100177ee
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x1001791e
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x24], 0x6469
mov dword [ebp - 0x38], str.ufd_yudbenbt_zqgmuz_qrshfw
cmp dword [ebp - 0x24], 0x67ce
jle 0x100178c8
and dword [ebp - 0x14], 0
jmp 0x1001781c
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x7cff
jge 0x100178bc
and dword [ebp - 0x18], 0
jmp 0x10017836
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x5eb7
jge 0x100178b7
and dword [ebp - 0x1c], 0
jmp 0x1001784c
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x21fc
jge 0x100178b2
and dword [ebp - 0x20], 0
jmp 0x10017862
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x6152
jge 0x100178b0
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sar eax, cl
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
shl edx, cl
or eax, edx
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x64]
call fcn.10002a51
pop ecx
pop ecx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
call fcn.1000b0ad
push eax
call fcn.1004498a
pop ecx
lea ecx, [ebp - 0x64]
call fcn.100013f2
jmp 0x1001785b
jmp 0x10017845
jmp 0x1001782f
jmp 0x10017815
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x644a
jge 0x100178e4
push dword [ebp - 0x38]
call fcn.1004498a
pop ecx
jmp 0x10017900
or dword [ebp - 4], 0xffffffff
jmp 0x1001790a
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x1001791e
push 0
push 0
call dword [sym.imp.USER32.dll_CharLowerBuffW]
jmp 0x10017946
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x40], eax
push 1
push dword [ebp - 0x40]
push 0x4fa3
push 0x52b2
push dword [ebp - 0x44]
call fcn.100164e1
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10019474
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005be70
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x5c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100195ea
mov dword [ebp - 0x24], 0x7bc4
mov dword [ebp - 0x2c], str.kveca_wjbq_ljgpfqowu_zdzy_xhotohntj_pqimqsize_fccwx_yknhxz_ugbds
cmp dword [ebp - 0x24], 0x7cd2
jle 0x10019558
push 0x25f2
push 0
push 0
push 0xd69
push 0
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
and dword [ebp - 0x20], 0
jmp 0x100194e0
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x76b
jge 0x10019558
and dword [ebp - 0x18], 0
jmp 0x100194f6
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x3eac
jge 0x10019556
and dword [ebp - 0x1c], 0
jmp 0x1001950c
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x4d2b
jge 0x10019554
mov eax, dword [ebp - 0x18]
cdq
idiv dword [ebp - 0x1c]
or edx, dword [ebp - 0x20]
mov eax, edx
cdq
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], edx
push dword [ebp - 0x50]
push dword [ebp - 0x54]
lea ecx, [ebp - 0x6c]
call fcn.10002a51
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
call fcn.1000b0ad
push eax
call fcn.1004498a
pop ecx
lea ecx, [ebp - 0x6c]
call fcn.100013f2
jmp 0x10019505
jmp 0x100194ef
jmp 0x100194d9
lea eax, [ebp + 0x14]
mov dword [ebp - 0x30], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x78b1
jge 0x10019574
push dword [ebp - 0x2c]
call fcn.1004498a
pop ecx
jmp 0x10019590
or dword [ebp - 4], 0xffffffff
jmp 0x1001959a
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x100195d3
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x100195d1
push 0x5db3
push 1
push 0x37c1
push 1
push 0x56ee
call fcn.10017793
add esp, 0x14
jmp 0x100195e8
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [eax], 0xbdfddca6
jmp 0x10019622
lea eax, [ebp + 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x1001960e
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x10019622
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
and dword [eax], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002afc9
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1002b044
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002b036
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1002b021
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 6
jle 0x1002b034
mov eax, dword [ebp - 0x1c]
mov dword [eax], 0xbdfddca6
jmp 0x1002b016
jmp 0x1002b042
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x1002b058
push 0
push 0x1aa9
push 0x3e35
call fcn.1002fe61
add esp, 0xc
mov esp, ebp
pop ebp
ret