joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10035b60
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x10083c3c]
test eax, eax
jne 0x10035bc9
push dword [0x100829d0]
call dword [sym.imp.kernel32.dll_TlsGetValue]
test eax, eax
jne 0x10035bc9
push esi
push 0x178
call fcn.10046ec0
add esp, 4
test eax, eax
je 0x10035b96
mov ecx, eax
call fcn.10046ec0
mov esi, eax
jmp 0x10035b98
xor esi, esi
cmp byte [0x10083c38], 0
jne 0x10035bb2
mov ecx, esi
mov dword [0x10083c3c], esi
call fcn.1001d6f0
mov eax, esi
pop esi
ret
push esi
push dword [0x100829d0]
call dword [sym.imp.kernel32.dll_TlsSetValue]
mov ecx, esi
call fcn.1001d6f0
mov eax, esi
pop esi
ret

Function at 0x10035bd0
Capabilities:
Get thread local storage value
Set thread local storage value

Disassembly:
mov eax, dword [0x100829d0]
cmp eax, 0xffffffff
je 0x10035c26
push esi
push eax
call dword [sym.imp.kernel32.dll_TlsGetValue]
mov esi, eax
test esi, esi
je 0x10035c17
mov ecx, dword [0x10083c3c]
xor eax, eax
cmp esi, ecx
cmove ecx, eax
mov dword [0x10083c3c], ecx
mov ecx, esi
call fcn.1001d720
mov ecx, esi
call fcn.1001d6c0
push 0x178
push esi
call fcn.10046ec0
add esp, 8
push 0
push dword [0x100829d0]
call dword [sym.imp.kernel32.dll_TlsSetValue]
pop esi
ret

Function at 0x10046ec0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x10046ecf
pop dword [ebp - 8]
mov eax, 0x4a47777a
sub eax, 0x3a4308ab
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xe14aa4fd
add dword [ebp - 0x18], 0x6d07a04e
mov dword [ebp - 0x14], 0x882c59ed
add dword [ebp - 0x14], 0xaa06f258
mov dword [ebp - 0x10], 0xefa2683c
sub dword [ebp - 0x10], 0xa356240e
mov dword [ebp - 0xc], 0x85a1db9d
add dword [ebp - 0xc], 0x7a5e2463
lea eax, [ebp - 0x18]
push eax
mov eax, 0x364fb811
sub eax, 0x2649f7f1
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0x65cbb8ba
add dword [ebp - 0x18], 0xea6b09c
mov dword [ebp - 0x14], 0x888f553
add dword [ebp - 0x14], 0x38e36c22
mov dword [ebp - 0x10], 0xc10136a8
add dword [ebp - 0x10], 0xa26e35c4
mov dword [ebp - 0xc], 0xfbe699a8
sub dword [ebp - 0xc], 0xfbe699a8
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0xeec292cb
sub eax, 0xdebcd2af
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x52699
push 0
call eax
mov ecx, 0x1df8e7c7
sub ecx, 0x1df8a348
mov edx, eax
mov ebx, 0xb844d653
sub ebx, 0xa83bba53
add ebx, dword [ebp - 8]
mov edi, 0xefbdcaf5
sub edi, 0x9818b838
mov dword [ebp - 4], 0xc1c7be2c
mov esi, dword [ebx]
add dword [ebp - 4], edi
sub esi, edi
xor dword [ebp - 4], 0x47515c4e
mov dword [edx], esi
sub dword [ebp - 4], edx
add edx, 4
add ebx, 0x13d959f2
add ebx, 0xec26a612
loop 0x10046ff1
add eax, 0x104cf
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0xd8a3a3ae
add ecx, 0x375c5c52
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x40618e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x120
push esi
mov esi, 0x104
lea eax, [ebp - 0x120]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp eax, esi
pop esi
jbe 0x4061b2
xor eax, eax
test eax, eax
je 0x4061c4
cmp byte [ebp + eax - 0x121], 0x5c
je 0x4061c4
xor ecx, ecx
jmp 0x4061c7
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx + 0x409014]
lea eax, [ebp + eax - 0x120]
push ecx
push str._s_s.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfA]
add esp, 0x10
lea eax, [ebp - 0x120]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExA]
leave
ret 4

Function at 0x406271
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4222c4], 0
push esi
jne 0x4062a8
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406282
mov dword [ecx*4 + 0x4222c0], eax
inc ecx
cmp ecx, 0x100
jl 0x40627d
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4062d9
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4222c0]
xor eax, esi
inc ecx
dec edx
jne 0x4062bb
pop edi
not eax
pop esi
ret 0xc

Function at 0x414b40
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0xe000]
push edi
or ebp, 0xffffffff
jmp 0x414b62
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x414b69
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x414b58
mov eax, 1
add ebx, ebx
jne 0x414b7b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x414b70
jne 0x414b8c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414b70
xor ecx, ecx
sub eax, 3
jb 0x414ba0
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x414c12
mov ebp, eax
add ebx, ebx
jne 0x414bab
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x414bb8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x414bdc
inc ecx
add ebx, ebx
jne 0x414bc8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x414bbd
jne 0x414bd9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x414bbd
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x414bfc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x414bed
jmp 0x414b5e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x414bfc
add edi, ecx
jmp 0x414b5e
pop esi
mov edi, esi
mov ecx, 0x43b
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x414c1a
cmp byte [edi], 0
jne 0x414c1a
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x414c1f
lea edi, [esi + 0x12000]
Function at 0x10008880
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
lea ebp, [esp - 0x39c]
sub esp, 0x41c
mov eax, dword [0x10028164]
xor eax, ebp
mov dword [ebp + 0x398], eax
mov edx, dword [ebp + 0x3a8]
mov eax, dword [ebp + 0x3a4]
push ebx
push esi
xor esi, esi
mov dword [ebp - 0x70], edx
mov edx, dword [ebp + 0x3ac]
mov dword [ebp - 0x74], eax
mov dword [ebp - 0x78], edx
mov dword [ebp - 0x7c], ecx
mov dword [ebp - 0x80], esi
mov dword [ebp - 0x6c], esi
push edi
test eax, eax
je 0x10008a43
mov ecx, eax
lea edx, [ecx + 2]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x100088d1
sub ecx, edx
sar ecx, 1
lea eax, [ecx + 1]
mov ecx, 2
imul ecx
mov edi, eax
test edx, edx
jg 0x10008977
jl 0x100088fe
cmp edi, 0x7fffffff
ja 0x10008977
cmp edx, 0xffffffff
jl 0x10008977
jg 0x1000890d
cmp edi, 0x80000000
jb 0x10008977
cmp edi, 0x400
jg 0x1000892d
push edi
call fcn.1001b8d3
add esp, 4
test al, al
je 0x1000892d
mov eax, edi
call fcn.1000bf00
mov ebx, esp
jmp 0x10008951
mov eax, edi
not eax
cmp eax, 8
jb 0x10008a91
lea eax, [edi + 8]
push eax
call fcn.1001b8d3
add esp, 4
test eax, eax
je 0x10008977
mov dword [eax], esi
lea ebx, [eax + 8]
mov esi, eax
test ebx, ebx
je 0x10008977
push 0
push 0
push edi
push ebx
push 0xffffffffffffffff
push dword [ebp - 0x74]
mov byte [ebx], 0
push 0
push 3
call dword [sym.imp.kernel32.dll_WideCharToMultiByte]
mov edi, eax
neg edi
sbb edi, edi
and edi, ebx
jmp 0x10008979
xor edi, edi
test edi, edi
je 0x10008a43
push 0x60
push 0
push edi
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov ebx, eax
test ebx, ebx
jne 0x100089ae
push 2
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadLibraryExA]
mov ebx, eax
test ebx, ebx
jne 0x100089ae
call fcn.10003920
mov edi, eax
jmp 0x10008a48
push dword [ebp - 0x78]
push dword [ebp - 0x70]
push ebx
call dword [sym.imp.kernel32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x100089c8
call fcn.10003920
jmp 0x10008a34
push edi
push ebx
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x70], eax
test eax, eax
jne 0x100089de
call fcn.10003920
jmp 0x10008a34
push edi
push ebx
call dword [sym.imp.kernel32.dll_SizeofResource]
mov edi, eax
lea eax, [edi + 1]
cmp eax, edi
jae 0x100089f6
mov edi, 0x8007000e
jmp 0x10008a36
push eax
lea ecx, [ebp - 0x6c]
call fcn.100033c0
cmp dword [ebp - 0x6c], 0
jne 0x10008a0c
mov edi, 0x8007000e
jmp 0x10008a36
push edi
push dword [ebp - 0x70]
push edi
push dword [ebp - 0x6c]
call fcn.1000aa30
mov eax, dword [ebp - 0x6c]
lea ecx, [ebp - 0x80]
add esp, 0x10
mov byte [eax + edi], 0
push dword [ebp + 0x3b0]
push dword [ebp - 0x6c]
call fcn.100086f0
mov edi, eax
test ebx, ebx
je 0x10008a48
push ebx
call dword [sym.imp.kernel32.dll_FreeLibrary]
jmp 0x10008a48
mov edi, 0x8007000e
lea eax, [ebp - 0x68]
cmp dword [ebp - 0x6c], eax
je 0x10008a58
lea ecx, [ebp - 0x6c]
call fcn.10005750
test esi, esi
je 0x10008a6f
nop dword [eax]
push esi
mov esi, dword [esi]
call fcn.1001b8d3
add esp, 4
test esi, esi
jne 0x10008a60
mov eax, edi
lea esp, [ebp - 0x8c]
pop edi
pop esi
pop ebx
mov ecx, dword [ebp + 0x398]
xor ecx, ebp
call fcn.1000bc54
lea esp, [ebp + 0x39c]
pop ebp
ret 0x10
push 0x80070216
call fcn.100013a0
int3
Function at 0x1000aeb0
Capabilities:
Create process on windows

Disassembly:
mov eax, dword [esp + 4]
test eax, eax
jne 0x1000aeb9
ret
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push dword [esp + 0x28]
push eax
call dword [sym.imp.kernel32.dll_CreateProcessA]
ret

Function at 0x1001b8d3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
pushal
call 0x1001b8e2
pop dword [ebp - 0x10]
mov eax, 0xecbb5e80
add eax, 0x23465a62
sub dword [ebp - 0x10], eax
push 0x40
push 0x1000
push 0x3e7b3
push 0
mov eax, 0x74e7c1ce
sub eax, 0x64e5e072
add eax, dword [ebp - 0x10]
call dword [eax]
mov ecx, 0x565a
mov edx, eax
mov ebx, 0x9df3ace5
sub ebx, 0x8df0cae5
add ebx, dword [ebp - 0x10]
mov esi, 0x733fb0ac
sub esi, 0xf43848ca
mov edi, dword [ebx]
xor dword [ebp - 0xc], ecx
add edi, esi
add dword [ebp - 0xc], 0x9be78118
mov dword [edx], edi
sub dword [ebp - 8], 0x9094aa6a
add edx, 0x619761a5
add edx, 0x9e689e5f
add ebx, 4
loop 0x1001b93b
add eax, 0x4102928e
add eax, 0xbefeb9ad
xor ebx, ebx
add ebx, eax
add eax, 0x8f1708d9
add eax, 0x70e8f72c
mov ecx, 0x78b5d0a0
add ecx, 0x974a2f60
add ecx, dword [ebp - 0x10]
call ebx
leave
ret
Function at 0x432004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
nop
cmp eax, 0
nop
nop
nop
nop
nop
je 0x432072
mov ebx, 0x40c7d0
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x38bd1bfa
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
loop 0x432060
nop
nop
mov eax, section..text_1
nop
nop
nop
cmp eax, 0
nop
nop
je 0x4320d2
nop
nop
mov ebx, 0x42f314
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x665c572e
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
loop 0x4320c0
nop
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x432005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
mov eax, section..text
mov ebx, 0x40c7d0
nop
nop
mov ecx, 0x74ae60c2
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x43204e
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
jne 0x432024
mov eax, section..data
nop
nop
mov ebx, 0x42f314
mov ecx, 0x34390540
nop
nop
nop
nop
test eax, eax
nop
nop
nop
je 0x432084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
jne 0x43206c
nop
nop
popal
nop
nop
nop
nop
jmp 0x431219
Function at 0x10006792
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10055fc2
call fcn.10055910
sub esp, 0x14
push ebx
push esi
mov dword [ebp - 0x18], 0x736f
mov eax, edx
cmp dword [ebp - 0x18], 0x750d
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], eax
jle 0x10006805
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov esi, edx
mov eax, esi
mov ecx, 0x10071e38
xor eax, ebx
cdq
push edx
push eax
call fcn.10003dea
inc ebx
cmp ebx, 0x7e74
jl 0x100067ca
mov esi, dword [ebp - 0x14]
inc edi
cmp edi, 0x265c
jl 0x100067c1
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0xdde
jl 0x100067bf
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov eax, dword [ebp - 0x1c]
push dword [ebp + 8]
push ecx
push eax
xor cl, cl
call fcn.10006bfe
and dword [ebp - 4], 0
add esp, 0xc
cmp dword [ebp - 0x18], 0x71d9
jge 0x10006830
mov edx, str.mbnyolnu_iqr_fzi
mov ecx, 0x10071e38
call fcn.10005f73
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10006a82
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
mov byte [esp + 8], dl
mov ebx, ecx
mov dword [esp + 0x10], 0x6c83
cmp dword [esp + 0x10], 0x7026
push esi
push edi
mov dword [esp + 0x1c], ebx
jle 0x10006b16
xor esi, esi
mov dword [esp + 0x14], esi
xor edi, edi
mov eax, esi
mov esi, 0x1b31
cdq
idiv edi
mov ebx, edx
mov eax, ebx
lea ecx, [esp + 0x20]
cdq
push edx
push eax
call fcn.10002462
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10006ad6
mov eax, dword [eax]
push eax
call fcn.1003eb1f
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.10004229
dec ebx
dec esi
jne 0x10006abe
mov esi, dword [esp + 0x14]
inc edi
cmp edi, 0x15a8
jl 0x10006ab2
inc esi
mov dword [esp + 0x14], esi
cmp esi, 0x732b
jl 0x10006ab0
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ebx, dword [esp + 0x1c]
cmp dword [esp + 0x18], 0x68f7
jge 0x10006b2b
push str.qgewwecet_wbglzpg_onwubcdm_bnisq_gxxhalh_cne
call fcn.1003eb1f
pop ecx
cmp byte [esp + 0x10], 0
je 0x10006b3c
push 0
call dword [sym.imp.USER32.dll_DestroyMenu]
jmp 0x10006b3e
dec dword [ebx]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006bfe
Capabilities:
Encode data using xor
Get common file path

Disassembly:
mov eax, 0x10056002
call fcn.10055910
sub esp, 0x2c
push ebx
push esi
mov byte [ebp - 0x14], cl
xor esi, esi
mov dword [ebp - 0x1c], 0x772e
cmp dword [ebp - 0x1c], 0x774d
push edi
mov dword [ebp - 0x10], esp
jle 0x10006c77
mov edi, esi
mov dword [ebp - 0x18], esi
mov ebx, esi
mov eax, edi
mov dword [ebp - 0x20], esi
cdq
idiv ebx
mov edi, edx
mov eax, edi
mov ecx, 0x10071e38
xor eax, esi
cdq
push edx
push eax
call fcn.10003dea
inc esi
cmp esi, 0xa1b
jl 0x10006c37
mov edi, dword [ebp - 0x18]
inc ebx
push 0
pop esi
cmp ebx, 0x27d3
jl 0x10006c2d
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x43c7
jl 0x10006c2b
push 0x1f7b
call dword [sym.imp.USER32.dll_GetSysColor]
mov dword [ebp - 0x18], 0x595a
cmp dword [ebp - 0x18], 0x5cb1
jle 0x10006ce1
push 0x123f
push esi
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
mov edi, esi
mov ebx, esi
mov eax, ebx
lea ecx, [ebp - 0x38]
and eax, edi
cdq
push edx
push eax
call fcn.10002462
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10006cb0
mov eax, dword [eax]
push eax
call fcn.1003eb1f
pop ecx
push esi
push 1
lea ecx, [ebp - 0x38]
call fcn.10004229
inc ebx
cmp ebx, 0x624
jl 0x10006c97
inc edi
cmp edi, 0x66c6
jl 0x10006c95
push esi
push 0x13f3
push esi
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
cmp dword [ebp - 0x18], 0x5896
jge 0x10006cf5
push str.nxyf_diugvvah_lzcade_zlnssjsme_qip_hqhwoe_ddawlcqr_sxcxdrwk_tprqafry_hxnpqsxxd_trusw
call fcn.1003eb1f
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x14], 0
je 0x10006d0f
push esi
push 0xd17
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x10006d33
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0xffffffff
je 0x10006d33
push esi
push eax
push 0x7535
push dword [ebp + 8]
mov edx, 0x43d3
mov ecx, 0x2039
call fcn.10006b45
add esp, 0x10
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x7467
jge 0x10006d52
mov edx, str.tfggd_hitjeuo_vciajfix_gxi_vtexsrwrb_cnfuxbfpt_iggnaass
mov ecx, 0x10071e38
call fcn.10005f73
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008f0c
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100561c9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
push ebx
push esi
push edi
mov eax, ecx
mov dword [esp + 0x10], 0x3426
cmp dword [esp + 0x10], 0x3746
mov ebx, edx
push 0
mov dword [esp + 0x10], eax
pop ecx
jle 0x10008fad
push ecx
push 0x12a6
push 0x23ae
push 0x7ea
call dword [sym.imp.GDI32.dll_MoveToEx]
xor esi, esi
xor edi, edi
mov eax, esi
lea ecx, [esp + 0x38]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10002462
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10008f81
mov eax, dword [eax]
push eax
call fcn.1003eb1f
pop ecx
push 0
push 1
lea ecx, [esp + 0x40]
call fcn.10004229
inc edi
cmp edi, 0x1670
jl 0x10008f64
inc esi
cmp esi, 0x5f15
jl 0x10008f62
mov eax, dword [esp + 0xc]
xor ecx, ecx
cmp byte [ebp + 0x14], 0
je 0x100090bd
sub esp, 0x18
mov ecx, esp
push eax
call fcn.10003eff
lea ecx, [esp + 0x2c]
call fcn.100088c1
add esp, 0x18
and dword [esp + 0x5c], 0
mov eax, dword [esp + 0x18]
cmp dword [esp + 0x14], eax
je 0x10009040
push dword [esp + 0x10]
and dword [esp + 0x34], 0
xor ecx, ecx
push eax
push dword [esp + 0x1c]
mov word [esp + 0x2c], cx
lea ecx, [esp + 0x2c]
mov dword [esp + 0x40], 7
call fcn.1000adaf
mov ecx, dword [ebp + 8]
lea edx, [esp + 0x20]
mov byte [esp + 0x5c], 1
call fcn.10008d4c
lea ecx, [esp + 0x20]
push 0
push 1
test eax, eax
jns 0x10009036
mov byte [ebx], 1
call fcn.10004734
lea ecx, [esp + 0x14]
call fcn.1000aadc
jmp 0x100090de
mov byte [esp + 0x64], 0
call fcn.10004734
mov byte [ebx], 0
mov dword [esp + 0x10], 0x7d0d
cmp dword [esp + 0x10], 0x7fa1
jle 0x10009028
xor esi, esi
mov dword [esp + 0x10], esi
xor edi, edi
mov dword [esp + 0xc], edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov edi, edx
xor esi, esi
mov eax, ebx
cdq
idiv esi
mov eax, edi
mov ecx, edx
sar eax, cl
mov ecx, 0x10071e38
cdq
push edx
push eax
call fcn.10003dea
inc esi
cmp esi, 0x2bde
jl 0x1000906c
inc ebx
cmp ebx, 0x6bab
jl 0x1000906a
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
inc edi
mov dword [esp + 0xc], edi
cmp edi, 0x48d6
jl 0x10009061
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0x108
jl 0x1000905b
jmp 0x10009028
push ecx
push ecx
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
cmp dword [esp + 0x10], 0x3324
jge 0x100090de
push str.wljbgx_fbmg_wrshhf_vyyprvb_qkufbtrt_uefvmfz_lgfish_lknmagoh
call fcn.1003eb1f
pop ecx
mov ecx, dword [esp + 0x54]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000affa
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
cmp byte [ebp + 8], 0
push ebx
push edi
mov edi, ecx
mov dword [esp + 0x1c], edi
je 0x1000b0c5
mov dword [esp + 0x14], 0x567c
cmp dword [esp + 0x14], 0x56a2
jle 0x1000b08e
xor edi, edi
xor ebx, ebx
mov dword [esp + 0x10], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0xc], 0x699d
mov eax, ebx
lea ecx, [esp + 0x20]
and eax, edi
cdq
push edx
push eax
call fcn.10002462
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000b055
mov eax, dword [eax]
push eax
call fcn.1003eb1f
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.10004229
dec ebx
dec dword [esp + 0xc]
jne 0x1000b03b
mov ebx, dword [esp + 0x10]
inc ebx
mov dword [esp + 0x10], ebx
cmp ebx, 0x14af
jl 0x1000b02f
inc edi
cmp edi, 0x77ac
jl 0x1000b029
mov edi, dword [esp + 0x1c]
mov dword [edi], 0
cmp dword [edi], 3
jge 0x1000b0ae
mov edx, dword [ebp + 0xc]
mov ecx, dword [edi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0xfdf99ff6
inc dword [edi]
cmp dword [edi], 3
jl 0x1000b09c
cmp dword [esp + 0x14], 0x52fb
jge 0x1000b0d6
push str.kvzlxp_wjylqgve_zvhp_kwa_arwipmlh
call fcn.1003eb1f
pop ecx
jmp 0x1000b0d6
push 0
push 0xd17
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000b7ba
Capabilities:
Query or enumerate registry value

Disassembly:
mov eax, 0x10056332
call fcn.10055910
sub esp, 0x1c
mov byte [ebp - 0x18], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x1000b887
mov dword [ebp - 0x20], 0x2bc8
cmp dword [ebp - 0x20], 0x2e4e
jle 0x1000b830
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
and dword [ebp - 0x24], 0
mov ebx, esi
mov esi, dword [ebp - 0x24]
mov ecx, edi
sar ebx, cl
mov ecx, esi
mov eax, ebx
shl eax, cl
mov ecx, 0x10071e38
cdq
push edx
push eax
call fcn.10003dea
inc esi
cmp esi, 0x75ef
jl 0x1000b7fc
mov esi, dword [ebp - 0x1c]
inc edi
cmp edi, 0x612b
jl 0x1000b7ef
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x6d24
jl 0x1000b7ed
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x1000b84c
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x28d2
jge 0x1000b868
mov edx, str.aqnxnifpo_zlmdib_talkuev_cdcyvdaot
mov ecx, 0x10071e38
call fcn.10005f73
jmp 0x1000b933
mov dword [ebp - 0x24], 0x49f4
cmp dword [ebp - 0x24], 0x4b63
jle 0x1000b8f1
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x20], edi
xor ebx, ebx
and dword [ebp - 0x28], 0
add edi, ebx
add edi, esi
mov esi, dword [ebp - 0x28]
mov ecx, esi
mov eax, edi
sar eax, cl
mov ecx, 0x10071e38
cdq
push edx
push eax
call fcn.10003dea
inc esi
cmp esi, 0x6574
jl 0x1000b8ae
mov esi, dword [ebp - 0x1c]
inc ebx
mov edi, dword [ebp - 0x20]
cmp ebx, 0x4a4d
jl 0x1000b8a3
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x2abd
jl 0x1000b8a1
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x5787
jl 0x1000b89c
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0x46dc
jge 0x1000b910
mov edx, str.fyp_sibuq_ffck_hpxafuqo_optkbhkt_apn_xszcglzg_krfiok
mov ecx, 0x10071e38
call fcn.10005f73
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x1000b933
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x399841b3
inc dword [edx]
cmp dword [edx], 3
jl 0x1000b921
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000ce5e
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x1000ce75
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x1000ce97
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x10072fe4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x10073370
jl 0x1000cea5
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x10073614
jl 0x1000cee5
mov ecx, dword [0x10074360]
xor ecx, dword [0x10072fe4]
and ecx, edi
xor ecx, dword [0x10074360]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x10072fe0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10073614]
mov dword [0x100739a0], eax
pop esi
ret