joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1005d423
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x654], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x653]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.1005c525
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
invalid
invalid
sahf
cld

Function at 0x10071422
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 0xc]
push edi
mov dword [ebp - 4], ecx
test esi, esi
jne 0x1007143c
call fcn.100090c2
mov esi, dword [eax + 0xc]
push dword [0x1016548c]
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x1007145a
xor eax, eax
pop edi
pop esi
leave
ret 8
push edi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov dword [ebp + 0xc], eax
test eax, eax
je 0x10071452
push ebx
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
test ebx, ebx
jne 0x10071487
xor esi, esi
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop ebx
jmp 0x10071454
push edi
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 4]
push eax
push ebx
call fcn.10071350
mov esi, eax
jmp 0x10071479

Function at 0x100ce207
Capabilities:
Resolve function by parsing pe exports

Disassembly:
mov edi, edi
push esi
mov esi, ecx
call fcn.10014471
call fcn.1000451b
cmp eax, esi
pop esi
jne 0x100ce223
mov ecx, 0x10161d98
jmp fcn.1000f194
ret
Function at 0x100d1b94
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
test byte [esi + 4], 1
push edi
mov ebx, ecx
je 0x100d1bac
mov edi, dword [esi + 0xc]
jmp 0x100d1bec
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceA]
mov edi, eax
test edi, edi
jne 0x100d1bc5
call fcn.1000a444
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x100d1bda
call fcn.1000a444
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x100d1bec
call fcn.1000a444
call fcn.100090c2
cmp dword [eax + 0x3c], 0
je 0x100d1c01
push edi
mov ecx, ebx
call fcn.100d09d0
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.100d1aae
mov dword [ebp + 8], eax
mov eax, dword [ebx + 0x7c]
test eax, eax
je 0x100d1c1f
push eax
call dword [sym.imp.KERNEL32.dll_GlobalFree]
and dword [ebx + 0x7c], 0
mov eax, dword [ebp + 8]
test eax, eax
je 0x100d1c2b
mov edi, eax
mov dword [ebx + 0x7c], eax
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
pop ebp
ret 8

Function at 0x100f6fd5
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1016039c]
jne 0x100f6fdf
repz ret
jmp fcn.1010155c
Function at 0x1010a1f4
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x1016039c]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.100fe025
and dword [ebp - 0x14], 0
cmp dword [0x10167c64], 0
mov dword [ebp - 0x18], eax
jne 0x1010a2a7
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x1010a34f
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x1010a34f
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push 0x10143780
push ebx
mov dword [0x10167c64], eax
call edi
push eax
call esi
push 0x1014376c
push ebx
mov dword [0x10167c68], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x10167c6c], eax
call edi
push eax
call esi
mov dword [0x10167c74], eax
test eax, eax
je 0x1010a2a7
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x10167c70], eax
mov eax, dword [0x10167c70]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x1010a300
cmp dword [0x10167c74], ecx
je 0x1010a300
push eax
call esi
push dword [0x10167c74]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x1010a300
test ebx, ebx
je 0x1010a300
call edi
test eax, eax
je 0x1010a2f7
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x1010a2f7
test byte [ebp - 8], 1
jne 0x1010a300
or dword [ebp + 0x10], 0x200000
jmp 0x1010a333
mov eax, dword [0x10167c68]
cmp eax, dword [ebp - 0x18]
je 0x1010a333
push eax
call esi
test eax, eax
je 0x1010a333
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x1010a333
mov eax, dword [0x10167c6c]
cmp eax, dword [ebp - 0x18]
je 0x1010a333
push eax
call esi
test eax, eax
je 0x1010a333
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x10167c64]
call esi
test eax, eax
je 0x1010a34f
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x1010a351
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100f6fd5
leave
ret
Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43200c
nop
nop
nop
nop
pop eax
nop
nop
add eax, 0x40729f
sub eax, 0x407245
nop
nop
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x432030
nop
nop
nop
add eax, 0xc
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
jne 0x43201e
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219

Function at 0x4059f0
Capabilities:
Access peb ldr_data
Get ntdll base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x426d76
mov eax, dword fs:[0]
push eax
push ebx
push esi
push edi
mov eax, dword [0x45190c]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [ebp + 0x10]
mov dword [ebx], 0x428da8
mov dword [ebx + 4], edx
mov dword [ebx + 8], edx
mov dword [ebx + 0xc], edx
mov dword [ebx + 0x10], edx
mov dword [ebx + 0x14], edx
mov dword [ebx + 0x18], edx
mov dword [ebx + 0x1c], edx
mov dword [ebx + 0x20], edx
mov dword [ebx + 0x24], edx
mov dword [ebx + 0x28], edx
or dword [ebx + 0x2c], 0xffffffff
mov dword [ebx + 0x30], edx
mov dword [ebx + 0x34], edx
mov dword [ebx + 0x38], edx
mov dword [ebx + 0x3c], edx
mov dword [ebx + 0x40], edx
mov dword [ebx + 0x44], edx
mov dword [ebx + 0x48], edx
mov dword [ebx + 0x4c], edx
mov dword [ebx + 0x50], eax
mov eax, dword [ebp + 8]
mov dword [ebx + 0x5c], eax
mov dword [ebx + 0x60], ecx
mov eax, dword [ecx + 4]
and dword [ebx + 0x8c], 0xffffffc0
and byte [ebx + 0x91], 0x80
or dword [ebx + 0x94], 0xffffffff
or dword [ebx + 0x98], 0xffffffff
mov dword [ebx + 0x64], eax
xor eax, eax
inc eax
mov dword [ebx + 0x68], edx
mov dword [ebx + 0x6c], edx
mov dword [ebx + 0x70], edx
mov dword [ebx + 0x74], edx
mov byte [ebx + 0x90], 0x4f
mov dword [ebx + 0x9c], eax
mov dword [ebx + 0xa0], eax
mov dword [ebx + 0xa4], edx
mov dword [ebx + 0xa8], edx
mov ecx, dword [ecx + 4]
test ecx, ecx
je 0x405acb
mov eax, dword [ecx + 0x24]
mov dword [ebx + 0x78], eax
mov dword [ecx + 0x24], ebx
mov eax, dword [ebx + 0x5c]
lea edi, [ebx + 0x58]
push 1
push edx
push edi
mov dword [eax + 4], ebx
lea esi, [ebx + 0x54]
mov ecx, dword [ebx + 0x60]
push esi
push ecx
mov eax, dword [ecx]
call dword [eax + 0x18]
push 4
push dword [esi]
mov esi, dword [0x4280f8]
push 6
call esi
push 8
push dword [edi]
mov dword [ebx + 0x7c], eax
push 2
call esi
mov ecx, dword [ebx + 0x7c]
mov dword [ebx + 0x80], eax
mov dword [ebx + 0x88], eax
mov eax, ebx
mov dword [ebx + 0x84], ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x10021253
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1006143e
push eax
mov dword fs:[0], esp
sub esp, 0x58
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
je 0x1002129b
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1002146d
xor ebx, ebx
push ebx
push 0x1f5b
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x1002146d
xor ebx, ebx
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], bl
je 0x1002146d
mov dword [esp + 0x24], 0x1dd4
cmp dword [esp + 0x24], 0xf6c
jge 0x10021462
lea eax, [esp + 0x30]
push eax
lea eax, [esp + 0x18]
push eax
push str._ld__ld
call fcn.10048aff
add esp, 0xc
lea ecx, [esp + 0x34]
push dword [esp + 0x14]
call fcn.10029352
xor edi, edi
mov dword [esp + 0x6c], ebx
mov esi, dword [esp + 0x14]
inc edi
cmp esi, edi
jle 0x10021345
lea eax, [esp + 0x10]
push eax
lea eax, [esp + 0x1c]
push eax
push str._ld__ld
call fcn.10048aff
mov eax, dword [esp + 0x24]
lea ecx, [esp + 0x1c]
add esp, 0xc
dec eax
dec dword [esp + 0x10]
mov dword [esp + 0x18], eax
push ecx
imul ecx, eax, 0xc
add ecx, dword [esp + 0x38]
call fcn.100293c7
imul ecx, dword [esp + 0x10], 0xc
lea eax, [esp + 0x18]
push eax
add ecx, dword [esp + 0x38]
call fcn.100293c7
mov esi, dword [esp + 0x14]
inc edi
cmp edi, esi
jl 0x100212f4
lea eax, [esp + 0x28]
mov dword [esp + 0x28], ebx
push eax
lea eax, [esi + 0x1f]
mov dword [esp + 0x54], ebx
shr eax, 5
lea ecx, [esp + 0x54]
push eax
mov dword [esp + 0x5c], ebx
mov dword [esp + 0x60], ebx
call fcn.10029a13
mov dword [esp + 0x5c], ebx
push esi
lea ecx, [esp + 0x54]
mov byte [esp + 0x70], 1
call fcn.100296c4
lea eax, [esp + 0x1c]
mov byte [esp + 0x6c], 2
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x24], ebx
push eax
lea eax, [esp + 0x58]
mov dword [esp + 0x24], ebx
push ebx
push eax
lea edx, [esp + 0x44]
xor ecx, ecx
call fcn.100211a1
mov esi, dword [esp + 0x24]
lea eax, [esp + 0x3c]
add esp, 0x10
mov dword [esp + 0x2c], ebx
lea ecx, [esp + 0x40]
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
push eax
lea eax, [esi + 0x1f]
shr eax, 5
push eax
call fcn.10029a13
mov dword [esp + 0x4c], ebx
push esi
lea ecx, [esp + 0x44]
mov byte [esp + 0x70], 3
call fcn.100296c4
lea eax, [esp + 0x1c]
mov byte [esp + 0x6c], 4
mov ecx, dword [esp + 0x1c]
lea edx, [esp + 0x34]
push eax
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x48]
push ebx
push eax
call fcn.100211a1
push dword [esp + 0x30]
push str._ld_n
call fcn.100483dc
add esp, 0x18
mov dword [esp + 0x4c], ebx
cmp dword [esp + 0x40], 0
je 0x10021438
push dword [esp + 0x40]
call fcn.100485a9
pop ecx
mov dword [esp + 0x40], ebx
mov dword [esp + 0x44], ebx
mov dword [esp + 0x48], ebx
cmp dword [esp + 0x50], 0
mov dword [esp + 0x5c], ebx
je 0x10021459
push dword [esp + 0x50]
call fcn.100485a9
pop ecx
mov dword [esp + 0x50], ebx
mov dword [esp + 0x54], ebx
mov dword [esp + 0x58], ebx
lea ecx, [esp + 0x34]
call fcn.10029749
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
mov ecx, dword [esp + 0x64]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002240e
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
mov dword [ebp - 8], 0x3b61
cmp dword [ebp - 8], 0x3e12
push esi
push edi
jle 0x1002248c
xor esi, esi
mov ebx, esi
mov dword [ebp - 4], 0x6871
xor edi, edi
mov ecx, edi
mov eax, ebx
shl eax, cl
lea ecx, [ebp - 0x20]
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002244f
mov eax, dword [eax]
push eax
call fcn.100483dc
pop ecx
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.10004d74
inc edi
cmp edi, 0x46c
jl 0x10022434
dec ebx
dec dword [ebp - 4]
jne 0x10022432
inc esi
cmp esi, 0x6121
jl 0x10022429
push 0x1c43
push 0x237c
push 0
call dword [sym.imp.GDI32.dll_PtInRegion]
cmp dword [ebp - 8], 0x399e
jge 0x100224a0
push str.enmimrhmn_jpfcywyvr_lrye_mkebw_famuao_czegtcmlg_hfhnbxgq_lnur_tmnlwvdll_jlqlsdkp_qcmjsmwys
call fcn.100483dc
pop ecx
cmp byte [ebp + 8], 0
je 0x100224cb
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x100224d6
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 2
inc dword [edx]
cmp dword [edx], 3
jl 0x100224b7
jmp 0x100224d6
push 0x1d55
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10022515
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov byte [esp + 4], cl
push ebx
push esi
push edi
test dl, dl
je 0x100225eb
cmp byte [ebp + 0xc], 0
je 0x100225e3
mov dword [esp + 0x14], 0xfc9
cmp dword [esp + 0x14], 0x111f
jle 0x100225ae
push 0
push 0
push 0x16e3
push 0
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoW]
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, edi
lea ecx, [esp + 0x18]
cdq
idiv ebx
or edx, esi
mov eax, edx
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002257f
mov eax, dword [eax]
push eax
call fcn.100483dc
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.10004d74
inc ebx
cmp ebx, 0x5052
jl 0x10022560
inc edi
cmp edi, 0x2cb5
jl 0x1002255e
inc esi
cmp esi, 0x6a5c
jl 0x1002255c
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x100225cc
push 0xcce
push ecx
push ecx
push 1
mov ecx, 0x226c
call fcn.100200ef
add esp, 0x10
cmp dword [esp + 0x14], 0xe46
jge 0x1002260d
push str.ntxqe_ymddhrdxu_xfxgtf_ytviz_whiypbwc_cjxzryg_mdxwoauzu_dtxnfz
call fcn.100483dc
pop ecx
jmp 0x1002260d
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
jmp 0x1002260d
test cl, cl
je 0x100225fe
push 0x21a6
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x1002260d
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
neg ecx
mov eax, dword [eax]
mov dword [eax + 8], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100239b1
Capabilities:
Encode data using xor
Enumerate gui resources

Disassembly:
mov eax, 0x10061529
call fcn.10060508
sub esp, 0x1c
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], ecx
je 0x10023a0f
cmp byte [ebp + 0x20], 0
je 0x100239f6
mov byte [ebp + 0xf], 0
cmp byte [ebp + 0xf], 0
je 0x10023b1d
push 0xd63
xor cl, cl
call fcn.1002149a
pop ecx
jmp 0x10023b1d
mov eax, dword [ebp + 0x24]
mov ecx, dword [ebp + 0x28]
mov eax, dword [eax]
mov eax, dword [eax + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x10023b1d
cmp byte [ebp + 0x38], 0
je 0x10023a30
mov eax, dword [ebp + 0x30]
cmp byte [eax], 0
je 0x10023b1d
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x10023b1d
mov dword [ebp - 0x18], 0x350d
cmp dword [ebp - 0x18], 0x35e0
jle 0x10023a9a
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
mov dword [ebp + 0xc], edi
mov ecx, edi
mov dword [ebp - 0x24], esi
xor ebx, ebx
shl esi, cl
xor edi, edi
mov ecx, edi
mov eax, ebx
sar eax, cl
mov ecx, 0x1007c858
xor eax, esi
cdq
push edx
push eax
call fcn.10004668
inc edi
cmp edi, 0x516
jl 0x10023a55
inc ebx
cmp ebx, 0x191e
jl 0x10023a53
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp - 0x14]
inc edi
mov dword [ebp + 0xc], edi
cmp edi, 0x71b3
jl 0x10023a4a
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x5191
jl 0x10023a45
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x336f
jge 0x10023ab6
mov edx, str.yrwjfwsco_fbefetxv_hgurnm_nessmfdgt_cxebvq_egksy_ioutmbnj_htzpxb_ywxtdynf
mov ecx, 0x1007c858
call fcn.10006b3c
mov esi, dword [ebp + 0x34]
xor edx, edx
mov edi, dword [ebp + 0x18]
mov eax, dword [ebp - 0x20]
mov ebx, dword [esi]
mov esi, dword [esi]
mov eax, dword [eax]
mov ecx, dword [edi]
cmp dword [ecx + esi*4], eax
mov esi, dword [ebp + 0x34]
sete dl
mov ecx, dword [esi]
mov eax, dword [esi]
add ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, dword [edi]
setne dl
xor ecx, ecx
cmp dword [eax + ebx*4], edx
mov edx, dword [ebp + 0x2c]
sete cl
mov eax, dword [edx]
sub eax, ecx
mov ecx, dword [ebp - 0x1c]
cmp eax, dword [esi]
jge 0x10023af9
mov eax, dword [ecx]
mov eax, dword [esi]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov eax, dword [ecx]
mov eax, dword [edx]
mov eax, dword [esi]
mov eax, dword [ebp + 8]
mov dword [eax], 0x5c3421ad
mov eax, dword [ebp + 0x1c]
mov dword [eax], 0xe74fd574
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10024696
Capabilities:
Create directory
Modify service

Disassembly:
mov eax, 0x10061563
call fcn.10060508
sub esp, 0x1c
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x10], esp
cmp byte [ebp + 0x10], bl
je 0x100247bb
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x10024700
push 0x1be3
push ebx
push 0x56bc
push 0x2ccc
push 0x1c0e
push 0x79c1
push 1
push 0x6ced
push 1
push 0xa96
push 0x3bb9
push 0x2a26
mov edx, 0x3024
mov ecx, 0x5cd4
call fcn.10023f7c
add esp, 0x30
mov dword [ebp - 0x24], 0x6540
cmp dword [ebp - 0x24], 0x6686
jle 0x10024784
mov esi, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x1c], 0x6916
mov edi, ebx
mov esi, ebx
mov ebx, dword [ebp - 0x18]
mov ecx, esi
mov eax, edi
shl eax, cl
mov ecx, 0x1007c858
and eax, ebx
cdq
push edx
push eax
call fcn.10004668
inc esi
cmp esi, 0x19b3
jl 0x10024726
inc edi
push 0
pop ebx
cmp edi, 0x156d
jl 0x10024721
dec dword [ebp - 0x18]
dec dword [ebp - 0x1c]
jne 0x1002471f
mov esi, dword [ebp - 0x20]
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x4092
jl 0x10024715
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xf5a
push 0xacb
push 0x1ab0
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x24], 0x637b
jge 0x1002479f
mov edx, str.pksvejvtf_rkvnatoy_kvbbav_skmyvkynu_bvceciepy_qud_zdh_tddyznju_lcm_wzqtzqka_dbfqyjg
mov ecx, 0x1007c858
call fcn.10006b3c
jmp 0x100247c3
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003974f
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061db9
call fcn.10060508
sub esp, 0x18
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x10039797
call fcn.10037033
push 0xa
pop ecx
xor edx, edx
div ecx
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x10]
add dx, word [eax]
movzx eax, dx
push eax
call fcn.100292fb
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x20], 0x122c
cmp dword [ebp - 0x20], 0x14f8
jle 0x100397fb
xor edi, edi
xor ebx, ebx
and dword [ebp - 0x1c], 0
xor ecx, ecx
mov dword [ebp - 0x18], 0x18ef
mov dword [ebp - 0x14], ecx
mov eax, ecx
mov ecx, 0x1007c858
xor eax, ebx
or eax, edi
cdq
push edx
push eax
call fcn.10004668
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x1c]
add ecx, eax
dec dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
jne 0x100397bb
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x7e8e
jl 0x100397af
inc ebx
cmp ebx, 0x66ce
jl 0x100397ab
inc edi
cmp edi, 0x6bb0
jl 0x100397a9
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0xf54
jge 0x10039817
mov edx, str.mpwlak_lhhoxrrb_vdnzfa_mpsar_vndbq
mov ecx, 0x1007c858
call fcn.10006b3c
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], 0x388e
cmp dword [ebp - 0x14], 0x3a3a
jle 0x10039884
xor edi, edi
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [ebx + edi]
mov dword [ebp - 0x20], 0xa6
mov dword [ebp - 0x24], eax
mov edi, eax
xor ebx, ebx
mov eax, edi
mov ecx, 0x1007c858
xor eax, ebx
cdq
push edx
push eax
call fcn.10004668
inc ebx
cmp ebx, 0x27bf
jl 0x10039846
dec edi
dec dword [ebp - 0x20]
jne 0x10039844
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x18]
inc ebx
mov dword [ebp - 0x1c], ebx
cmp ebx, 0x6793
jl 0x10039835
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x274e
jl 0x10039830
mov edx, dword [ebp + 0x18]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x100398a7
mov edi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [edi]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [edx]
cmp dword [edx], 1
jl 0x10039895
mov dword [ebp - 4], 2
cmp dword [ebp - 0x14], 0x378e
jge 0x10039786
mov edx, str.axxez_zetncq_uar_jdp_ufs
mov ecx, 0x1007c858
call fcn.10006b3c
jmp 0x10039786
Function at 0x10039fad
Capabilities:
Encode data using xor
Get file attributes

Disassembly:
mov eax, 0x10061e10
call fcn.10060508
sub esp, 0x1c
push ebx
push esi
mov dword [ebp - 0x20], 0x771b
xor ebx, ebx
cmp dword [ebp - 0x20], 0x79c1
push edi
mov dword [ebp - 0x10], esp
jle 0x1003a027
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov edi, ebx
mov dword [ebp - 0x1c], ebx
mov eax, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x24], ebx
mov ebx, eax
and ebx, edi
mov edi, dword [ebp - 0x24]
mov eax, ebx
mov ecx, 0x1007c858
xor eax, edi
cdq
push edx
push eax
call fcn.10004668
inc edi
cmp edi, 0x6954
jl 0x10039fed
mov eax, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x18], eax
push 0
pop ebx
cmp eax, 0x372a
jl 0x10039fe3
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x6c4
jl 0x10039fde
cmp byte [ebp + 0x18], 0
je 0x1003a09c
mov edi, dword [ebp + 0x24]
cmp dword [edi], ebx
jbe 0x1003a06c
call fcn.10037033
push 0x34
pop ecx
xor edx, edx
div ecx
push ecx
push 0x777f
push dword [ebp + 0x3c]
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], edx
push ecx
push eax
push 0x4460
push dword [ebp + 0x10]
mov dl, 1
push ecx
mov ecx, dword [ebp + 0x1c]
call fcn.10039de4
add esp, 0x20
inc ebx
cmp ebx, dword [edi]
jb 0x1003a034
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x74ca
jge 0x1003a08b
mov edx, str.wvt_hkrdqefvv_roisxiyvz_temgzsixq_ppkj_diwfetpcr_uwnlip
mov ecx, 0x1007c858
call fcn.10006b3c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [ebp - 0x11], bl
mov dword [ebp - 0x1c], 0x20e0
cmp dword [ebp - 0x1c], 0x223a
jle 0x1003a0dc
mov edi, ebx
mov dword [ebp - 0x28], ebx
mov ecx, ebx
mov eax, edi
sar eax, cl
mov ecx, 0x1007c858
cdq
push edx
push eax
call fcn.10004668
inc ebx
cmp ebx, 0x593e
jl 0x1003a0b4
inc edi
push 0
pop ebx
cmp edi, 0x7aa6
jl 0x1003a0b1
cmp byte [ebp - 0x11], 0
je 0x1003a144
push 0x53cc
push 0x3b9d
push 1
push 0x51d8
push 0x197d
push 0x78a4
push ebx
push 0x3272
push 0x41eb
push 1
push 0x4e13
push 0x65a6
push 0x2c0f
push 0x59ee
push 0x44f5
push 0x1236
push 0x5a8b
push 0x45e0
mov edx, 0x25d4
mov ecx, 0x1a0f
call fcn.10038655
add esp, 0x48
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1c], 0x1ebf
jge 0x1003a06c
mov edx, str.hsyby_bwnuiwlu_ejaeynoi_emcmynh_jkfjp_cpoiic_fbgkv_twp
mov ecx, 0x1007c858
call fcn.10006b3c
jmp 0x1003a06c

Function at 0x1003a468
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x1003a47f
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8