joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004c30
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
xor ecx, ecx
xor edx, edx
mov esi, dword [esp + 0x14]
mov ebp, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
mov cl, byte [esi + 0x100]
mov dl, byte [esi + 0x101]
test ebp, ebp
je 0x10004c7f
inc ecx
mov ebx, 0xff
and ecx, ebx
xor eax, eax
mov al, byte [esi + ecx]
add edx, eax
and edx, ebx
xor ebx, ebx
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov byte [esi + edx], al
add al, bl
mov bl, byte [edi]
mov al, byte [esi + eax]
xor bl, al
mov byte [edi], bl
inc edi
dec ebp
jne 0x10004c54
pop ebp
pop edi
lea eax, [esi + 0x100]
pop esi
mov byte [eax], cl
pop ebx
mov byte [eax + 1], dl
ret 0xc

Function at 0x10004c91
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebx
mov eax, 0x3020100
push esi
mov ecx, 0x40
mov esi, dword [esp + 0xc]
push edi
mov edx, esi
push ebp
mov dword [edx], eax
add edx, 4
add eax, 0x4040404
dec ecx
jne 0x10004ca5
xor ecx, ecx
xor edi, edi
mov ebp, dword [esp + 0x1c]
mov byte [esi + 0x100], cl
mov byte [esi + 0x101], cl
xor ebx, ebx
xor edx, edx
xor eax, eax
mov dl, byte [edi + esi]
mov al, byte [ebp + ecx]
add bl, al
inc ecx
add bl, dl
inc edi
mov al, byte [ebx + esi]
mov byte [edi + esi - 1], al
cmp dword [esp + 0x18], ecx
mov byte [ebx + esi], dl
jne 0x10004ceb
xor ecx, ecx
cmp edi, 0x100
jb 0x10004cc8
pop ebp
pop edi
pop esi
pop ebx
ret 0xc

Function at 0x100055a0
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
cmp eax, 1
je 0x100055ec
jle 0x100055e7
cmp eax, 3
jg 0x100055e7
push esi
mov esi, dword [ecx]
test esi, esi
je 0x100055de
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
push ebx
sub ecx, eax
push edi
sub edx, eax
mov edi, dword [ecx + eax]
mov ebx, dword [eax]
xor edi, ebx
mov dword [edx + eax], edi
add eax, 4
dec esi
jne 0x100055cc
pop edi
pop ebx
mov eax, 1
pop esi
ret 0x10
xor eax, eax
ret 0x10
mov eax, dword [ecx + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push ecx
push edx
push eax
call fcn.1000bc8a
mov eax, 1
ret 0x10

Function at 0x10005b60
Capabilities:
Encode data using xor

Disassembly:
mov ecx, dword [esp + 0x10]
mov eax, dword [ecx + 8]
cmp eax, 1
je 0x10005bac
jle 0x10005ba7
cmp eax, 3
jg 0x10005ba7
push esi
mov esi, dword [ecx]
test esi, esi
je 0x10005b9e
mov eax, dword [esp + 0xc]
mov ecx, dword [esp + 8]
mov edx, dword [esp + 0x10]
push ebx
sub ecx, eax
push edi
sub edx, eax
mov edi, dword [ecx + eax]
mov ebx, dword [eax]
xor edi, ebx
mov dword [edx + eax], edi
add eax, 4
dec esi
jne 0x10005b8c
pop edi
pop ebx
mov eax, 1
pop esi
ret 0x10
xor eax, eax
ret 0x10
mov eax, dword [ecx + 0x10]
mov ecx, dword [esp + 0xc]
mov edx, dword [esp + 8]
push eax
mov eax, dword [esp + 8]
push ecx
push edx
push eax
call fcn.10006a50
mov eax, 1
ret 0x10
Function at 0x10006080
Capabilities:
Encode data using xor

Disassembly:
sub esp, 0x10c
push ebx
push ebp
push esi
mov esi, dword [esp + 0x124]
push edi
mov eax, dword [esi + 8]
mov ebx, dword [esi]
mov edi, dword [esi + 4]
mov ecx, dword [esi + 0x124]
sub eax, 2
mov dword [esp + 0x14], ebx
mov dword [esp + 0x10], edi
mov dword [esp + 0x18], ecx
je 0x100061c2
dec eax
je 0x100060c6
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x10c
ret 0xc
mov ecx, dword [esi + 0x20]
push esi
mov edi, ecx
lea eax, [esp + 0x20]
and ecx, 0x1f
mov ebx, 1
push 1
push eax
shr edi, 5
shl ebx, cl
call fcn.10005610
test eax, eax
mov ebp, dword [esp + 0x124]
je 0x10006104
push esi
push 1
push ebp
call fcn.10005610
test eax, eax
je 0x10006104
mov eax, 1
jmp 0x10006106
xor eax, eax
mov ecx, dword [esp + 0x10]
lea edi, [esp + edi*4 + 0x1c]
cmp ecx, 1
mov dword [edi], ebx
je 0x10006177
dec ecx
mov dword [esp + 0x10], ecx
test eax, eax
je 0x10006164
lea ecx, [esp + 0x1c]
push esi
lea edx, [esp + 0x20]
push ecx
lea eax, [esp + 0x24]
push edx
push eax
call fcn.10005990
test eax, eax
je 0x10006164
push esi
push ebp
push ebp
push ebp
call fcn.10005990
test eax, eax
je 0x10006164
mov ecx, dword [esp + 0x120]
push esi
push ebp
push ebp
lea edx, [esp + 0x28]
push ecx
push edx
call fcn.10005a00
test eax, eax
je 0x10006164
mov eax, 1
jmp 0x10006166
xor eax, eax
mov edx, dword [edi]
mov ecx, dword [esp + 0x10]
xor edx, ebx
dec ecx
mov dword [edi], edx
mov dword [esp + 0x10], ecx
jne 0x1000611a
test eax, eax
je 0x100060b7
lea eax, [esp + 0x1c]
push esi
push eax
push ebp
push ebp
push ebp
call fcn.10005a00
test eax, eax
je 0x100060b7
mov ecx, dword [esp + 0x120]
push esi
lea edx, [esp + 0x20]
push ecx
push edx
call fcn.1000bc8a
test eax, eax
je 0x100060b7
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x10c
ret 0xc
xor esi, esi
xor edx, edx
test edi, edi
mov edi, dword [esp + 0x124]
je 0x10006219
mov ebx, dword [esp + 0x120]
mov eax, edx
shr eax, 5
mov ecx, edx
mov ebx, dword [ebx + eax*4]
and ecx, 0x1f
shr ebx, cl
mov ebp, dword [edi + eax*4]
and ebx, 1
xor esi, ebx
mov ebx, esi
not ebx
and ebx, 1
shl ebx, cl
not ebx
and ebx, ebp
mov ebp, esi
and ebp, 1
shl ebp, cl
or ebx, ebp
inc edx
mov dword [edi + eax*4], ebx
mov eax, dword [esp + 0x10]
cmp edx, eax
jne 0x100061d1
mov ebx, dword [esp + 0x14]
mov ecx, dword [esp + 0x18]
mov edx, dword [edi + ebx*4 - 4]
xor eax, eax
test esi, esi
sete al
shl edx, cl
shr edx, cl
mov dword [edi + ebx*4 - 4], edx
pop edi
pop esi
pop ebp
pop ebx
add esp, 0x10c
ret 0xc

Function at 0x10007440
Capabilities:
Get system information on windows

Disassembly:
sub esp, 0x24
lea eax, [esp]
push eax
call dword [sym.imp.kernel32.dll_GetSystemInfo]
mov eax, dword [esp + 0x18]
sub eax, 0x182
je 0x10007474
sub eax, 0x64
je 0x10007474
sub eax, 0x64
cmp word [esp + 0x20], 6
jb 0x10007474
push 0xc
call fcn.1000d220
add esp, 0x24
ret
push 4
call fcn.1000d220
add esp, 0x24
ret
Function at 0x1000c770
Capabilities:
Encode data using xor

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 0x10]
sub esp, 0x51c
lea edx, [eax + 0x1f]
push ebx
push ebp
lea ebp, [ecx + 0x1f]
push esi
shr edx, 5
shr ebp, 5
cmp edx, ebp
mov ebx, edx
ja 0x1000c795
mov ebx, ebp
mov ecx, dword [esp + 0x53c]
xor esi, esi
xor eax, eax
cmp ecx, esi
setne al
cmp ebx, esi
mov dword [esp + 0xc], eax
je 0x1000c99c
cmp ebx, 0x40
ja 0x1000c99c
lea eax, [esp + 0x324]
mov ecx, ebx
mov dword [eax - 0x204], esi
mov dword [eax], esi
mov dword [eax - 0x104], esi
mov dword [eax + 0x100], esi
add eax, 4
dec ecx
jne 0x1000c7c3
mov ecx, dword [esp + 0x120]
mov esi, dword [esp + 0x52c]
xor ecx, 1
push edi
mov dword [esp + 0x124], ecx
mov ecx, edx
lea edi, [esp + 0x224]
push edx
rep movsd dword es:[edi], dword [esi]
mov esi, dword [esp + 0x53c]
lea ecx, [ebp*4]
mov dword [esp + 0x24], ecx
mov eax, ecx
lea edi, [esp + 0x42c]
shr ecx, 2
rep movsd dword es:[edi], dword [esi]
mov ecx, eax
and ecx, 3
rep movsb byte es:[edi], byte [esi]
mov ecx, dword [esp + 0x534]
push ecx
call fcn.1000bc8a
push ebp
mov edx, dword [esp + 0x53c]
mov dword [esp + 0x328], eax
push edx
call fcn.1000bc8a
xor edx, edx
mov dword [esp + 0x528], eax
mov eax, edx
mov dword [esp + 0x18], edx
shl eax, 7
add eax, edx
shl eax, 2
mov ecx, eax
neg ecx
mov esi, dword [esp + ecx + 0x528]
test esi, esi
je 0x1000c93e
lea esi, [esp + eax + 0x124]
lea ebp, [esp + ecx + 0x328]
mov dword [esp + 0x1c], ebp
mov eax, dword [esi + 0x200]
mov ecx, dword [ebp + 0x200]
cmp eax, ecx
jb 0x1000c930
sub eax, ecx
push ebx
mov edi, eax
lea eax, [esp + 0x28]
push eax
lea eax, [ebp + 0x100]
push edi
push eax
call fcn.1000b030
lea edx, [esi + 0x100]
lea ecx, [esp + 0x24]
mov eax, edx
mov dword [esp + 0x14], ebx
mov ebp, dword [ecx]
add ecx, 4
xor dword [eax], ebp
mov ebp, dword [esp + 0x14]
add eax, 4
dec ebp
mov dword [esp + 0x14], ebp
jne 0x1000c8c2
push ebx
push edx
call fcn.1000bc8a
mov dword [esi + 0x200], eax
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1000c914
mov ebp, dword [esp + 0x1c]
lea ecx, [esp + 0x24]
push ebx
push ecx
push edi
push ebp
call fcn.1000b030
lea ecx, [esp + 0x24]
mov eax, esi
sub ecx, esi
mov edx, ebx
mov edi, dword [ecx + eax]
xor dword [eax], edi
add eax, 4
dec edx
jne 0x1000c907
jmp 0x1000c918
mov ebp, dword [esp + 0x1c]
mov eax, dword [esi + 0x200]
mov ecx, dword [ebp + 0x200]
cmp eax, ecx
jae 0x1000c89b
mov edx, dword [esp + 0x18]
mov eax, 1
sub eax, edx
mov edx, eax
jmp 0x1000c854
mov edi, dword [esp + 0x544]
test edi, edi
je 0x1000c95b
mov eax, edx
mov ecx, ebx
shl eax, 7
add eax, edx
lea esi, [esp + eax*4 + 0x224]
rep movsd dword es:[edi], dword [esi]
mov eax, dword [esp + 0x10]
test eax, eax
je 0x1000c98a
mov ecx, dword [esp + 0x20]
mov edi, dword [esp + 0x540]
mov eax, edx
shl eax, 7
add eax, edx
mov edx, ecx
shr ecx, 2
lea esi, [esp + eax*4 + 0x124]
rep movsd dword es:[edi], dword [esi]
mov ecx, edx
and ecx, 3
rep movsb byte es:[edi], byte [esi]
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x51c
ret 0x18
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x51c
ret 0x18
Function at 0x10020655
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push 0x428
mov eax, 0x100279c3
call fcn.1002568a
mov edx, dword [ebp + 0xc]
xor ebx, ebx
mov eax, dword [ebp + 8]
mov esi, ebx
mov dword [ebp - 0x42c], edx
mov edx, dword [ebp + 0x10]
mov dword [ebp - 0x41c], eax
mov dword [ebp - 0x428], edx
mov dword [ebp - 0x424], esi
mov dword [ebp - 4], ebx
mov dword [ebp - 0x430], ecx
mov dword [ebp - 0x434], ebx
mov dword [ebp - 0x418], ebx
mov byte [ebp - 4], 1
test eax, eax
je 0x10020876
push eax
call dword [sym.imp.api_ms_win_crt_string_l1_1_0.dll_wcslen]
inc eax
push 2
push eax
mov dword [ebp - 0x420], eax
lea eax, [ebp - 0x420]
push eax
call fcn.1000bc8a
add esp, 0x10
test eax, eax
js 0x10020870
mov edi, dword [ebp - 0x420]
cmp edi, 0x400
jg 0x100206f9
push edi
call fcn.1001a3b8
pop ecx
test al, al
je 0x100206f9
mov eax, edi
call fcn.10025830
mov dword [ebp - 0x10], esp
mov eax, esp
jmp 0x1002070b
push edi
lea ecx, [ebp - 0x424]
call fcn.1000bc8a
mov esi, dword [ebp - 0x424]
push 3
push edi
push dword [ebp - 0x41c]
push eax
call fcn.1000bc8a
mov dword [ebp - 0x41c], eax
test eax, eax
je 0x10020870
push 0x60
push ebx
push eax
call fcn.10021bf8
mov edi, eax
mov dword [ebp - 0x420], edi
test edi, edi
jne 0x10020763
push 2
push ebx
push dword [ebp - 0x41c]
call fcn.10021bf8
mov edi, eax
mov dword [ebp - 0x420], eax
test edi, edi
jne 0x10020763
call fcn.10015691
mov ebx, eax
jmp 0x1002083f
push dword [ebp - 0x428]
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_FindResourceA]
mov dword [ebp - 0x42c], eax
test eax, eax
jne 0x1002078a
call fcn.10015691
jmp 0x10020832
push eax
push edi
call dword [sym.imp.kernel32.dll_LoadResource]
mov dword [ebp - 0x428], eax
test eax, eax
je 0x10020780
push dword [ebp - 0x42c]
push edi
call dword [sym.imp.kernel32.dll_SizeofResource]
mov dword [ebp - 0x41c], eax
lea ecx, [eax + 1]
cmp ecx, eax
jae 0x100207bd
mov ebx, 0x8007000e
jmp 0x10020834
push ecx
lea ecx, [ebp - 0x418]
mov byte [ebp - 4], 2
call fcn.1000bc8a
jmp 0x100207e3
cmp dword [ebp - 0x418], 0
mov dword [ebp - 4], 1
je 0x100207b6
mov eax, dword [ebp - 0x41c]
push eax
push dword [ebp - 0x428]
push eax
push dword [ebp - 0x418]
call fcn.1000bc8a
mov eax, dword [ebp - 0x418]
add esp, 0x10
mov ecx, dword [ebp - 0x41c]
push dword [ebp + 0x14]
mov byte [eax + ecx], bl
lea ecx, [ebp - 0x434]
push dword [ebp - 0x418]
call fcn.1000bc8a
mov ebx, eax
test edi, edi
je 0x1002083f
push edi
call dword [sym.imp.kernel32.dll_FreeLibrary]
lea eax, [ebp - 0x414]
cmp dword [ebp - 0x418], eax
je 0x10020858
lea ecx, [ebp - 0x418]
call fcn.1001fe4b
or dword [ebp - 4], 0xffffffff
jmp 0x10020868
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x1002085e
mov eax, ebx
jmp 0x100208a4
mov ebx, dword [ebp - 0x418]
lea eax, [ebp - 0x414]
cmp ebx, eax
je 0x1002088b
lea ecx, [ebp - 0x418]
call fcn.1001fe4b
or dword [ebp - 4], 0xffffffff
jmp 0x1002089b
push esi
mov esi, dword [esi]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
test esi, esi
jne 0x10020891
mov eax, 0x8007000e
lea esp, [ebp - 0x444]
call fcn.100255d7
ret 0x10
Function at 0x10001c1b
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp byte [ebp + 8], 0
push esi
mov esi, edx
je 0x10001c6e
mov dword [esi], 0xfffffff3
jmp 0x10001c67
lea eax, [ebp - 8]
mov dword [ebp - 0xc], 0xfffffffa
push eax
push dword [ebp + 0x14]
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], 0x30dfddae
push eax
push esi
mov dword [ebp - 8], 0xffffffff
lea edx, [ebp - 0x10]
push 0x3199
xor cl, cl
call fcn.100021f0
add esp, 0x14
inc dword [esi]
cmp dword [esi], 0x14
je 0x10001c32
jmp 0x10001c86
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x10001c86
push eax
push 0x20e
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10001ca1
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0xc], 0
push edi
je 0x10001ce9
mov edi, dword [ebp + 8]
mov dword [edi], 0
jmp 0x10001ce2
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push eax
push 0x5bf8
push 0x77d1
push 1
mov dword [ebp - 4], 0x57a67d92
mov edx, 0x7486
push 0
call fcn.10002339
add esp, 0x14
inc dword [edi]
cmp dword [edi], 1
jle 0x10001cb7
jmp 0x10001cfa
cmp byte [ecx], 0
je 0x10001cfa
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10004a76
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x10004a8d
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x10004aaf
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x1044c7c4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x1044cb50
jl 0x10004abd
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x1044cdf4
jl 0x10004afd
mov ecx, dword [0x1044db40]
xor ecx, dword [0x1044c7c4]
and ecx, edi
xor ecx, dword [0x1044db40]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x1044c7c0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x1044cdf4]
mov dword [0x1044d180], eax
pop esi
ret

Function at 0x10007169
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov dword [esp + 4], 0x5caf
mov ebx, edx
cmp dword [esp + 4], 0x5cbd
push esi
push edi
jle 0x100071d0
xor esi, esi
xor edi, edi
mov eax, esi
lea ecx, [esp + 0x10]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001a8a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100071aa
mov eax, dword [eax]
push eax
call fcn.10046da3
pop ecx
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.100045f1
inc edi
cmp edi, 0x2af9
jl 0x1000718d
inc esi
cmp esi, 0x785d
jl 0x1000718b
cmp byte [ebp + 8], 0
je 0x100071dd
xor eax, eax
mov word [ebx], ax
jmp 0x100071f1
mov eax, dword [ebp + 0x20]
cmp byte [eax], 0
je 0x100071f1
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp dword [esp + 0xc], 0x5932
jge 0x10007206
push str.qnafj_olcdj_lpleubi_osihijyr_tdbbipsg_xixei_lnl
call fcn.10046da3
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007469
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov esi, edx
je 0x100074d9
xor edx, edx
mov dword [esi], edx
cmp dword [esi], 2
jg 0x100074df
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 8]
mov dword [esp + 0x14], 0x13281d21
dec dword [esp + 0x14]
je 0x100074a8
mov ecx, dword [esi]
mov eax, dword [ebx]
cmp dword [eax + ecx*4], edx
je 0x100074a8
xor eax, eax
inc eax
jmp 0x100074aa
mov eax, edx
mov dword [edi], eax
mov dword [edi], edx
jmp 0x100074cb
mov byte [esp + 0x13], dl
cmp byte [esp + 0x13], 0
je 0x100074c9
push edx
push edx
push edx
push edx
push edx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
xor edx, edx
inc dword [edi]
cmp dword [edi], 2
jle 0x100074b0
inc dword [esi]
cmp dword [esi], 2
jle 0x1000748c
jmp 0x100074df
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000754d
Capabilities:
Create process on windows
Read .ini file

Disassembly:
mov eax, 0x1005ce39
call fcn.1005c610
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x1000759b
xor ebx, ebx
cmp byte [ebp + 8], bl
je 0x10007588
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x100076be
push ebx
push 0xea1
call dword [sym.imp.GDI32.dll_GetClipBox]
jmp 0x100076be
push ebx
push 0x20e
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x100076be
cmp byte [ebp + 0xc], 0
je 0x10007678
cmp byte [ecx], 0
je 0x1000765c
xor ebx, ebx
push ebx
push ecx
push 0x4700
call fcn.1000720d
mov dword [ebp - 0x24], 0x3030
add esp, 0xc
cmp dword [ebp - 0x24], 0x3167
jle 0x10007641
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], 0x31fe
mov esi, dword [ebp - 0x18]
mov edi, ebx
mov ecx, edi
mov dword [ebp - 0x28], esi
mov dword [ebp - 0x2c], ebx
shl esi, cl
mov ecx, ebx
mov eax, esi
shl eax, cl
mov ecx, 0x10078098
cdq
push edx
push eax
call fcn.10003fb2
inc ebx
cmp ebx, 0x142e
jl 0x100075eb
mov esi, dword [ebp - 0x18]
inc edi
push 0
pop ebx
cmp edi, 0x1ef5
jl 0x100075e1
mov esi, dword [ebp - 0x20]
add dword [ebp - 0x18], esi
dec dword [ebp - 0x1c]
jne 0x100075dc
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x34b2
jl 0x100075d2
push 0x2491
push ebx
push ebx
push ebx
push ebx
push 0x24eb
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x24], 0x2ce6
jge 0x1000765c
mov edx, str.pxdt_jlka_vwgjwlz_zagjro_fioeyprak_nqvnc
mov ecx, 0x10078098
call fcn.100065fc
jmp 0x100076be
sub esp, 0xc
mov dword [ebp - 0x2c], 0xfffc
lea eax, [ebp - 0x12]
xor ebx, ebx
mov byte [ebp - 0x12], bl
mov edx, 0x18f9
push eax
sub esp, 0x14
push ebx
call fcn.10007169
mov byte [ebp - 0x11], bl
add esp, 0x28
cmp byte [ebp - 0x11], bl
je 0x100076be
push ebx
push 0xffd
push 0x6929
mov edx, 0x7ca9
xor cl, cl
call fcn.10007469
add esp, 0xc
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100076cf
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x1005ce43
call fcn.1005c610
sub esp, 0x34
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, edx
je 0x10007882
mov dword [ebp - 0x20], 0x547e
xor esi, esi
cmp dword [ebp - 0x20], 0x56ad
jle 0x1000777e
mov edi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp + 8], edi
mov dword [ebp - 0x18], 0x3222
mov ebx, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x24], ebx
mov dword [ebp + 8], 0x3a5c
mov ecx, ebx
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0x40]
cdq
push edx
push eax
call fcn.10001a8a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10007739
mov eax, dword [eax]
push eax
call fcn.10046da3
pop ecx
push esi
push 1
lea ecx, [ebp - 0x40]
call fcn.100045f1
dec ebx
dec dword [ebp + 8]
jne 0x1000771e
mov ebx, dword [ebp - 0x14]
inc ebx
mov dword [ebp - 0x14], ebx
cmp ebx, 0xae9
jl 0x10007714
dec edi
dec dword [ebp - 0x18]
jne 0x1000770f
mov edi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x6b99
jl 0x10007705
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
cmp dword [ebp - 0x20], 0x51b6
jge 0x10007792
push str.xbmj_oxyfo_thsxei_hlduczn_twrojp
call fcn.10046da3
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x18], 0
je 0x10007874
mov dword [ebp - 0x18], 0x45b4
cmp dword [ebp - 0x18], 0x493e
jle 0x10007816
mov edi, esi
mov dword [ebp - 0x1c], esi
mov ebx, esi
mov dword [ebp - 0x20], esi
mov eax, edi
mov ecx, esi
cdq
idiv ebx
mov dword [ebp + 8], ecx
mov ebx, edx
mov edi, esi
mov esi, ebx
and esi, ecx
mov eax, esi
mov ecx, 0x10078098
or eax, edi
cdq
push edx
push eax
call fcn.10003fb2
inc edi
cmp edi, 0x56fc
jl 0x100077cc
mov ecx, dword [ebp + 8]
inc ecx
mov dword [ebp + 8], ecx
push 0
pop esi
cmp ecx, 0x3ae
jl 0x100077c6
mov ebx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 0x20], ebx
cmp ebx, 0x7c88
jl 0x100077ba
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x415e
jl 0x100077b5
mov dword [ebp - 4], 2
cmp dword [ebp - 0x18], 0x444e
jge 0x10007853
mov edx, str.yrvo_xqd_xvzavch_ytatqhu
mov ecx, 0x10078098
call fcn.100065fc
jmp 0x10007853
mov edx, dword [ebp + 0x1c]
mov dword [edx], esi
cmp dword [edx], 4
jge 0x100078b4
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [edx]
cmp dword [edx], 4
jl 0x10007860
jmp 0x100078b4
push esi
push 1
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventA]
jmp 0x100078b4
cmp byte [ebp + 0x10], 0
je 0x10007897
and dword [ebp - 0x28], 0
lea eax, [ebp - 0x28]
push eax
call fcn.1000a031
jmp 0x100078b4
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
jmp 0x100078af
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xaa6f
inc dword [edx]
cmp dword [edx], 3
jl 0x100078a2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007b74
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005ce5f
call fcn.1005c610
sub esp, 0x1c
push ebx
push esi
mov dword [ebp - 0x1c], 0x3823
mov eax, edx
cmp dword [ebp - 0x1c], 0x38a8
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
jle 0x10007bf0
xor esi, esi
mov dword [ebp - 0x18], esi
mov ebx, esi
mov dword [ebp - 0x14], 0x3b9
xor edi, edi
xor esi, esi
lea eax, [esi + edi]
mov ecx, 0x10078098
xor eax, ebx
cdq
push edx
push eax
call fcn.10003fb2
inc esi
cmp esi, 0x783b
jl 0x10007bb1
inc edi
cmp edi, 0x5fb7
jl 0x10007baf
dec ebx
dec dword [ebp - 0x14]
jne 0x10007bad
mov esi, dword [ebp - 0x18]
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x5f01
jl 0x10007ba4
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
push eax
push ecx
push dword [ebp + 8]
call fcn.10007c44
and dword [ebp - 4], 0
add esp, 0xc
cmp dword [ebp - 0x1c], 0x3623
jge 0x10007c19
mov edx, str.pabcdb_qztvilo_hqt
mov ecx, 0x10078098
call fcn.100065fc
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret