joyce8/EMBER2024-capa huggingface dataset:
Function at 0x625640
Capabilities:
Get hostname

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 0xc]
push edi
mov edi, dword [ebp + 8]
push esi
push edi
mov byte [edi], 0
call dword [sym.imp.WS2_32.dll_gethostname]
mov byte [edi + esi - 1], 0
test eax, eax
jne 0x625673
push 0x2e
push edi
call fcn.0062d140
add esp, 8
test eax, eax
je 0x625671
mov byte [eax], 0
xor eax, eax
pop edi
pop esi
pop ebp
ret

Function at 0x627040
Capabilities:
Authenticate hmac
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push esi
mov esi, dword [ebp + 8]
push edi
mov ecx, dword [esi + 0xc]
mov eax, dword [esi + 0x14]
lea eax, [eax + ecx*2]
add eax, 0xc
push eax
call dword [0x70b4c4]
mov edi, eax
add esp, 4
test edi, edi
jne 0x62706d
pop edi
pop esi
mov esp, ebp
pop ebp
ret
lea ecx, [edi + 0xc]
mov dword [edi], esi
mov dword [edi + 4], ecx
mov eax, dword [esi + 0xc]
add eax, ecx
push ebx
mov ebx, dword [ebp + 0x10]
mov dword [edi + 8], eax
cmp ebx, dword [esi + 0x10]
jbe 0x6270b7
mov eax, dword [esi]
push ecx
call eax
mov eax, dword [esi + 4]
push ebx
push dword [ebp + 0xc]
push dword [edi + 4]
call eax
mov eax, dword [edi + 8]
add eax, dword [esi + 0xc]
push dword [edi + 4]
mov dword [ebp - 4], eax
push eax
mov eax, dword [esi + 8]
call eax
mov ebx, dword [esi + 0x14]
add esp, 0x18
mov ecx, dword [edi + 4]
mov dword [ebp + 0x10], ebx
jmp 0x6270bd
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [esi]
push ecx
call eax
push dword [edi + 8]
mov eax, dword [esi]
call eax
mov eax, dword [ebp + 0x10]
add esp, 8
xor ebx, ebx
test eax, eax
je 0x62711b
mov ebx, dword [ebp - 4]
mov dword [ebp - 8], eax
nop dword [eax + eax]
movzx eax, byte [ebx]
xor al, 0x36
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 4]
mov eax, dword [esi + 4]
call eax
movzx eax, byte [ebx]
lea ebx, [ebx + 1]
xor al, 0x5c
mov byte [ebp + 0xb], al
lea eax, [ebp + 0xb]
push 1
push eax
push dword [edi + 8]
mov eax, dword [esi + 4]
call eax
add esp, 0x18
sub dword [ebp + 0x10], 1
jne 0x6270e0
mov ebx, dword [ebp - 8]
cmp ebx, dword [esi + 0x10]
jae 0x627147
mov eax, dword [esi + 4]
push 1
push 0x674554
push dword [edi + 4]
call eax
mov eax, dword [esi + 4]
push 1
push 0x674555
push dword [edi + 8]
call eax
inc ebx
add esp, 0x18
cmp ebx, dword [esi + 0x10]
jb 0x627120
pop ebx
mov eax, edi
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x647cec
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00647b62

Function at 0x64a7f0
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.0064a343
Function at 0x43b570
Capabilities:
Move file

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 0xc]
push eax
mov ecx, dword [ebp + 8]
push ecx
call dword [sym.imp.KERNEL32.dll_MoveFileA]
test eax, eax
jne 0x43b593
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x43b59a
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x43b5b1
mov edx, dword [ebp - 4]
push edx
call fcn.00442960
add esp, 4
or eax, 0xffffffff
jmp 0x43b5b3
xor eax, eax
mov esp, ebp
pop ebp
ret

Function at 0x43f970
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4633d4]
jne 0x43f97a
repz ret
jmp fcn.004507c0
Function at 0x4602f0
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4d4
cmp dword [0x88f5f8], 0x37
jne 0x4603f2
push 0
push 0x40a060
push 0
push 0x40a0c0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetProcessShutdownParameters]
xor eax, eax
mov word [ebp - 0x4cc], ax
xor ecx, ecx
mov word [ebp - 0x4ca], cx
lea edx, [ebp - 0xc8]
push edx
mov eax, dword [ebp - 0x4cc]
push eax
lea ecx, [ebp - 0x4d4]
push ecx
lea edx, [ebp - 8]
push edx
push 0
call dword [sym.imp.KERNEL32.dll_ScrollConsoleScreenBufferA]
push 0
push 0
push 0
lea eax, [ebp - 0xc0]
push eax
call dword [sym.imp.KERNEL32.dll_VerifyVersionInfoA]
push 0x40a114
push 0
push 0
call dword [sym.imp.KERNEL32.dll_OpenWaitableTimerA]
push 0x40a14c
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
mov ecx, dword [ebp - 0x20]
push ecx
lea edx, [ebp - 0x4c8]
push edx
mov eax, dword [ebp - 0xc4]
push eax
push 0x40a174
call dword [sym.imp.KERNEL32.dll_FindFirstFileExA]
mov dword [ebp - 0x1c], 0
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], ecx
lea edx, [ebp - 0x1c]
push edx
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LockFileEx]
push 0
push 0x40a18c
push 0
push 0x40a1a8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareStringW]
mov eax, dword [0x887044]
add eax, dword [ebp + 8]
mov ecx, dword [0x88f5fc]
add ecx, dword [ebp + 8]
mov dl, byte [ecx + 0x12336]
mov byte [eax], dl
mov esp, ebp
pop ebp
ret 4

Function at 0x460630
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xac
mov eax, dword [ebp + 8]
mov dword [ebp - 4], eax
mov ecx, dword [ebp + 0xc]
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 0xc]
shr edx, 3
mov dword [ebp - 0xc], edx
mov dword [ebp - 8], 0
jmp 0x460660
mov eax, dword [ebp - 8]
add eax, 1
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 8]
cmp ecx, dword [ebp - 0xc]
jae 0x4606b1
mov edx, dword [ebp - 8]
mov dword [ebp - 0x10], edx
mov eax, dword [ebp - 0x10]
shl eax, 1
mov dword [ebp - 0x10], eax
cmp dword [0x88f5f8], 0x1c
jne 0x46069c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetConsoleMode]
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
lea ecx, [ebp - 0xa8]
push ecx
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
mov edx, dword [ebp + 0x10]
push edx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 4]
lea edx, [ecx + eax*4]
push edx
call fcn.00460480
jmp 0x460657
mov esp, ebp
pop ebp
ret 0xc
Function at 0x4205ef
Capabilities:
Encode data using xor

Disassembly:
add byte [edi], ch
jae 0x4205d6
outsd dx, dword [esi]
add byte [esi], ah
je 0x4205dc
add byte cs:[edx], al
imul eax, dword [eax], 0x67006e
push edi
add byte [ebp], ah
popal
add byte [eax + eax + 0x68], dh
add byte [ebp], ah
jb 0x4205f4
pop edi
add byte [eax], bh
add byte [edi], dh
add byte gs:[ebx], ch
jns 0x420600
bound eax, qword [eax]
xor eax, dword [eax]
add byte fs:[eax], bh
add byte [edx], ah
bound eax, qword [eax]
bound eax, qword [eax]
ja 0x42060e
add byte gs:[esi], al
adc byte [eax], dh
add byte [ecx + 0x1001200], ch
or byte [eax], al
add byte [eax], al
add byte [eax], al
lsl eax, word [eax]
add byte [eax], al
add ebx, edi
cmpsb byte [esi], byte es:[edi]
jns 0x4205d1
aas
ror dword [edi], 0xc1
jle 0x42069b
out 0x90, eax
sub dword [esi + 0x75], ebp
or ecx, dword [ebx - 0x36e125b9]
jbe 0x420608
ret 0xe6dc
insb byte es:[edi], dx
and ebp, dword [ebp + 0x57]
add byte [edi + 0x6e], dh
rol byte [edx], 0x64
xchg dword [eax], eax
adc byte [eax], bh
add byte [ecx + 0x1001200], ch
or al, byte [eax]
add byte [eax], al
add byte [eax], al
lsl eax, word [eax]
add byte [eax], al
add byte [eax + eax], al
add byte [ecx - 0x2e2751f9], al
test edi, ecx
xchg esi, eax
rcl byte [edi], 0x6a
cmp ebx, dword [edx]
out dx, al
test byte [eax - 0x25], dh
add byte [edi - 0x1b], bl
jecxz 0x420679
add ebp, 0x3a9d9433
Function at 0x10005f74
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov byte [esp + 8], dl
push ebx
push esi
push edi
test cl, cl
je 0x10005fbf
test dl, dl
je 0x10005fb2
push 0x406f
xor ebx, ebx
lea ecx, [esp + 0x17]
push 1
push ebx
push 0x39c2
mov dl, 1
mov byte [esp + 0x23], bl
call fcn.10005cea
add esp, 0x10
jmp 0x100060b8
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov dword [ecx + 4], eax
jmp 0x100060b8
mov dword [esp + 0x24], 0x57d3
cmp dword [esp + 0x24], 0x59e4
push 0
pop ebx
jle 0x10006069
mov esi, ebx
mov dword [esp + 0x20], ebx
mov edi, ebx
mov dword [esp + 0x1c], ebx
mov eax, ebx
mov dword [esp + 0x18], ebx
lea ecx, [edi + esi]
mov esi, ebx
mov dword [esp + 0x28], ecx
mov ecx, eax
mov edi, dword [esp + 0x28]
sar edi, cl
mov ecx, esi
mov eax, edi
sar eax, cl
lea ecx, [esp + 0x30]
cdq
push edx
push eax
call fcn.10001a94
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10006017
mov eax, dword [eax]
push eax
call fcn.1003cd2f
pop ecx
push ebx
push 1
lea ecx, [esp + 0x38]
call fcn.10003730
inc esi
cmp esi, 0x29bc
jl 0x10005ffb
mov eax, dword [esp + 0x18]
mov esi, dword [esp + 0x20]
inc eax
mov edi, dword [esp + 0x1c]
mov dword [esp + 0x18], eax
cmp eax, 0x1d3a
jl 0x10005fea
inc edi
mov dword [esp + 0x1c], edi
cmp edi, 0x4ea7
jl 0x10005fe4
inc esi
mov dword [esp + 0x20], esi
cmp esi, 0x1312
jl 0x10005fde
cmp byte [ebp + 0xc], 0
je 0x1000608e
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0x1396
push 0x10c7
push 0x1b6c
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x100060a3
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x100060a3
push ebx
push 0xb9a
push ebx
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
cmp dword [esp + 0x24], 0x552e
jge 0x100060b8
push str.xekcp_zlykezida_eknfg_von_dyxwhj_srqr_tdwcujyep_xbt_gzkfo_ttmaxzxw_fwpnmegx_xecocnv
call fcn.1003cd2f
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000be9c
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
je 0x1000bf75
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1000becb
push 0xc93
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov dword [ebp - 0x14], 0x2886
cmp dword [ebp - 0x14], 0x2aac
jle 0x1000bf5f
xor esi, esi
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], esi
mov ecx, edi
xor ebx, ebx
shl esi, cl
mov dword [ebp - 8], esi
and dword [ebp - 0x18], 0
mov edi, esi
mov esi, dword [ebp - 0x18]
and edi, ebx
mov eax, edi
lea ecx, [ebp - 0x30]
or eax, esi
cdq
push edx
push eax
call fcn.10001a94
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000bf19
mov eax, dword [eax]
push eax
call fcn.1003cd2f
pop ecx
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.10003730
inc esi
cmp esi, 0x1cf3
jl 0x1000bf00
mov esi, dword [ebp - 8]
inc ebx
cmp ebx, 0x280c
jl 0x1000bef5
mov edi, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
inc edi
mov dword [ebp - 0xc], edi
cmp edi, 0x1cda
jl 0x1000bee9
inc esi
mov dword [ebp - 0x10], esi
cmp esi, 0x5bd0
jl 0x1000bee4
cmp dword [ebp - 0x14], 0x284a
jge 0x1000bf8c
push str.deu_otqhygvgf_uabdjyj_vamaifr_lyeyfb_paf_ejza_izhqvkcx_pnqjfk_jfmnp_kvfmvxqhl
call fcn.1003cd2f
pop ecx
jmp 0x1000bf8c
cmp byte [edx], 0
je 0x1000bf8c
push 0x2508
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsDlgButtonChecked]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000c38e
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10056981
call fcn.10055fd8
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x28], 0x1a6f
mov edi, edx
cmp dword [ebp - 0x28], 0x1e01
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], edi
jle 0x1000c3f3
xor ebx, ebx
xor edi, edi
xor eax, eax
mov dword [ebp - 0x1c], eax
and eax, edi
mov ecx, 0x1006f978
xor eax, ebx
cdq
push edx
push eax
call fcn.100032ed
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x5692
jl 0x1000c3bf
inc edi
cmp edi, 0x303d
jl 0x1000c3ba
inc ebx
cmp ebx, 0x4931
jl 0x1000c3b8
mov edi, dword [ebp - 0x18]
cmp byte [ebp + 0xc], 0
je 0x1000c49f
mov dword [ebp - 0x24], 0x4fca
cmp dword [ebp - 0x24], 0x52cf
jle 0x1000c460
xor ebx, ebx
mov dword [ebp - 0x20], ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
and dword [ebp - 0x2c], 0
mov edi, ebx
mov ebx, dword [ebp - 0x2c]
mov ecx, eax
sar edi, cl
mov ecx, ebx
mov eax, edi
sar eax, cl
mov ecx, 0x1006f978
cdq
push edx
push eax
call fcn.100032ed
inc ebx
cmp ebx, 0x3e49
jl 0x1000c424
mov eax, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x559c
jl 0x1000c417
inc ebx
mov dword [ebp - 0x20], ebx
cmp ebx, 0x749d
jl 0x1000c412
mov edi, dword [ebp - 0x18]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x4bef
jge 0x1000c49b
mov edx, str.pwb_ynksp_cfduvd_dplovlth
mov ecx, 0x1006f978
call fcn.1000548e
jmp 0x1000c49b
dec dword [edi]
jmp 0x1000c4ae
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x1000c4ae
call fcn.1000c63d
mov dword [ebp - 4], 2
cmp dword [ebp - 0x28], 0x16ea
jge 0x1000c4cd
mov edx, str.mjd_ylkeq_wgbdedzrg_ccdpcefq_yjwt_pumbu_cmowf_itdnxr_qjtswyxk_lyecbeq_bxicsg_vfqxcib_iknmxua_gvwfjxbds
mov ecx, 0x1006f978
call fcn.1000548e
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d960
Capabilities:
Create directory

Disassembly:
mov eax, 0x100569af
call fcn.10055fd8
sub esp, 0x20
push ebx
push esi
mov dword [ebp - 0x24], 0x2621
cmp dword [ebp - 0x24], 0x270a
push edi
mov dword [ebp - 0x10], esp
jle 0x1000d9df
xor edi, edi
mov dword [ebp - 0x20], edi
xor esi, esi
mov dword [ebp - 0x1c], esi
mov ebx, esi
mov dword [ebp - 0x18], 0x163a
mov ecx, ebx
mov dword [ebp - 0x28], edi
xor esi, esi
shl edi, cl
mov ecx, esi
mov eax, edi
shl eax, cl
mov ecx, 0x1006f978
cdq
push edx
push eax
call fcn.100032ed
inc esi
cmp esi, 0x1047
jl 0x1000d99f
mov edi, dword [ebp - 0x20]
dec ebx
dec dword [ebp - 0x18]
jne 0x1000d996
mov esi, dword [ebp - 0x1c]
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x2e1d
jl 0x1000d98d
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x63ec
jl 0x1000d988
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x2561
jge 0x1000d9fb
mov edx, str.kqbcn_soq_nahdnjffu_kqfcpfi_bxsmuhe_nnmchn_lvupmkcw_zta_bqdcnufen_nrp_rtmsgecp_ljzdcca_plm_tmkwqb
mov ecx, 0x1006f978
call fcn.1000548e
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0xc], 0
je 0x1000da33
push 0x28a9
lea edx, [ebp - 0x11]
mov byte [ebp - 0x11], 0
call fcn.1000da4e
pop ecx
jmp 0x1000da3d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000da79
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov byte [ebp - 4], dl
mov byte [ebp - 8], cl
je 0x1000db65
test dl, dl
je 0x1000db5b
push ecx
push ecx
xor ebx, ebx
lea edx, [ebp + 0xb]
mov byte [ebp + 0xb], bl
mov cl, 1
call fcn.1000c6f6
mov dword [ebp - 0x14], 0xf46
cmp dword [ebp - 0x14], 0x10c0
pop ecx
pop ecx
jle 0x1000db45
mov esi, ebx
mov dword [ebp - 0x10], ebx
mov edi, ebx
mov dword [ebp - 0xc], ebx
mov eax, esi
mov ecx, edi
sar eax, cl
mov esi, ebx
mov dword [ebp + 8], eax
mov edi, ebx
or eax, edi
lea ecx, [ebp - 0x30]
or eax, esi
cdq
push edx
push eax
call fcn.10001a94
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000daf1
mov eax, dword [eax]
push eax
call fcn.1003cd2f
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x30]
call fcn.10003730
mov eax, dword [ebp + 8]
inc edi
cmp edi, 0x1a7f
jl 0x1000dad8
inc esi
cmp esi, 0x75ed
jl 0x1000dad6
mov edi, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
inc edi
mov dword [ebp - 0xc], edi
cmp edi, 0x2a15
jl 0x1000dacb
inc esi
mov dword [ebp - 0x10], esi
cmp esi, 0x5f61
jl 0x1000dac6
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetPropA]
cmp dword [ebp - 0x14], 0xe7b
jge 0x1000db7f
push str.jtudmve_pxhdtg_zjmqpdede_hkrycyjz_olmlgi_zaxfqi_owcoourlb_yiuil_jgpzwzjjv_gortrjm_wjnrsewjx
call fcn.1003cd2f
pop ecx
jmp 0x1000db7f
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x1000db7f
test cl, cl
je 0x1000db70
mov eax, dword [ebp + 0xc]
inc dword [eax]
jmp 0x1000db7f
push 0x25ee
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_OpenServiceW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000dca4
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
test cl, cl
je 0x1000dcce
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1000dcde
push 0x45f
push 0
push 1
mov edx, 0x1a89
mov cl, 1
call fcn.1000db86
add esp, 0xc
jmp 0x1000dcde
cmp byte [edx], 0
je 0x1000dcde
push 0x260f
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
pop ecx
pop ebp
ret
Function at 0x100142d0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x100142e7
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x10014309
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x100711f4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x10071580
jl 0x10014317
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x10071824
jl 0x10014357
mov ecx, dword [0x10072570]
xor ecx, dword [0x100711f4]
and ecx, edi
xor ecx, dword [0x10072570]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x100711f0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10071824]
mov dword [0x10071bb0], eax
pop esi
ret

Function at 0x10015099
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10056bb3
call fcn.10055fd8
sub esp, 0x24
and dword [ebp - 0x20], 0
lea eax, [ebp - 0x2c]
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
xor esi, esi
push 0x10019207
push fcn.100088a8
inc esi
mov dword [ebp - 0x18], edx
push esi
push 0xc
push eax
mov dword [ebp - 0x1c], ecx
call fcn.1003d451
mov dword [ebp - 4], esi
mov dword [ebp - 0x14], 0x31fe
cmp dword [ebp - 0x14], 0x35b2
jle 0x10015120
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
xor ebx, ebx
xor edi, edi
xor esi, esi
lea eax, [edi + ebx]
mov ecx, 0x1006f978
xor eax, esi
cdq
push edx
push eax
call fcn.100032ed
inc esi
cmp esi, 0x5d43
jl 0x100150f0
inc edi
cmp edi, 0xca9
jl 0x100150ee
inc ebx
cmp ebx, 0x31ab
jl 0x100150ec
xor esi, esi
inc esi
mov ecx, dword [ebp - 0x18]
lea edx, [ebp - 0x2c]
push 0
push 0x164f
push dword [ebp + 8]
call fcn.10016751
add esp, 0xc
mov byte [ebp - 4], 2
cmp dword [ebp - 0x14], 0x30d5
jge 0x10015173
mov edx, str.bbu_adfii_dmckvjyqj
mov ecx, 0x1006f978
call fcn.1000548e
jmp 0x10015173
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], esi
mov ecx, dword [ebp - 0x1c]
push eax
call fcn.10019121
push 0x10019207
push esi
push 0xc
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x20], esi
push eax
mov byte [ebp - 4], 0
call fcn.1003d384
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10017083
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov eax, edx
cmp byte [ebp + 0x14], 0
push esi
push edi
je 0x100170cd
cmp byte [ebp + 0xc], 0
je 0x100170b1
mov eax, dword [ebp + 0x20]
push dword [ebp + 0x28]
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
mov edx, dword [eax]
call fcn.100147a4
pop ecx
jmp 0x1001712c
mov eax, dword [ebp + 8]
mov edx, dword [ecx]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
cmp eax, dword [ecx + edx*4]
jge 0x1001712c
mov eax, dword [ebp + 0x24]
or dword [eax], 0xffffffff
jmp 0x1001712c
cmp byte [ebp + 0x18], 0
je 0x10017103
mov edi, dword [ebp + 0x1c]
lea ecx, [esp + 0x10]
mov esi, dword [ebp + 0x2c]
push eax
imul edx, dword [edi], 0x18
add edx, dword [esi]
call fcn.10015019
pop ecx
imul ecx, dword [edi], 0x18
push eax
add ecx, dword [esi]
call fcn.10018fbf
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.10003c3b
jmp 0x1001712c
xor eax, eax
mov byte [esp + 0xf], al
cmp byte [esp + 0xf], al
je 0x1001712c
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push 0x1396
push 0x10c7
push 0x1b6c
push eax
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001b3f8
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1001b432
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0xc], eax
push 0x44ed
push dword [ebp - 8]
push 1
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.1001b48a
add esp, 0x14
jmp 0x1001b486
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1001b461
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x1001b486
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1396
push 0x10c7
push 0x1b6c
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov esp, ebp
pop ebp
ret
Function at 0x1001b589
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10056edb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1001b618
lea eax, [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1001b5f0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0x1396
push 0x10c7
push 0x1b6c
push 0
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
jmp 0x1001b613
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x1001b613
push 0xe95
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
jmp 0x1001b71b
lea eax, [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x1001b63c
push 0
push 0
push 0x2488
call dword [sym.imp.ADVAPI32.dll_CopySid]
jmp 0x1001b71b
mov byte [ebp - 0x11], 0
mov dword [ebp - 0x20], 0x4fd0
mov dword [ebp - 0x3c], str.vwpuecj_kfzpi_qct_uelmu_llr_ukxpol_gouwrnk_ikhvtbsu_sixubnq_ykapxoge_ztil_iqawnxdp
cmp dword [ebp - 0x20], 0x503f
jle 0x1001b6c0
and dword [ebp - 0x18], 0
jmp 0x1001b664
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x5e5a
jge 0x1001b6c0
and dword [ebp - 0x1c], 0
jmp 0x1001b67a
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x65f8
jge 0x1001b6be
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
shl eax, cl
cdq
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
push dword [ebp - 0x40]
push dword [ebp - 0x44]
lea ecx, [ebp - 0x5c]
call fcn.10001a94
pop ecx
pop ecx
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
call fcn.100032cd
push eax
call fcn.1003cd2f
pop ecx
lea ecx, [ebp - 0x5c]
call fcn.100032c3
jmp 0x1001b673
jmp 0x1001b65d
push 0x702f
push 0x5205
push 0x44f4
push 1
lea eax, [ebp - 0x11]
push eax
push 0
call fcn.10019c73
add esp, 0x18
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x4dc7
jge 0x1001b6f5
push dword [ebp - 0x3c]
call fcn.1003cd2f
pop ecx
jmp 0x1001b711
or dword [ebp - 4], 0xffffffff
jmp 0x1001b71b
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret