joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4a935b
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.004a91ca
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x4a94ca
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x4a94ca
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x4a947f
jg 0x4a93b7
test eax, eax
je 0x4a9475
push 1
push 0x1000
call fcn.0040fa11
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x4a93da
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x4a946c
push 0x8000
push ebx
call fcn.0040aab8
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x4a9403
jg 0x4a93fe
cmp ecx, 0x1000
jb 0x4a9403
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.0041d2f5
add esp, 0x10
cmp eax, 0xffffffff
je 0x4a9448
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x4a93fe
jl 0x4a942f
test ecx, ecx
jne 0x4a93f0
push dword [ebp - 0xc]
push ebx
call fcn.0040aab8
push esi
call fcn.0040e490
add esp, 0xc
xor ebx, ebx
jmp 0x4a94d8
cmp byte [edi + 0x24], 0
je 0x4a945f
cmp dword [edi + 0x20], 5
jne 0x4a945f
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x4a946a
mov ebx, dword [edi + 0x18]
jmp 0x4a946c
xor ebx, ebx
push esi
call fcn.0040e490
pop ecx
jmp 0x4a94d8
test ecx, ecx
jg 0x4a9441
jl 0x4a947f
test eax, eax
jae 0x4a9441
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.0041f363
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x4a949f
cmp byte [edi + 0x1c], 0
je 0x4a9441
jmp 0x4a94d0
push ebx
call fcn.004112f7
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x4a9441
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x4a94d8
cmp byte [edi + 0x1c], 0
je 0x4a94d5
mov ebx, dword [edi + 0x18]
jmp 0x4a94d8
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.0041f363
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret
Function at 0x4aa59f
Capabilities:
Set thread local storage value

Disassembly:
push esi
push 0x188
push 8
push dword [0x32fee44]
call dword [sym.imp.KERNEL32.dll_HeapAlloc]
mov esi, eax
push esi
push dword [0x33014e4]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
push dword [esp + 8]
mov dword [0x33014e8], esi
and dword [esi + 0xa8], 0
or dword [esi + 0xac], 0xffffffff
or dword [esi + 0xb0], 0xffffffff
push esi
mov dword [esi + 0xa4], 0xffffff
mov dword [esi + 0x74], 2
mov dword [esi + 0x78], 0x3f
call fcn.004ad559
mov dword [esi + 0x58], 0x4ab582
mov eax, esi
mov dword [esi + 0x5c], 0x4ab5ce
mov dword [esi + 0x10], fcn.004ab0ba
mov dword [esi + 0x30], 0x4aae95
mov dword [esi + 0x64], 0x4ab663
mov dword [esi + 0x60], 0x4ab617
mov dword [esi + 0x34], 0x4aa960
mov dword [esi + 0x24], 0x4aa937
mov dword [esi + 0x28], 0x4aa90c
mov dword [esi + 0x2c], 0x4aa860
mov dword [esi + 0x44], 0x4ab352
mov dword [esi + 0x68], 0x4aa660
mov dword [esi + 0x6c], 0x4ab865
pop esi
ret 4
Function at 0x4b3826
Capabilities:
Resolve function by parsing pe exports

Disassembly:
sub esp, 0x68
lea eax, [esp + 0x10]
push ebx
push esi
push eax
push dword [esp + 0x78]
xor esi, esi
mov ebx, esi
call dword [sym.imp.USER32.dll_GetIconInfo]
test eax, eax
je 0x4b39bd
push dword [esp + 0x28]
call fcn.0043a57a
test eax, eax
je 0x4b3866
push dword [esp + 0x24]
mov ebx, dword [esp + 0x2c]
call dword [sym.imp.GDI32.dll_DeleteObject]
jmp 0x4b39bd
push edi
push esi
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov edi, eax
test edi, edi
je 0x4b39aa
push ebp
mov ebp, dword [sym.imp.GDI32.dll_GetObjectW]
lea eax, [esp + 0x34]
push eax
push 0x18
push dword [esp + 0x38]
call ebp
cmp eax, 0x18
jne 0x4b39a2
push 0x2c
lea eax, [esp + 0x50]
push esi
push eax
call fcn.0041fa80
mov eax, dword [esp + 0x44]
add esp, 0xc
mov dword [esp + 0x50], eax
mov eax, dword [esp + 0x3c]
mov dword [esp + 0x54], eax
xor eax, eax
push 0x20
inc eax
mov dword [esp + 0x50], 0x28
mov word [esp + 0x5c], ax
pop eax
push esi
push esi
mov word [esp + 0x62], ax
lea eax, [esp + 0x1c]
push eax
push esi
lea eax, [esp + 0x5c]
mov dword [esp + 0x6c], esi
push eax
push edi
call dword [sym.imp.GDI32.dll_CreateDIBSection]
mov ebx, eax
mov dword [esp + 0x1c], ebx
test ebx, ebx
je 0x4b39a2
mov esi, dword [sym.imp.GDI32.dll_SelectObject]
push ebx
push edi
call esi
push 2
xor eax, eax
push eax
push eax
push dword [esp + 0x48]
push dword [esp + 0x48]
push dword [esp + 0x90]
push eax
push eax
push edi
call dword [sym.imp.USER32.dll_DrawIconEx]
push dword [esp + 0x2c]
push edi
call esi
lea eax, [esp + 0x34]
push eax
push 0x18
push dword [esp + 0x38]
call ebp
cmp eax, 0x18
jne 0x4b39a2
mov ebp, dword [esp + 0x38]
xor esi, esi
mov edx, dword [esp + 0x3c]
mov eax, ebp
shl eax, 2
mov dword [esp + 0x10], eax
test edx, edx
jle 0x4b39a2
mov eax, dword [sym.imp.GDI32.dll_GetPixel]
mov dword [esp + 0x18], eax
mov eax, dword [esp + 0x14]
mov ecx, edx
sub ecx, esi
add eax, 3
dec ecx
xor ebx, ebx
imul ecx, dword [esp + 0x10]
add eax, ecx
mov dword [esp + 0x7c], eax
test ebp, ebp
jle 0x4b3999
push esi
push ebx
push edi
call dword [esp + 0x24]
mov ecx, dword [esp + 0x7c]
test eax, eax
setne al
dec al
mov byte [ecx], al
add ecx, 4
mov ebp, dword [esp + 0x38]
inc ebx
mov dword [esp + 0x7c], ecx
cmp ebx, ebp
jl 0x4b3971
mov edx, dword [esp + 0x3c]
inc esi
cmp esi, edx
jl 0x4b3954
mov ebx, dword [esp + 0x1c]
push edi
call dword [sym.imp.GDI32.dll_DeleteDC]
pop ebp
push dword [esp + 0x28]
mov esi, dword [sym.imp.GDI32.dll_DeleteObject]
call esi
push dword [esp + 0x2c]
call esi
pop edi
pop esi
mov eax, ebx
pop ebx
add esp, 0x68
ret 4
Function at 0x10006e14
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100585b1
call fcn.10057d24
sub esp, 0x10
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, edx
je 0x10006f2f
cmp byte [ebp + 0x10], 0
je 0x10006e65
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10006f6b
mov esi, dword [ebp + 0x28]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [edx]
cmp dword [edx], 2
jl 0x10006e4e
jmp 0x10006f6b
mov dword [ebp - 0x18], 0x387f
cmp dword [ebp - 0x18], 0x3bbc
jle 0x10006ed4
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
mov dword [ebp + 0x18], edi
xor ebx, ebx
mov eax, edi
and dword [ebp - 0x1c], 0
cdq
mov edi, esi
idiv ebx
mov esi, dword [ebp - 0x1c]
mov ecx, edx
shl edi, cl
mov eax, edi
mov ecx, 0x10073b38
xor eax, esi
cdq
push edx
push eax
call fcn.10004192
inc esi
cmp esi, 0x67f9
jl 0x10006e93
mov esi, dword [ebp - 0x14]
inc ebx
mov edi, dword [ebp + 0x18]
cmp ebx, 0x1a0c
jl 0x10006e81
inc edi
mov dword [ebp + 0x18], edi
cmp edi, 0x1198
jl 0x10006e7f
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x4a25
jl 0x10006e7a
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x36e2
jge 0x10006ef0
mov edx, str.knztnmesb_mqrzhki_uktbpd_ekjbxf
mov ecx, 0x10073b38
call fcn.10005a51
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 4
jge 0x10006f6b
mov esi, dword [ebp + 0x24]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x7909b792
inc dword [edx]
cmp dword [edx], 4
jl 0x10006f01
jmp 0x10006f6b
cmp byte [ebp + 0x1c], 0
je 0x10006f5b
push 0x1a
pop edi
cmp dword [ecx], edi
jge 0x10006f46
mov eax, dword [ebp + 0x2c]
movzx edx, word [eax]
add edx, dword [ecx]
jmp 0x10006f50
mov eax, dword [ecx]
cdq
idiv edi
movzx eax, word [esi]
add edx, eax
mov ecx, dword [ebp + 8]
push edx
call fcn.100090a5
jmp 0x10006f6b
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp + 0x20]
push eax
call fcn.10009304
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007361
Capabilities:
Clear file content

Disassembly:
mov eax, 0x100585c5
call fcn.10057d24
sub esp, 0x20
push ebx
push esi
mov byte [ebp - 0x14], cl
mov esi, edx
mov dword [ebp - 0x20], 0x3e33
cmp dword [ebp - 0x20], 0x4140
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], esi
jle 0x10007410
push 0x2596
push 0
push 0x1d71
push 0xc09
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
xor edi, edi
xor eax, eax
mov dword [ebp - 0x18], eax
and dword [ebp - 0x28], 0
lea esi, [edi + ebx]
mov ebx, dword [ebp - 0x28]
xor esi, eax
mov eax, esi
mov ecx, 0x10073b38
or eax, ebx
cdq
push edx
push eax
call fcn.10004192
inc ebx
cmp ebx, 0xe94
jl 0x100073cd
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x4f38
jl 0x100073c1
inc edi
cmp edi, 0x55ae
jl 0x100073bc
inc ebx
mov dword [ebp - 0x1c], ebx
cmp ebx, 0x1b33
jl 0x100073ba
mov esi, dword [ebp - 0x24]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x3df2
jge 0x1000744b
mov edx, str.qggj_frx_fqifoshvh_zpirwktsu_urrigmv_cfazxf_ifulq_izqmjg_euhjnfsld
mov ecx, 0x10073b38
call fcn.10005a51
jmp 0x1000744b
cmp byte [ebp - 0x14], 0
je 0x10007473
mov dword [esi], 0
cmp dword [esi], 2
jge 0x1000747b
mov edx, dword [ebp + 8]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0xec0a
inc dword [esi]
cmp dword [esi], 2
jl 0x1000745f
jmp 0x1000747b
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007c4b
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x10058629
call fcn.10057d24
sub esp, 0x20
push ebx
push esi
mov dword [ebp - 0x20], 0x25e0
mov ebx, edx
cmp dword [ebp - 0x20], 0x28ff
mov eax, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], eax
jle 0x10007ce3
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x18], edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov eax, edx
mov dword [ebp - 0x14], eax
xor esi, esi
mov edi, 0x4e22
mov ecx, esi
shl eax, cl
mov ecx, 0x10073b38
cdq
push edx
push eax
call fcn.10004192
mov eax, dword [ebp - 0x14]
add esi, ebx
dec edi
jne 0x10007c95
inc ebx
cmp ebx, 0x4fa4
jl 0x10007c8e
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x3659
jl 0x10007c82
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x734c
jl 0x10007c7d
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
mov eax, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x28]
cmp byte [ebp + 0x14], 0
je 0x10007d08
mov edx, dword [ebp + 8]
mov dword [edx], 0
jmp 0x10007d01
mov ecx, dword [edx]
mov eax, dword [ebx]
mov dword [eax + ecx*4], 0x48b1647c
inc dword [edx]
cmp dword [edx], 1
jl 0x10007cf4
jmp 0x10007d14
cmp byte [eax], 0
je 0x10007d14
push ecx
call fcn.10008640
pop ecx
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x2406
jge 0x10007d30
mov edx, str.juhzervpt_ejtq_xrioogs_vxjwmijj_mzm
mov ecx, 0x10073b38
call fcn.10005a51
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007d96
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1005863b
push eax
mov dword fs:[0], esp
sub esp, 0x20
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov esi, edx
je 0x10007dca
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x10007f31
mov eax, dword [0x10075790]
xor edi, edi
inc edi
mov ebx, 0x270
test al, 1
jne 0x10007e17
or eax, edi
mov ecx, 0x1571
or dword [0x10076b34], 0xffffffff
mov edx, edi
mov dword [0x10075790], eax
mov dword [0x100757b4], ecx
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
mov dword [edx*4 + 0x100757b4], ecx
inc edx
cmp edx, ebx
jl 0x10007df6
mov dword [0x100757b0], ebx
sub esp, 0xc
call fcn.10008ee0
add esp, 0xc
lea ecx, [esp + 0x1c]
push 4
call fcn.100013fd
push ecx
xor ebx, ebx
lea eax, [esp + 0x1c]
mov dword [esp + 0x38], ebx
lea ecx, [esp + 0x20]
push ebx
mov dword [esp + 0x1c], 0xa32b1cec
mov dword [esp + 0x1c], 0xfffffffa
push eax
call fcn.10007194
mov dword [esp + 0x20], 3
add esp, 0xc
cmp dword [esp + 0x14], ebx
jl 0x10007e8f
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x10007e78
push ebx
push edi
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_CreateEventW]
push ecx
push edi
push 0xc
mov ecx, 0x4ad1
call fcn.10007194
add esp, 0xc
dec dword [esp + 0x14]
jns 0x10007e64
or dword [esp + 0x34], 0xffffffff
lea ecx, [esp + 0x1c]
call fcn.10001439
push 0xbed
push ecx
push 0x10074c74
push 0x28f8
push ecx
push 0x100757b0
push 0x35c4
push ecx
push 0x4f8d
push 0x26aa
xor dl, dl
mov ecx, 0x345c
call fcn.100072ad
mov eax, dword [0x100757b0]
add esp, 0x28
cmp eax, 0x270
jne 0x10007ee5
call fcn.100093fd
jmp 0x10007ef1
cmp eax, 0x4e0
jb 0x10007ef6
call fcn.1000933d
mov eax, dword [0x100757b0]
mov ecx, dword [eax*4 + 0x100757b4]
inc eax
mov dword [0x100757b0], eax
mov eax, ecx
shr eax, 0xb
and eax, dword [0x10076b34]
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
mov dword [esi], eax
mov ecx, dword [esp + 0x2c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009304
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x1000931b
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x1000933d
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x100757b4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x10075b40
jl 0x1000934b
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x10075de4
jl 0x1000938b
mov ecx, dword [0x10076b30]
xor ecx, dword [0x100757b4]
and ecx, edi
xor ecx, dword [0x10076b30]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x100757b0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10075de4]
mov dword [0x10076170], eax
pop esi
ret

Function at 0x100093fd
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, 0x100757b4
mov ecx, dword [esi + 4]
xor ecx, dword [esi]
and ecx, 0x7fffffff
xor ecx, dword [esi]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
add esi, 4
cmp esi, 0x10076174
jl 0x10009403
pop esi
ret
Function at 0x1000b907
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10058907
call fcn.10057d24
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 0x14], 0x43cd
cmp dword [ebp - 0x14], 0x43e9
push edi
mov dword [ebp - 0x10], esp
jle 0x1000b95d
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x10073b38
xor eax, edi
or eax, esi
cdq
push edx
push eax
call fcn.10004192
inc ebx
cmp ebx, 0x1be6
jl 0x1000b92f
inc edi
cmp edi, 0x2ba
jl 0x1000b92d
inc esi
cmp esi, 0x6538
jl 0x1000b92b
push 0
push 0x1c72
push dword [ebp + 0xc]
push ecx
push 0x4192
push ecx
push 0x3e10
mov ecx, 0x73f9
call fcn.1000b9c7
and dword [ebp - 4], 0
add esp, 0x1c
cmp dword [ebp - 0x14], 0x41a9
jge 0x1000b99c
mov edx, str.xrpcdfpon_vxdyxdk_grhxc_xlitfdhiy_bdptnuy_cpaedtnk_qxtstvle
mov ecx, 0x10073b38
call fcn.10005a51
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000c54d
Capabilities:
Clear file content

Disassembly:
mov eax, 0x1005896e
call fcn.10057d24
sub esp, 0x30
cmp byte [ebp + 0x1c], 0
push ebx
je 0x1000c5df
sub esp, 0x18
mov ecx, esp
push dword [ebp + 8]
call fcn.10001388
lea ecx, [ebp - 0x20]
call fcn.1000b2c6
add esp, 0x18
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x20], eax
je 0x1000c5d0
push dword [ebp - 0x14]
xor ecx, ecx
mov dword [ebp - 0x24], 7
push eax
push dword [ebp - 0x20]
mov word [ebp - 0x38], cx
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x28], ebx
call fcn.1000e873
mov ecx, dword [ebp + 0xc]
lea edx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.1000c4f7
lea ecx, [ebp - 0x38]
push ebx
push 1
test eax, eax
jns 0x1000c5cb
mov eax, dword [ebp + 0x18]
mov byte [eax], 1
call fcn.100016dd
jmp 0x1000c5d5
call fcn.100016dd
mov eax, dword [ebp + 0x18]
mov byte [eax], bl
lea ecx, [ebp - 0x20]
call fcn.1000e484
jmp 0x1000c5e7
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000c6b4
Capabilities:
Terminate process

Disassembly:
mov eax, 0x1005898a
call fcn.10057d24
sub esp, 0x14
push ebx
push esi
mov byte [ebp - 0x14], dl
mov esi, ecx
mov dword [ebp - 0x18], 0x52bf
cmp dword [ebp - 0x18], 0x548a
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
jle 0x1000c713
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x10073b38
or eax, edi
cdq
push edx
push eax
call fcn.10004192
inc ebx
cmp ebx, 0x5cc2
jl 0x1000c6e3
inc edi
cmp edi, 0x173e
jl 0x1000c6e1
push 0x21fb
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x4fcd
jge 0x1000c74e
mov edx, str.gyajxmbnw_fsl_ojhvpz_xzvyitfeo_zpq_ksnsfx
mov ecx, 0x10073b38
call fcn.10005a51
jmp 0x1000c74e
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x14], 0
je 0x1000c76a
mov eax, dword [ebp + 0x10]
movzx eax, word [eax]
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.10001cc5
jmp 0x1000c79b
mov dword [esi], 0
jmp 0x1000c796
push 1
push 0
push 0x42cf
push 0x5b56
push 0x4620
mov edx, 0x4156
mov cl, 1
call fcn.100097aa
add esp, 0x14
dec dword [esi]
cmp dword [esi], 0xfffffff9
jg 0x1000c772
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000ca80
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x100589a6
call fcn.10057d24
sub esp, 0x18
push ebx
push esi
mov dword [ebp - 0x1c], 0x4309
mov eax, ecx
cmp dword [ebp - 0x1c], 0x44d4
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], eax
jle 0x1000caf9
xor edi, edi
xor esi, esi
mov dword [ebp - 0x18], esi
xor ebx, ebx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x14], 0x1f25
mov ecx, esi
mov eax, edi
shl eax, cl
mov ecx, 0x10073b38
cdq
push edx
push eax
call fcn.10004192
add esi, ebx
dec dword [ebp - 0x14]
jne 0x1000cabb
mov esi, dword [ebp - 0x18]
dec ebx
cmp ebx, 0xffffc67e
jg 0x1000cab1
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x675a
jl 0x1000caaf
inc edi
cmp edi, 0x7f90
jl 0x1000caaa
mov eax, dword [ebp - 0x24]
cmp byte [ebp + 8], 0
je 0x1000cb0c
push ecx
push ecx
mov ecx, dword [ebp + 0xc]
push eax
call fcn.1000603d
jmp 0x1000cb12
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x41c2
jge 0x1000cb2e
mov edx, str.dkhehit_ool_ivw_bmgmdzj
mov ecx, 0x10073b38
call fcn.10005a51
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d981
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10058a52
call fcn.10057d24
sub esp, 0x14
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
mov ebx, edx
mov dword [ebp - 0x18], edi
je 0x1000d9ba
mov ecx, dword [ebp + 0x10]
call fcn.10003f1d
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x14], 0x2da6
cmp dword [ebp - 0x14], 0x311a
jle 0x1000d9f4
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x10073b38
xor eax, esi
cdq
push edx
push eax
call fcn.10004192
inc edi
cmp edi, 0x146a
jl 0x1000d9ce
inc esi
cmp esi, 0x56f4
jl 0x1000d9cc
mov edi, dword [ebp - 0x18]
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
mov esi, dword [ebp + 0x18]
sar eax, 2
mov dword [edi], eax
jmp 0x1000da16
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x1c]
push eax
mov ecx, ebx
call fcn.1000e068
inc dword [edi]
mov eax, dword [edi]
cmp eax, dword [esi]
jl 0x1000da03
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x2a83
jge 0x1000d9a9
mov edx, str.tpajheih_hwzbkq_ycajmxdm_vbmovqpj_ckpag_hsu_nuvncpc_apnnzp_qhbikvgpm_bkcmxuv_ivsghk_ggzavoa
mov ecx, 0x10073b38
call fcn.10005a51
jmp 0x1000d9a9