joyce8/EMBER2024-capa huggingface dataset:
Function at 0x401750
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ss
adc dword [eax], ecx
mov ecx, dword [0xd2c7c8]
pop ebx
aam 0xc1
inc eax
push 0xf640d274
push ecx
call dword [0x408580]
mov eax, dword [0x41d5c5]
add esp, 0xc
test eax, eax
je 0x401787
push eax
jg 0x4017cf
rol dword [eax - 0x2f], 1
call dword [sym.imp.MSVCRT.dll_modf]
add esp, 8
push 1
call dword [sym.imp.MSVCRT.dll_exit]
nop
push ebp
mov ebp, esp
sub esp, 0xd40000b8
cmp bh, byte [eax + 2]
inc ecx
add byte [ebp - 0x36b34b40], al
cmp eax, dword [eax]
je 0x4017bb
push 0x15ecf640
push eax
call fcn.00405850
mov si, di
je 0x401803
mov esp, 0x8b144344
adc eax, 0xb441af00
mov edx, dword [0xb441af00]
push edx
push eax
call fcn.0040586c
mov cx, word [0x4117f4]
mov dword [0x6c1808], eax
mov eax, dword [0x840288]
push ebx
rcr dword [edi + 0x35], cl
ror byte fs:[ecx + 0xd896600], 1
invalid
test eax, eax
je 0x40181c
mov eax, dword [0x410274]
push eax
adc eax, 0x1d1240
push 0xf7d484
call esi
xor dword [esp + ecx - 0x32], 0xffffff8d
rcl byte [eax + eax]
test eax, eax
mov byte [0x40d480], al
out dx, eax
mov byte [eax + 0x40737c], bh
sub dword [eax + 0x6c], 0xff0040d4
popfd
mov ecx, dword [sym.imp.MSVCRT.dll__iob]
scasb al, byte es:[edi]
inc ebx
and byte [ebx + 0x10], cl
adc eax, 0x1ec154
add esp, 0xc
mov edx, dword [0x66400718]
invalid
into
invalid

Function at 0x409ed0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
adc al, 0x45
or byte [ebx + 0x48], ah
or bh, dh
rol dword [eax], 0
fist dword [eax]
xchg ebx, eax
xor eax, 0xeb05c983
jae 0xd1cba6b4
Function at 0x10002d04
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
cmp byte [ebp + 8], 0
mov eax, ecx
push ebx
push esi
mov ebx, edx
mov dword [esp + 0xc], eax
push edi
mov dword [esp + 0x14], ebx
je 0x10002d97
mov dword [esp + 0xc], 0x7f8b
cmp dword [esp + 0xc], 0x82a8
jle 0x10002d73
xor esi, esi
mov edi, esi
mov ebx, esi
mov dword [esp + 0x10], esi
mov eax, esi
mov ecx, 0x1006cbb8
and eax, ebx
or eax, edi
cdq
push edx
push eax
call fcn.1000c318
inc esi
cmp esi, 0x7994
jl 0x10002d3e
inc ebx
push 0
pop esi
cmp ebx, 0x210d
jl 0x10002d3a
inc edi
cmp edi, 0x2a6
jl 0x10002d38
mov ebx, dword [esp + 0x14]
cmp dword [esp + 0xc], 0x7e08
jge 0x10002d8c
mov edx, str.nldsm_toak_tenhdwpjr_ycoy_vwrhc
mov ecx, 0x1006cbb8
call fcn.1000e58f
mov dword [ebx], 3
jmp 0x10002e2b
mov dword [esp + 0xc], 0x3a5b
cmp dword [esp + 0xc], 0x3dac
push 0
pop esi
jle 0x10002e09
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_StretchDIBits]
mov edi, esi
mov ebx, esi
mov eax, edi
lea ecx, [esp + 0x18]
cdq
idiv ebx
mov eax, edx
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10002de0
mov eax, dword [eax]
push eax
call fcn.1004139c
pop ecx
push esi
push 1
lea ecx, [esp + 0x20]
call fcn.1000c8ef
inc ebx
cmp ebx, 0x6772
jl 0x10002dc3
inc edi
cmp edi, 0x27c4
jl 0x10002dc1
mov eax, dword [esp + 0x10]
cmp byte [eax], 0
je 0x10002e16
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp dword [esp + 0xc], 0x37d2
jge 0x10002e2b
push str.cqvhoidq_fhjatsenl_hpiacrdoj_jdgismf_ubkle_aefxn_jrcrkgxh_golwg_hfsuwcw_xojc_fdik_xecdbc
call fcn.1004139c
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000416e
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov dword [ebp - 8], 0x7a2e
mov ebx, 0x1006cbb8
cmp dword [ebp - 8], 0x7c00
push esi
push edi
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
jle 0x100041e0
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 4], ecx
lea eax, [edi + esi]
xor eax, ecx
mov ecx, 0x1006cbb8
xor eax, ebx
cdq
push edx
push eax
call fcn.1000c318
mov ecx, dword [ebp - 4]
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x4158
jl 0x1000419d
inc ebx
cmp ebx, 0x61a8
jl 0x10004198
inc edi
cmp edi, 0x1859
jl 0x10004196
inc esi
cmp esi, 0x1c5c
jl 0x10004194
mov ebx, 0x1006cbb8
cmp dword [ebp - 8], 0x791b
jge 0x100041f5
mov edx, str.fxwqqqh_ilkoqxcji_qbvox_uov_frttd_pfqapvb
mov ecx, ebx
call fcn.1000e58f
cmp byte [ebp + 8], 0
je 0x100042d8
mov dword [ebp - 8], 0x7a02
cmp dword [ebp - 8], 0x7c7a
jle 0x1000423b
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, ebx
or eax, esi
cdq
push edx
push eax
call fcn.1000c318
inc edi
cmp edi, 0x6bc2
jl 0x10004213
inc esi
cmp esi, 0x4b70
jl 0x10004211
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
cmp dword [ebp - 8], 0x772e
jge 0x10004250
mov edx, str.cmowesq_cno_cghf_tneg
mov ecx, ebx
call fcn.1000e58f
mov ebx, dword [ebp + 0x30]
mov ecx, 0x919c44d4
xor edi, edi
inc edi
mov eax, dword [ebx]
sub ecx, eax
cmp ecx, 0x1d2a
jge 0x10004273
mov eax, dword [ebp + 0x24]
cmp dword [eax], 0
jne 0x10004273
xor ecx, ecx
jmp 0x10004275
mov ecx, edi
mov eax, dword [ebx]
mov esi, dword [ebp + 0xc]
add eax, ecx
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ecx]
xor ecx, ecx
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov eax, dword [ebp + 0x28]
mov esi, dword [esi]
mov edx, dword [eax]
mov eax, dword [ebx]
cmp dword [edx + esi*4], eax
mov esi, dword [ebp + 0xc]
setl cl
neg ecx
jne 0x100042a2
mov eax, dword [esi]
mov eax, dword [ebp + 0x24]
xor edx, edx
mov ecx, dword [eax]
mov eax, dword [ebp + 0x20]
mov dword [eax], ecx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebx]
mov eax, dword [eax]
cmp ecx, eax
mov eax, dword [ebp + 0x18]
setle dl
xor ecx, ecx
cmp edx, edi
setle cl
cmp ecx, dword [eax]
jge 0x100042cd
cmp dword [esi], 0
jne 0x100042cf
xor edi, edi
mov eax, dword [ebp - 0x10]
neg edi
mov dword [eax], edi
jmp 0x100042dd
mov eax, dword [ebp + 0x34]
inc dword [eax]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004c5d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
mov byte [ebp - 4], dl
push ebx
push esi
push edi
test cl, cl
je 0x10004d36
test dl, dl
je 0x10004d0a
mov dword [ebp - 0x10], 0x1394
cmp dword [ebp - 0x10], 0x143e
jle 0x10004ce8
xor esi, esi
xor edi, edi
mov dword [ebp - 0xc], edi
xor ebx, ebx
mov dword [ebp - 8], ebx
and dword [ebp - 0x14], 0
mov eax, edi
cdq
idiv ebx
mov edi, dword [ebp - 0x14]
mov ebx, edx
mov ecx, edi
mov eax, ebx
sar eax, cl
mov ecx, 0x1006cbb8
xor eax, esi
cdq
push edx
push eax
call fcn.1000c318
inc edi
cmp edi, 0x61c0
jl 0x10004ca3
mov ebx, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
inc ebx
mov dword [ebp - 8], ebx
cmp ebx, 0x5aab
jl 0x10004c95
inc edi
mov dword [ebp - 0xc], edi
cmp edi, 0x1408
jl 0x10004c90
inc esi
cmp esi, 0x4c79
jl 0x10004c8b
cmp dword [ebp - 0x10], 0x11ac
jge 0x10004d00
mov edx, str.dxnjpu_cxird_olcnahmr_ijus
mov ecx, 0x1006cbb8
call fcn.1000e58f
mov eax, dword [ebp + 0x10]
inc dword [eax]
jmp 0x10004dc9
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x10004dc9
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 8
inc dword [edx]
cmp dword [edx], 3
jl 0x10004d1f
jmp 0x10004dc9
mov dword [ebp - 0x10], 0x5c20
cmp dword [ebp - 0x10], 0x5fa4
jle 0x10004d95
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
lea ecx, [ebp - 0x2c]
and eax, edi
or eax, esi
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10004d67
mov eax, dword [eax]
push eax
call fcn.1004139c
pop ecx
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.1000c8ef
inc ebx
cmp ebx, 0x4695
jl 0x10004d4c
inc edi
cmp edi, 0x24ed
jl 0x10004d4a
inc esi
cmp esi, 0x412f
jl 0x10004d48
cmp dword [ebp - 0x10], 0x5970
jge 0x10004da9
push str.herffui_mljv_wvvjm_obuwqa_feypec_bvte_eqtgulwa_mcpvl_wokkgxysn_aoerp_ujgthmrg_heoa
call fcn.1004139c
pop ecx
cmp byte [ebp + 8], 0
je 0x10004db7
mov eax, dword [ebp + 0x14]
mov byte [eax], 1
jmp 0x10004dc9
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10004dc9
push 0
push 0
call dword [sym.imp.USER32.dll_FlashWindow]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100058cc
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x1c], edx
push 0
mov dword [ebp - 0x18], ebx
pop esi
je 0x100059a2
mov dword [ebp - 0x14], 0x3c2c
cmp dword [ebp - 0x14], 0x3d6a
jle 0x10005970
mov edi, esi
mov dword [ebp - 0x10], esi
mov dword [ebp - 0xc], esi
mov eax, edi
mov dword [ebp - 8], 0x7829
mov dword [ebp - 4], eax
mov edi, eax
mov ebx, 0x35fe
mov eax, edi
lea ecx, [ebp - 0x34]
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000592c
mov eax, dword [eax]
push eax
call fcn.1004139c
pop ecx
push esi
push 1
lea ecx, [ebp - 0x34]
call fcn.1000c8ef
dec edi
dec ebx
jne 0x10005915
mov eax, dword [ebp - 4]
mov ebx, dword [ebp - 0xc]
add eax, ebx
dec dword [ebp - 8]
mov dword [ebp - 4], eax
jne 0x1000590e
mov edi, dword [ebp - 0x10]
dec ebx
mov dword [ebp - 0xc], ebx
cmp ebx, 0xffffc41f
jg 0x10005902
inc edi
mov dword [ebp - 0x10], edi
cmp edi, 0x3ff8
jl 0x100058ff
mov ebx, dword [ebp - 0x18]
cmp dword [ebp - 0x14], 0x38d1
jge 0x10005984
push str.hgy_wfwjy_nuwgnochk_hkedeq_tcfluer_rvixxe_vkp_vvrfasmgv
call fcn.1004139c
pop ecx
mov edx, dword [ebp + 0x1c]
mov dword [edx], esi
jmp 0x10005998
mov ecx, dword [edx]
mov eax, dword [ebx]
mov dword [eax + ecx*4], 0x7ddc85f7
inc dword [edx]
cmp dword [edx], 3
jl 0x1000598b
jmp 0x10005abf
mov dword [ebp - 4], 0x17f9
cmp dword [ebp - 4], 0x181d
jle 0x10005a38
push esi
push esi
call dword [sym.imp.USER32.dll_GetWindowPlacement]
mov dword [ebp - 8], esi
mov ebx, esi
mov dword [ebp - 0xc], 0x6e57
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x14], 0x764d
mov edi, esi
mov eax, ebx
lea ecx, [ebp - 0x4c]
or eax, edi
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100059f2
mov eax, dword [eax]
push eax
call fcn.1004139c
pop ecx
push esi
push 1
lea ecx, [ebp - 0x4c]
call fcn.1000c8ef
inc edi
cmp edi, 0x66b8
jl 0x100059d9
inc ebx
dec dword [ebp - 0x14]
jne 0x100059d7
mov ebx, dword [ebp - 0x10]
mov edi, dword [ebp - 8]
add ebx, edi
dec dword [ebp - 0xc]
mov dword [ebp - 0x10], ebx
jne 0x100059cd
inc edi
mov dword [ebp - 8], edi
cmp edi, 0x2d7
jl 0x100059c1
push esi
push esi
push esi
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
cmp dword [ebp - 4], 0x17bd
jge 0x10005a4c
push str.ognhjmmv_naiabrj_tliwp_vgtf_ygdoxvyfk_uphpcyqfu_tnjcva
call fcn.1004139c
pop ecx
mov dword [ebp - 0x14], 0x6742
cmp dword [ebp - 0x14], 0x69e7
jle 0x10005a9d
push esi
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x18], esi
mov ecx, esi
mov eax, ebx
shl eax, cl
mov ecx, 0x1006cbb8
xor eax, edi
cdq
push edx
push eax
call fcn.1000c318
inc esi
cmp esi, 0x7a2b
jl 0x10005a6a
inc ebx
push 0
pop esi
cmp ebx, 0x6a92
jl 0x10005a67
inc edi
cmp edi, 0x6a2c
jl 0x10005a65
mov edx, dword [ebp - 0x1c]
mov eax, dword [ebp + 0xc]
mov edx, dword [edx]
mov dword [eax], edx
cmp dword [ebp - 0x14], 0x671a
jge 0x10005abf
mov edx, str.mgpfx_wmahj_xosy_psf
mov ecx, 0x1006cbb8
call fcn.1000e58f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005def
Capabilities:
Clear file content

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0x24], 0
push ebx
push esi
push edi
je 0x10005e1b
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10005eb0
sub esp, 0xc
push 0
push ecx
call fcn.10006a6b
add esp, 0x14
jmp 0x10005eb0
cmp byte [ecx], 0
je 0x10005eb0
mov dword [ebp - 4], 0x3c32
mov ebx, 0x1006cbb8
cmp dword [ebp - 4], 0x3f58
jle 0x10005e65
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, ebx
or eax, esi
cdq
push edx
push eax
call fcn.1000c318
inc edi
cmp edi, 0x113b
jl 0x10005e45
inc esi
cmp esi, 0x6a4b
jl 0x10005e43
push 0x4ba6
push 1
push 0x2652
push 0x24f9
push 0x2f37
push 0x313e
push 0x1e01
push 1
push 0x400f
mov edx, 0x5a15
xor cl, cl
call fcn.10004749
add esp, 0x24
cmp dword [ebp - 4], 0x3a6c
jge 0x10005eb0
mov edx, str.fnihhc_kqhbmmic_vxv_wyeb_lxfpuram_eajsksrhr_ofbvwj_csbtwxo_crxgf
mov ecx, ebx
call fcn.1000e58f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100072a8
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov ebx, edx
mov dword [ebp - 0x14], ebx
push esi
push edi
test cl, cl
je 0x10007369
cmp byte [ebp + 0x14], 0
je 0x100072df
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1000738f
xor esi, esi
push esi
push esi
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
jmp 0x1000738f
mov dword [ebp - 0xc], 0x71b5
cmp dword [ebp - 0xc], 0x7520
push 0
pop esi
jle 0x10007336
mov dword [ebp - 8], esi
mov ebx, esi
mov dword [ebp - 4], 0x699f
mov dword [ebp - 0x10], esi
mov edi, 0x1d95
mov eax, esi
mov ecx, 0x1006cbb8
cdq
push edx
push eax
call fcn.1000c318
add esi, ebx
dec edi
jne 0x10007306
mov edi, dword [ebp - 8]
add ebx, edi
dec dword [ebp - 4]
push 0
pop esi
jne 0x100072fe
inc edi
mov dword [ebp - 8], edi
cmp edi, 0x2bb4
jl 0x100072f5
mov ebx, dword [ebp - 0x14]
cmp dword [ebp - 0xc], 0x6e15
jge 0x1000734e
mov edx, str.gtm_ljjqbyuks_gcblvbci_tns_bpdd_dreiy_xpm_kvue_emqbcdcut_ktodbeoov
mov ecx, 0x1006cbb8
call fcn.1000e58f
mov edx, dword [ebp + 0x18]
mov dword [edx], esi
jmp 0x10007362
mov ecx, dword [edx]
mov eax, dword [ebx]
mov dword [eax + ecx*4], 0x4be76d23
inc dword [edx]
cmp dword [edx], 3
jl 0x10007355
jmp 0x1000738f
cmp byte [ebp + 0x10], 0
je 0x10007383
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1000738f
xor esi, esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1000738f
xor esi, esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10013129
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10013221
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10013182
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1001317d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x1001321f
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov dword [ebp - 8], 1
mov dword [ebp - 4], 0
jmp 0x100131a5
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 4
jge 0x100131b8
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x3c], 0x82062403
jmp 0x1001319e
mov dword [ebp - 4], 0
jmp 0x100131c8
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 1
jge 0x100131db
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x2c], 7
jmp 0x100131c1
mov dword [ebp - 8], 0
jmp 0x100131eb
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x100131fe
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x3c], 1
jmp 0x100131e4
mov dword [ebp - 8], 3
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
sub eax, 0xa
cdq
mov ecx, 0x5e2
idiv ecx
sub eax, 0xa
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
jmp 0x10013229
jmp 0x10013229
push 0
call fcn.10011e06
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10024181
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100242b1
lea eax, [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x100241c4
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100241bf
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x100242af
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x18], 0x3833
mov dword [ebp - 0x30], str.qbyfjkq_syg_nxnwajnje_usohgvl_nwnk_fiuwk
cmp dword [ebp - 0x18], 0x3b8f
jle 0x1002428f
and dword [ebp - 0x14], 0
jmp 0x100241f2
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x60fd
jge 0x1002428f
and dword [ebp - 8], 0
jmp 0x1002420c
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x4b2c
jge 0x1002428a
and dword [ebp - 0xc], 0
jmp 0x10024222
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x2ecb
jge 0x10024285
and dword [ebp - 0x10], 0
jmp 0x10024238
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x71de
jge 0x10024283
mov eax, dword [ebp - 8]
cdq
idiv dword [ebp - 0xc]
and edx, dword [ebp - 0x10]
or edx, dword [ebp - 0x14]
mov eax, edx
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
lea ecx, [ebp - 0x58]
call fcn.100019c5
pop ecx
pop ecx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
call fcn.1000c2f8
push eax
call fcn.1004139c
pop ecx
lea ecx, [ebp - 0x58]
call fcn.1000c2ee
jmp 0x10024231
jmp 0x1002421b
jmp 0x10024205
jmp 0x100241eb
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
and dword [eax], 0
cmp dword [ebp - 0x18], 0x34aa
jge 0x100242af
push dword [ebp - 0x30]
call fcn.1004139c
pop ecx
jmp 0x100242dc
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
push dword [ebp - 0x34]
push 0
push 0x6152
push 0x1fb9
push dword [ebp - 0x38]
push 0x75b7
call fcn.1003376d
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x10034448
Capabilities:
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push esi
mov dword [ebp - 0x14], 0x3287
mov dword [ebp - 0x18], str.solbj_cucpl_fdaquei_djqrxug_gwmy_kwigfhuj_tlf_aehagwcpl_riar_jnunqu_sqqggim_opmdhyq_wbvctji
cmp dword [ebp - 0x14], 0x354b
jle 0x10034507
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyA]
and dword [ebp - 4], 0
jmp 0x10034485
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x776c
jge 0x10034507
and dword [ebp - 8], 0
jmp 0x1003449b
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x60fa
jge 0x10034502
and dword [ebp - 0xc], 0
jmp 0x100344b1
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x8ce
jge 0x10034500
and dword [ebp - 0x10], 0
jmp 0x100344c7
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x1d43
jge 0x100344fe
mov esi, dword [ebp - 4]
mov ecx, dword [ebp - 8]
sar esi, cl
mov eax, dword [ebp - 0xc]
cdq
idiv dword [ebp - 0x10]
mov ecx, edx
sar esi, cl
mov eax, esi
cdq
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], edx
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
mov ecx, 0x1006cbb8
call fcn.1000c318
jmp 0x100344c0
jmp 0x100344aa
jmp 0x10034494
jmp 0x1003447e
push 0x1939
push 0x3780
push dword [ebp + 8]
push dword [ebp + 0xc]
push 0x188e
push dword [ebp + 0x10]
push 0x671a
push dword [ebp + 0x14]
push 1
push 0x6bb1
push 0x72cb
call fcn.10034556
add esp, 0x2c
cmp dword [ebp - 0x14], 0x30d2
jge 0x10034551
mov edx, dword [ebp - 0x18]
mov ecx, 0x1006cbb8
call fcn.1000e58f
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10039583
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
push ebx
mov dword [ebp - 0x10], 0x74ef
cmp dword [ebp - 0x10], 0x7556
push esi
push edi
mov dword [ebp - 0x18], ecx
jle 0x100395e2
xor esi, esi
xor edi, edi
mov dword [ebp - 8], 0x6728
xor ebx, ebx
mov ecx, ebx
mov eax, edi
shl eax, cl
mov ecx, 0x1006cbb8
cdq
push edx
push eax
call fcn.1000c318
inc ebx
cmp ebx, 0x5e62
jl 0x100395ac
add edi, esi
dec dword [ebp - 8]
jne 0x100395aa
inc esi
cmp esi, 0x3404
jl 0x100395a1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
mov dword [ebp - 0xc], 0x6c31
cmp dword [ebp - 0xc], 0x6f18
jle 0x1003965b
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor esi, esi
mov dword [ebp - 8], esi
xor edi, edi
mov ecx, edi
mov dword [ebp - 0x14], esi
xor ebx, ebx
shl esi, cl
mov eax, esi
lea ecx, [ebp - 0x30]
or eax, ebx
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10039627
mov eax, dword [eax]
push eax
call fcn.1004139c
pop ecx
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.1000c8ef
inc ebx
cmp ebx, 0x6776
jl 0x1003960e
mov esi, dword [ebp - 8]
inc edi
cmp edi, 0x6917
jl 0x10039605
inc esi
mov dword [ebp - 8], esi
cmp esi, 0x2b55
jl 0x10039603
cmp dword [ebp - 0xc], 0x6983
jge 0x1003966f
push str.ufv_vfgjjel_ixl_qvunoyhu_hec_fgf_ewitmy_yxcdoum_bsedbjxim_civtuj_mnwy_qrx
call fcn.1004139c
pop ecx
cmp byte [ebp + 0x18], 0
je 0x100396a1
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x10039731
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x6a485bf2
inc dword [edx]
cmp dword [edx], 1
jl 0x1003968a
jmp 0x10039731
mov dword [ebp - 0xc], 0x5f99
cmp dword [ebp - 0xc], 0x6311
jle 0x100396fd
push 0
call dword [sym.imp.USER32.dll_DestroyAcceleratorTable]
xor esi, esi
xor edi, edi
mov ecx, edi
mov eax, esi
shl eax, cl
lea ecx, [ebp - 0x48]
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100396d8
mov eax, dword [eax]
push eax
call fcn.1004139c
pop ecx
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.1000c8ef
inc edi
cmp edi, 0x164e
jl 0x100396bd
inc esi
cmp esi, 0x6b50
jl 0x100396bb
cmp dword [ebp - 0xc], 0x5d70
jge 0x10039711
push str.iiox_rrkwsf_qhg_sqsqnogte_yaoqy_shm_mqhwqpdld_tcfcgws_oconkp_pallyryc_atoajmfhj_iicyr_sro
call fcn.1004139c
pop ecx
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
cmp dword [edx], 4
jge 0x10039731
mov esi, dword [ebp - 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
and dword [eax + ecx*4], 0
inc dword [edx]
cmp dword [edx], 4
jl 0x10039722
cmp dword [ebp - 0x10], 0x743c
jge 0x10039749
mov edx, str.qryi_niedd_gsu_lojeswdrl
mov ecx, 0x1006cbb8
call fcn.1000e58f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003a5b3
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
mov byte [ebp - 4], dl
mov ebx, ecx
mov dword [ebp - 0xc], 0x7ecd
cmp dword [ebp - 0xc], 0x81da
push esi
push edi
mov dword [ebp - 0x10], ebx
jle 0x1003a61e
xor esi, esi
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 8], eax
add eax, ebx
mov ecx, 0x1006cbb8
xor eax, edi
xor eax, esi
cdq
push edx
push eax
call fcn.1000c318
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp eax, 0x6c81
jl 0x1003a5df
inc ebx
cmp ebx, 0x293a
jl 0x1003a5da
inc edi
cmp edi, 0x9de
jl 0x1003a5d8
inc esi
cmp esi, 0xca5
jl 0x1003a5d6
mov ebx, dword [ebp - 0x10]
cmp dword [ebp - 0xc], 0x7c1a
jge 0x1003a636
mov edx, str.riioix_spjmy_eggcth_fracjkisg_ngs_ntmcuylkg_juxyjsb_qlnpfwei_xubthtgr_mxvcrtqul_wdqdch_sml_jrc_qahxfkra
mov ecx, 0x1006cbb8
call fcn.1000e58f
cmp byte [ebp - 4], 0
je 0x1003a641
mov byte [ebx], 1
jmp 0x1003a664
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x1003a664
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x93e0566a
inc dword [edx]
cmp dword [edx], 3
jl 0x1003a652
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret