joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001c565
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100643b9
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001c59c
push 1
call fcn.1001c70d
pop ecx
jmp 0x1001c6fc
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], 0x21b7
mov dword [ebp - 0x44], str.ulqkgkia_xry_lymkuwyo_uufjxemto_pwnvvctc_hgqr_cucp_iydqthelg_qkamzbhfb
cmp dword [ebp - 0x24], 0x23d2
jle 0x1001c664
and dword [ebp - 0x1c], 0
jmp 0x1001c5d6
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3765
jge 0x1001c653
and dword [ebp - 0x20], 0
jmp 0x1001c5ec
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x3921
jge 0x1001c64e
and dword [ebp - 0x14], 0
jmp 0x1001c602
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x5e43
jge 0x1001c64c
and dword [ebp - 0x18], 0
jmp 0x1001c618
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x10d2
jge 0x1001c64a
mov eax, dword [ebp - 0x14]
xor eax, dword [ebp - 0x18]
mov edx, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
sar edx, cl
or eax, edx
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
mov ecx, 0x10081838
call fcn.10001e6d
jmp 0x1001c611
jmp 0x1001c5fb
jmp 0x1001c5e5
jmp 0x1001c5cf
push 0
push 0
push 0x1de0
push 0
call dword [sym.imp.USER32.dll_AppendMenuA]
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1001c69e
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x1001c69c
push 0x21c5
push 0
push 0
push 0
push 0
push 0x10b0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1001c6bc
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x1001c6bc
push 0
call fcn.1001c11b
pop ecx
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x21a8
jge 0x1001c6d6
mov edx, dword [ebp - 0x44]
mov ecx, 0x10081838
call fcn.100038af
jmp 0x1001c6f2
or dword [ebp - 4], 0xffffffff
jmp 0x1001c6fc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10025983
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
mov dword [esp + 0x10], 0x7d
mov edi, ecx
cmp dword [esp + 0x10], 0x96
mov ebx, edx
mov dword [esp + 0x14], edi
jle 0x100259fd
push 0
push 0x11b1
call dword [sym.imp.USER32.dll_GetWindowInfo]
xor esi, esi
xor edi, edi
lea eax, [edi + esi]
cdq
lea ecx, [esp + 0x18]
push edx
push eax
call fcn.10001a31
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100259d3
mov eax, dword [eax]
push eax
call fcn.1004b116
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.100022d2
inc edi
cmp edi, 0xcdc
jl 0x100259ba
inc esi
cmp esi, 0x5bcf
jl 0x100259b8
mov edi, dword [esp + 0x14]
cmp dword [esp + 0x10], 0xfffffe50
jge 0x10025a12
push str.cuqjeueep_wjoevmdo_wsbxogub_lvubfsv_spiylwhak_cjplaib_pmendb_rnvbi
call fcn.1004b116
pop ecx
cmp byte [ebp + 0xc], 0
je 0x10025a51
mov esi, dword [ebp + 0x18]
xor ecx, ecx
mov eax, dword [esi]
mov dword [eax], ecx
jmp 0x10025a48
mov byte [esp + 0xf], cl
cmp byte [esp + 0xf], 0
je 0x10025a44
push 0x21c5
push ecx
push ecx
push ecx
push ecx
push 0x10b0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor ecx, ecx
mov eax, dword [esi]
inc dword [eax]
mov eax, dword [esi]
cmp dword [eax], 0x13
jl 0x10025a23
jmp 0x10025aca
mov ecx, dword [ebp + 0x24]
mov eax, dword [ebp + 0x14]
mov esi, dword [ebp + 0x20]
push 0
mov dword [eax], 1
mov eax, dword [ecx]
mov dword [ecx], eax
mov eax, dword [ebx]
imul eax, dword [ecx]
xor ecx, ecx
test eax, eax
mov eax, dword [esi]
setns cl
xor edx, edx
cmp ecx, eax
mov eax, dword [edi]
mov edi, dword [ebp + 0x1c]
setle dl
sub edx, eax
mov eax, dword [edi]
add eax, edx
mov eax, dword [esi]
pop edx
sets dl
xor ecx, ecx
sub edx, eax
mov eax, dword [esp + 0x14]
mov eax, dword [eax]
cmp edx, eax
setge cl
xor edx, edx
cmp ecx, 0x49ec59c4
setle dl
xor eax, eax
cmp edx, 0x5714a8a5
mov edx, 0xab7a3ebe
setge al
xor ecx, ecx
mov dword [ebx], eax
mov eax, dword [ebp + 8]
mov dword [eax], edx
mov eax, dword [edi]
cmp eax, edx
setle cl
neg ecx
mov dword [edi], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10026dbd
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100647e7
call fcn.10063318
sub esp, 0x10
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, edx
je 0x10026e8f
mov dword [ebp - 0x18], 0x5a8e
cmp dword [ebp - 0x18], 0x5c2f
jle 0x10026e4a
xor esi, esi
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
and eax, ebx
mov ecx, 0x10081838
and eax, edi
xor eax, esi
cdq
push edx
push eax
call fcn.10001e6d
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x5611
jl 0x10026df7
inc ebx
cmp ebx, 0x6fe0
jl 0x10026df2
inc edi
cmp edi, 0x35df
jl 0x10026df0
inc esi
cmp esi, 0x6fd9
jl 0x10026dee
push 0x1a9f
push 0
push 0x5c1
push 0x109b
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
push 0x63c
push 0x65
call dword [sym.imp.GDI32.dll_RestoreDC]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x5708
jge 0x10026e73
mov edx, str.dsfwgmd_xtvyh_pgiwxszju
mov ecx, 0x10081838
call fcn.100038af
jmp 0x10026eed
cmp dword [edi], 0
je 0x10026ee3
mov eax, dword [edi]
xor ebx, ebx
mov eax, dword [edi]
xor ecx, ecx
mov esi, dword [ebp + 0x2c]
inc ebx
mov dword [esi], eax
mov eax, dword [ebp + 0x34]
mov eax, dword [eax]
cmp eax, ebx
mov eax, dword [edi]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esi]
setg dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [edi]
setge cl
xor edx, edx
cmp ecx, ebx
setge dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [ebp + 8]
setg bl
xor ecx, ecx
mov eax, dword [eax]
cmp ebx, eax
setg cl
cmp ecx, dword [edi]
je 0x10026ee3
xor ecx, ecx
inc ecx
jmp 0x10026ee5
xor ecx, ecx
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov dword [eax + 8], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002715e
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x100647f1
call fcn.10063318
sub esp, 0x20
mov dword [ebp - 0x2c], edx
mov byte [ebp - 0x14], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x10027331
mov dword [ebp - 0x28], 0x1023
xor esi, esi
cmp dword [ebp - 0x28], 0x10e8
jle 0x100271d6
push 0x20fc
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x20], esi
lea eax, [esi + ebx]
mov ecx, 0x10081838
add eax, edi
cdq
push edx
push eax
call fcn.10001e6d
inc esi
cmp esi, 0xec0
jl 0x100271a6
inc ebx
push 0
pop esi
cmp ebx, 0x3c6d
jl 0x100271a3
inc edi
cmp edi, 0x64ec
jl 0x100271a1
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], 0x1694
cmp dword [ebp - 0x20], 0x1050
jge 0x100272da
lea eax, [ebp - 0x18]
mov dword [ebp - 0x24], esi
push eax
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], esi
push eax
lea eax, [ebp - 0x24]
mov dword [ebp - 0x18], esi
push eax
push str._ld__ld__ld
call fcn.1004b73b
mov eax, dword [ebp - 0x18]
add esp, 0x10
mov edi, dword [ebp - 0x24]
or ebx, 0xffffffff
test eax, eax
jle 0x10027242
cmp eax, edi
jge 0x10027242
mov eax, dword [ebp - 0x1c]
lea ecx, [eax + eax]
mov eax, edi
neg eax
cmp eax, ecx
jge 0x100272cd
cmp ecx, edi
jge 0x100272cd
xor ebx, ebx
inc ebx
jmp 0x100272cd
cdq
idiv edi
mov edx, eax
mov ecx, eax
and ecx, 0x80000001
jns 0x10027256
dec ecx
or ecx, 0xfffffffe
inc ecx
mov dword [ebp - 0x20], ecx
jne 0x10027279
mov ecx, edx
imul ecx, edi
cmp dword [ebp - 0x18], ecx
jle 0x10027279
mov ecx, dword [ebp - 0x1c]
mov eax, edi
neg eax
cmp eax, ecx
jge 0x1002727c
test ecx, ecx
jns 0x1002727c
imul eax, edx, 3
jmp 0x100272c6
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x20]
test eax, eax
jne 0x100272a5
mov eax, edx
imul eax, edi
cmp dword [ebp - 0x18], eax
jle 0x100272a2
test ecx, ecx
jle 0x100272a2
cmp ecx, edi
jge 0x100272a2
imul eax, edx, 3
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
inc ebx
jmp 0x100272cd
mov eax, dword [ebp - 0x20]
cmp eax, 1
jne 0x100272cd
mov eax, edx
imul eax, edi
cmp dword [ebp - 0x18], eax
jle 0x100272cd
mov eax, edi
add ecx, ecx
neg eax
cmp eax, ecx
jge 0x100272cd
cmp ecx, edi
jge 0x100272cd
imul eax, edx, 3
inc eax
cdq
sub eax, edx
mov ebx, eax
sar ebx, 1
push ebx
push str._ld_n
call fcn.1004b116
pop ecx
pop ecx
cmp dword [ebp - 0x28], 0xd0f
jge 0x10027310
mov edx, str.zraopwnwh_gihq_sgn_kutophl
mov ecx, 0x10081838
call fcn.100038af
jmp 0x10027310
mov edx, dword [ebp - 0x2c]
mov dword [edx], esi
cmp dword [edx], 3
jge 0x10027340
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xf37911b9
inc dword [edx]
cmp dword [edx], 3
jl 0x1002731d
jmp 0x10027340
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10027340
push ecx
call fcn.100255ec
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100281d2
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10064837
call fcn.10063318
sub esp, 0x14
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ecx
je 0x1002820b
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [eax + 4], 0xa5c62e08
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x18], 0x7122
cmp dword [ebp - 0x18], 0x728e
jle 0x1002826a
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov eax, ebx
cdq
idiv ecx
mov eax, edi
mov ecx, edx
sar eax, cl
mov ecx, 0x10081838
xor eax, esi
cdq
push edx
push eax
call fcn.10001e6d
mov ecx, dword [ebp - 0x14]
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x75ac
jl 0x10028226
inc ebx
cmp ebx, 0x269a
jl 0x10028221
inc edi
cmp edi, 0x1969
jl 0x1002821f
inc esi
cmp esi, 0x7686
jl 0x1002821d
mov ecx, dword [ebp - 0x1c]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x6ffe
mov eax, dword [ebp + 0x10]
mov dword [ecx], eax
jge 0x100281fa
mov edx, str.zfxgvbjpk_aumeyx_uybijmzs_gabatr_tohhfflb_snxfdw_ike
mov ecx, 0x10081838
call fcn.100038af
jmp 0x100281fa

Function at 0x10028324
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov byte [ebp - 8], dl
mov byte [ebp - 1], 0
test dl, dl
je 0x10028344
cmp byte [ebp - 1], 0
je 0x10028352
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x10028352
cmp byte [ebp - 1], 0
je 0x10028352
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
mov esp, ebp
pop ebp
ret
Function at 0x10028f64
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10064880
call fcn.10063318
sub esp, 0x28
cmp byte [ebp + 0x14], 0
mov eax, edx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x14], cl
je 0x1002900e
test cl, cl
je 0x10028fab
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x10028f9a
call fcn.100291e8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x18], 0x228b
cmp dword [ebp - 0x18], 0xcfd
jge 0x10028ffe
movdqa xmm0, xmmword [0x10073640]
lea ecx, [ebp - 0x30]
push 4
xor edx, edx
mov dword [ebp - 0x20], 7
movdqu xmmword [ebp - 0x30], xmm0
call fcn.10028f2e
pop ecx
xor esi, esi
push dword [ebp + esi*4 - 0x30]
mov ecx, 0x10081838
call fcn.100220d1
mov edx, 0x1006dc40
mov ecx, eax
call fcn.100038af
inc esi
cmp esi, 5
jl 0x10028fde
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10028f9a
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
jmp 0x10028f9a
mov dword [ebp - 0x18], 0x3743
cmp dword [ebp - 0x18], 0x3895
jle 0x10029050
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x10081838
xor eax, esi
cdq
push edx
push eax
call fcn.10001e6d
inc edi
cmp edi, 0x7b33
jl 0x10029022
inc esi
cmp esi, 0x2664
jl 0x10029020
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov eax, dword [ebp - 0x1c]
cmp byte [ebp + 8], 0
je 0x10029096
push 0x1af4
push 0x1a7b
push 0x702e
push 1
lea eax, [ebp + 0x17]
mov byte [ebp + 0x17], 0
push eax
push 0x15b0
push 0
push 0x268c
push 0x28ac
push 0x37b6
mov edx, 0x4311
mov cl, 1
call fcn.10025db1
add esp, 0x28
jmp 0x100290a3
cmp byte [eax], 0
je 0x100290a3
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x3711
jge 0x10028f9a
mov edx, str.dylykkrw_nonvdu_vnkxdulzl_gdoi_qiz
mov ecx, 0x10081838
call fcn.100038af
jmp 0x10028f9a
Function at 0x100297a8
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10064894
call fcn.10063318
sub esp, 0x28
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x10029906
mov dword [ebp - 0x18], 0x36b5
cmp dword [ebp - 0x18], 0x3a8b
jle 0x10029829
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, edi
cdq
idiv ebx
mov eax, esi
mov ecx, edx
shl eax, cl
lea ecx, [ebp - 0x34]
cdq
push edx
push eax
call fcn.10001a31
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100297fb
mov eax, dword [eax]
push eax
call fcn.1004b116
pop ecx
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.100022d2
inc ebx
cmp ebx, 0x73fc
jl 0x100297db
inc edi
cmp edi, 0x3a4c
jl 0x100297d9
inc esi
cmp esi, 0x1187
jl 0x100297d7
cmp dword [ebp - 0x18], 0x358d
jge 0x1002983d
push str.ucarun_buznfmb_gvwxju_shamsahhe_tmfnaogr
call fcn.1004b116
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], 0x6ca9
cmp dword [ebp - 0x1c], 0x6db3
jle 0x1002989a
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
lea eax, [ebx + edi]
and eax, ecx
mov ecx, 0x10081838
xor eax, esi
cdq
push edx
push eax
call fcn.10001e6d
mov ecx, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x17c2
jl 0x1002985c
inc ebx
cmp ebx, 0xf4f
jl 0x10029857
inc edi
cmp edi, 0x1551
jl 0x10029855
inc esi
cmp esi, 0x1d90
jl 0x10029853
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x6b5c
jge 0x100298b9
mov edx, str.ayyzwxvv_wbarrbhe_plrnko_lugkzb_braxm_eojnctr_owjti_hbgno_jjs_kpzkixdpo_qnnr_kpvzf
mov ecx, 0x10081838
call fcn.100038af
mov esi, dword [ebp + 0x1c]
or dword [ebp - 4], 0xffffffff
mov dword [esi], 2
jmp 0x100298ff
push 0x648
push 0x7d05
push 0x66cc
mov dl, 1
xor cl, cl
call fcn.10026026
add esp, 0xc
dec dword [esi]
cmp dword [esi], 0
jge 0x100298e2
jmp 0x1002991d
push 0
push 0x295
push 0x2248
push 0x19f6
call dword [sym.imp.GDI32.dll_MoveToEx]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002a74c
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
cmp byte [ebp + 0x18], 0
push ebx
push esi
mov ebx, ecx
mov dword [esp + 0x20], edx
push edi
mov dword [esp + 0x20], ebx
je 0x1002a877
mov dword [esp + 0x18], 0x32a1
cmp dword [esp + 0x18], 0x3517
jle 0x1002a7f4
xor edi, edi
xor ebx, ebx
xor esi, esi
mov dword [esp + 0x14], esi
mov dword [esp + 0x1c], esi
mov dword [esp + 0x10], 0x707c
mov ecx, esi
mov eax, ebx
sar eax, cl
lea ecx, [esp + 0x28]
and eax, edi
cdq
push edx
push eax
call fcn.10001a31
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002a7b2
mov eax, dword [eax]
push eax
call fcn.1004b116
pop ecx
push 0
push 1
lea ecx, [esp + 0x30]
call fcn.100022d2
dec esi
dec dword [esp + 0x10]
jne 0x1002a794
mov esi, dword [esp + 0x14]
inc esi
mov dword [esp + 0x14], esi
cmp esi, 0x148c
jl 0x1002a788
inc ebx
cmp ebx, 0x492f
jl 0x1002a782
inc edi
cmp edi, 0x3c5e
jl 0x1002a780
mov ebx, dword [esp + 0x20]
cmp byte [ebp + 0x2c], 0
je 0x1002a81c
mov esi, dword [ebp + 0x10]
mov dword [esi], 0
jmp 0x1002a815
push dword [ebp + 0x14]
mov ecx, esi
push 1
call fcn.100267cf
inc dword [esi]
pop ecx
pop ecx
cmp dword [esi], 3
jl 0x1002a805
jmp 0x1002a860
mov eax, dword [ebp + 0x20]
xor ecx, ecx
mov edi, dword [ebp + 0x24]
mov esi, dword [ebp + 0x30]
mov eax, dword [eax]
mov eax, dword [ebx]
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax]
mov eax, dword [edi]
cmp eax, 0xffffffff
setne cl
xor edx, edx
mov dword [esi], ecx
mov ecx, dword [edi]
mov eax, dword [edi]
neg ecx
cmp ecx, eax
mov eax, dword [edi]
setne dl
add eax, dword [esi]
xor ecx, ecx
cmp eax, edx
setne cl
mov dword [ebx], ecx
mov eax, dword [ebx]
mov eax, dword [esp + 0x24]
mov dword [eax], 1
cmp dword [esp + 0x18], 0x31c1
jge 0x1002a8a1
push str.hmxkraqxq_pjbnjfspe_ifle_fcvax_vunzut_vpetsexc_htcnm
call fcn.1004b116
pop ecx
jmp 0x1002a8a1
cmp byte [ebp + 8], 0
je 0x1002a88f
mov eax, dword [ebp + 0x28]
cmp byte [eax], 0
je 0x1002a8a1
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
jmp 0x1002a8a1
push 0
push 0x25a1
push 0x26f
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002a9dd
Capabilities:
Create process on windows
Query environment variable

Disassembly:
mov eax, 0x100648e0
call fcn.10063318
sub esp, 0x58
push ebx
push esi
mov dword [ebp - 0x28], 0x1c0b
xor ebx, ebx
cmp dword [ebp - 0x28], 0x1cff
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], edx
jle 0x1002aa59
push 0x21c5
push ebx
push ebx
push ebx
push ebx
push 0x10b0
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
mov esi, ebx
mov edi, ebx
lea eax, [edi + esi]
cdq
lea ecx, [ebp - 0x48]
push edx
push eax
call fcn.10001a31
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002aa35
mov eax, dword [eax]
push eax
call fcn.1004b116
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.100022d2
inc edi
cmp edi, 0x4d9f
jl 0x1002aa1d
inc esi
cmp esi, 0x282e
jl 0x1002aa1b
cmp byte [ebp + 8], 0
je 0x1002ab5d
mov byte [ebp - 0x15], bl
mov dword [ebp - 0x24], 0x1bbe
cmp dword [ebp - 0x24], 0x1e43
jle 0x1002aaff
push ebx
push 0xbbb
call dword [sym.imp.USER32.dll_EndPaint]
mov esi, ebx
mov dword [ebp - 0x20], ebx
mov edi, ebx
mov dword [ebp - 0x1c], ebx
mov ecx, edi
mov dword [ebp - 0x2c], esi
mov edi, esi
mov dword [ebp - 0x30], ebx
shl edi, cl
mov esi, ebx
mov ecx, esi
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0x60]
cdq
push edx
push eax
call fcn.10001a31
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002aab9
mov eax, dword [eax]
push eax
call fcn.1004b116
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x60]
call fcn.100022d2
inc esi
cmp esi, 0x4a6d
jl 0x1002aa9e
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0xa37
jl 0x1002aa90
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x7554
jl 0x1002aa8b
push 0x268c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
push 0x5660
push 0x501
push 0x73be
push 1
lea eax, [ebp - 0x15]
mov edx, 0x3970
push eax
push ebx
xor cl, cl
call fcn.1002ad18
add esp, 0x18
cmp dword [ebp - 0x24], 0x1a8f
jge 0x1002ab38
push str.vajruj_vdk_gcswqt_ohbqh
call fcn.1004b116
pop ecx
cmp dword [ebp - 0x28], 0x1853
jge 0x1002ab4c
push str.ziuvclzlx_syvuwew_jpvgqkr
call fcn.1004b116
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x20], 0x36cc
cmp dword [ebp - 0x20], 0x3829
jle 0x1002abaa
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x24], 0x3183
mov dword [ebp - 0x30], ebx
mov ecx, ebx
mov eax, edi
sar eax, cl
mov ecx, 0x10081838
cdq
push edx
push eax
call fcn.10001e6d
inc ebx
cmp ebx, 0x1f52
jl 0x1002ab7b
add edi, esi
dec dword [ebp - 0x24]
push 0
pop ebx
jne 0x1002ab78
inc esi
cmp esi, 0x2c6
jl 0x1002ab6f
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
inc dword [eax]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x3623
jge 0x1002ab38
mov edx, str.cqwulgr_qrugzyrv_xchuxhlj_wtwqiva_nrnx_dkgw_ngzorh_ahrcppx_rkfgdt_lfzic_ngxs_nfgfyth_loro
mov ecx, 0x10081838
call fcn.100038af
jmp 0x1002ab38
Function at 0x1002b6a2
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100648fe
call fcn.10063318
sub esp, 0x38
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x1002b782
mov byte [ebp - 0x15], 0
mov dword [ebp - 0x28], 0x2349
cmp dword [ebp - 0x28], 0x2581
jle 0x1002b73f
xor esi, esi
mov dword [ebp - 0x24], esi
xor edi, edi
mov dword [ebp - 0x20], 0x65bf
mov esi, edi
mov dword [ebp - 0x1c], 0x2802
xor ebx, ebx
mov ecx, ebx
mov eax, esi
sar eax, cl
lea ecx, [ebp - 0x40]
cdq
push edx
push eax
call fcn.10001a31
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002b707
mov eax, dword [eax]
push eax
call fcn.1004b116
pop ecx
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.100022d2
inc ebx
cmp ebx, 0x27b0
jl 0x1002b6ec
inc esi
dec dword [ebp - 0x1c]
jne 0x1002b6ea
mov esi, dword [ebp - 0x24]
add edi, esi
dec dword [ebp - 0x20]
jne 0x1002b6e1
inc esi
mov dword [ebp - 0x24], esi
cmp esi, 0x5288
jl 0x1002b6d8
cmp byte [ebp - 0x15], 0
je 0x1002b75d
push 1
push 0x63b6
push 0x4fcb
xor dl, dl
mov cl, 1
call fcn.10027351
add esp, 0xc
cmp dword [ebp - 0x28], 0x22f6
jge 0x1002b771
push str.zfm_anztr_uhxdixu_xmcn_podzk_eab_dil_ntjif_drxok_fjuaakkvi_vbzjdx_uywylbl
call fcn.1004b116
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x28], 0x3d4
cmp dword [ebp - 0x28], 0x7a9
jle 0x1002b7cc
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x10081838
and eax, edi
xor eax, esi
cdq
push edx
push eax
call fcn.10001e6d
inc ebx
cmp ebx, 0x1ad8
jl 0x1002b798
inc edi
cmp edi, 0x291
jl 0x1002b796
inc esi
cmp esi, 0x48af
jl 0x1002b794
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
mov byte [ebp - 0x15], 0
cmp byte [ebp - 0x15], 0
je 0x1002b7e1
push 0x24a3
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x28], 0x1fd
jge 0x1002b771
mov edx, str.pdiu_qkxn_aeeizge_qzbfrdq_xnylmt_asiy_brbigtac_yxayz_jhxjv_wcikmi
mov ecx, 0x10081838
call fcn.100038af
jmp 0x1002b771