joyce8/EMBER2024-capa huggingface dataset:
Function at 0x409e457f
Capabilities:
Set thread local storage value

Disassembly:
mov edi, edi
push esi
push 0x50
push 0x40
call dword [sym.imp.KERNEL32.dll_LocalAlloc]
mov esi, eax
test esi, esi
je 0x409e4651
push 2
push 0x400
push 0x409f2278
mov ecx, esi
call fcn.409ef0d1
push 8
push 0x2000
push 0x409f2280
lea ecx, [esi + 0x20]
call fcn.409ef0d1
and dword [esi + 0x40], 0
and dword [esi + 0x44], 0
and dword [esi + 0x48], 0
push 0x409e13c8
call 0x409fbf5e
test eax, eax
jne 0x409e463d
push 0x409e13b0
call 0x409fbf5e
test eax, eax
jne 0x409e463d
push 0x409e1398
call 0x409fbf5e
test eax, eax
jne 0x409e463d
push 0x409e1388
call 0x409fbf5e
test eax, eax
jne 0x409e463d
push 0x409e1370
call fcn.409e443a
test eax, eax
jne 0x409e463d
push 0x409e1354
call fcn.409e443a
test eax, eax
je 0x409e4626
or dword [esi + 0x44], 0x1000000
jmp 0x409e4644
push 0x409e133c
call fcn.409e443a
test eax, eax
je 0x409e4644
or dword [esi + 0x44], 0x10000
jmp 0x409e4644
or dword [esi + 0x44], 0x100000
push esi
push dword [section..data]
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov eax, esi
neg eax
sbb eax, eax
and eax, 0x7ff8fff2
add eax, 0x8007000e
pop esi
ret

Function at 0x409e4734
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push esi
push dword [section..data]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call esi
test eax, eax
je 0x409e474d
xor eax, eax
jmp 0x409e4781
call fcn.409e457f
test eax, eax
je 0x409e475d
mov eax, 0x8007000e
jmp 0x409e4781
push edi
call fcn.409e59f9
push dword [section..data]
mov edi, eax
call esi
mov dword [eax + 0x40], edi
mov eax, edi
neg eax
sbb eax, eax
and eax, 0x7ff8fff2
add eax, 0x8007000e
pop edi
pop esi
ret 0xc

Function at 0x409e47b0
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x409f2284]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push dword [section..data]
mov esi, dword [sym.imp.KERNEL32.dll_TlsGetValue]
call esi
test eax, eax
jne 0x409e47e8
mov eax, dword [ebp + 0xc]
neg eax
sbb eax, eax
and eax, 0x7fffbffb
add eax, 0x80004005
jmp 0x409e4866
push ebx
push dword [section..data]
call esi
mov ebx, dword [eax + 0x40]
mov eax, dword [ebp + 0xc]
sub eax, 0
je 0x409e481c
dec eax
je 0x409e480e
dec eax
jne 0x409e4860
push dword [ebp + 8]
mov ecx, ebx
call fcn.409e5365
jmp 0x409e4818
push dword [ebp + 8]
mov ecx, ebx
call fcn.409e4e92
mov esi, eax
jmp 0x409e4863
push edi
push 1
push 0x10
push dword [ebp + 0x10]
call sub.wow32.dll_WOWGetVDMPointer
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea eax, [ebp - 0x18]
push eax
lea eax, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
push eax
push dword [ebp + 8]
mov ecx, ebx
movsd dword es:[edi], dword [esi]
call fcn.409e5de7
push eax
call sym.OLETHK32.dll_TransformHRESULT_3216
push 1
push 0x10
push dword [ebp + 0x10]
mov esi, eax
call sub.wow32.dll_WOWGetVDMPointer
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
pop edi
jmp 0x409e4863
mov esi, dword [ebp - 0x18]
mov eax, esi
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.409ef71b
leave
ret 0xc
Function at 0x10003bdf
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
je 0x10003c1a
mov esi, dword [ebp + 8]
xor ebx, ebx
mov dword [esi], ebx
jmp 0x10003c11
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10003c0f
push 0x609d
push 0x55
xor dl, dl
pop ecx
call fcn.10003fb5
pop ecx
dec dword [esi]
cmp dword [esi], ebx
jge 0x10003bf7
jmp 0x10003cc7
mov dword [ebp - 0x14], 0x1baa
cmp dword [ebp - 0x14], 0x1e7a
push 0
pop ebx
jle 0x10003c90
mov dword [ebp - 0x10], ebx
mov edi, ebx
mov dword [ebp - 0xc], 0x22ae
mov esi, ebx
mov dword [ebp - 8], 0x4d4a
mov eax, esi
lea ecx, [ebp - 0x2c]
cdq
push edx
push eax
call fcn.10001a11
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10003c59
mov eax, dword [eax]
push eax
call fcn.100400a6
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x2c]
call fcn.10001eb4
add esi, edi
dec dword [ebp - 8]
jne 0x10003c42
mov esi, dword [ebp - 0x10]
add edi, esi
dec dword [ebp - 0xc]
jne 0x10003c39
inc esi
mov dword [ebp - 0x10], esi
cmp esi, 0x1497
jl 0x10003c30
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
cmp dword [ebp - 0x14], 0x18c5
jge 0x10003ca4
push str.wilcg_hdntbdag_llrc_nncyy_xyzbj_xmgbmdgu_nyvmpb_sxywmp_zgfsfynbj_wjzjuemr_fnpyuo_cykelctd_ldigteugp
call fcn.100400a6
pop ecx
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x10003cc7
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
push ebx
push 0x1d98
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003dac
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x1005889a
call fcn.100582b8
sub esp, 0x2c
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], ebx
mov byte [ebp - 0x14], cl
je 0x10003ea2
cmp byte [ebp + 0x10], 0
je 0x10003dff
push 0x198b
push 0x17d9
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x18], 0xeff
cmp dword [ebp - 0x18], 0x1112
jle 0x10003e71
xor esi, esi
mov dword [ebp + 0x14], esi
xor edi, edi
mov eax, edi
xor ebx, ebx
xor eax, esi
mov dword [ebp - 0x1c], eax
mov esi, eax
mov eax, esi
lea ecx, [ebp - 0x38]
or eax, ebx
cdq
push edx
push eax
call fcn.10001a11
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10003e3a
mov eax, dword [eax]
push eax
call fcn.100400a6
pop ecx
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.10001eb4
inc ebx
cmp ebx, 0x3557
jl 0x10003e21
mov esi, dword [ebp + 0x14]
inc edi
cmp edi, 0x335d
jl 0x10003e16
inc esi
mov dword [ebp + 0x14], esi
cmp esi, 0x77de
jl 0x10003e14
mov ebx, dword [ebp - 0x20]
cmp dword [ebp - 0x18], 0xe15
jge 0x10003e85
push str.ajgmfzi_qehrqfu_ptc_ntc
call fcn.100400a6
pop ecx
cmp byte [ebx], 0
je 0x10003dee
push 0x1916
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x10003dee
mov dword [ebp + 0x14], 0x4a30
cmp dword [ebp + 0x14], 0x4e05
jle 0x10003efe
push 0x266c
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetLayout]
xor esi, esi
xor edi, edi
xor ebx, ebx
lea eax, [edi + esi]
mov ecx, 0x10072ab8
or eax, ebx
cdq
push edx
push eax
call fcn.10001ac8
inc ebx
cmp ebx, 0x82f
jl 0x10003ed1
inc edi
cmp edi, 0x65e3
jl 0x10003ecf
inc esi
cmp esi, 0x3564
jl 0x10003ecd
cmp byte [ebp - 0x14], 0
je 0x10003f4e
mov ecx, dword [ebp + 0x18]
mov dword [ecx], 1
cmp dword [ecx], 0
jl 0x10003f26
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
cmp dword [eax + 4], 0
jne 0x10003f26
mov eax, dword [ecx]
dec dword [ecx]
cmp dword [ecx], 0
jge 0x10003f15
mov dword [ebp - 4], 2
cmp dword [ebp + 0x14], 0x483d
jge 0x10003dee
mov edx, str.cgabv_xov_vjohdvjqs_xrzxqkel_xrqt_hreshefn_xyyuyyy_ybdnwinr_xrpbgse_nrdvgw_xkxidogvu_xozyjzphu_qoh
mov ecx, 0x10072ab8
call fcn.1000350a
jmp 0x10003dee
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10003f26
push 0x254f
call dword [sym.imp.KERNEL32.dll_ExitThread]
Function at 0x100040c7
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0x1c], 0
push edi
mov edi, edx
mov byte [ebp - 4], cl
je 0x1000414a
test cl, cl
je 0x10004143
mov edx, dword [ebp + 0x20]
push ebx
push esi
mov esi, dword [ebp + 0x18]
push 0
mov eax, dword [esi]
mov ecx, dword [esi]
mov eax, dword [esi]
neg ecx
add ecx, eax
mov eax, dword [edx]
add eax, ecx
pop eax
je 0x100040fb
cmp dword [esi], eax
je 0x100040fb
inc eax
mov dword [edi], eax
xor ecx, ecx
mov eax, dword [edx]
mov eax, dword [esi]
mov eax, dword [edx]
cmp eax, 1
mov eax, dword [esi]
setne cl
xor ebx, ebx
cmp ecx, 0xf9c3ab31
mov ecx, dword [esi]
pop esi
setge bl
xor edx, edx
cmp ebx, eax
mov eax, dword [ebp + 0x14]
pop ebx
setne dl
imul ecx, edx
mov dword [eax], ecx
mov ecx, dword [ebp + 0x28]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ecx]
mov ecx, 0xab462a77
cmp ecx, eax
mov eax, dword [ebp + 0x10]
sbb ecx, ecx
inc ecx
jmp 0x1000416b
mov eax, dword [ebp + 0xc]
inc dword [eax]
jmp 0x1000416d
cmp byte [ebp + 8], 0
je 0x10004158
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
jmp 0x1000416d
mov eax, dword [ebp + 0x30]
mov ecx, dword [ebp + 0x2c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp + 0x24]
mov ecx, dword [ecx]
neg ecx
mov eax, dword [eax]
mov dword [eax], ecx
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x10005106
Capabilities:
Resume thread

Disassembly:
mov eax, 0x100588de
call fcn.100582b8
sub esp, 0x20
mov dword [ebp - 0x28], ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10005171
cmp byte [ebp + 0x38], 0
je 0x10005140
xor ebx, ebx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x100052d1
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x100052d1
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0x100052d1
push 0
push 0x149f
push 0xad2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
jmp 0x100052d1
cmp byte [ebp + 8], 0
je 0x1000527a
mov dword [ebp - 0x1c], 0x1bc5
xor ebx, ebx
cmp dword [ebp - 0x1c], 0x1c5f
jle 0x100051d5
mov esi, ebx
mov dword [ebp - 0x18], ebx
mov edi, ebx
mov ecx, edi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
sar esi, cl
mov ecx, ebx
mov eax, esi
sar eax, cl
mov ecx, 0x10072ab8
cdq
push edx
push eax
call fcn.10001ac8
inc ebx
cmp ebx, 0x6b66
jl 0x1000519e
mov esi, dword [ebp - 0x18]
inc edi
push 0
pop ebx
cmp edi, 0x8062
jl 0x10005194
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x147
jl 0x10005192
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1c], 0x1b9d
jge 0x1000520e
mov edx, str.tyczqjiw_hfqay_bxieat_rmsokgy_euv_duzcpap_rdwuc_iyjj_zvpb_mjjcule_tbknadpoz_iubjcbybi_vqn_qgwp
mov ecx, 0x10072ab8
call fcn.1000350a
jmp 0x1000520e
mov eax, dword [ebp + 0x1c]
xor edx, edx
mov esi, dword [ebp + 0x28]
mov edi, dword [ebp + 0xc]
mov dword [eax], 0xfffe
mov eax, dword [esi]
mov eax, dword [ebp + 0x24]
mov dword [eax], ebx
mov eax, dword [eax]
mov ecx, dword [esi]
mov eax, dword [ebp + 0x30]
mov eax, dword [eax]
cmp eax, ecx
mov eax, dword [edi]
setne dl
xor ecx, ecx
cmp dword [eax + 8], edx
mov eax, dword [esi]
mov edx, dword [edi]
sete cl
xor ebx, ebx
cmp ecx, eax
mov eax, dword [ebp - 0x28]
setge bl
xor ecx, ecx
mov eax, dword [eax]
cmp dword [edx + 8], eax
sete cl
lea eax, [ecx + 0xffff]
xor ecx, ecx
add eax, ebx
cmp eax, 0xa75e3aa9
mov eax, dword [edi]
setne cl
xor edx, edx
cmp ecx, 0xffff55d3
setge dl
mov dword [eax + 0xc], edx
jmp 0x100052d1
mov edx, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + 8], ecx
test ecx, ecx
jne 0x1000529c
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + 8], ecx
test ecx, ecx
jne 0x1000529c
xor ebx, ebx
mov esi, ebx
jmp 0x100052a1
xor esi, esi
inc esi
xor ebx, ebx
mov eax, dword [edx]
mov eax, dword [ebp + 0x2c]
mov edx, dword [ebp + 0x34]
mov eax, dword [eax]
inc dword [edx]
mov eax, dword [ebp + 0x20]
mov ecx, dword [edx]
add ecx, 0xfffffffa
mov eax, dword [eax]
add eax, ecx
jne 0x100052bf
cmp dword [edx], ebx
je 0x100052c2
xor ebx, ebx
inc ebx
mov eax, dword [ebp + 0x3c]
xor ecx, ecx
test esi, esi
sets cl
imul ecx, ebx
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100053cb
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100588e8
call fcn.100582b8
sub esp, 0x10
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, edx
mov byte [ebp - 0x14], cl
je 0x100054f1
test cl, cl
je 0x10005438
mov dword [esi], 0xffffffe3
jmp 0x1000542e
push 0x10a5
push 0
lea eax, [ebp + 8]
mov dword [ebp + 8], 7
push eax
push 0x2a26
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0xfffe
push 0x5372
push eax
mov dl, 1
xor cl, cl
call fcn.10006b60
add esp, 0x18
inc dword [esi]
cmp dword [esi], 0x1d
jle 0x100053f9
jmp 0x10005507
mov dword [ebp - 0x1c], 0x1bac
cmp dword [ebp - 0x1c], 0x1f0d
jle 0x100054a3
push 0x270e
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
xor edi, edi
xor esi, esi
mov dword [ebp - 0x18], esi
mov ebx, esi
mov dword [ebp + 8], 0x21be
xor esi, esi
mov ecx, esi
mov eax, ebx
sar eax, cl
mov ecx, 0x10072ab8
xor eax, edi
cdq
push edx
push eax
call fcn.10001ac8
inc esi
cmp esi, 0x5fe
jl 0x10005467
dec ebx
dec dword [ebp + 8]
jne 0x10005465
mov esi, dword [ebp - 0x18]
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x5248
jl 0x1000545c
inc edi
cmp edi, 0x72d1
jl 0x10005457
push 0
push 0x2689
push 0
call dword [sym.imp.ADVAPI32.dll_ControlService]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x1ad2
jge 0x10005433
mov edx, str.hrcixn_qmwzo_aabglqzra_xzgfuqzgt_qizmu
mov ecx, 0x10072ab8
call fcn.1000350a
jmp 0x10005433
cmp byte [ebp + 0xc], 0
je 0x100054ff
call dword [sym.imp.KERNEL32.dll_GetVersion]
jmp 0x10005507
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10005cc6
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov dword [ebp - 8], 0xf69
cmp dword [ebp - 8], 0x116f
push esi
push edi
jle 0x10005d28
xor esi, esi
xor edi, edi
mov eax, edi
lea ecx, [ebp - 0x20]
xor eax, esi
cdq
push edx
push eax
call fcn.10001a11
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10005cfb
mov eax, dword [eax]
push eax
call fcn.100400a6
pop ecx
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.10001eb4
inc edi
cmp edi, 0x2aee
jl 0x10005ce2
inc esi
cmp esi, 0x65b1
jl 0x10005ce0
push 0
call dword [sym.imp.COMDLG32.dll_FindTextW]
cmp byte [ebp + 0x20], 0
je 0x10005d49
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x10005d4f
push ecx
push 0x12a4
xor dl, dl
call fcn.10005518
pop ecx
pop ecx
jmp 0x10005d4f
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
cmp dword [ebp - 8], 0xc83
jge 0x10005d63
push str.paw_zhmrbdd_pshqdpl_ivhkgo_pnbpxdg_hnyedlqa_whcme_dkobhjvk_xml_wipuehqom_tmleclzuw_mlitajsq
call fcn.100400a6
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10006070
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov dword [esp + 0x14], edx
mov ebx, ecx
je 0x10006133
cmp byte [ebp + 0x20], 0
je 0x100060b1
push ecx
push 0x11ff
push ecx
xor dl, dl
mov byte [esp + 0x1e], 0
lea ecx, [esp + 0x1e]
call fcn.10008441
add esp, 0xc
jmp 0x10006154
mov eax, dword [ebp + 0x14]
xor edx, edx
mov esi, dword [ebp + 0x24]
mov edi, dword [ebp + 0x1c]
inc dword [eax]
mov ecx, dword [esi]
mov eax, dword [esi]
cmp ecx, eax
mov ecx, dword [edi]
mov eax, dword [esi]
setle dl
add ecx, edx
xor edx, edx
cmp ecx, eax
mov eax, 0x93dda37b
setne dl
cmp eax, edx
sbb eax, eax
xor ecx, ecx
neg eax
sub eax, 0x7dd34c5d
cmp eax, 0x11c3fc02
mov eax, dword [esp + 0x14]
setg cl
xor edx, edx
mov eax, dword [eax]
cmp eax, ecx
mov eax, dword [edi]
setge dl
sub edx, eax
mov eax, dword [ebx]
lea ecx, [edx - 0xa41a]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp + 0xc]
sete dl
xor ecx, ecx
mov eax, dword [eax]
cmp edx, eax
mov eax, 0xd55fd0a3
setge cl
cmp eax, ecx
sbb eax, eax
xor ecx, ecx
neg eax
cmp eax, 0xf5a2f617
setne cl
mov dword [ebx], ecx
jmp 0x10006154
cmp byte [ebp + 8], 0
je 0x10006140
mov eax, dword [ebp + 0x10]
inc dword [eax]
jmp 0x10006154
xor eax, eax
mov byte [esp + 0x13], al
cmp byte [esp + 0x13], al
je 0x10006154
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10006d1d
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 8], dl
test dl, dl
je 0x10006d44
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x10006d4c
push ecx
push 0
sub esp, 0x18
call fcn.10005cc6
add esp, 0x20
jmp 0x10006d4c
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov esp, ebp
pop ebp
ret
Function at 0x1000767c
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov byte [ebp - 8], cl
test cl, cl
je 0x100076de
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x100076fc
push 0x5995
push 1
push 1
push 0xcf5
push 0x7e42
push 0x3d6c
push 0xb36
push 0x4970
push 0x563
push 0x6504
push 0x2f49
push 0x2d38
push 1
mov edx, 0x6c93
mov ecx, 0x45bd
call fcn.10004451
add esp, 0x34
jmp 0x100076fc
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x100076fc
xor eax, eax
push eax
push eax
push eax
push eax
push 0x17f6
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esp, ebp
pop ebp
ret
Function at 0x100079ce
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov byte [ebp - 0xc], cl
mov byte [ebp - 0x10], 1
je 0x10007aaf
mov dword [ebp - 0x1c], 0x7418
cmp dword [ebp - 0x1c], 0x7469
jle 0x10007a76
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x14], edi
mov ecx, edi
mov dword [ebp + 0x14], esi
mov edi, esi
xor ebx, ebx
shl edi, cl
mov dword [ebp + 0x14], edi
xor esi, esi
mov dword [ebp - 0x20], edi
and edi, ebx
mov eax, edi
lea ecx, [ebp - 0x38]
xor eax, esi
cdq
push edx
push eax
call fcn.10001a11
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10007a30
mov eax, dword [eax]
push eax
call fcn.100400a6
pop ecx
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.10001eb4
inc esi
cmp esi, 0x174
jl 0x10007a17
mov edi, dword [ebp + 0x14]
inc ebx
cmp ebx, 0x174b
jl 0x10007a10
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x1d89
jl 0x10007a02
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0xc66
jl 0x100079fd
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10007a99
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 3
inc dword [edx]
cmp dword [edx], 2
jl 0x10007a87
cmp dword [ebp - 0x1c], 0x7395
jge 0x10007ae2
push str.nnqnftx_hpgz_esmihd_ldx
call fcn.100400a6
pop ecx
jmp 0x10007ae2
test cl, cl
je 0x10007abf
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x10007ae2
mov edx, dword [ebp + 0x18]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10007ae2
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x633efc07
inc dword [edx]
cmp dword [edx], 2
jl 0x10007ad0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10007def
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov byte [ebp - 8], dl
mov byte [ebp - 0xc], cl
je 0x10007e29
test dl, dl
je 0x10007e10
mov eax, dword [ebp + 8]
jmp 0x10007ec7
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x10007ec9
push 0
call dword [sym.imp.ole32.dll_CoInitialize]
jmp 0x10007ec9
test cl, cl
je 0x10007ec4
mov dword [ebp + 0xc], 0x7189
cmp dword [ebp + 0xc], 0x747a
jle 0x10007e99
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, edi
lea ecx, [ebp - 0x24]
cdq
idiv ebx
or edx, esi
mov eax, edx
cdq
push edx
push eax
call fcn.10001a11
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10007e65
mov eax, dword [eax]
push eax
call fcn.100400a6
pop ecx
push 0
push 1
lea ecx, [ebp - 0x24]
call fcn.10001eb4
inc ebx
cmp ebx, 0xb4a
jl 0x10007e47
inc edi
cmp edi, 0x1383
jl 0x10007e45
inc esi
cmp esi, 0x434e
jl 0x10007e43
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x10007eae
push 0x64e
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
cmp dword [ebp + 0xc], 0x6de8
jge 0x10007ec9
push str.jioew_hbjfjxasq_ttih_eawuneqxa_upamxmn_kao_qwfanoxld
call fcn.100400a6
pop ecx
jmp 0x10007ec9
mov eax, dword [ebp + 0x18]
inc dword [eax]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008275
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100589ac
call fcn.100582b8
sub esp, 0x2c
mov dword [ebp - 0x1c], edx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x100082ae
cmp byte [ebp + 8], 0
je 0x100082a3
mov eax, dword [ebp + 0x14]
mov dword [eax], 0xffffffff
jmp 0x10008430
mov eax, dword [ebp + 0x2c]
mov byte [eax], 1
jmp 0x10008430
mov dword [ebp - 0x18], 0x765d
xor ebx, ebx
cmp dword [ebp - 0x18], 0x784e
jle 0x100082e7
mov esi, ebx
mov edi, ebx
mov eax, edi
mov ecx, 0x10072ab8
xor eax, esi
cdq
push edx
push eax
call fcn.10001ac8
inc edi
cmp edi, 0x237e
jl 0x100082c4
inc esi
cmp esi, 0x35ee
jl 0x100082c2
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x7355
jge 0x10008302
mov edx, str.csxgrq_ajxamldh_lvtgsqdzv_pboqvj_djb_hrgre_fcuhtge_udw_bojef_fjulkya
mov ecx, 0x10072ab8
call fcn.1000350a
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x30], 0
je 0x1000840e
mov dword [ebp - 0x18], 0x1ef2
cmp dword [ebp - 0x18], 0x1fbb
jle 0x10008361
mov esi, ebx
mov edi, ebx
mov eax, edi
lea ecx, [ebp - 0x34]
xor eax, esi
cdq
push edx
push eax
call fcn.10001a11
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000833d
mov eax, dword [eax]
push eax
call fcn.100400a6
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x34]
call fcn.10001eb4
inc edi
cmp edi, 0x77e4
jl 0x10008324
inc esi
cmp esi, 0x7f9a
jl 0x10008322
cmp dword [ebp - 0x18], 0x1dd8
jge 0x10008375
push str.ejjxr_hetwwhxq_jig_dptlmc_wfllkvk_hojeksaxs_iwfabyaw_sbmpvhciz_bwyjir_wrqvsio_wnsq
call fcn.100400a6
pop ecx
mov esi, dword [ebp + 0x18]
mov edi, dword [ebp + 0x20]
cmp dword [esi], 0x81479b69
mov eax, dword [esi]
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp - 0x1c]
sete cl
xor edx, edx
mov dword [eax], ecx
mov eax, dword [eax]
mov ecx, dword [edi]
add eax, dword [ecx + 8]
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
mov eax, dword [esi]
mov ecx, dword [ecx]
sub ecx, eax
mov eax, dword [ebp + 0x24]
mov dword [eax], ecx
mov ecx, dword [esi]
mov eax, dword [eax]
cmp eax, ecx
mov eax, 0xc7e43439
setl dl
cmp eax, edx
mov eax, dword [ebp + 0x10]
sbb ecx, ecx
neg ecx
mov dword [eax], ecx
mov ecx, dword [ebp + 0x1c]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ecx]
mov eax, dword [edi]
cmp dword [eax + 8], 0xfbb9cf7d
jb 0x100083df
mov eax, dword [ebp + 0x24]
cmp dword [eax], ebx
je 0x100083e2
xor ebx, ebx
inc ebx
mov eax, dword [ebp + 0x28]
mov dword [eax], ebx
jmp 0x10008430
push 0x54ef
push 1
push ebx
push 0x17d8
push 0x36a3
lea edx, [ebp - 0x11]
mov byte [ebp - 0x11], bl
mov cl, 1
call fcn.10003dac
add esp, 0x14
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret