joyce8/EMBER2024-capa huggingface dataset:
Function at 0x457590
Capabilities:
Contain obfuscated stackstrings

Disassembly:
mov eax, dword [0x11fffffc]
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
movsd dword es:[edi], dword [esi]
cld
invalid
push dword [esi]
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
test dword [eax + 0x27fffffc], ebp

Function at 0x458980
Capabilities:
Enumerate gui resources

Disassembly:
push ebx
push esi
add esp, 0xfffffff8
mov ebx, eax
mov eax, dword [0x460bdc]
cmp dword [eax + 0x30], 0
je 0x458a2a
cmp dword [ebx + 0x94], 0
jne 0x458a24
mov eax, dword [ebx + 0x30]
mov dword [esp], eax
mov byte [esp + 4], dl
mov eax, esp
push eax
push 0x458910
call sub.user32.dll_EnumWindows
mov eax, dword [ebx + 0x90]
cmp dword [eax + 8], 0
je 0x458a24
push 3
mov eax, dword [esp + 4]
push eax
call sub.user32.dll_GetWindow
mov esi, eax
mov dword [esp], esi
push 0xffffffffffffffec
push esi
call sub.user32.dll_GetWindowLongA
test al, 8
je 0x4589ea
mov dword [esp], 0xfffffffe
mov eax, dword [ebx + 0x90]
mov esi, dword [eax + 8]
dec esi
cmp esi, 0
jl 0x458a24
push 0x213
push 0
push 0
push 0
push 0
mov eax, dword [esp + 0x14]
push eax
mov edx, esi
mov eax, dword [ebx + 0x90]
call fcn.00413f1c
push eax
call sub.user32.dll_SetWindowPos
dec esi
cmp esi, 0xffffffff
jne 0x4589f9
inc dword [ebx + 0x94]
pop ecx
pop edx
pop esi
pop ebx
ret

Function at 0x45958c
Capabilities:
Get graphical window text

Disassembly:
push ebx
push esi
add esp, 0xffffff00
mov esi, edx
mov ebx, eax
cmp byte [ebx + 0xa4], 0
je 0x4595c1
push pe_nt_image_headers32
lea eax, [esp + 4]
push eax
mov eax, dword [ebx + 0x30]
push eax
call sub.user32.dll_GetWindowTextA
mov ecx, eax
mov edx, esp
mov eax, esi
call fcn.00404088
jmp 0x4595ce
mov eax, esi
mov edx, dword [ebx + 0x8c]
call fcn.00403fec
add esp, 0x100
pop esi
pop ebx
ret

Function at 0x45a6c0
Capabilities:
Hide graphical window

Disassembly:
push ebx
push esi
mov ebx, eax
mov esi, dword [ebx + 0x84]
test esi, esi
je 0x45a701
mov eax, esi
call fcn.004408a8
test al, al
je 0x45a701
mov eax, dword [ebx + 0x84]
call fcn.004405a4
push eax
call sub.user32.dll_IsWindowVisible
test eax, eax
je 0x45a701
push 0
mov eax, dword [ebx + 0x84]
call fcn.004405a4
push eax
call sub.user32.dll_ShowWindow
pop esi
pop ebx
ret
Function at 0x45b810
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff4
push ebx
xor ebx, ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], ecx
mov dword [ebp - 4], edx
mov eax, dword [ebp - 4]
call fcn.00404448
mov eax, dword [ebp - 8]
call fcn.00404448
mov eax, dword [ebp + 8]
call fcn.00404448
xor eax, eax
push ebp
push 0x45b8e4
push dword fs:[eax]
mov dword fs:[eax], esp
lea eax, [ebp - 4]
mov edx, 0x45b8fc
call fcn.00404260
lea eax, [ebp - 8]
mov edx, 0x45b8fc
call fcn.00404260
lea eax, [ebp + 8]
mov edx, 0x45b8fc
call fcn.00404260
mov bl, 1
push 1
lea eax, [ebp + 8]
call fcn.004044b0
push eax
lea eax, [ebp - 8]
call fcn.004044b0
push eax
lea eax, [ebp - 4]
call fcn.004044b0
push eax
push 0
push 0
call sub.shell32.dll_ShellExecuteA
cmp eax, 0x20
jae 0x45b8c1
xor ebx, ebx
push 0
lea eax, [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov edx, 0x45b908
call fcn.004042a4
mov eax, dword [ebp - 0xc]
mov cx, word [0x45b91c]
mov dl, 1
call fcn.00428ab8
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x45b8eb
lea eax, [ebp - 0xc]
mov edx, 3
call fcn.00403fbc
lea eax, [ebp + 8]
call fcn.00403f98
ret
Function at 0x40c930
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x41bf08
mov eax, dword fs:[0]
push eax
sub esp, 0x38
push ebx
push esi
push edi
mov eax, dword [0x4243cc]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x10], edi
mov dword [ebp - 0x14], edi
push 0x40
mov dword [edi], 0
mov dword [edi + 4], 0
call fcn.0041a1af
add esp, 4
mov dword [eax], eax
mov dword [eax + 4], eax
mov dword [eax + 8], eax
mov word [eax + 0xc], 0x101
mov dword [edi], eax
push 0
mov dword [ebp - 4], 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push 0x41d838
mov esi, eax
push 0x66
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edx, eax
mov dword [ebp - 0x1c], 0
mov ecx, edx
mov dword [ebp - 0x18], 0xf
mov byte [ebp - 0x2c], 0
lea esi, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x40c9d0
sub ecx, esi
push ecx
push edx
lea ecx, [ebp - 0x2c]
call fcn.0040d040
push 1
lea eax, [ebp - 0x2c]
mov byte [ebp - 4], 1
push eax
lea eax, [ebp - 0x44]
push eax
call fcn.004118e2
add esp, 0xc
mov ecx, eax
mov byte [ebp - 4], 2
call fcn.00411401
mov ebx, eax
cmp edi, ebx
je 0x40ca97
mov esi, dword [edi]
mov ecx, edi
push dword [esi + 4]
push edi
call fcn.0040abe0
push dword [ebp - 0x14]
mov dword [esi + 4], esi
mov ecx, edi
mov dword [esi], esi
mov dword [esi + 8], esi
push dword [edi]
mov dword [edi + 4], 0
mov eax, dword [ebx]
push dword [eax + 4]
call fcn.0040c680
mov ecx, eax
mov eax, dword [edi]
mov dword [eax + 4], ecx
mov esi, dword [edi]
mov eax, dword [ebx + 4]
mov dword [edi + 4], eax
mov edx, dword [esi + 4]
cmp byte [edx + 0xd], 0
jne 0x40ca90
mov ecx, dword [edx]
cmp byte [ecx + 0xd], 0
jne 0x40ca6c
nop dword [eax + eax]
mov eax, dword [ecx]
mov edx, ecx
mov ecx, eax
cmp byte [eax + 0xd], 0
je 0x40ca60
mov dword [esi], edx
mov edx, dword [edi]
mov ecx, dword [edx + 4]
mov eax, dword [ecx + 8]
cmp byte [eax + 0xd], 0
jne 0x40ca8b
nop dword [eax]
mov ecx, eax
mov eax, dword [ecx + 8]
cmp byte [eax + 0xd], 0
je 0x40ca80
mov dword [edx + 8], ecx
jmp 0x40ca97
mov dword [esi], esi
mov ecx, dword [edi]
mov dword [ecx + 8], ecx
lea ecx, [ebp - 0x44]
call fcn.0040ae60
lea ecx, [ebp - 0x2c]
call fcn.004084d0
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x42e004
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
je 0x42e072
nop
nop
nop
nop
nop
mov ebx, 0x407ef8
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
div edi
xchg ecx, eax
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x386f534f
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x42e060
nop
nop
mov eax, section..data
nop
nop
nop
cmp eax, 0
nop
je 0x42e0d2
nop
nop
nop
mov ebx, 0x42cd70
nop
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
div edi
nop
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x3a92536b
nop
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x42e0c0
nop
nop
nop
nop
popal
nop
jmp 0x401219
Function at 0x417650
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x459490
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0x49c
mov eax, dword [0x46c008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
push 0x40a
push 0x46d788
call fcn.00419250
add esp, 8
push 0x406
push str._xw
call fcn.00419250
add esp, 8
mov dword [ebp - 0x430], 0
mov byte [ebp - 0x436], 0
mov eax, 1
test eax, eax
je 0x4177b5
movzx ecx, byte [ebp - 0x436]
test ecx, ecx
je 0x417794
mov edx, dword [ebp - 0x430]
add edx, 0xb
mov dword [ebp - 0x430], edx
lea eax, [ebp - 0x498]
push eax
push 0x40
mov ecx, dword [ebp - 0x430]
mov edx, dword [ecx - 0x14]
push edx
mov eax, dword [ebp - 0x430]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x458], 0
jmp 0x41771d
mov ecx, dword [ebp - 0x458]
add ecx, 1
mov dword [ebp - 0x458], ecx
mov edx, dword [ebp - 0x430]
mov eax, dword [ebp - 0x458]
cmp eax, dword [edx - 0x14]
jae 0x417792
mov ecx, dword [ebp - 0x430]
movzx edx, byte [ecx - 0x15]
mov eax, dword [ebp - 0x430]
add eax, dword [ebp - 0x458]
movzx ecx, byte [eax - 4]
xor edx, ecx
mov eax, dword [ebp - 0x430]
add eax, dword [ebp - 0x458]
movzx ecx, byte [eax - 2]
xor edx, ecx
mov eax, dword [ebp - 0x430]
add eax, dword [ebp - 0x458]
movzx ecx, byte [eax - 3]
xor edx, ecx
mov eax, dword [ebp - 0x430]
add eax, dword [ebp - 0x458]
movzx ecx, byte [eax]
xor ecx, edx
mov edx, dword [ebp - 0x430]
add edx, dword [ebp - 0x458]
mov byte [edx], cl
jmp 0x41770e
jmp 0x4177b5
mov byte [ebp - 0x436], 1
jmp 0x4177a5
add byte [eax], al
xor dword [edi], esp
add byte [eax], al
add al, ch
add byte [eax], al
add byte [eax], al
call 0x4177aa
pop dword [ebp - 0x430]
jmp 0x4176b7
pop ecx
into
xor esp, esp
inc edi
pop eax
insd dword es:[edi], dx
mov ebx, 0x327a2311
sub esp, edi
adc eax, 0x61697984
and bh, byte [edx + esi*4 + 0x7be62725]
mov dh, 0xac
pop ss
jbe 0x417811
sar dword [esi], 1
fsub qword [esi + 0x62]
xor dword [edx - 0x75], esp
test eax, edx
sti
invalid
jmp 0x41779e
Function at 0x419250
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov dword [ebp - 8], 0
mov byte [ebp - 1], 0
mov eax, 1
test eax, eax
je 0x419310
movzx ecx, byte [ebp - 1]
test ecx, ecx
je 0x4192f5
mov edx, dword [ebp - 8]
add edx, 0xb
mov dword [ebp - 8], edx
lea eax, [ebp - 0x18]
push eax
push 0x40
mov ecx, dword [ebp - 8]
mov edx, dword [ecx - 0x14]
push edx
mov eax, dword [ebp - 8]
push eax
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0xc], 0
jmp 0x4192a8
mov ecx, dword [ebp - 0xc]
add ecx, 1
mov dword [ebp - 0xc], ecx
mov edx, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
cmp eax, dword [edx - 0x14]
jae 0x4192f3
mov ecx, dword [ebp - 8]
movzx edx, byte [ecx - 0x15]
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax - 4]
xor edx, ecx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax - 2]
xor edx, ecx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax - 3]
xor edx, ecx
mov eax, dword [ebp - 8]
add eax, dword [ebp - 0xc]
movzx ecx, byte [eax]
xor ecx, edx
mov edx, dword [ebp - 8]
add edx, dword [ebp - 0xc]
mov byte [edx], cl
jmp 0x41929f
jmp 0x419310
mov byte [ebp - 1], 1
jmp 0x419303
call 0x419308
pop dword [ebp - 8]
jmp 0x419261
mov dword [ebp - 0x14], 0x8ecb0d1f
mov dword [edx + 3], ebp
invalid
Function at 0x41af00
Capabilities:
Allocate or change rwx memory

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x4595a0
mov eax, dword fs:[0]
push eax
push ecx
sub esp, 0xdc
mov eax, dword [0x46c008]
xor eax, ebp
mov dword [ebp - 0x14], eax
push ebx
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov eax, dword [ebp + 8]
mov dword [0x487698], eax
mov dword [ebp - 0x5c], 0
mov byte [ebp - 0x5f], 0
mov ecx, 1
test ecx, ecx
je 0x41affb
movzx edx, byte [ebp - 0x5f]
test edx, edx
je 0x41afe0
mov eax, dword [ebp - 0x5c]
add eax, 0xb
mov dword [ebp - 0x5c], eax
lea ecx, [ebp - 0xe4]
push ecx
push 0x40
mov edx, dword [ebp - 0x5c]
mov eax, dword [edx - 0x14]
push eax
mov ecx, dword [ebp - 0x5c]
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov dword [ebp - 0x6c], 0
jmp 0x41af93
mov edx, dword [ebp - 0x6c]
add edx, 1
mov dword [ebp - 0x6c], edx
mov eax, dword [ebp - 0x5c]
mov ecx, dword [ebp - 0x6c]
cmp ecx, dword [eax - 0x14]
jae 0x41afde
mov edx, dword [ebp - 0x5c]
movzx eax, byte [edx - 0x15]
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0x6c]
movzx edx, byte [ecx - 4]
xor eax, edx
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0x6c]
movzx edx, byte [ecx - 2]
xor eax, edx
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0x6c]
movzx edx, byte [ecx - 3]
xor eax, edx
mov ecx, dword [ebp - 0x5c]
add ecx, dword [ebp - 0x6c]
movzx edx, byte [ecx]
xor edx, eax
mov eax, dword [ebp - 0x5c]
add eax, dword [ebp - 0x6c]
mov byte [eax], dl
jmp 0x41af8a
jmp 0x41affb
mov byte [ebp - 0x5f], 1
jmp 0x41afee
call 0x41aff3
pop dword [ebp - 0x5c]
jmp 0x41af45
push 0x16
push 0x7ef0ae4b
mov eax, 0xd83a28b5
mov bl, 0x42
out dx, eax
mov dh, 0x3e
stosb byte es:[edi], al
xlatb
lodsd eax, dword [esi]
wait
push ss
rol dh, 1
sub byte [ecx - 0x55], cl
rol byte [edx - 0x11], 0xb6
cmp al, 0xaa
sbb eax, 0x19df51ae
salc
sub byte [eax - 0x46], bl
rol dword [edx - 0x11], 1
mov dh, 0x33
stosb byte es:[edi], al
ret 0x8ea0

Function at 0x430040
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [ebp + 8]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
test eax, eax
jne 0x43005d
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov dword [ebp - 4], eax
jmp 0x430064
mov dword [ebp - 4], 0
cmp dword [ebp - 4], 0
je 0x43007b
mov ecx, dword [ebp - 4]
push ecx
call fcn.00423bc0
add esp, 4
or eax, 0xffffffff
jmp 0x43007d
xor eax, eax
mov esp, ebp
pop ebp
ret
Function at 0x1000312d
Capabilities:
Create pipe

Disassembly:
mov eax, 0x10062567
call fcn.10061fc8
sub esp, 0x20
mov byte [ebp - 0x14], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10003152
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
jmp 0x10003219
mov dword [ebp - 0x24], 0x4d31
cmp dword [ebp - 0x24], 0x4e86
jle 0x100031dc
xor esi, esi
mov dword [ebp - 0x20], esi
xor edi, edi
mov dword [ebp - 0x1c], edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov dword [ebp - 0x18], ebx
mov eax, edx
mov dword [ebp - 0x2c], eax
cdq
xor esi, esi
idiv ebx
mov edi, 0x71f1
mov dword [ebp - 0x28], edx
mov ebx, edx
mov eax, esi
mov ecx, 0x10080098
cdq
push edx
push eax
call fcn.1000b94d
add esi, ebx
dec edi
jne 0x1000318a
mov ebx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
inc ebx
mov dword [ebp - 0x18], ebx
cmp ebx, 0x4a01
jl 0x1000317b
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x1d87
jl 0x1000316c
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x40d1
jl 0x10003167
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x49e7
jge 0x100031f8
mov edx, str.uaon_eudufmud_iytzngpjs_cawnhbmhl
mov ecx, 0x10080098
call fcn.1000f355
mov eax, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
cmp byte [eax], 0
je 0x10003219
push ecx
push 0x72bb
push 0
mov edx, 0x310f
call fcn.10002930
add esp, 0xc
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100033f5
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp byte [ebp + 0xc], 0
mov byte [ebp - 4], dl
je 0x10003419
cmp byte [ebp + 8], 0
je 0x10003414
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1000348a
mov byte [ecx], 1
jmp 0x1000348a
test dl, dl
je 0x10003456
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0x17
jmp 0x1000344f
mov dword [ebp - 8], 0
jmp 0x1000343f
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x10], 0x8f8f576c
inc dword [ebp - 8]
cmp dword [ebp - 8], 2
jl 0x10003431
cmp dword [ecx], 0
jne 0x1000348a
dec dword [ebp - 0xc]
dec dword [ecx]
cmp dword [ecx], 0x12
jge 0x10003428
jmp 0x1000348a
lea eax, [ebp + 0xf]
mov byte [ebp + 0xf], 0
push eax
push 0x62e5
push 0x642c
push 0x1ff9
push 1
push 0x9df
push 0
push 0x1b3b
mov dl, 1
mov ecx, 0x4efc
call fcn.10002537
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x10003b32
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x100625ad
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x38
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov byte [esp + 0xc], cl
je 0x10003c35
cmp byte [ebp + 0x14], 0
je 0x10003c1a
mov dword [esp + 0x10], 0x432
cmp dword [esp + 0x10], 0x57c
jle 0x10003bde
push 0
push 0x1eb9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
xor esi, esi
xor edi, edi
xor ebx, ebx
lea eax, [ebx + edi]
or eax, esi
lea ecx, [esp + 0x28]
cdq
push edx
push eax
call fcn.10001381
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10003baf
mov eax, dword [eax]
push eax
call fcn.10049bf0
pop ecx
push 0
push 1
lea ecx, [esp + 0x30]
call fcn.10001612
inc ebx
cmp ebx, 0xb00
jl 0x10003b94
inc edi
cmp edi, 0x35c2
jl 0x10003b92
inc esi
cmp esi, 0x2736
jl 0x10003b90
cmp dword [esp + 0x10], 0x289
jge 0x10003bf3
push str.niw_tzogicd_yggnx_kawzyqm_byeynboi_kzbwmn_stgh_mryaxahri_dxo_cghdzn_tlshfnbyt
call fcn.10049bf0
pop ecx
mov eax, dword [ebp + 0x10]
or dword [esp + 0x4c], 0xffffffff
cmp byte [eax], 0
je 0x10003ca4
push 1
push ecx
push ecx
mov ecx, 0x2c0f
call fcn.10004757
add esp, 0xc
jmp 0x10003ca4
mov eax, dword [ebp + 8]
xor edx, edx
mov ecx, dword [eax]
mov eax, dword [eax]
cmp ecx, eax
mov eax, dword [ebp + 0xc]
sete dl
imul ecx, edx, 0xf7dd
mov dword [eax], ecx
jmp 0x10003ca4
test cl, cl
je 0x10003c3d
inc dword [edx]
jmp 0x10003ca4
push 4
lea ecx, [esp + 0x20]
call fcn.100014b5
lea eax, [esp + 0x1c]
mov dword [esp + 0x4c], 2
push eax
push ecx
push ecx
mov dl, 1
mov dword [esp + 0x20], 0xa18885c6
lea ecx, [esp + 0x24]
call fcn.100024e5
add esp, 0xc
lea eax, [esp + 0x1c]
mov edx, 0x27d9
lea ecx, [esp + 0x14]
push 0
push 0x1058
push 0x5def
push 1
push eax
push 1
call fcn.10002c7e
add esp, 0x18
cmp dword [esp + 0x1c], 0
je 0x10003ca4
push dword [esp + 0x1c]
call fcn.10049cc1
pop ecx
mov ecx, dword [esp + 0x44]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100040a2
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
push ebx
push esi
push edi
mov byte [esp + 0x10], dl
mov dword [esp + 0x1c], 0x70fc
cmp dword [esp + 0x1c], 0x73fe
push 0
pop ebx
jle 0x10004112
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esi, ebx
mov edi, ebx
mov eax, edi
lea ecx, [esp + 0x40]
xor eax, esi
cdq
push edx
push eax
call fcn.10001381
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100040ed
mov eax, dword [eax]
push eax
call fcn.10049bf0
pop ecx
push ebx
push 1
lea ecx, [esp + 0x48]
call fcn.10001612
inc edi
cmp edi, 0x7ac4
jl 0x100040d3
inc esi
cmp esi, 0x19cf
jl 0x100040d1
cmp byte [esp + 0x10], 0
je 0x100041e6
push 0xfffffffffffffffc
pop ecx
mov dword [esp + 0x28], ecx
mov dword [esp + 0x18], 6
mov dword [esp + 0x18], 1
mov dword [esp + 0x18], 0x72a8358b
mov dword [esp + 0x18], 0xffffffff
mov dword [esp + 0x18], 7
mov dword [esp + 0x20], 0x3fe5e81a
mov dword [esp + 0x18], 0x443ac46d
mov dword [esp + 0x18], ebx
mov dword [esp + 0x18], 0xdbdf7cd9
mov dword [esp + 0x18], 3
mov dword [esp + 0x18], 0x9b2b534
mov dword [esp + 0x18], 0x85ea6eda
mov dword [esp + 0x18], 0xd73df2ef
mov dword [esp + 0x2c], 0xed162c5d
mov dword [esp + 0x24], 0xd4a79744
push 2
mov dword [esp + 0x1c], 1
mov dword [esp + 0x18], ebx
pop esi
jmp 0x100041b5
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x38], ecx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x100041a9
push 0x64c8
lea eax, [esp + 0x24]
mov ecx, 0x7ded
push eax
push ebx
lea eax, [esp + 0x30]
push eax
push ebx
lea eax, [esp + 0x3c]
push eax
push 1
lea edx, [esp + 0x48]
call fcn.10002ef6
add esp, 0x1c
jmp 0x1000424c
mov edi, dword [ebp + 0xc]
push 2
pop esi
mov dword [edi], ebx
jmp 0x10004248
mov dword [esp + 0x18], 0xff55e00f
mov dword [esp + 0x18], 0xc4185a1f
mov dword [esp + 0x18], ebx
jmp 0x10004240
mov dword [esp + 0x14], ebx
jmp 0x1000421c
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x30], 1
inc dword [esp + 0x14]
cmp dword [esp + 0x14], esi
jl 0x1000420c
push 0x6ea6
push ecx
push ecx
xor dl, dl
mov ecx, 0x5876
call fcn.100024e5
add esp, 0xc
inc dword [esp + 0x34]
inc dword [esp + 0x18]
cmp dword [esp + 0x18], esi
jle 0x10004206
inc dword [edi]
cmp dword [edi], esi
jle 0x100041f0
cmp dword [esp + 0x1c], 0x6ef6
jge 0x10004261
push str.rhhdjjvba_yjjucgwqi_katicnrg_komm_mbo_aukorcmxh_bzccufvm_zoxo_tzgtxqb_dyjnc_yrl_apknqcv_ojddsz
call fcn.10049bf0
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005561
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
cmp byte [ebp + 0x20], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], edx
mov byte [ebp - 4], cl
je 0x100056ce
cmp byte [ebp + 8], 0
je 0x10005591
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x28]
mov eax, dword [eax]
mov dword [eax], ecx
jmp 0x10005713
mov edi, dword [ebp + 0x2c]
mov dword [edi], 3
jmp 0x100056c3
mov dword [ebp - 0xc], 0x3196e86f
mov dword [ebp + 0x20], 0x6493
mov dword [ebp + 0x20], 0
jmp 0x100055c4
mov eax, dword [ebp + 0x20]
mov dword [ebp + eax*4 - 0x18], 0xffffffff
inc dword [ebp + 0x20]
cmp dword [ebp + 0x20], 2
jl 0x100055b6
mov ebx, dword [ebp + 0x14]
mov ecx, dword [edi]
mov eax, dword [ebx]
cmp dword [eax + ecx*4], 0
je 0x100056a4
mov ecx, dword [edi]
mov eax, dword [ebx]
cmp dword [eax + ecx*4], 0
je 0x100055f8
mov ecx, dword [edi]
mov eax, dword [ebx]
cmp dword [eax + ecx*4], 0
je 0x100055f8
mov dword [ebp - 8], 1
jmp 0x100055fc
and dword [ebp - 8], 0
mov ecx, dword [edi]
mov eax, dword [ebx]
mov edx, dword [ebp + 0x18]
mov eax, dword [eax + ecx*4]
mov dword [edx], eax
mov esi, dword [edi]
mov ecx, dword [ebp - 0xc]
mov eax, dword [edx]
xor edx, edx
mov edi, dword [ebx]
cmp eax, ecx
setne dl
xor ecx, ecx
add edx, dword [edi + esi*4]
cmp edx, dword [edi + 0xc]
mov edx, dword [ebx]
setle cl
mov edi, dword [ebp + 0x2c]
xor eax, eax
test ecx, ecx
mov esi, dword [edx]
setg al
mov dword [ebp + 0x20], eax
xor ecx, ecx
mov eax, dword [ebp + 0x20]
cmp eax, 0x3a5bed85
setge cl
xor eax, eax
imul ecx, esi
add ecx, dword [edx + 8]
mov edx, dword [ebp - 0x10]
cmp ecx, esi
setl al
mov dword [edx], eax
mov esi, dword [edi]
mov eax, dword [edx]
xor edx, edx
mov ecx, dword [ebx]
cmp eax, dword [ecx + 8]
mov eax, dword [ebx]
mov ecx, dword [edi]
setl dl
xor ebx, ebx
cmp edx, dword [eax + esi*4]
mov eax, dword [ebp + 0x14]
setl bl
add ebx, dword [ebp - 8]
mov eax, dword [eax]
mov dword [eax + ecx*4], ebx
xor eax, eax
mov ecx, dword [ebp + 0x1c]
cmp ebx, 0x1ee01e6e
setne al
mov dword [ecx], eax
mov eax, dword [ecx]
mov ecx, dword [ebp + 0x24]
mov dword [ecx], eax
mov eax, dword [ecx]
xor ecx, ecx
cmp eax, 0xf1ba
setl cl
cmp ecx, dword [edi]
jne 0x100056a4
xor ecx, ecx
inc ecx
jmp 0x100056a6
xor ecx, ecx
mov eax, dword [ebp + 0x10]
xor edx, edx
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
cmp ecx, eax
mov eax, dword [edi]
setg dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [ebp - 0x18], ecx
dec dword [edi]
cmp dword [edi], 0
jge 0x1000559f
jmp 0x10005713
xor ebx, ebx
test cl, cl
je 0x100056f3
mov esi, dword [ebp + 0x34]
mov dword [esi], ebx
jmp 0x100056ec
mov byte [ebp + 0x23], bl
cmp byte [ebp + 0x23], bl
je 0x100056ea
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
inc dword [esi]
cmp dword [esi], 3
jle 0x100056db
jmp 0x10005713
mov esi, dword [ebp + 0x30]
mov dword [esi], 2
jmp 0x1000570f
mov byte [ebp + 0x23], bl
cmp byte [ebp + 0x23], bl
je 0x1000570d
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
dec dword [esi]
cmp dword [esi], ebx
jge 0x100056fe
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret