joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100299e6
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov byte [esp + 8], dl
push ebx
push esi
push edi
test dl, dl
je 0x10029a0e
push 0x11cb
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
jmp 0x10029aeb
mov dword [esp + 0x24], 0x1c92
cmp dword [esp + 0x24], 0x6a9
push 0
pop ebx
jge 0x10029ada
lea eax, [esp + 0x18]
mov dword [esp + 0x18], ebx
push eax
mov esi, 0x10063a60
push esi
call fcn.100401eb
push 0x7c
call fcn.1003b7f3
add esp, 0xc
mov edx, eax
xor eax, eax
mov dword [esp + 0x24], edx
mov edi, edx
push 0x1f
pop ecx
rep stosd dword es:[edi], eax
jmp 0x10029a7e
lea eax, [esp + 0x1c]
mov dword [esp + 0x1c], ebx
push eax
dec ecx
push esi
mov dword [esp + 0x20], ecx
call fcn.100401eb
pop ecx
pop ecx
mov ecx, dword [esp + 0x1c]
call fcn.100299c0
mov edx, dword [esp + 0x24]
lea eax, [edx + eax*4]
inc dword [eax]
mov ecx, dword [esp + 0x18]
test ecx, ecx
jne 0x10029a56
dec ecx
xorps xmm0, xmm0
xor eax, eax
movlpd qword [esp + 0x28], xmm0
mov esi, dword [esp + 0x2c]
inc eax
mov edi, dword [esp + 0x28]
mov dword [esp + 0x18], ecx
mov dword [esp + 0x20], eax
mov ecx, dword [edx + eax*4]
push ebx
push 2
lea eax, [ecx - 1]
imul ecx
push edx
push eax
call fcn.10058890
add edi, eax
mov eax, dword [esp + 0x20]
adc esi, edx
mov edx, dword [esp + 0x24]
inc eax
mov dword [esp + 0x20], eax
cmp eax, 0x1e
jle 0x10029aa3
push esi
push edi
push str._lld_n
call fcn.1004041f
add esp, 0xc
push ebx
lea edx, [esp + 0x17]
mov byte [esp + 0x17], bl
xor cl, cl
call fcn.1002995d
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10029f7d
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x10059680
call fcn.10058864
sub esp, 0x10
mov byte [ebp - 0x18], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x1002a02e
xor ebx, ebx
mov byte [ebp - 0x11], bl
mov dword [ebp - 0x1c], 0x54ed
cmp dword [ebp - 0x1c], 0x57fd
jle 0x10029fe3
mov esi, ebx
mov edi, ebx
mov ebx, 0x2593
mov eax, edi
mov ecx, 0x10072098
cdq
push edx
push eax
call fcn.10013ec4
add edi, esi
dec ebx
jne 0x10029fb9
inc esi
cmp esi, 0x507c
jl 0x10029fb2
push ebx
push ebx
push 0x2028
call dword [sym.imp.KERNEL32.dll_OpenFileMappingA]
cmp byte [ebp - 0x11], 0
je 0x10029ff7
push 0x2552
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualQueryEx]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1c], 0x5250
jge 0x1002a012
mov edx, str.naq_ivvku_sajnx_haockkaqb_jrsdfydu_grygjtmb_wxme_qpzhgxgz_njkiwg_imdvezpff_wzfhhl_ackuglbrk
mov ecx, 0x10072098
call fcn.1001684d
jmp 0x1002a03c
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1002a03c
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002a354
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
mov eax, 0x1005968a
call fcn.10058864
sub esp, 0x1c
mov eax, edx
mov dword [ebp - 0x28], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x1002a457
cmp byte [ebp + 0xc], 0
je 0x1002a3a4
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x1002a393
push 0xfd6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x24], 0x6683
cmp dword [ebp - 0x24], 0x6738
jle 0x1002a40e
xor esi, esi
mov dword [ebp - 0x20], esi
xor ebx, ebx
mov dword [ebp - 0x1c], 0x2370
mov dword [ebp - 0x18], ebx
xor edi, edi
mov eax, ebx
mov ebx, 0x10f6
cdq
idiv edi
mov esi, edx
mov eax, esi
mov ecx, 0x10072098
cdq
push edx
push eax
call fcn.10013ec4
dec esi
dec ebx
jne 0x1002a3d3
mov ebx, dword [ebp - 0x18]
inc edi
cmp edi, 0x4e48
jl 0x1002a3c7
mov esi, dword [ebp - 0x20]
add ebx, esi
dec dword [ebp - 0x1c]
mov dword [ebp - 0x18], ebx
jne 0x1002a3c5
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x468e
jl 0x1002a3b9
mov eax, dword [ebp - 0x28]
push dword [eax]
mov ecx, dword [ebp + 0x10]
call fcn.100173f6
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x6342
jge 0x1002a393
mov edx, str.mnou_yhclrf_uyexmov_nogwdgvzv_yrlxxf
mov ecx, 0x10072098
call fcn.1001684d
jmp 0x1002a393
mov dword [ebp - 0x1c], 0x5b47
cmp dword [ebp - 0x1c], 0x5ba5
jle 0x1002a4c8
xor esi, esi
mov dword [ebp - 0x20], esi
xor edi, edi
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x18], esi
mov ecx, edi
xor ebx, ebx
shl esi, cl
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x28], esi
and esi, ebx
mov eax, esi
mov ecx, 0x10072098
xor eax, edi
cdq
push edx
push eax
call fcn.10013ec4
inc edi
cmp edi, 0x174e
jl 0x1002a484
mov esi, dword [ebp - 0x18]
inc ebx
cmp ebx, 0x122b
jl 0x1002a47d
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
inc edi
mov dword [ebp - 0x24], edi
cmp edi, 0x6cc5
jl 0x1002a471
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x3bb2
jl 0x1002a46c
cmp byte [ebp + 8], 0
je 0x1002a506
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x1002a510
push 0
push 1
push 1
push 0x6b76
push 0x6acb
push 0x20de
push 0x251f
mov edx, 0x7721
mov ecx, 0x60bf
call fcn.10029b81
add esp, 0x1c
jmp 0x1002a510
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x5b1e
jge 0x1002a393
mov edx, str.zteznk_osrzfd_uefk_jhrbgau_fok_fdo_hgeozyir_egnwcgbaq_oopb_ccwaq_pnur_fwh
mov ecx, 0x10072098
call fcn.1001684d
jmp 0x1002a393
Function at 0x1002b5eb
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [ebp + 0xc], 0
je 0x1002b610
push ecx
push 0x1cfc
lea eax, [ebp - 1]
mov byte [ebp - 1], 0
push eax
push 1
call fcn.1002a72e
add esp, 0x10
jmp 0x1002b626
xor eax, eax
push eax
push eax
push eax
push eax
push 0x13c7
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
mov esp, ebp
pop ebp
ret

Function at 0x1002b62a
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x1002b641
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x1002b663
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x100e99a4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x100e9d30
jl 0x1002b671
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x100e9fd4
jl 0x1002b6b1
mov ecx, dword [0x100ead20]
xor ecx, dword [0x100e99a4]
and ecx, edi
xor ecx, dword [0x100ead20]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x100e99a0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x100e9fd4]
mov dword [0x100ea360], eax
pop esi
ret
Function at 0x1002c246
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 4], dl
push edi
mov edi, ecx
test dl, dl
je 0x1002c2b8
push esi
mov esi, dword [ebp + 0x18]
xor edx, edx
cmp dword [esi], edx
jne 0x1002c282
mov eax, dword [esi]
xor ecx, ecx
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [esi]
cmp eax, 0xfffffff8
mov eax, dword [ebp + 0x1c]
setle cl
mov dword [eax], ecx
mov ecx, dword [ebp + 8]
mov eax, dword [eax]
mov dword [ecx], eax
cmp dword [ecx], edx
je 0x1002c285
xor edx, edx
inc edx
mov eax, dword [esi]
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp + 0xc]
setge cl
xor edx, edx
cmp ecx, 0xfff7
setne dl
xor ecx, ecx
mov dword [eax], edx
mov eax, dword [esi]
cmp edx, eax
mov eax, dword [esi]
setle cl
cmp ecx, 0xfffffff8
pop esi
sbb ecx, ecx
neg ecx
imul eax, ecx
mov dword [edi], eax
jmp 0x1002c2c8
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1002c2c8
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1002d58c
Capabilities:
Get disk information

Disassembly:
mov eax, 0x10059742
call fcn.10058864
sub esp, 0x14
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], ecx
je 0x1002d6ab
mov dword [ebp - 0x14], 0x5199
cmp dword [ebp - 0x14], 0x548b
jle 0x1002d607
push 0x1a9c
push 0x1905
push 0
call dword [sym.imp.KERNEL32.dll_SetHandleInformation]
xor esi, esi
xor edi, edi
xor ebx, ebx
mov ecx, ebx
mov eax, edi
sar eax, cl
mov ecx, 0x10072098
and eax, esi
cdq
push edx
push eax
call fcn.10013ec4
inc ebx
cmp ebx, 0x3a7a
jl 0x1002d5d7
inc edi
cmp edi, 0x26a1
jl 0x1002d5d5
inc esi
cmp esi, 0x1c24
jl 0x1002d5d3
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x4eb2
jge 0x1002d623
mov edx, str.kbojixv_zykwys_pusyk_lsysojtr_zyyfjo_kdaoyua_zlxy
mov ecx, 0x10072098
call fcn.1001684d
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0xc]
cmp dword [esi], 0
je 0x1002d636
mov eax, dword [esi]
mov eax, dword [edi]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [edi]
mov eax, dword [esi]
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
imul eax, dword [ecx], 0xfffffffe
cmp eax, 0xfffc
sbb eax, eax
xor ecx, ecx
inc eax
cmp eax, 0x6652d0da
mov eax, dword [esi]
setl cl
xor edx, edx
sub ecx, eax
mov eax, dword [esi]
cmp ecx, 0xed16
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [edi]
setle cl
xor edx, edx
cmp ecx, 0xffffffff
setg dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [edi]
setg bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp - 0x1c]
setge cl
mov dword [eax], ecx
mov eax, dword [eax]
mov dword [esi], eax
jmp 0x1002d6ba
push 0x11cb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002d6cb
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x1005974c
call fcn.10058864
sub esp, 0x30
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x18], dl
test cl, cl
je 0x1002d7a9
mov dword [ebp - 0x24], 0x5512
cmp dword [ebp - 0x24], 0x583d
jle 0x1002d746
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x20], 0x66fb
mov eax, edi
lea ecx, [ebp - 0x3c]
cdq
push edx
push eax
call fcn.10001ade
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002d71d
mov eax, dword [eax]
push eax
call fcn.1004041f
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.10014649
add edi, esi
dec dword [ebp - 0x20]
jne 0x1002d706
inc esi
cmp esi, 0x63c8
jl 0x1002d6fd
push ebx
call dword [sym.imp.KERNEL32.dll_ResetEvent]
cmp byte [ebp + 8], 0
je 0x1002d768
push 0x1017
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
jmp 0x1002d784
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1002d784
push ebx
push ebx
push ebx
push ebx
push 0x13c7
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
cmp dword [ebp - 0x24], 0x52f0
jge 0x1002d798
push str.mvkfog_rkumyubyo_sulcfqle_wvybf_qfxt_lgyxv_dvgckfn
call fcn.1004041f
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x24], 0x649c
cmp dword [ebp - 0x24], 0x687d
jle 0x1002d7df
mov esi, ebx
mov edi, ebx
mov ebx, 0xbff
mov eax, edi
mov ecx, 0x10072098
cdq
push edx
push eax
call fcn.10013ec4
add edi, esi
dec ebx
jne 0x1002d7c2
inc esi
cmp esi, 0x6358
jl 0x1002d7bb
cmp byte [ebp - 0x18], 0
je 0x1002d7f8
mov byte [ebp - 0x19], bl
cmp byte [ebp - 0x19], 0
je 0x1002d800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_lstrcpyW]
jmp 0x1002d800
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0x619e
jge 0x1002d798
mov edx, str.knmy_tjoxl_sjifogl_gbzf_mvcvhbvx_kxfqz_lbciguzr_lfdkb_bie_brhebhmv_cksmhqtq_bqey_yyxuh_irmgqctt
mov ecx, 0x10072098
call fcn.1001684d
jmp 0x1002d798
Function at 0x1002d869
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x10059756
call fcn.10058864
sub esp, 0x14
push ebx
push esi
push edi
mov byte [ebp - 0x14], cl
mov edi, edx
mov dword [ebp - 0x1c], 0x3a64
cmp dword [ebp - 0x1c], 0x3b47
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
jle 0x1002d8cf
xor esi, esi
mov ebx, esi
mov dword [ebp - 0x18], 0x46f3
xor edi, edi
mov ecx, edi
mov eax, ebx
shl eax, cl
mov ecx, 0x10072098
cdq
push edx
push eax
call fcn.10013ec4
inc edi
cmp edi, 0x775c
jl 0x1002d8a1
dec ebx
dec dword [ebp - 0x18]
jne 0x1002d89f
inc esi
cmp esi, 0x7bb1
jl 0x1002d896
mov edi, dword [ebp - 0x20]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x3732
jge 0x1002d90a
mov edx, str.hxibxw_nqhryexej_uyoga_lorldcgj_ddjspaxli_jvauiqgl_yzaxcgyj_vnuoq_iidpc_ygkzpxhdr
mov ecx, 0x10072098
call fcn.1001684d
jmp 0x1002d90a
cmp byte [ebp - 0x14], 0
je 0x1002d92d
push 0
push 0
push 0x1606
push 0x1947
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
jmp 0x1002d938
cmp byte [edi], 0
je 0x1002d938
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002d9d6
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x10059760
call fcn.10058864
sub esp, 0x38
push ebx
push esi
mov byte [ebp - 0x18], cl
mov dword [ebp - 0x28], 0x575e
cmp dword [ebp - 0x28], 0x5ad2
push edi
mov dword [ebp - 0x10], esp
jle 0x1002da76
xor esi, esi
mov dword [ebp - 0x24], esi
xor edi, edi
mov dword [ebp - 0x20], edi
xor ebx, ebx
mov eax, edi
and dword [ebp - 0x2c], 0
cdq
mov edi, esi
idiv ebx
mov esi, dword [ebp - 0x2c]
sub edi, edx
mov ecx, esi
mov eax, edi
shl eax, cl
lea ecx, [ebp - 0x44]
cdq
push edx
push eax
call fcn.10001ade
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002da33
mov eax, dword [eax]
push eax
call fcn.1004041f
pop ecx
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.10014649
inc esi
cmp esi, 0x5898
jl 0x1002da18
mov esi, dword [ebp - 0x24]
inc ebx
mov edi, dword [ebp - 0x20]
cmp ebx, 0x5967
jl 0x1002da08
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x2604
jl 0x1002da06
inc esi
mov dword [ebp - 0x24], esi
cmp esi, 0x3b3f
jl 0x1002da01
cmp byte [ebp - 0x18], 0
je 0x1002dab0
mov byte [ebp - 0x19], 0
cmp byte [ebp - 0x19], 0
je 0x1002da8b
call fcn.1002b9d2
cmp dword [ebp - 0x28], 0x5643
jge 0x1002da9f
push str.ukgxsuex_aywvrorpj_zjlyqxk_ceqqg_xhcqlo_fcr_ondqgdw_ahvzohqfk_ogvij_sjgaphhd
call fcn.1004041f
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1002dabe
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov dword [ebp - 0x24], 0x1662
cmp dword [ebp - 0x24], 0x1930
jle 0x1002daf7
xor esi, esi
xor edi, edi
mov ecx, edi
mov eax, esi
shl eax, cl
mov ecx, 0x10072098
cdq
push edx
push eax
call fcn.10013ec4
inc edi
cmp edi, 0x41f8
jl 0x1002dad2
inc esi
cmp esi, 0x6f69
jl 0x1002dad0
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x1473
jge 0x1002da8b
mov edx, str.mzxuukn_thqbh_cpaf_trggb_hel_rgv_xfuczzqt_pfbtjtzas_fiqws_kgbdgwhry_kottdkgo_jraai_lowmf_eljrfgoyg
mov ecx, 0x10072098
call fcn.1001684d
jmp 0x1002da8b

Function at 0x1002dbfa
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0xc], 0
push esi
je 0x1002dc26
cmp byte [ebp + 0x18], 0
je 0x1002dc1d
cmp byte [edx], 0
je 0x1002dc59
push 0
push ecx
push ecx
call fcn.1002e3d4
add esp, 0xc
jmp 0x1002dc59
mov eax, dword [ebp + 0x14]
mov al, byte [eax]
mov byte [ecx], al
jmp 0x1002dc59
cmp byte [ebp + 0x10], 0
je 0x1002dc4f
mov esi, dword [ebp + 8]
mov ecx, esi
mov eax, dword [esi]
push dword [eax + 4]
call fcn.100322a1
mov eax, dword [esi]
mov dword [eax + 4], eax
mov eax, dword [esi]
mov dword [eax], eax
mov eax, dword [esi]
mov dword [eax + 8], eax
and dword [esi + 4], 0
jmp 0x1002dc59
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
pop esi
pop ebp
ret
Function at 0x1002dca5
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005976a
call fcn.10058864
sub esp, 0xc
cmp byte [ebp + 0x28], 0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], esi
je 0x1002dccb
call dword [sym.imp.KERNEL32.dll_GetVersion]
jmp 0x1002dd42
mov dword [ebp - 0x14], 0x2743
cmp dword [ebp - 0x14], 0x286c
jle 0x1002dd02
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x10072098
xor eax, edi
cdq
push edx
push eax
call fcn.10013ec4
inc ebx
cmp ebx, 0x655e
jl 0x1002dcdf
inc edi
cmp edi, 0x5656
jl 0x1002dcdd
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x2686
jge 0x1002dd3d
mov edx, str.qqj_dbs_wzeko_nsjcqp_ewio_iywza_cotplygcz_thsvykwx_hnqs_cgevswg_tfaggbc
mov ecx, 0x10072098
call fcn.1001684d
jmp 0x1002dd3d
mov eax, dword [ebp + 0x10]
mov dword [esi], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002deee
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 8], 0
je 0x1002df0c
cmp byte [ecx], 0
je 0x1002df4e
push 0x57f
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryA]
jmp 0x1002df4e
push 1
push 0x2d3e
push 0x1ce0
xor ecx, ecx
lea eax, [ebp - 1]
push ecx
push eax
push ecx
push 0xe9
push 0x74be
push 0x51e6
mov byte [ebp - 1], cl
mov edx, 0x3c27
push 0x7ab1
push 0xcad
mov ecx, 0x6b6b
call fcn.1002e2b7
add esp, 0x2c
mov esp, ebp
pop ebp
ret

Function at 0x1002e126
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
mov eax, edx
mov dword [esp + 0xc], eax
push ebx
push edi
test cl, cl
je 0x1002e1ec
mov dword [esp + 0x10], 0x6bd6
cmp dword [esp + 0x10], 0x6fa3
jle 0x1002e1af
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [esp + 0xc], eax
and eax, ebx
lea ecx, [esp + 0x18]
xor eax, edi
cdq
push edx
push eax
call fcn.10001ade
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002e175
mov eax, dword [eax]
push eax
call fcn.1004041f
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.10014649
mov eax, dword [esp + 0xc]
inc eax
mov dword [esp + 0xc], eax
cmp eax, 0x4e93
jl 0x1002e15b
inc ebx
cmp ebx, 0x48f7
jl 0x1002e155
inc edi
cmp edi, 0x50c7
jl 0x1002e153
mov eax, dword [esp + 0x14]
cmp byte [ebp + 0x14], 0
je 0x1002e1be
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
jmp 0x1002e1d5
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1002e1d5
push 0
push 0x127e
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
cmp dword [esp + 0x10], 0x6a96
jge 0x1002e215
push str.raus_shzfqe_lxoslsme_vof_efevmfl_qjlwzrp_kwfv
call fcn.1004041f
pop ecx
jmp 0x1002e215
cmp byte [ebp + 0x10], 0
je 0x1002e206
push 0x22d8
push 0
push 0x1b2a
call dword [sym.imp.KERNEL32.dll_OpenProcess]
jmp 0x1002e215
push 0xfd6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002e4d3
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [ebp + 8], 0
je 0x1002e500
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x1002e523
push 0xa1f
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x1002e523
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1002e523
xor eax, eax
push eax
push eax
push 0x1606
push 0x1947
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov esp, ebp
pop ebp
ret

Function at 0x1002e59c
Capabilities:
Create process on windows

Disassembly:
xor eax, eax
test dl, dl
je 0x1002e5b9
push 0xa1f
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
ret
push eax
push 0x127e
push eax
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
ret

Function at 0x1002e664
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10059792
call fcn.10058864
sub esp, 0x14
cmp byte [ebp + 8], 0
mov eax, ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], eax
je 0x1002e761
mov dword [ebp - 0x1c], 0x6d33
cmp dword [ebp - 0x1c], 0x6e7e
jle 0x1002e702
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x14], edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov edi, edx
xor esi, esi
mov ecx, esi
mov eax, ebx
shl eax, cl
mov ecx, 0x10072098
xor eax, edi
cdq
push edx
push eax
call fcn.10013ec4
inc esi
cmp esi, 0x260a
jl 0x1002e6ab
inc ebx
cmp ebx, 0x4787
jl 0x1002e6a9
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x12f9
jl 0x1002e6a0
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x74ef
jl 0x1002e69b
push 0x1f62
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VirtualQuery]
mov eax, dword [ebp - 0x20]
cmp byte [eax], 0
je 0x1002e729
push 0x3b60
push 0x42e9
push 0
mov dl, 1
push 0x68f0
push 0x4253
mov cl, dl
call fcn.1002ca13
add esp, 0x14
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x6b76
jge 0x1002e745
mov edx, str.ojae_bnmuj_ysqix_pkv_ifksymv_pcqwy
mov ecx, 0x10072098
call fcn.1001684d
jmp 0x1002e7bb
mov esi, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [ecx]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [ecx]
xor ecx, ecx
cmp eax, 8
mov eax, dword [ebp + 0x18]
setg cl
xor edx, edx
cmp ecx, 0xc698
setg dl
xor ecx, ecx
add edx, 9
mov dword [eax], edx
mov eax, dword [eax]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [esi]
cmp eax, 0x7f45b6d4
mov eax, dword [esi]
setge cl
xor edx, edx
cmp ecx, 0x4ce5fef4
setg dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [ebp + 0xc]
setge cl
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002eb66
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [ebp + 8], 0
mov byte [ebp - 4], dl
mov byte [ebp - 8], cl
je 0x1002ebaf
mov byte [ebp + 0xb], 0
test cl, cl
je 0x1002eb9a
cmp byte [ebp + 0xb], 0
je 0x1002ebd6
mov dl, 1
push 0x2064
push 1
mov cl, dl
call fcn.1002d6cb
pop ecx
pop ecx
jmp 0x1002ebd6
cmp byte [ebp + 0xb], 0
je 0x1002ebd6
push 0xe54
push 0
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
jmp 0x1002ebd6
test dl, dl
je 0x1002ebd0
push 0x1017
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
jmp 0x1002ebd6
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov esp, ebp
pop ebp
ret