joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10003fc6
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10004020
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10004018
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
push 0x247e
push 0
push 0x2f5
push 0x65c8
push 0x419b
push 0x678a
push 0x9d9
push 0
call fcn.10006c03
add esp, 0x24
jmp 0x1000401e
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x1000403c
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
push dword [ebp - 0xc]
push 0
push dword [ebp - 0x10]
call fcn.10005f74
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x10004040
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005a868
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], 0x362f
mov dword [ebp - 0x20], str.kbpltlgwk_ysmiwyty_hpaanv_pllvv_xudhveit_wsjolwfa_avcmuuaim_wkn_sjx_pvmn
cmp dword [ebp - 0x1c], 0x36dc
jle 0x100040d7
push 0x1cef
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoW]
and dword [ebp - 0x14], 0
jmp 0x10004097
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x447e
jge 0x100040d7
and dword [ebp - 0x18], 0
jmp 0x100040ad
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x225b
jge 0x100040d5
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
push dword [ebp - 0x24]
push dword [ebp - 0x28]
mov ecx, 0x10075958
call fcn.1000daa1
jmp 0x100040a6
jmp 0x10004090
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp + 0x10]
push 0
push 0x3f3f
call fcn.10004140
add esp, 0x14
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x33c3
jge 0x10004109
mov edx, dword [ebp - 0x20]
mov ecx, 0x10075958
call fcn.1001082c
jmp 0x10004125
or dword [ebp - 4], 0xffffffff
jmp 0x1000412f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004de9
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005a8a3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10004f08
mov dword [ebp - 0x1c], 0x21db
mov dword [ebp - 0x24], str.uevhwe_cjvdmyj_svolrd
cmp dword [ebp - 0x1c], 0x2482
jle 0x10004e7c
and dword [ebp - 0x14], 0
jmp 0x10004e3b
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x41f1
jge 0x10004e7c
and dword [ebp - 0x18], 0
jmp 0x10004e51
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2e8c
jge 0x10004e7a
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
mov ecx, 0x10075958
call fcn.1000daa1
jmp 0x10004e4a
jmp 0x10004e34
lea eax, [ebp + 0x14]
mov dword [ebp - 0x28], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x1f56
jge 0x10004e9c
mov edx, dword [ebp - 0x24]
mov ecx, 0x10075958
call fcn.1001082c
jmp 0x10004eb8
or dword [ebp - 4], 0xffffffff
jmp 0x10004ec2
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10004eeb
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
jmp 0x10004f06
push 0x1ace
push 0
push 0x3ea
push 0x426
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x10004f30
lea eax, [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
push dword [eax]
push 0
push dword [ebp - 0x38]
push 0xf2
push 0x5c91
call fcn.100042c9
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000927c
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100092cf
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x100092c0
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x100092be
push 0
call fcn.100097ea
pop ecx
jmp 0x100092ca
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x100093d4
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x100093b0
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0x84dcc80f
jae 0x1000930f
mov dword [ebp - 8], 1
jmp 0x10009313
and dword [ebp - 8], 0
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
sub ecx, dword [eax]
cmp ecx, 4
ja 0x1000932e
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x1000932e
and dword [ebp - 0xc], 0
jmp 0x10009335
mov dword [ebp - 0xc], 1
mov eax, dword [ebp - 4]
mov eax, dword [eax]
add eax, 0x5a97963b
cmp eax, dword [ebp - 0xc]
jl 0x1000934d
mov dword [ebp - 0x10], 1
jmp 0x10009351
and dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 0x924c
jge 0x1000936c
mov eax, 0x41ac3dc9
test eax, eax
je 0x1000936c
mov dword [ebp - 0x14], 1
jmp 0x10009370
and dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0x509cb0be
jne 0x10009382
mov dword [ebp - 0x18], 1
jmp 0x10009386
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
cmp dword [ebp - 0x18], eax
je 0x10009399
mov dword [ebp - 0x3c], 1
jmp 0x1000939d
and dword [ebp - 0x3c], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100093d4
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
push 0
mov ecx, dword [ebp - 0x48]
call fcn.10001d4d
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x10012499
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push esi
push edi
test cl, cl
je 0x10012500
cmp byte [ebp + 0x20], 0
je 0x100124df
mov edi, dword [ebp + 0x18]
xor esi, esi
mov dword [edi], esi
jmp 0x100124d8
push dword [ebp + 0x1c]
mov dl, 1
mov ecx, 0x4c23
push 0x6d00
push edi
push esi
push dword [ebp + 0xc]
push 0x6c2f
push esi
call fcn.10011ec8
add esp, 0x1c
inc dword [edi]
cmp dword [edi], 2
jle 0x100124b4
jmp 0x1001252a
cmp byte [edx], 0
je 0x1001252a
push 0x1ace
xor esi, esi
push esi
push 0x3ea
push 0x426
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x1001252a
cmp byte [ebp + 0x10], 0
je 0x10012522
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x1001252a
push 0x277d
mov edx, 0x1193
xor cl, cl
call fcn.100126c7
pop ecx
jmp 0x1001252a
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov dword [ecx + 4], eax
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001725a
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, 0x8c176b0f
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x10], eax
mov dword [ebp - 0xc], eax
push ebx
xor ebx, ebx
mov dword [ebp - 8], eax
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10017283
push ebx
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x100172a3
push 0x1ace
push ebx
push 0x3ea
push 0x426
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
push 0x23cc
push 0x181a
push 0x149a
call fcn.1002da9b
pop ecx
pop ecx
call eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10019334
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005b16f
call fcn.1005a1d8
sub esp, 0x14
cmp byte [ebp + 0x18], 0
mov eax, edx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], eax
je 0x10019369
mov eax, dword [ebp + 0x10]
or dword [eax], 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x18], 0x178a
xor esi, esi
cmp dword [ebp - 0x18], 0x1aee
jle 0x100193d4
push esi
push 0xbca
push 0x2013
push 0x14f5
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileMappingA]
mov ebx, esi
mov edi, esi
mov dword [ebp - 0x14], esi
mov esi, edi
mov edi, 0x29ff
mov eax, esi
mov ecx, 0x10075958
xor eax, ebx
cdq
push edx
push eax
call fcn.1000daa1
dec esi
dec edi
jne 0x100193a1
mov edi, dword [ebp - 0x14]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0xf14
jl 0x1001939a
inc ebx
push 0
pop esi
cmp ebx, 0x5c5c
jl 0x10019395
mov eax, dword [ebp - 0x1c]
cmp byte [eax], 0
je 0x100193e6
push esi
push 0x1975
push esi
call dword [sym.imp.GDI32.dll_ExtCreateRegion]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x18], 0x13e2
jge 0x10019358
mov edx, str.jcux_utevg_rkewsyex_tqybuoqoy_ymmdqbovg_xhxpxsic
mov ecx, 0x10075958
call fcn.1001082c
jmp 0x10019358

Function at 0x100194a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp byte [ebp + 0xc], 0
je 0x10019545
mov dword [ebp - 8], 0x6a86
cmp dword [ebp - 8], 0x6e36
jle 0x1001952a
push ebx
push esi
push edi
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 4], ecx
lea eax, [ebx + edi]
xor eax, ecx
lea ecx, [ebp - 0x20]
or eax, esi
cdq
push edx
push eax
call fcn.100026cb
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100194ea
mov eax, dword [eax]
push eax
call fcn.10041403
pop ecx
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.1000e4ee
mov ecx, dword [ebp - 4]
inc ecx
mov dword [ebp - 4], ecx
cmp ecx, 0x9fd
jl 0x100194ce
inc ebx
cmp ebx, 0x6915
jl 0x100194c9
inc edi
cmp edi, 0x13f1
jl 0x100194c7
inc esi
cmp esi, 0x7cc8
jl 0x100194c5
pop edi
pop esi
pop ebx
cmp dword [ebp - 8], 0x671b
jge 0x1001953e
push str.pyvf_likl_fnhnaop_qcsigxpdu_wkqzllk_dgm_dibirtn_afplxect_oftrdteo_dnsxnqyu_mbqsiqkw
call fcn.10041403
pop ecx
mov eax, dword [ebp + 8]
dec dword [eax]
jmp 0x10019560
push 0x1ace
push 0
push 0x3ea
push 0x426
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov esp, ebp
pop ebp
ret
Function at 0x1001a796
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005b268
call fcn.1005a1d8
sub esp, 0xc
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x1001a837
mov dword [ebp - 0x14], 0x3dd0
cmp dword [ebp - 0x14], 0x3f2e
jle 0x1001a7f7
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x10075958
xor eax, edi
or eax, esi
cdq
push edx
push eax
call fcn.1000daa1
inc ebx
cmp ebx, 0x6fc7
jl 0x1001a7c9
inc edi
cmp edi, 0xef5
jl 0x1001a7c7
inc esi
cmp esi, 0x447e
jl 0x1001a7c5
mov ecx, dword [ebp + 0x18]
call fcn.1001da65
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x3d8d
jge 0x1001a81b
mov edx, str.rdqy_npqzy_qjablziuk_mapm_ppbmqlobf
mov ecx, 0x10075958
call fcn.1001082c
jmp 0x1001a857
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1001a857
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x2bfbd3ae
inc dword [edx]
cmp dword [edx], 2
jl 0x1001a845
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002f31c
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005b8cb
call fcn.1005a1d8
sub esp, 0xc
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], edi
je 0x1002f37a
cmp byte [ebp + 0x18], 0
je 0x1002f354
push 0x1183
push 0
push 0
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
jmp 0x1002f43d
mov dword [edx], 0
cmp dword [edx], 3
jge 0x1002f43d
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
and dword [eax + ecx*4], 0
inc dword [edx]
cmp dword [edx], 3
jl 0x1002f366
jmp 0x1002f43d
cmp byte [ebp + 0x20], 0
je 0x1002f423
mov dword [ebp - 0x14], 0x3fcd
cmp dword [ebp - 0x14], 0x3fea
jle 0x1002f3bb
xor esi, esi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x10075958
xor eax, esi
cdq
push edx
push eax
call fcn.1000daa1
inc ebx
cmp ebx, 0xaaa
jl 0x1002f398
inc esi
cmp esi, 0x2d63
jl 0x1002f396
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x3d01
jge 0x1002f3f6
mov edx, str.qfp_nltclywlr_ieb
mov ecx, 0x10075958
call fcn.1001082c
jmp 0x1002f3f6
or dword [ebp - 4], 0xffffffff
push 0x1a
pop ecx
cmp dword [edi], ecx
jge 0x1002f40b
mov eax, dword [ebp + 0x1c]
movzx edx, word [eax]
add edx, dword [edi]
jmp 0x1002f418
mov eax, dword [edi]
cdq
idiv ecx
mov eax, dword [ebp + 0x14]
movzx eax, word [eax]
add edx, eax
mov ecx, dword [ebp + 0x10]
push edx
call fcn.1000dc3e
jmp 0x1002f43d
push 0x6701
push 0x2b8f
lea edx, [ebp + 0xf]
mov byte [ebp + 0xf], 0
xor cl, cl
call fcn.1002ef35
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002f60b
Capabilities:
Accept command line arguments
Encode data using xor

Disassembly:
mov eax, 0x1005b8d5
call fcn.1005a1d8
sub esp, 0x20
push ebx
push esi
xor ebx, ebx
push edi
mov dword [ebp - 0x10], esp
cmp byte [ebp + 8], bl
je 0x1002f72a
mov dword [ebp - 0x1c], 0x69f2
cmp dword [ebp - 0x1c], 0x6c92
jle 0x1002f688
mov edi, ebx
mov esi, ebx
mov dword [ebp - 0x18], ebx
mov ebx, esi
mov esi, 0x504c
mov ecx, ebx
mov eax, edi
shl eax, cl
mov ecx, 0x10075958
cdq
push edx
push eax
call fcn.1000daa1
dec ebx
dec esi
jne 0x1002f647
mov esi, dword [ebp - 0x18]
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x72e6
jl 0x1002f640
inc edi
push 0
pop ebx
cmp edi, 0xe0d
jl 0x1002f63b
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1c], 0x6784
jge 0x1002f6c1
mov edx, str.azjnr_hjgszksvs_sdl_ivtgxsepj
mov ecx, 0x10075958
call fcn.1001082c
jmp 0x1002f6c1
mov dword [ebp - 0x18], 0x8d4081c2
mov dword [ebp - 0x18], ebx
jmp 0x1002f6db
mov eax, dword [ebp - 0x18]
mov dword [ebp + eax*4 - 0x2c], 0xfffffff7
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x1002f6cd
mov dword [ebp - 0x18], ebx
jmp 0x1002f714
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1002f711
push 0x513d
push 0x5b26
push 0x51de
push 0xd20
push 1
xor dl, dl
mov cl, 1
call fcn.1002f471
add esp, 0x14
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jle 0x1002f6e6
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x1002f74c
push 0x45ff
push 0x13cc
push ebx
mov dl, 1
mov ecx, 0x3231
call fcn.1002eeec
add esp, 0xc
mov dword [ebp - 0x24], 0x6ec2
cmp dword [ebp - 0x24], 0x6f09
jle 0x1002f7ca
mov dword [ebp - 0x18], ebx
mov esi, ebx
mov dword [ebp - 0x20], ebx
mov edi, ebx
mov dword [ebp - 0x1c], ebx
mov ecx, edi
mov dword [ebp - 0x2c], ebx
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x2c]
mov dword [ebp - 0x28], esi
shl esi, cl
mov eax, esi
mov ecx, 0x10075958
xor eax, edi
or eax, ebx
cdq
push edx
push eax
call fcn.1000daa1
inc edi
cmp edi, 0x1ca0
jl 0x1002f779
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
inc edi
mov dword [ebp - 0x1c], edi
push 0
pop ebx
cmp edi, 0x3398
jl 0x1002f769
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x42ff
jl 0x1002f764
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x6f76
jl 0x1002f75f
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0x6e06
jge 0x1002f719
mov edx, str.zwpbieuv_uvrcvlob_nzhhh_eswptpxo_ksynhvw_pzteb_msvdjk_hxwfx
mov ecx, 0x10075958
call fcn.1001082c
jmp 0x1002f719
Function at 0x1002f837
Capabilities:
Set registry value

Disassembly:
mov eax, 0x1005b8df
call fcn.1005a1d8
sub esp, 0xc
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], cl
je 0x1002f90d
test cl, cl
je 0x1002f883
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0
cmp dword [edx], 4
jge 0x1002f87e
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfdbd0176
inc dword [edx]
cmp dword [edx], 4
jl 0x1002f86c
jmp 0x1002f9bc
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1002f87e
push 0xb67
push 0x74da
xor dl, dl
mov cl, 1
call fcn.1002f9cd
mov dword [ebp + 0x14], 0x14c1
cmp dword [ebp + 0x14], 0x160d
pop ecx
pop ecx
jle 0x1002f8d5
xor esi, esi
mov edi, esi
mov ebx, 0x7c33
mov eax, edi
mov ecx, 0x10075958
cdq
push edx
push eax
call fcn.1000daa1
dec edi
dec ebx
jne 0x1002f8b9
inc esi
cmp esi, 0x5381
jl 0x1002f8b2
and dword [ebp - 4], 0
cmp dword [ebp + 0x14], 0x10ef
jge 0x1002f87e
mov edx, str.pghxzhqh_zsrzjxjnd_lcmrm_grse_nopm_ikono_szonaqraf_qnl_ypwghbp_akfxnn_azfl_pfdex_zokcwe_crcc
mov ecx, 0x10075958
call fcn.1001082c
jmp 0x1002f87e
cmp byte [ebp + 0x20], 0
je 0x1002f99c
mov dword [ebp + 0x14], 0x1fb1
cmp dword [ebp + 0x14], 0x1fbd
jle 0x1002f950
xor esi, esi
xor edi, edi
mov ecx, edi
mov eax, esi
sar eax, cl
mov ecx, 0x10075958
cdq
push edx
push eax
call fcn.1000daa1
inc edi
cmp edi, 0x85
jl 0x1002f92b
inc esi
cmp esi, 0x14ad
jl 0x1002f929
mov dword [ebp - 4], 2
cmp dword [ebp + 0x14], 0x1ca3
jge 0x1002f96f
mov edx, str.mwe_trrtutu_bahbdbkd_lsrveiejg_sqkglirlu_vykhqlukh_vpk_nopdmmrkb_noqb_xtudwwg_pljiukfmn_sbscwq
mov ecx, 0x10075958
call fcn.1001082c
mov eax, dword [ebp + 0x18]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0x10]
push dword [eax]
call fcn.1000dc80
jmp 0x1002f9bc
cmp byte [edx], 0
je 0x1002f9bc
push 0x1ace
push 0
push 0x3ea
push 0x426
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100309fa
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov dword [ebp - 8], 0x6cc4
mov ebx, edx
cmp dword [ebp - 8], 0x6d6a
push esi
push edi
jle 0x10030a6e
xor esi, esi
xor edi, edi
mov eax, esi
lea ecx, [ebp - 0x20]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.100026cb
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10030a35
mov eax, dword [eax]
push eax
call fcn.10041403
pop ecx
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.1000e4ee
inc edi
cmp edi, 0x2378
jl 0x10030a19
inc esi
cmp esi, 0x75fa
jl 0x10030a17
push 0x15c0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
cmp dword [ebp - 8], 0x6b7c
jge 0x10030a82
push str.wtiwomrm_wiyg_vbu_xbgezlzfp_bjxkgjuz
call fcn.10041403
pop ecx
cmp byte [ebp + 0xc], 0
je 0x10030a97
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 8]
push dword [eax]
call fcn.1000dd3b
jmp 0x10030a9b
mov eax, dword [ebx]
dec dword [eax]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100311cf
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x100311e6
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x10031208
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x1007d624
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x1007d9b0
jl 0x10031216
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x1007dc54
jl 0x10031256
mov ecx, dword [0x1007e9a0]
xor ecx, dword [0x1007d624]
and ecx, edi
xor ecx, dword [0x1007e9a0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x1007d620], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x1007dc54]
mov dword [0x1007dfe0], eax
pop esi
ret
Function at 0x100313ce
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
push esi
push edi
test cl, cl
je 0x100314ad
mov dword [esp + 0x1c], 0x6723
cmp dword [esp + 0x1c], 0x6a2c
push 0
pop esi
jle 0x1003146d
mov ebx, esi
mov dword [esp + 0x18], esi
mov eax, esi
mov dword [esp + 0x10], 0x1d25
mov dword [esp + 0x14], eax
mov edi, esi
and eax, edi
lea ecx, [esp + 0x20]
and eax, ebx
cdq
push edx
push eax
call fcn.100026cb
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10031427
mov eax, dword [eax]
push eax
call fcn.10041403
pop ecx
push esi
push 1
lea ecx, [esp + 0x28]
call fcn.1000e4ee
mov eax, dword [esp + 0x14]
inc edi
cmp edi, 0x70d4
jl 0x1003140d
mov edi, dword [esp + 0x18]
add eax, edi
dec dword [esp + 0x10]
mov dword [esp + 0x14], eax
jne 0x1003140b
inc edi
mov dword [esp + 0x18], edi
cmp edi, 0x32e8
jl 0x100313fd
inc ebx
cmp ebx, 0x5b9f
jl 0x100313f9
cmp dword [esp + 0x1c], 0x63a1
jge 0x10031482
push str.wewss_kvhxjoyjw_letmmut_gkduqzp_ibgk_nictjt_ninnahh_wmt_lrf_afovtdnl_nmu_lmfsmve
call fcn.10041403
pop ecx
cmp byte [ebp + 0x1c], 0
je 0x100314a0
push 0xc97
push esi
push esi
push 0x1ba4
push esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
jmp 0x10031578
mov ecx, dword [ebp + 0x14]
mov eax, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x10031578
cmp byte [ebp + 8], 0
je 0x10031559
mov edi, dword [ebp + 0x18]
mov dword [edi], 0xffffffef
cmp dword [edi], 0xfffffff5
jle 0x10031578
mov ebx, dword [ebp + 0x10]
xor esi, esi
mov dword [esp + 0x1c], 0x7d20
mov dword [esp + 0x1c], 0xfffffffa
mov dword [esp + 0x14], 0x6e5b14f4
mov dword [esp + 0x10], esi
jmp 0x100314fc
mov eax, dword [esp + 0x10]
mov dword [esp + eax*4 + 0x18], 0xe57f
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 1
jl 0x100314ec
mov eax, dword [esp + 0x14]
mov dword [ebx], 0xe864896
mov dword [esp + 0x1c], 0xe864896
mov eax, dword [esp + 0x1c]
mov dword [esp + 0x1c], eax
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
dec eax
neg eax
push 0xfffffffffffffffd
sbb eax, eax
inc eax
pop ecx
cmp ecx, eax
sbb edx, edx
xor ecx, ecx
inc edx
add edx, dword [esp + 0x14]
mov eax, dword [edi]
cmp edx, eax
setg cl
mov dword [esp + 0x14], ecx
inc dword [edi]
cmp dword [edi], 0xfffffff5
jg 0x100314ce
jmp 0x10031578
cmp byte [edx], 0
je 0x10031578
push 0x1ace
xor esi, esi
push esi
push 0x3ea
push 0x426
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10031f3c
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [ebp + 8], 0
je 0x10031f5b
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x10031f78
push eax
push eax
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x10031f78
cmp byte [edx], 0
je 0x10031f78
push 0x7a07
push 0
push 1
xor dl, dl
mov ecx, 0x3b13
call fcn.100345bc
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10031fc0
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0xc], 0
mov edx, ecx
je 0x10031fe0
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x10032002
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x10032002
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10032002
push esi
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffffd
inc dword [edx]
cmp dword [edx], 2
jl 0x10031fef
pop esi
mov esp, ebp
pop ebp
ret