joyce8/EMBER2024-capa huggingface dataset:
Function at 0x402626
Capabilities:
Accept command line arguments
Authenticate hmac
Check for time delay via gettickcount
Set registry value
Terminate process

Disassembly:
lea esp, [esp + 4]
mov al, byte [0x409078]
mov ecx, dword [0x409068]
xor al, byte [0x40907f]
sbb di, dx
xor di, 0x3b67
mov edx, dword [0x40906c]
sub ebx, ebx
not di
bt di, 0x79
mov edi, 0x40bff0
cmp bp, 0x7692
clc
stc
and al, 0x36
test edx, 0x751915a4
clc
lea ecx, [ecx + edx*2]
mov byte [0x40907f], al
cmc
cmp cx, di
mov dword [0x409068], ecx
btr ecx, 0x6f
shrd cx, di, 0x68
xor ch, dl
mov ecx, dword [0x409070]
test edi, esi
cmp dh, 0xff
push ebx
test sp, 0x69e4
cmp si, si
movzx eax, al
cmp bp, 0x4a7b
and ecx, 3
test ebp, esi
mov dword [ebp - 0x20], edi
jmp loc.0040d16f
push ebp
mov ebp, esp
sub esp, 0x124
push ebx
push esi
push edi
push 0x4091a4
jmp 0x4024e9

Function at 0x401037
Capabilities:
Delete file
Extract resource via kernel32 functions
Get common file path

Disassembly:
call 0x401037
push 0
call sub.kernel32.dll_ExitProcess
push ebp
mov ebp, esp
add esp, 0xfffffbf4
push esi
push edi
push ebx
push 0
call sub.kernel32.dll_GetModuleHandleA
mov dword [0x403030], eax
mov dword [ebp - 8], 0
push 0xa
push section..data
push 0
call sub.kernel32.dll_FindResourceA
or eax, eax
je 0x401089
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 0
call sub.kernel32.dll_SizeofResource
mov dword [ebp - 0xc], eax
push dword [ebp - 4]
push 0
call sub.kernel32.dll_LoadResource
or eax, eax
je 0x401089
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
je 0x4010c1
push 4
push 0x1000
push dword [ebp - 0xc]
push 0
call sub.kernel32.dll_VirtualAlloc
mov edi, eax
push dword [ebp - 0xc]
push dword [ebp - 8]
push edi
call sub.kernel32.dll_RtlMoveMemory
mov dword [ebp - 8], edi
push 0xdeadbeef
push dword [ebp - 0xc]
push dword [ebp - 8]
call section..text
cmp dword [ebp - 8], 0
je 0x4010fb
lea eax, [ebp - 0x40c]
push eax
push 0x400
call sub.kernel32.dll_GetTempPathA
push str.dup2patcher.dll
lea eax, [ebp - 0x40c]
push eax
call sub.kernel32.dll_lstrcatA
push dword [ebp - 0xc]
push dword [ebp - 8]
lea eax, [ebp - 0x40c]
push eax
call fcn.00401184
lea eax, [ebp - 0x40c]
push eax
call sub.kernel32.dll_LoadLibraryA
or eax, eax
je 0x401130
mov ebx, eax
push str.load_patcher
push ebx
call sub.kernel32.dll_GetProcAddress
or eax, eax
je 0x40111e
call eax
push ebx
call sub.kernel32.dll_FreeLibrary
lea eax, [ebp - 0x40c]
push eax
call sub.kernel32.dll_DeleteFileA
pop ebx
pop edi
pop esi
leave
ret

Function at 0x401184
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
push dword [ebp + 8]
call sub.kernel32.dll_CreateFileA
cmp eax, 0xffffffff
jne 0x4011af
xor eax, eax
leave
ret 0xc
mov dword [ebp - 4], eax
push 0
lea eax, [ebp - 8]
push eax
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp - 4]
call sub.kernel32.dll_WriteFile
push dword [ebp - 4]
call sub.kernel32.dll_FlushFileBuffers
push dword [ebp - 4]
call sub.kernel32.dll_CloseHandle
mov eax, dword [ebp - 8]
leave
ret 0xc
Function at 0x10004fe3
Capabilities:
Create thread
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
je 0x10004ffc
mov eax, dword [ebp + 0x10]
dec dword [eax]
jmp 0x10005109
mov dword [ebp - 0xc], 0x9b8
cmp dword [ebp - 0xc], 0xad6
jle 0x10005070
push 0
push 0x2309
push 0
push 0
push 0x50
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
lea ecx, [ebp - 0x24]
and eax, edi
xor eax, esi
cdq
push edx
push eax
call fcn.10001a21
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10005042
mov eax, dword [eax]
push eax
call fcn.1003f696
pop ecx
push 0
push 1
lea ecx, [ebp - 0x24]
call fcn.1000200c
inc ebx
cmp ebx, 0x3882
jl 0x10005027
inc edi
cmp edi, 0x376f
jl 0x10005025
inc esi
cmp esi, 0x536e
jl 0x10005023
mov dword [ebp - 8], 0x1034
cmp dword [ebp - 8], 0x10c8
jle 0x100050d9
xor esi, esi
xor edi, edi
xor ebx, ebx
mov ecx, ebx
mov eax, edi
shl eax, cl
lea ecx, [ebp - 0x3c]
and eax, esi
cdq
push edx
push eax
call fcn.10001a21
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100050a3
mov eax, dword [eax]
push eax
call fcn.1003f696
pop ecx
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.1000200c
inc ebx
cmp ebx, 0x3b58
jl 0x10005086
inc edi
cmp edi, 0x61d9
jl 0x10005084
inc esi
cmp esi, 0x7956
jl 0x10005082
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
mov eax, dword [ebp + 8]
xor ecx, ecx
cmp dword [ebp - 8], 0xddb
mov word [eax], cx
jge 0x100050f5
push str.mcwiwdan_nizhkclsf_rqsslczt_kmlszpcgo_ztlldfvo_qgldujfms_ozse_svux_wnyxvqik
call fcn.1003f696
pop ecx
cmp dword [ebp - 0xc], 0x72d
jge 0x10005109
push str.ddx_tzy_hkfvcorz_tgknymsy_wmaediyn
call fcn.1003f696
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a852
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1000a87b
push 0
push 0xe6e
push 0x8fe
push 0x7a94
call fcn.1000f24b
add esp, 0x10
jmp 0x1000a8db
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1000a8ba
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1000a8b8
push 0xbc1
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x1000a8db
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1000a8db
push 0xbc1
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
mov esp, ebp
pop ebp
ret
Function at 0x1002353e
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10023580
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
push dword [eax]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 1
mov eax, dword [ebp - 0x14]
push dword [eax]
call fcn.100235da
add esp, 0x14
jmp 0x100235d6
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x100235bf
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x100235bd
push 0xbc1
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x100235d6
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov esp, ebp
pop ebp
ret
Function at 0x10025826
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10058595
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x10025888
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
push 1
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0x56bd
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
call fcn.100259c1
add esp, 0x18
jmp 0x100259b0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x100258ad
push 0
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
jmp 0x100259b0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x20], 0x4ffa
mov dword [ebp - 0x48], str.cyzle_dnmalsq_kbbzhktg_zgs_ozm_oyidwmsgt_euq_lbgpmbq_jukolqvu_fjsuosf_mscqbbg_ypfy
cmp dword [ebp - 0x20], 0x511b
jle 0x10025952
and dword [ebp - 0x1c], 0
jmp 0x100258db
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3793
jge 0x10025952
and dword [ebp - 0x14], 0
jmp 0x100258f1
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x5a7c
jge 0x10025950
and dword [ebp - 0x18], 0
jmp 0x10025907
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1759
jge 0x1002594e
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
shl eax, cl
or eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
lea ecx, [ebp - 0x68]
call fcn.10001a21
pop ecx
pop ecx
mov dword [ebp - 0x3c], eax
mov ecx, dword [ebp - 0x3c]
call fcn.10001c88
push eax
call fcn.1003f696
pop ecx
lea ecx, [ebp - 0x68]
call fcn.10001c7e
jmp 0x10025900
jmp 0x100258ea
jmp 0x100258d4
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x10025974
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x4e5e
jge 0x1002598a
push dword [ebp - 0x48]
call fcn.1003f696
pop ecx
jmp 0x100259a6
or dword [ebp - 4], 0xffffffff
jmp 0x100259b0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002b99c
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10058721
call fcn.10057898
sub esp, 0x20
push ebx
push esi
mov byte [ebp - 0x14], dl
mov esi, ecx
mov dword [ebp - 0x24], 0x2ea4
cmp dword [ebp - 0x24], 0x2f73
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], esi
jle 0x1002ba1a
xor edi, edi
mov dword [ebp - 0x20], edi
xor esi, esi
mov dword [ebp - 0x1c], 0x7be
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x18], 0x741
mov eax, esi
mov ecx, 0x1006f978
xor eax, edi
cdq
push edx
push eax
call fcn.10001ca8
add edi, ebx
dec dword [ebp - 0x18]
jne 0x1002b9e0
inc ebx
cmp ebx, 0x5942
jl 0x1002b9d7
mov edi, dword [ebp - 0x20]
add esi, edi
dec dword [ebp - 0x1c]
jne 0x1002b9d5
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x7b66
jl 0x1002b9cc
mov esi, dword [ebp - 0x28]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x2afa
jge 0x1002ba55
mov edx, str.cgiswgh_kfalzkb_chllxrv_qid
mov ecx, 0x1006f978
call fcn.1000365f
jmp 0x1002ba55
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x14], 0
je 0x1002ba8a
mov dword [esi], 2
cmp dword [esi], 0xffffffed
jle 0x1002baad
mov ecx, dword [ebp + 0x14]
mov edx, dword [ebp + 0xc]
mov dword [ebp - 0x24], 0xfffffffe
mov eax, dword [ebp - 0x24]
mov dword [ecx], eax
cmp dword [edx], 0
jne 0x1002baad
dec dword [esi]
cmp dword [esi], 0xffffffed
jg 0x1002ba70
jmp 0x1002baad
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1002baad
push 0
push 0x93c
push 0x5725
mov edx, 0x5fdd
mov cl, 1
call fcn.1002a9d9
add esp, 0xc
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002c19f
Capabilities:
Check for time delay via gettickcount

Disassembly:
mov eax, 0x1005875c
call fcn.10057898
sub esp, 0x18
push ebx
push esi
mov dword [ebp - 0x18], 0x68f
mov ebx, ecx
cmp dword [ebp - 0x18], 0x9ba
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], ebx
jle 0x1002c207
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, edi
mov ecx, 0x1006f978
cdq
idiv ebx
or edx, esi
mov eax, edx
cdq
push edx
push eax
call fcn.10001ca8
inc ebx
cmp ebx, 0x4808
jl 0x1002c1d0
inc edi
cmp edi, 0x7472
jl 0x1002c1ce
inc esi
cmp esi, 0x35c0
jl 0x1002c1cc
mov edx, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x20]
cmp byte [ebp + 0x10], 0
je 0x1002c231
cmp byte [ebp + 0xc], 0
je 0x1002c221
mov eax, dword [ebp + 0x14]
mov ecx, edx
push dword [eax]
call fcn.1000a1c2
jmp 0x1002c258
lea edx, [ebp - 0x11]
mov byte [ebp - 0x11], 0
xor cl, cl
call fcn.1002b0c1
jmp 0x1002c258
cmp byte [ebp + 8], 0
je 0x1002c248
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ecx
push eax
mov ecx, ebx
call fcn.1002c632
jmp 0x1002c258
mov byte [ebp + 0x13], 0
cmp byte [ebp + 0x13], 0
je 0x1002c258
call dword [sym.imp.KERNEL32.dll_GetTickCount]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x2ba
jge 0x1002c274
mov edx, str.wpbzivsx_zpkuuvfjb_msscik_oabgb_vdswwoc_bjezs_ufuqm_ufqjltnyj_qgprv_ydbgwhz_hevvxl
mov ecx, 0x1006f978
call fcn.1000365f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002c632
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x1002c649
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x1002c66b
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x10070d74
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x10071100
jl 0x1002c679
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x100713a4
jl 0x1002c6b9
mov ecx, dword [0x100720f0]
xor ecx, dword [0x10070d74]
and ecx, edi
xor ecx, dword [0x100720f0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x10070d70], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x100713a4]
mov dword [0x10071730], eax
pop esi
ret
Function at 0x1002c742
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10058766
call fcn.10057898
sub esp, 0x18
push ebx
push esi
mov dword [ebp - 0x24], 0x431
mov eax, ecx
cmp dword [ebp - 0x24], 0x698
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], eax
jle 0x1002c79f
push 0
call dword [sym.imp.ole32.dll_CoTaskMemFree]
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x18], 0x6c4f
mov eax, ebx
mov ecx, 0x1006f978
cdq
push edx
push eax
call fcn.10001ca8
add ebx, edi
dec dword [ebp - 0x18]
jne 0x1002c77d
inc edi
cmp edi, 0x5c3d
jl 0x1002c774
mov eax, dword [ebp - 0x20]
cmp byte [ebp + 0xc], 0
je 0x1002c7e5
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x1002c7b5
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0x3f8
jge 0x1002c7d4
mov edx, str.lkg_lbbtg_rrwiimlme_qwsjppz_pwfiywa_svroooiwl_ijsjmura
mov ecx, 0x1006f978
call fcn.1000365f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [eax], 0
je 0x1002c7b5
mov dword [ebp - 0x20], 0x3bc9
cmp dword [ebp - 0x20], 0x3d16
jle 0x1002c84b
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
xor eax, eax
mov dword [ebp - 0x1c], eax
xor eax, ecx
lea ecx, [ebx + edi]
or eax, ecx
mov ecx, 0x1006f978
cdq
push edx
push eax
call fcn.10001ca8
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x49d2
jl 0x1002c808
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x5436
jl 0x1002c803
inc ebx
cmp ebx, 0x2ed2
jl 0x1002c7fe
inc edi
cmp edi, 0x4ecb
jl 0x1002c7fc
call fcn.1002d33d
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x3937
jge 0x1002c7b5
mov edx, str.puhntqm_brcewg_tqfhpj_dji_gnhimossl_eazg_btkju_etmxw_uxxakoxjj_jrhafp_pxm_btobgaro
mov ecx, 0x1006f978
call fcn.1000365f
jmp 0x1002c7b5

Function at 0x1002c8c5
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10058770
call fcn.10057898
sub esp, 0x14
push ebx
push esi
mov dword [ebp - 0x1c], 0x548c
mov eax, ecx
cmp dword [ebp - 0x1c], 0x56cf
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], eax
jle 0x1002c948
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x14], edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov edi, edx
xor esi, esi
mov eax, esi
mov ecx, 0x1006f978
and eax, ebx
xor eax, edi
cdq
push edx
push eax
call fcn.10001ca8
inc esi
cmp esi, 0x506d
jl 0x1002c902
inc ebx
cmp ebx, 0x7d84
jl 0x1002c900
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0xef4
jl 0x1002c8f7
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x5be9
jl 0x1002c8f2
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp + 8]
mov edx, 0x23bd
push 0x630
push 1
push 0
push 0
push eax
call fcn.1002e8d2
and dword [ebp - 4], 0
add esp, 0x14
cmp dword [ebp - 0x1c], 0x516b
jge 0x1002c980
mov edx, str.nmk_idrsspexl_ztacsnfu_grjopom_dxyj_tgk_ejivrmoip_gucl_uqgwzm
mov ecx, 0x1006f978
call fcn.1000365f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002e7de
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov byte [esp + 0xc], dl
je 0x1002e80f
cmp byte [ebp + 0x18], 0
je 0x1002e804
mov eax, dword [ebp + 8]
dec dword [eax]
jmp 0x1002e8cb
mov dword [ecx], 8
jmp 0x1002e8cb
test dl, dl
je 0x1002e8b8
mov dword [esp + 0x14], 0x47b7
cmp dword [esp + 0x14], 0x4b16
jle 0x1002e880
xor esi, esi
mov ebx, esi
mov dword [esp + 0x10], 0x523b
xor edi, edi
mov ecx, edi
mov eax, ebx
sar eax, cl
lea ecx, [esp + 0x18]
cdq
push edx
push eax
call fcn.10001a21
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002e853
mov eax, dword [eax]
push eax
call fcn.1003f696
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.1000200c
inc edi
cmp edi, 0x3531
jl 0x1002e837
dec ebx
dec dword [esp + 0x10]
jne 0x1002e835
inc esi
cmp esi, 0x5de3
jl 0x1002e82b
mov esi, dword [ebp + 0x14]
mov ecx, esi
mov eax, dword [esi]
push dword [eax + 4]
call fcn.100340e0
mov eax, dword [esi]
mov dword [eax + 4], eax
mov eax, dword [esi]
mov dword [eax], eax
mov eax, dword [esi]
mov dword [eax + 8], eax
and dword [esi + 4], 0
cmp dword [esp + 0x14], 0x442a
jge 0x1002e8cb
push str.ilbnbsft_cowhd_arwb_wli_pwbq_qdrxclf_yzmyx_grajnnkmr
call fcn.1003f696
pop ecx
jmp 0x1002e8cb
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1002e8cb
push 0xbc1
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10030514
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10058843
call fcn.10057898
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x28], 0x1e13
mov edi, edx
cmp dword [ebp - 0x28], 0x21ed
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edi
jle 0x1003057d
xor esi, esi
xor ebx, ebx
lea eax, [ebx + esi]
cdq
lea ecx, [ebp - 0x4c]
push edx
push eax
call fcn.10001a21
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10030558
mov eax, dword [eax]
push eax
call fcn.1003f696
pop ecx
push 0
push 1
lea ecx, [ebp - 0x4c]
call fcn.1000200c
inc ebx
cmp ebx, 0x13d8
jl 0x10030540
inc esi
cmp esi, 0x3b5b
jl 0x1003053e
cmp byte [ebp + 0x14], 0
je 0x10030690
mov dword [ebp - 0x20], 0x4d72
cmp dword [ebp - 0x20], 0x4e7e
jle 0x100305f2
xor esi, esi
mov dword [ebp - 0x1c], esi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov ecx, ebx
mov dword [ebp - 0x2c], esi
xor edi, edi
shl esi, cl
xor ebx, ebx
mov eax, esi
mov ecx, 0x1006f978
xor eax, ebx
xor eax, edi
cdq
push edx
push eax
call fcn.10001ca8
inc ebx
cmp ebx, 0x7681
jl 0x100305ac
inc edi
cmp edi, 0x18d
jl 0x100305aa
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 0x18], ebx
cmp ebx, 0x1bd3
jl 0x100305a1
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x5a81
jl 0x1003059c
mov edi, dword [ebp - 0x24]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x4cf9
jge 0x1003062d
mov edx, str.aczdg_riy_scj_zth_fak_xbthmaah
mov ecx, 0x1006f978
call fcn.1000365f
jmp 0x1003062d
mov eax, dword [ebp + 8]
mov ecx, edi
or dword [ebp - 4], 0xffffffff
mov ebx, dword [ebp + 0x10]
push ebx
mov eax, dword [eax]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ebp - 0x1c], eax
lea eax, [ebp - 0x30]
push eax
call fcn.100340b0
mov esi, dword [ebp - 0x30]
cmp esi, dword [edi]
je 0x1003065e
mov eax, dword [ebx]
cmp eax, dword [esi + 0x10]
jge 0x10030682
push ecx
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], ebx
push eax
push ecx
mov ecx, edi
call fcn.1003428c
push eax
add eax, 0x10
mov ecx, edi
push eax
push esi
lea eax, [ebp - 0x34]
push eax
call fcn.100342bc
mov esi, dword [ebp - 0x34]
mov eax, dword [ebp - 0x20]
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0x1c]
mov dword [esi + 0x18], eax
jmp 0x100306b5
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0x100306b5
push 0x18dc
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolygon]
cmp dword [ebp - 0x28], 0x1bc5
jge 0x100306c9
push str.zwjre_lrye_kvsbdz_dar_wuvr_qcnj_zcwtx_ngrnpe_hyfnd_ukdfbaik
call fcn.1003f696
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret