joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100077d0
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100077fd
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
push 0x5fff
push 0x5abc
push dword [ebp - 8]
push 1
call fcn.1000786b
add esp, 0x10
jmp 0x10007867
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10007850
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1000784e
push 0
push 0x1713
push 0x8ce
push 0x123f
push 0x1b62
push 0x2627
push 0x29
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x10007867
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
push 0
push 0x205b
call fcn.10008175
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x10009d29
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005ea48
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], 0x5d9e
mov dword [ebp - 0x24], str.ehpkbhe_brwd_mypmohnj_cecuwglf_lesu_rzgzzkjm_xlk_icjvip_miswxks_aizqiyi_rhv
cmp dword [ebp - 0x20], 0x5ed2
jle 0x10009ded
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
and dword [ebp - 0x14], 0
jmp 0x10009d82
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x6ea3
jge 0x10009de0
and dword [ebp - 0x18], 0
jmp 0x10009d98
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x3269
jge 0x10009dde
and dword [ebp - 0x1c], 0
jmp 0x10009dae
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x6916
jge 0x10009ddc
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
shl eax, cl
cdq
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], edx
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
mov ecx, 0x1007acd8
call fcn.1000e15c
jmp 0x10009da7
jmp 0x10009d91
jmp 0x10009d7b
push 0x182d
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
push 0x39bc
push dword [ebp + 0xc]
push 0
push dword [ebp + 0x10]
push dword [ebp + 8]
push 0x7f03
push 0xc36
call fcn.1000a0b6
add esp, 0x1c
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x5d19
jge 0x10009e29
mov edx, dword [ebp - 0x24]
mov ecx, 0x1007acd8
call fcn.10010ea8
jmp 0x10009e45
or dword [ebp - 4], 0xffffffff
jmp 0x10009e4f
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10012402
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005eda4
call fcn.1005e378
sub esp, 0x40
cmp byte [ebp + 0x38], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edx
je 0x10012510
cmp byte [ebp + 0x10], 0
je 0x100124f7
mov dword [ebp - 0x14], 0x3604
xor esi, esi
cmp dword [ebp - 0x14], 0x36dd
jle 0x10012486
mov edi, esi
mov dword [ebp + 0x38], esi
mov ebx, esi
mov dword [ebp - 0x18], esi
mov ecx, ebx
mov esi, edi
mov edi, dword [ebp - 0x18]
sar esi, cl
mov eax, esi
mov ecx, 0x1007acd8
xor eax, edi
cdq
push edx
push eax
call fcn.1000e15c
inc edi
cmp edi, 0x1e66
jl 0x10012451
mov edi, dword [ebp + 0x38]
inc ebx
push 0
pop esi
cmp ebx, 0x44ea
jl 0x10012445
inc edi
mov dword [ebp + 0x38], edi
cmp edi, 0x611b
jl 0x10012443
mov dword [ebp - 4], esi
cmp dword [ebp - 0x14], 0x33bd
jge 0x100124a1
mov edx, str.rqfnllmw_fxr_tpgfbopoi_mnvixb_laavptxjp_cqbkzd_dktbbbto_ofg_kmxlge_ymwiyrt_wppw_tivvsbbf_sevwtozuy_olv
mov ecx, 0x1007acd8
call fcn.10010ea8
or dword [ebp - 4], 0xffffffff
mov eax, dword [ebp + 0x34]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x2c]
mov eax, dword [eax]
sub eax, ecx
push eax
push ecx
mov ecx, dword [ebp + 0x40]
lea eax, [ebp - 0x34]
push eax
call fcn.10016aaf
mov ecx, dword [ebp - 0x1c]
push eax
mov dword [ebp - 4], 2
call fcn.10016b62
push esi
lea ecx, [ebp - 0x34]
jmp 0x1001253b
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1001258a
sub esp, 0x24
call fcn.10012f75
add esp, 0x24
jmp 0x1001258a
cmp byte [ebp + 0xc], 0
je 0x10012544
mov eax, dword [ebp + 0x24]
push 0xffffffffffffffff
push dword [eax]
lea eax, [ebp - 0x4c]
push eax
call fcn.10016aaf
mov ecx, dword [ebp + 0x20]
push eax
mov dword [ebp - 4], 3
call fcn.10016b62
push 0
lea ecx, [ebp - 0x4c]
push 1
call fcn.1000edc9
jmp 0x1001258a
mov eax, dword [ebp + 0x18]
xor esi, esi
mov ecx, dword [ebp + 0x1c]
mov eax, dword [eax]
mov eax, dword [ecx]
mov eax, dword [ecx]
add eax, dword [ecx]
je 0x1001255b
cmp dword [ecx], esi
je 0x1001255b
inc esi
mov edx, dword [ebp + 0x3c]
push 6
pop eax
cmp eax, esi
sbb eax, eax
inc eax
imul eax, dword [ecx]
xor ecx, ecx
test eax, eax
mov eax, dword [ebp + 0x14]
setns cl
mov dword [edx], ecx
xor ecx, ecx
mov eax, dword [eax]
mov eax, dword [edx]
mov eax, dword [ebp + 0x28]
mov eax, dword [eax]
test eax, eax
mov eax, dword [ebp + 0x30]
setne cl
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100141f7
Capabilities:
Encode data using xor
Get session user name

Disassembly:
mov eax, 0x1005ef57
call fcn.1005e378
sub esp, 0x48
push ebx
push esi
mov dword [ebp - 0x1c], 0x28ba
cmp dword [ebp - 0x1c], 0x2b84
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edx
jle 0x10014280
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x18], 0x2155
xor edi, edi
mov ecx, edi
mov eax, ebx
shl eax, cl
lea ecx, [ebp - 0x38]
cdq
push edx
push eax
call fcn.10001a9f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10014245
mov eax, dword [eax]
push eax
call fcn.10046233
pop ecx
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.1000ebf5
inc edi
cmp edi, 0xb57
jl 0x1001422a
add ebx, esi
dec dword [ebp - 0x18]
jne 0x10014228
inc esi
cmp esi, 0x4b57
jl 0x1001421f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
cmp dword [ebp - 0x1c], 0x24de
jge 0x10014294
push str.zfrzhbt_zqn_cdbc_bkzo_jtccxf_mrnhu
call fcn.10046233
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x1c], 0
je 0x100142b3
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
mov eax, dword [ebp + 0x10]
sar ecx, 2
mov dword [eax], ecx
jmp 0x1001434d
mov dword [ebp - 0x1c], 0x4761
cmp dword [ebp - 0x1c], 0x4ae8
jle 0x10014301
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x1007acd8
and eax, edi
xor eax, esi
cdq
push edx
push eax
call fcn.1000e15c
inc ebx
cmp ebx, 0x424
jl 0x100142c9
inc edi
cmp edi, 0x184b
jl 0x100142c7
inc esi
cmp esi, 0x78b9
jl 0x100142c5
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x4633
jge 0x10014320
mov edx, str.akbqyfjfz_kzjgqau_ywz_rtcuqxr_jplrkprk_bmani
mov ecx, 0x1007acd8
call fcn.10010ea8
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
push 0x21
pop edx
call fcn.1003413e
push ecx
push ecx
mov ecx, dword [ebp - 0x20]
push eax
mov dword [ebp - 4], 4
call fcn.1001759d
push 0
push 1
lea ecx, [ebp - 0x50]
call fcn.1000edc9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100149e3
Capabilities:
Delete file

Disassembly:
mov eax, 0x1005ef95
call fcn.1005e378
sub esp, 0x30
push ebx
test dl, dl
je 0x10014a73
sub esp, 0x18
mov ecx, esp
push dword [ebp + 8]
call fcn.1000e271
lea ecx, [ebp - 0x20]
call fcn.10014007
add esp, 0x18
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword [ebp - 0x1c]
cmp dword [ebp - 0x20], eax
je 0x10014a6c
push dword [ebp - 0x14]
xor ecx, ecx
mov dword [ebp - 0x24], 7
push eax
push dword [ebp - 0x20]
mov word [ebp - 0x38], cx
lea ecx, [ebp - 0x38]
mov dword [ebp - 0x28], ebx
call fcn.10017894
mov ecx, dword [ebp + 0x10]
lea edx, [ebp - 0x38]
mov byte [ebp - 4], 1
call fcn.10014999
lea ecx, [ebp - 0x38]
push ebx
push 1
test eax, eax
jns 0x10014a67
mov eax, dword [ebp + 0x18]
mov byte [eax], 1
call fcn.1000edc9
lea ecx, [ebp - 0x20]
call fcn.100173c6
jmp 0x10014a7b
call fcn.1000edc9
mov eax, dword [ebp + 0x18]
mov byte [eax], bl
jmp 0x10014a5d
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10015427
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005f00f
call fcn.1005e378
sub esp, 0x18
push ebx
push esi
mov byte [ebp - 0x14], dl
mov eax, ecx
mov dword [ebp - 0x20], 0x4b71
xor esi, esi
cmp dword [ebp - 0x20], 0x4dd9
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], eax
jle 0x100154b3
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindNextFileW]
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x1c], esi
mov eax, esi
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
lea ecx, [eax + esi]
mov eax, ebx
sar eax, cl
mov ecx, 0x1007acd8
xor eax, edi
cdq
push edx
push eax
call fcn.1000e15c
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x6dde
jl 0x1001546b
inc esi
push 0
mov dword [ebp - 0x1c], esi
cmp esi, 0x4719
pop esi
jl 0x10015463
inc ebx
cmp ebx, 0x51ed
jl 0x10015460
inc edi
cmp edi, 0x7377
jl 0x1001545e
mov eax, dword [ebp - 0x24]
cmp byte [ebp - 0x14], 0
jne 0x100154bc
mov eax, dword [ebp + 8]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x20], 0x4806
mov dword [eax], esi
jge 0x100154d9
mov edx, str.cfj_vbxpg_efsj_mutnqkz_xqdb
mov ecx, 0x1007acd8
call fcn.10010ea8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10019ff3
Capabilities:
Get session user name

Disassembly:
mov eax, 0x1005f224
call fcn.1005e378
sub esp, 0x14
mov byte [ebp - 0x14], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x1001a03b
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1001a0ca
push 0
push 0x2112
push 0x3c57
push 1
xor dl, dl
mov ecx, 0x7644
call fcn.1001ab2d
add esp, 0x10
jmp 0x1001a0ca
mov dword [ebp - 0x1c], 0x1219
cmp dword [ebp - 0x1c], 0x1313
jle 0x1001a0a5
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov eax, esi
mov esi, 0x51c7
cdq
idiv edi
mov ebx, edx
mov eax, ebx
mov ecx, 0x1007acd8
cdq
push edx
push eax
call fcn.1000e15c
dec ebx
dec esi
jne 0x1001a068
mov esi, dword [ebp - 0x18]
inc edi
cmp edi, 0x3e1c
jl 0x1001a05c
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x2da8
jl 0x1001a05a
push 0x16b2
push 0x230c
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x105c
jge 0x1001a0c1
mov edx, str.bpsttyto_bxgjb_syod_hue_aggl_iqpw_etil_njgwbqxlt_slay_fzgnnb_jdopn_mytby_iocxf
mov ecx, 0x1007acd8
call fcn.10010ea8
mov eax, dword [ebp + 0xc]
push 0xb
pop ecx
mov word [eax], cx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001ad0f
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005f252
call fcn.1005e378
sub esp, 0x24
push ebx
push esi
mov dword [ebp - 0x24], 0x173d
mov ebx, ecx
cmp dword [ebp - 0x24], 0x19b4
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], ebx
jle 0x1001adac
xor esi, esi
mov dword [ebp - 0x20], esi
xor eax, eax
mov dword [ebp - 0x1c], 0x130
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x14]
xor ebx, ebx
mov dword [ebp - 0x18], ebx
and dword [ebp - 0x28], 0
mov eax, esi
cdq
idiv ebx
mov esi, dword [ebp - 0x28]
mov ebx, edx
mov eax, ebx
mov ecx, 0x1007acd8
xor eax, esi
cdq
push edx
push eax
call fcn.1000e15c
inc esi
cmp esi, 0x70e2
jl 0x1001ad5e
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
inc ebx
mov dword [ebp - 0x18], ebx
cmp ebx, 0x1f11
jl 0x1001ad50
mov esi, dword [ebp - 0x20]
add dword [ebp - 0x14], esi
dec dword [ebp - 0x1c]
jne 0x1001ad48
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x7f4
jl 0x1001ad3c
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ebx, dword [ebp - 0x2c]
cmp byte [ebp + 0x10], 0
je 0x1001ae0f
mov esi, dword [ebp + 0x2c]
mov edx, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x18]
mov eax, dword [esi]
mov eax, dword [ebp + 0x34]
mov eax, dword [eax]
mov eax, dword [esi]
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax]
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [ecx]
mov eax, dword [edx]
mov eax, dword [ebx]
mov eax, dword [ebp + 0x24]
mov dword [eax], 0xfffffffa
mov dword [edx], 1
mov ecx, dword [edx]
xor edx, edx
mov eax, dword [esi]
cmp ecx, eax
mov eax, dword [ebp + 0x14]
setle dl
lea ecx, [edx*4 + 1]
mov dword [eax], ecx
xor ecx, ecx
mov eax, dword [esi]
cmp eax, 0xe094bf7d
mov eax, dword [ebp + 0xc]
setne cl
mov dword [eax], ecx
jmp 0x1001aeb0
mov dword [ebp - 0x1c], 0x35e3
cmp dword [ebp - 0x1c], 0x3927
jle 0x1001ae71
xor esi, esi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov dword [ebp - 0x20], ecx
add ecx, eax
mov eax, ebx
sar eax, cl
mov ecx, 0x1007acd8
and eax, esi
cdq
push edx
push eax
call fcn.1000e15c
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
inc ecx
mov dword [ebp - 0x20], ecx
cmp ecx, 0x3e08
jl 0x1001ae2d
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x582b
jl 0x1001ae28
inc ebx
cmp ebx, 0x2007
jl 0x1001ae23
inc esi
cmp esi, 0x4c1d
jl 0x1001ae21
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x3481
jge 0x1001ae8d
mov edx, str.lvog_wauwxwmj_laotglvcn_gtvv_kjeke_tiahraaj_vumjy_nfq_mfcvkvle_dhrr_qcvhqyt
mov ecx, 0x1007acd8
call fcn.10010ea8
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x1001aeb0
mov esi, dword [ebp + 0x38]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x3629aa8
inc dword [edx]
cmp dword [edx], 1
jl 0x1001ae9e
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0x16a7
jge 0x1001aecf
mov edx, str.cagsxmm_vpu_femmd_xck_urtgqkei_alowjtxbo_xrlcg_krnojqm_zshbdmar_muwfjeyn_nzmx_qwiarmxci_igtopklo
mov ecx, 0x1007acd8
call fcn.10010ea8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001d8ba
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
mov dword [esp + 0xc], 0x3934
mov eax, edx
cmp dword [esp + 0xc], 0x3958
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
jle 0x1001d94c
xor edi, edi
xor esi, esi
xor ebx, ebx
mov dword [esp + 0x10], 0x4aac
mov eax, ebx
lea ecx, [esp + 0x20]
or eax, edi
cdq
push edx
push eax
call fcn.10001a9f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001d90c
mov eax, dword [eax]
push eax
call fcn.10046233
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.1000ebf5
add ebx, esi
dec dword [esp + 0x10]
jne 0x1001d8f2
inc esi
cmp esi, 0x51dd
jl 0x1001d8e8
inc edi
cmp edi, 0x3e60
jl 0x1001d8e6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
cmp eax, 0x13823798
jae 0x1001d95d
sub dword [0x10077af8], 0x23a0be45
cmp dword [esp + 0x14], 0x37c4
jge 0x1001d972
push str.fokyyrfk_guc_zvshqjkt
call fcn.10046233
pop ecx
mov eax, dword [0x10a05708]
test al, 1
jne 0x1001d98f
or eax, 1
mov dword [0x10a05708], eax
call fcn.1003309f
mov dword [0x10a056f4], eax
jmp 0x1001d994
mov eax, dword [0x10a056f4]
mov eax, dword fs:[eax]
pop edi
pop esi
mov dword [ebx], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003481b
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005fa40
call fcn.1005e378
sub esp, 0x20
push ebx
push esi
mov byte [ebp - 0x14], cl
mov dword [ebp - 0x1c], 0x7d61
cmp dword [ebp - 0x1c], 0x800c
push edi
mov dword [ebp - 0x10], esp
jle 0x1003487e
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov eax, ebx
sar eax, cl
mov ecx, 0x1007acd8
and eax, edi
cdq
push edx
push eax
call fcn.1000e15c
mov ecx, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x2a53
jl 0x1003484a
inc ebx
cmp ebx, 0x6556
jl 0x10034845
inc edi
cmp edi, 0x3ba
jl 0x10034843
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x7c72
jge 0x1003489a
mov edx, str.kkbczutpe_vunnqg_moc_hgxffcuxy_jly_szlvemf_yjcmgv_mced_unndleqay_qsaupx_vicdeu
mov ecx, 0x1007acd8
call fcn.10010ea8
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x14], 0
je 0x1003496f
mov dword [ebp - 0x28], 0x719a
cmp dword [ebp - 0x28], 0x72ad
jle 0x10034915
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x24], edi
xor eax, eax
mov dword [ebp - 0x20], 0x72a7
mov dword [ebp - 0x18], eax
mov edi, dword [ebp - 0x18]
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov eax, edi
and eax, ecx
mov ecx, 0x1007acd8
xor eax, ebx
cdq
push edx
push eax
call fcn.1000e15c
mov ecx, dword [ebp - 0x1c]
inc ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0xd25
jl 0x100348d3
mov edi, dword [ebp - 0x24]
add dword [ebp - 0x18], edi
dec dword [ebp - 0x20]
jne 0x100348cb
inc edi
mov dword [ebp - 0x24], edi
cmp edi, 0x4294
jl 0x100348bf
inc ebx
cmp ebx, 0x4878
jl 0x100348ba
mov eax, dword [ebp + 0x14]
inc dword [eax]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x28], 0x713b
jge 0x10034939
mov edx, str.wckatalkm_frtkqmi_dmlw_xvdka_kbdlqt_hihwdzq
mov ecx, 0x1007acd8
call fcn.10010ea8
jmp 0x1003497c
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1003497c
call fcn.10034f1c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003498d
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005fa4a
call fcn.1005e378
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 0x14], 0x3d66
mov ebx, ecx
cmp dword [ebp - 0x14], 0x3f7c
push edi
mov dword [ebp - 0x10], esp
jle 0x100349d8
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x1007acd8
xor eax, esi
cdq
push edx
push eax
call fcn.1000e15c
inc edi
cmp edi, 0x483
jl 0x100349b5
inc esi
cmp esi, 0x2edd
jl 0x100349b3
push 0x7f0c
push ebx
push 0x3b3b
push dword [ebp + 0xc]
mov edx, 0x59f3
mov ecx, 0x53dd
push dword [ebp + 8]
push 0
push 0
push 1
push dword [ebp + 0x10]
call fcn.100360f3
and dword [ebp - 4], 0
add esp, 0x24
cmp dword [ebp - 0x14], 0x3a29
jge 0x10034a20
mov edx, str.bvxahp_jjkgr_qksmzrm_nyeiisrdx_kodetzkzw_nmgwtlokk_okevvanje
mov ecx, 0x1007acd8
call fcn.10010ea8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10034a60
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
cmp byte [ebp + 8], 0
push esi
je 0x10034a9d
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10034ac7
push 0
push 0x1713
push 0x8ce
push 0x123f
push 0x1b62
push 0x2627
push 0x29
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x10034ac7
mov esi, dword [ebp + 0x1c]
mov dword [esi], 0
jmp 0x10034ac2
push 0x42fa
push 0x134d
push 1
mov dl, 1
xor cl, cl
call fcn.10033930
add esp, 0xc
inc dword [esi]
cmp dword [esi], 1
jle 0x10034aa8
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003565b
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005fa9f
call fcn.1005e378
sub esp, 0x1c
push ebx
push esi
mov dword [ebp - 0x1c], 0x330
mov eax, edx
cmp dword [ebp - 0x1c], 0x444
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
jle 0x100356db
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov eax, esi
mov dword [ebp - 0x14], 0x5c24
cdq
idiv edi
mov ebx, edx
xor esi, esi
mov eax, ebx
mov ecx, 0x1007acd8
xor eax, esi
cdq
push edx
push eax
call fcn.1000e15c
inc esi
cmp esi, 0x13a2
jl 0x1003569d
inc ebx
dec dword [ebp - 0x14]
jne 0x1003569b
mov esi, dword [ebp - 0x18]
inc edi
cmp edi, 0x5eb2
jl 0x1003568d
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x14cd
jl 0x1003568b
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x24]
push dword [ebp + 8]
mov edx, eax
push dword [ebp + 0x18]
push ecx
push dword [ebp + 0xc]
push ecx
push dword [ebp + 0x10]
mov cl, byte [ebp + 0x14]
call fcn.1003573a
and dword [ebp - 4], 0
add esp, 0x18
cmp dword [ebp - 0x1c], 0x35
jge 0x1003570f
mov edx, str.out_wqzpnxqd_fwpuzgd_jbtwnu_vtjyc
mov ecx, 0x1007acd8
call fcn.10010ea8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10036613
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov dword [0x10a05724], ecx
inc edx
mov esi, 0x270
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
mov dword [edx*4 + 0x10a05724], ecx
inc edx
cmp edx, esi
jl 0x10036628
mov dword [0x10a05720], esi
pop esi
pop ebp
ret 8

Function at 0x1003664e
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x10a05724
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x10a05ab0
jl 0x1003665c
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x10a05d54
jl 0x1003669c
mov ecx, dword [0x10a06aa0]
xor ecx, dword [0x10a05724]
and ecx, edi
xor ecx, dword [0x10a06aa0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x10a05720], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10a05d54]
mov dword [0x10a060e0], eax
pop esi
ret
Function at 0x10037bab
Capabilities:
Clear file content
Encode data using xor

Disassembly:
mov eax, 0x1005fbb1
call fcn.1005e378
sub esp, 0x10
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x10037bdd
push 0
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov edx, dword [ebp + 0xc]
xor esi, esi
mov dword [edx], esi
cmp dword [edx], 0xfffffffe
jl 0x10037c4b
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x14], 0xdfb
mov dword [ebp - 0x18], 0xe469209a
mov dword [ebp - 0x1c], 1
mov eax, dword [edi]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x14]
je 0x10037c1b
cmp dword [ebp - 0x14], esi
je 0x10037c1b
xor eax, eax
inc eax
jmp 0x10037c1d
mov eax, esi
push 6
pop ecx
cmp ecx, eax
sbb ecx, ecx
xor eax, eax
inc ecx
imul ecx, dword [ebp - 0x14]
test ecx, ecx
setns al
xor ecx, ecx
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x18]
mov eax, dword [edx]
test eax, eax
setne cl
mov dword [ebx], ecx
dec dword [edx]
cmp dword [edx], 0xfffffffe
jge 0x10037bef
mov dword [ebp - 0x14], 0x14c3
cmp dword [ebp - 0x14], 0x182e
jle 0x10037c9d
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x18], 0xb46
mov dword [ebp - 0x1c], esi
mov eax, ebx
mov ecx, 0x1007acd8
xor eax, esi
cdq
push edx
push eax
call fcn.1000e15c
inc esi
cmp esi, 0x647a
jl 0x10037c69
add ebx, edi
dec dword [ebp - 0x18]
push 0
pop esi
jne 0x10037c66
inc edi
cmp edi, 0x7601
jl 0x10037c5d
push esi
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x14], 0x13d6
jge 0x10037bcc
mov edx, str.gglplnagi_gedbgkn_kvw_izfoyq_extdxk_brqxbpvdp_nefohpy_hptlveeq_nliq_dthjwgvw_osrr
mov ecx, 0x1007acd8
call fcn.10010ea8
jmp 0x10037bcc