joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100089af
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100528ce
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10008b16
lea eax, [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], 0x1857
mov dword [ebp - 0x3c], str.psrhay_hhedwc_nqfdlmms_btwq_gwc_fvb_vrbirbdw_vifhwbjq_bpdbtm_jeu_hny_gqtm_hwyiz_rmzwf
cmp dword [ebp - 0x24], 0x1a89
jle 0x10008a8e
and dword [ebp - 0x18], 0
jmp 0x10008a11
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x22d0
jge 0x10008a8e
and dword [ebp - 0x1c], 0
jmp 0x10008a27
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x71f9
jge 0x10008a89
and dword [ebp - 0x20], 0
jmp 0x10008a3d
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x34b2
jge 0x10008a87
mov eax, dword [ebp - 0x18]
cdq
idiv dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
sar edx, cl
mov eax, edx
cdq
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
push dword [ebp - 0x40]
push dword [ebp - 0x44]
lea ecx, [ebp - 0x5c]
call fcn.10003c04
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
call fcn.10001c55
push eax
call fcn.1003a280
pop ecx
lea ecx, [ebp - 0x5c]
call fcn.10001c4b
jmp 0x10008a36
jmp 0x10008a20
jmp 0x10008a0a
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10008abf
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x10008abd
push 0x20fc
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
jmp 0x10008ad8
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x10008ad8
push 0xeb4
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x1693
jge 0x10008aee
push dword [ebp - 0x3c]
call fcn.1003a280
pop ecx
jmp 0x10008b0a
or dword [ebp - 4], 0xffffffff
jmp 0x10008b14
jmp 0x10008b24
push 0
push 0x949
call fcn.100093d6
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000b2d8
Capabilities:
Create process on windows
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1000b30d
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1000b2fe
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x1000b30b
push 0xeb4
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x1000b330
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push 0
push dword [ebp - 8]
push 0x4be2
mov eax, dword [ebp - 0xc]
push dword [eax]
call fcn.1000bd01
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1000b9ca
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005299b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1000bb26
mov dword [ebp - 0x24], 0x7f0d
mov dword [ebp - 0x30], str.qjgbpsih_exk_gnwlhm
cmp dword [ebp - 0x24], 0x8139
jle 0x1000ba98
and dword [ebp - 0x14], 0
jmp 0x1000ba20
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xea4
jge 0x1000ba98
and dword [ebp - 0x18], 0
jmp 0x1000ba36
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x63a3
jge 0x1000ba96
and dword [ebp - 0x1c], 0
jmp 0x1000ba4c
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x62b2
jge 0x1000ba94
and dword [ebp - 0x20], 0
jmp 0x1000ba62
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x798d
jge 0x1000ba92
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sar eax, cl
or eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
mov ecx, 0x1006a318
call fcn.10001c75
jmp 0x1000ba5b
jmp 0x1000ba45
jmp 0x1000ba2f
jmp 0x1000ba19
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x40], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x7d47
jge 0x1000bab8
mov edx, dword [ebp - 0x30]
mov ecx, 0x1006a318
call fcn.10003644
jmp 0x1000bad4
or dword [ebp - 4], 0xffffffff
jmp 0x1000bade
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x1000bb0d
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x28]
mov dword [ecx], eax
jmp 0x1000bb24
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x2c]
mov dword [ecx], eax
jmp 0x1000bb5a
lea eax, [ebp + 8]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x1000bb45
push 0x10a2
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x1000bb5a
push 0
push 0
push 0x25f5
push 0
push 1
push 0
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000bb6b
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100529a5
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], 0x305
mov dword [ebp - 0x3c], str.ohi_vjopkoz_uddllpsxh_tkykn_maopr_hmvauyq_pticjeljz_fnpswaj_ahufc
cmp dword [ebp - 0x24], 0x661
jle 0x1000bc37
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetMenu]
and dword [ebp - 0x14], 0
jmp 0x1000bbc2
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x2fc7
jge 0x1000bc37
and dword [ebp - 0x18], 0
jmp 0x1000bbd8
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x7880
jge 0x1000bc35
and dword [ebp - 0x1c], 0
jmp 0x1000bbee
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3159
jge 0x1000bc33
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x18]
xor eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
push dword [ebp - 0x40]
push dword [ebp - 0x44]
lea ecx, [ebp - 0x5c]
call fcn.10003c04
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
call fcn.10001c55
push eax
call fcn.1003a280
pop ecx
lea ecx, [ebp - 0x5c]
call fcn.10001c4b
jmp 0x1000bbe7
jmp 0x1000bbd1
jmp 0x1000bbbb
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1000bc5e
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
push 1
push 0x7df6
push dword [ebp - 0x2c]
push 0x2eb4
call fcn.1000bd01
add esp, 0x10
jmp 0x1000bcb7
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x1000bc83
push 0x194a
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x1000bcb7
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [eax], 0
jmp 0x1000bca5
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
mov eax, dword [ebp - 0x20]
cmp dword [eax], 3
jg 0x1000bcb7
push 0
call fcn.1000c0f4
pop ecx
jmp 0x1000bc9a
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0xffffffe5
jge 0x1000bcca
push dword [ebp - 0x3c]
call fcn.1003a280
pop ecx
jmp 0x1000bce6
or dword [ebp - 4], 0xffffffff
jmp 0x1000bcf0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000bf5e
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1000bfb4
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1000bf92
push 0
push 0
push 0
push 0
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
jmp 0x1000bfb2
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1000bfb2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FileTimeToSystemTime]
jmp 0x1000c000
lea eax, [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1000bff8
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1000bff6
push 1
push 0
push 0x12e3
push 0x5c31
call fcn.1000bb6b
add esp, 0x10
jmp 0x1000c000
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov esp, ebp
pop ebp
ret
Function at 0x1000c3d2
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100529c1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1000c495
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1000c479
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x1000c450
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 2
jg 0x1000c477
mov dword [ebp - 0x58], 0x11accbad
push 0x5557
push 1
push 1
push dword [ebp - 0x3c]
push 1
call fcn.1000b9ca
add esp, 0x14
jmp 0x1000c445
jmp 0x1000c490
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
jmp 0x1000c570
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x24], 0x641c
mov dword [ebp - 0x48], str.clpcn_gocjkx_rusaedve_adegaesla_bzaaeszhu_nha_ptn_giynjifo_ujcpxwvuw_ukknqxm_lfcvxomeh_fjvnrdjob
cmp dword [ebp - 0x24], 0x6446
jle 0x1000c50d
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
and dword [ebp - 0x18], 0
jmp 0x1000c4cd
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x316b
jge 0x1000c50d
and dword [ebp - 0x1c], 0
jmp 0x1000c4e3
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xc62
jge 0x1000c50b
mov eax, dword [ebp - 0x18]
and eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], edx
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
mov ecx, 0x1006a318
call fcn.10001c75
jmp 0x1000c4dc
jmp 0x1000c4c6
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x50], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x6215
jge 0x1000c52d
mov edx, dword [ebp - 0x48]
mov ecx, 0x1006a318
call fcn.10003644
jmp 0x1000c549
or dword [ebp - 4], 0xffffffff
jmp 0x1000c553
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push 0x773f
push 0x5765
push 1
call fcn.10007f10
add esp, 0x18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10023ce0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 8], cl
test cl, cl
je 0x10023cfc
push 0xeb4
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x10023d0b
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x10023d0b
call fcn.100252df
mov esp, ebp
pop ebp
ret

Function at 0x10024327
Capabilities:
Accept command line arguments
Encode data using xor
Query environment variable

Disassembly:
mov eax, 0x10052e3c
call fcn.10052218
sub esp, 0x14
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ebx
mov byte [ebp - 0x14], cl
je 0x1002436c
cmp byte [ebp + 0x10], 0
je 0x10024358
mov eax, dword [ebp + 8]
inc dword [eax]
jmp 0x10024411
push 0x163e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x10024411
mov dword [ebp - 0x18], 0x29b
cmp dword [ebp - 0x18], 0x3b8
jle 0x100243c0
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
xor edi, edi
xor esi, esi
mov dword [ebp + 0x14], esi
mov ebx, esi
mov esi, 0x7254
mov eax, ebx
mov ecx, 0x1006a318
xor eax, edi
cdq
push edx
push eax
call fcn.10001c75
dec ebx
dec esi
jne 0x10024390
mov esi, dword [ebp + 0x14]
inc esi
mov dword [ebp + 0x14], esi
cmp esi, 0x12aa
jl 0x10024389
inc edi
cmp edi, 0x7cad
jl 0x10024384
mov ebx, dword [ebp - 0x1c]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x280
jge 0x100243fb
mov edx, str.hpmycisos_ziiiilnrz_lbhptcspo_enr_tveahnf_vyvqhiq_ntzfklxx_wfwfjsgg_mnrba_oku_jwlug_yrfzapru_wuofkiu
mov ecx, 0x1006a318
call fcn.10003644
jmp 0x100243fb
cmp byte [ebp - 0x14], 0
je 0x1002440c
mov eax, dword [ebp + 0xc]
mov dword [eax], 0xc58fb770
jmp 0x10024411
mov eax, dword [ebp + 0x18]
mov dword [eax], ebx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002465d
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x18], 0
je 0x100246ab
xor ecx, ecx
push esi
mov esi, dword [ebp + 8]
mov eax, dword [esi]
cmp eax, 0xffff
mov eax, dword [esi]
setne cl
xor edx, edx
cmp ecx, 1
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp + 0x1c]
mov edx, dword [ebp + 0x10]
setg cl
mov dword [eax], ecx
mov ecx, dword [edx]
mov eax, dword [edx]
sub ecx, eax
cmp dword [esi], ecx
jne 0x1002469b
mov eax, dword [edx]
mov eax, dword [esi]
imul ecx, dword [esi], 0xffff
mov eax, dword [ebp + 0x14]
pop esi
mov dword [eax], ecx
pop ebp
ret
push 0x10a2
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
pop ebp
ret
Function at 0x100252fa
Capabilities:
Create directory
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov byte [ebp - 0xc], dl
push ebx
push esi
push edi
test cl, cl
je 0x100253c1
cmp byte [ebp + 8], 0
je 0x100253b5
mov dword [ebp - 0x10], 0x5314
cmp dword [ebp - 0x10], 0x559d
jle 0x10025378
xor esi, esi
xor edi, edi
xor ebx, ebx
mov ecx, ebx
lea eax, [edi + esi]
sar eax, cl
lea ecx, [ebp - 0x28]
cdq
push edx
push eax
call fcn.10003c04
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002534a
mov eax, dword [eax]
push eax
call fcn.1003a280
pop ecx
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.10002056
inc ebx
cmp ebx, 0x6e71
jl 0x1002532e
inc edi
cmp edi, 0x7dc9
jl 0x1002532c
inc esi
cmp esi, 0x222b
jl 0x1002532a
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1002539f
push 0x4af2
push 0
push 0x7bcf
push 0x2f4c
push ecx
push 0x36bb
call fcn.1002465d
add esp, 0x18
cmp dword [ebp - 0x10], 0x5264
jge 0x10025406
push str.nidi_ifcwbwimr_vjpv_cdisp_aftow_qnyzyesmk_bljqrym_aol
call fcn.1003a280
pop ecx
jmp 0x10025406
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x10025406
test dl, dl
je 0x100253d9
mov byte [ebp - 5], 0
cmp byte [ebp - 5], 0
je 0x10025406
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x10025406
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10025406
push 0xa26
push 0
push 0x940
push 0x1107
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10025bac
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0x10], 0
je 0x10025bd5
cmp byte [edx], 0
je 0x10025be4
push 1
push 1
push 0
mov edx, 0x53fd
mov ecx, 0x14cf
call fcn.1002540d
add esp, 0xc
jmp 0x10025be4
push 0x163e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
pop ecx
pop ebp
ret

Function at 0x10025e1c
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
test dl, dl
je 0x10025e3d
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10025e47
xor eax, eax
push eax
push 0xb28
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
pop ebp
ret
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_EnumWindows]
pop ebp
ret
Function at 0x1002a053
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [ebp + 0x14], 0
push esi
mov esi, ecx
je 0x1002a087
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1002a0ad
push 0xc2d
push ecx
push ecx
push 0x7162
push ecx
mov dl, 1
mov ecx, 0x1bb9
call fcn.10029f5a
add esp, 0x14
jmp 0x1002a0ad
mov dword [esi], 0xfffffffe
jmp 0x1002a0a8
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x1002a0a6
push 0xeb4
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
inc dword [esi]
cmp dword [esi], 0x10
je 0x1002a08f
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1002ac68
Capabilities:
Get disk information

Disassembly:
mov eax, 0x10052f70
call fcn.10052218
sub esp, 0x28
push ebx
push esi
mov byte [ebp - 0x14], cl
xor ebx, ebx
mov dword [ebp - 0x30], 0x7fd9
cmp dword [ebp - 0x30], 0x82fe
push edi
mov dword [ebp - 0x10], esp
jle 0x1002acf5
mov dword [ebp - 0x1c], ebx
mov edi, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov ebx, dword [ebp - 0x1c]
mov eax, edi
mov dword [ebp - 0x24], 0x37c9
mov edi, dword [ebp - 0x28]
mov dword [ebp - 0x20], eax
and eax, ebx
mov ecx, 0x1006a318
cdq
push edx
push eax
call fcn.10001c75
mov eax, dword [ebp - 0x20]
add eax, edi
dec dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
jne 0x1002acad
inc edi
mov dword [ebp - 0x28], edi
cmp edi, 0x2dd3
mov edi, dword [ebp - 0x2c]
jl 0x1002ac9e
inc edi
mov dword [ebp - 0x2c], edi
push 0
pop ebx
cmp edi, 0x44c3
jl 0x1002ac98
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x2064
jl 0x1002ac93
cmp byte [ebp - 0x14], 0
je 0x1002ad4a
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1002ad1a
push ebx
push ebx
push 0x7b1c
mov dl, 1
mov ecx, 0x1a2a
call fcn.1002be06
add esp, 0xc
mov dword [ebp - 4], 2
cmp dword [ebp - 0x30], 0x7f8a
jge 0x1002ad39
mov edx, str.limpbuqba_royj_coyflaza_izd_hikssq_jllqeyz
mov ecx, 0x1006a318
call fcn.10003644
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], 0x7fd1
cmp dword [ebp - 0x1c], 0x830a
jle 0x1002adc4
mov edi, ebx
mov dword [ebp - 0x20], ebx
mov eax, ebx
mov dword [ebp - 0x24], ebx
mov ecx, eax
mov dword [ebp - 0x2c], edi
mov dword [ebp - 0x28], ebx
shl edi, cl
mov ecx, ebx
mov ebx, dword [ebp - 0x28]
mov dword [ebp - 0x2c], ecx
mov eax, ebx
sar eax, cl
mov ecx, 0x1006a318
or eax, edi
cdq
push edx
push eax
call fcn.10001c75
mov ecx, dword [ebp - 0x2c]
inc ecx
mov dword [ebp - 0x2c], ecx
cmp ecx, 0x6ddd
jl 0x1002ad76
inc ebx
push 0
mov dword [ebp - 0x28], ebx
cmp ebx, 0x3c95
pop ebx
jl 0x1002ad6e
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x3e13
jl 0x1002ad64
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x2c02
jl 0x1002ad5f
push ebx
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1c], 0x7da3
jge 0x1002ad1a
mov edx, str.kwrh_vhxxlj_zzb_kbuw_wfjxfqhl_ijznui_trlp_kxgyh_trx_apwblrent_gek_ctp
mov ecx, 0x1006a318
call fcn.10003644
jmp 0x1002ad1a
Function at 0x1002b120
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov ebx, ecx
push esi
push edi
test dl, dl
je 0x1002b16b
cmp byte [ebp + 0x10], 0
je 0x1002b15f
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 8]
mov eax, dword [edi + 4]
sub eax, dword [edi]
sar eax, 2
mov dword [esi], eax
jmp 0x1002b159
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
mov ecx, edi
call fcn.1002dc3e
inc dword [esi]
mov eax, dword [esi]
cmp eax, dword [ebx]
jl 0x1002b146
jmp 0x1002b19e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x1002b19e
cmp byte [ebp + 0xc], 0
je 0x1002b18a
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0x1002b19e
push 0x20fc
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_OpenSCManagerW]
jmp 0x1002b19e
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x1002b19e
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002e69e
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
test cl, cl
je 0x1002e6b1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
pop ebp
ret
mov eax, dword [ebp + 0xc]
add dword [eax], 0x18
pop ebp
ret

Function at 0x1002f08c
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
cmp byte [ebp + 8], 0
push esi
je 0x1002f0af
cmp byte [ecx], 0
je 0x1002f1ac
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x1002f1ac
mov dword [ebp - 0xc], 7
xor edx, edx
mov dword [ebp - 0x14], edx
xor esi, esi
mov dword [ebp - 0x1c], 0xa6edad94
inc esi
mov dword [ebp - 0x20], 6
mov dword [ebp - 0x20], 0xfffffff8
push 0xfffffffffffffffa
pop ecx
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x18], 0x98b9
mov dword [ebp - 0x10], esi
mov dword [ebp - 8], 0xcc321a07
mov dword [ebp - 4], edx
jmp 0x1002f0fc
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x28], ecx
inc dword [ebp - 4]
cmp dword [ebp - 4], 2
jl 0x1002f0f2
mov dword [ebp - 4], edx
jmp 0x1002f115
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x34], 0xc842f88d
inc dword [ebp - 4]
cmp dword [ebp - 4], 3
jl 0x1002f107
mov eax, dword [ebp - 0x10]
mov eax, dword [ebp - 0x34]
inc dword [ebp - 8]
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x10]
sub ecx, eax
mov eax, dword [ebp - 0x14]
imul eax, ecx
xor ecx, ecx
cmp eax, 0xa9a1
setne cl
sub ecx, 0xb29d
neg ecx
sbb ecx, ecx
add ecx, 0xfffffffb
cmp esi, ecx
sbb ecx, ecx
inc ecx
imul ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
neg ecx
sbb ecx, ecx
neg ecx
sub ecx, eax
mov eax, 0xb5c74600
imul ecx, dword [ebp - 0xc]
cmp eax, ecx
sbb eax, eax
neg eax
cmp eax, 0x439fcb6e
je 0x1002f17a
mov eax, esi
cmp dword [ebp - 0x34], edx
jne 0x1002f17c
mov eax, edx
cmp dword [ebp - 0x24], eax
jne 0x1002f188
cmp dword [ebp - 0x1c], edx
je 0x1002f188
mov edx, esi
mov eax, dword [ebp - 0x20]
xor ecx, ecx
cmp edx, esi
setle cl
add eax, 0xc64e
add eax, ecx
je 0x1002f19e
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 0xc]
sub eax, 0xfffffff6
neg eax
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
pop esi
mov esp, ebp
pop ebp
ret