joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10005a6e
Capabilities:
Encode data using xor
Set registry value

Disassembly:
mov eax, 0x1005e058
call fcn.1005db30
sub esp, 0x28
mov byte [ebp - 0x10], cl
push ebx
push esi
push edi
test cl, cl
je 0x10005b49
mov dword [ebp - 0x18], 0x293b
cmp dword [ebp - 0x18], 0x2b77
push 0
pop esi
jle 0x10005ad7
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x14], 0x750b
mov dword [ebp - 0x1c], esi
mov eax, ebx
mov ecx, 0x10075b78
xor eax, esi
cdq
push edx
push eax
call fcn.1000c233
inc esi
cmp esi, 0x66a
jl 0x10005aaa
add ebx, edi
dec dword [ebp - 0x14]
push 0
pop esi
jne 0x10005aa7
inc edi
cmp edi, 0x148c
jl 0x10005a9e
push 1
lea ecx, [ebp - 0x34]
call fcn.1000c44b
lea eax, [ebp - 0x28]
mov dword [ebp - 4], esi
push eax
push esi
mov dword [ebp - 0x20], 0x81c2900
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x24], 0xfffffffb
mov edx, 0x3808
push 1
call fcn.10003b4f
add esp, 0xc
lea eax, [ebp - 0x34]
xor dl, dl
lea ecx, [ebp - 0x24]
push eax
lea eax, [ebp - 0x20]
push 0x3a0d
push eax
call fcn.1000608d
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
add esp, 0xc
call fcn.1000c4ce
cmp dword [ebp - 0x18], 0x257b
jge 0x10005b57
mov edx, str.dgehxd_yhilkl_axgpk_pcmx_kogw_biu_mave
mov ecx, 0x10075b78
call fcn.1000e4aa
jmp 0x10005b57
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10006419
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [ebp + 0x24], 0
je 0x1000643d
push ecx
push ecx
push 1
sub esp, 0xc
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
call fcn.100033e6
add esp, 0x1c
jmp 0x1000644f
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0x1000644f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
mov esp, ebp
pop ebp
ret
Function at 0x100074aa
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
push ebx
mov dword [ebp - 0x14], 0x5bde
cmp dword [ebp - 0x14], 0x5edf
push esi
push edi
mov dword [ebp - 0x18], ecx
jle 0x1000753a
xor esi, esi
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [ebp - 0xc], 0x7f4f
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
xor edi, edi
xor ebx, ebx
mov eax, edi
cdq
idiv ebx
mov eax, esi
mov ecx, edx
shl eax, cl
lea ecx, [ebp - 0x30]
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100074fe
mov eax, dword [eax]
push eax
call fcn.10048abc
pop ecx
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.1000c80a
inc ebx
cmp ebx, 0x5b4f
jl 0x100074de
inc edi
cmp edi, 0x1603
jl 0x100074dc
mov esi, dword [ebp - 0x10]
add dword [ebp - 8], esi
dec dword [ebp - 0xc]
jne 0x100074d7
inc esi
mov dword [ebp - 0x10], esi
cmp esi, 0x3f6e
jl 0x100074cb
cmp byte [ebp + 0x10], 0
je 0x100075d8
mov dword [ebp - 0x10], 0x43ae
cmp dword [ebp - 0x10], 0x445a
jle 0x100075b1
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_DefWindowProcA]
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
lea ecx, [ebp - 0x48]
and eax, edi
or eax, esi
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10007583
mov eax, dword [eax]
push eax
call fcn.10048abc
pop ecx
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.1000c80a
inc ebx
cmp ebx, 0x474d
jl 0x10007568
inc edi
cmp edi, 0x6cef
jl 0x10007566
inc esi
cmp esi, 0x67f0
jl 0x10007564
cmp dword [ebp - 0x10], 0x418c
jge 0x100075c5
push str.eura_aipnbxpe_wcxkg_mvsn_jhmlvlms_cdodv_csp
call fcn.10048abc
pop ecx
mov eax, dword [ebp + 0x14]
mov ecx, 0x86cce57b
mov eax, dword [eax]
mov dword [eax], ecx
mov eax, dword [ebp - 0x18]
mov dword [eax], ecx
jmp 0x10007644
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x10007644
mov dword [ebp - 0x10], 0x360
cmp dword [ebp - 0x10], 0x55d
jle 0x10007625
xor esi, esi
xor edi, edi
xor ebx, ebx
lea eax, [edi + esi]
mov ecx, 0x10075b78
xor eax, ebx
cdq
push edx
push eax
call fcn.1000c233
inc ebx
cmp ebx, 0x793
jl 0x100075f8
inc edi
cmp edi, 0x5473
jl 0x100075f6
inc esi
cmp esi, 0xd44
jl 0x100075f4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommState]
cmp dword [ebp - 0x10], 0xffffff86
jge 0x10007644
mov edx, str.fchg_bkbme_sgnwblt_wdxav_khtt_xjnme_ercckgqj_ektlpolq_sjtarjb_khcmmmnmt_isbd_mtudq_ekemk_sbqnluwu
mov ecx, 0x10075b78
call fcn.1000e4aa
cmp dword [ebp - 0x14], 0x5b14
jge 0x10007658
push str.thrcjk_esjxqvax_ppda_sxbhtrn_ecrnslpp_rvt_fllyufgpd
call fcn.10048abc
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000770c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 4], cl
push ebx
push esi
push edi
test dl, dl
je 0x1000775c
test cl, cl
je 0x1000774c
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x100077f3
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x8bbc
inc dword [edx]
cmp dword [edx], 3
jl 0x10007735
jmp 0x100077f3
xor esi, esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_GetScrollInfo]
jmp 0x100077f3
cmp byte [ebp + 0x18], 0
je 0x100077d0
mov dword [ebp - 8], 0x640b
cmp dword [ebp - 8], 0x668b
push 0
pop esi
jle 0x100077a6
mov edi, esi
mov ebx, esi
mov eax, ebx
mov ecx, 0x10075b78
xor eax, edi
cdq
push edx
push eax
call fcn.1000c233
inc ebx
cmp ebx, 0x1a16
jl 0x10007779
inc edi
cmp edi, 0x1a09
jl 0x10007777
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_SetScrollInfo]
mov eax, dword [ebp + 0x1c]
cmp byte [eax], 0
je 0x100077b6
push esi
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSectionAndSpinCount]
cmp dword [ebp - 8], 0x63d9
jge 0x100077f3
mov edx, str.bjbmyldbh_qbnjilnqh_hkiy_sdojkurav
mov ecx, 0x10075b78
call fcn.1000e4aa
jmp 0x100077f3
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x100077f3
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffff7
inc dword [edx]
cmp dword [edx], 3
jl 0x100077e1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100126c6
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10012720
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10012700
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100126fe
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x1001271e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1001271e
push 0
call fcn.10016c40
pop ecx
jmp 0x10012748
lea eax, [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
push dword [ebp - 0x18]
push 0x6822
push 0
mov eax, dword [ebp - 0x1c]
push dword [eax]
push 0x51f1
call fcn.10016c9d
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x10015f17
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10015f69
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10015f5d
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10015f5b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableA]
jmp 0x10015f67
push 0
push 0
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
jmp 0x10015f82
push 0x7ec0
push 0
push 0x59d7
push 0x36de
call fcn.1001f36c
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1001660f
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x70
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100167bc
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1001664c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x100167ba
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x20], 0x7427
mov dword [ebp - 0x40], str.sdaq_elvordo_lpedawowy_uhn_mppqp
cmp dword [ebp - 0x20], 0x76cf
jle 0x100166d8
and dword [ebp - 4], 0
jmp 0x1001667c
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x76d5
jge 0x100166d8
and dword [ebp - 8], 0
jmp 0x10016692
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0x2247
jge 0x100166d6
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 8]
shl eax, cl
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
lea ecx, [ebp - 0x70]
call fcn.100019c5
pop ecx
pop ecx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
call fcn.1000c213
push eax
call fcn.10048abc
pop ecx
lea ecx, [ebp - 0x70]
call fcn.1000c209
jmp 0x1001668b
jmp 0x10016675
mov dword [ebp - 0x1c], 0x3ece
mov dword [ebp - 0x3c], str.gkyrhly_wcduba_ecx_xlakxsy_amkoa_orwmho_ueiul_vwismuimr_iveps_nypmtyhty_qyesyi_hcjeauy_lrakv
cmp dword [ebp - 0x1c], 0x404c
jle 0x10016778
and dword [ebp - 0xc], 0
jmp 0x10016700
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x535e
jge 0x10016778
and dword [ebp - 0x10], 0
jmp 0x10016716
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x428b
jge 0x10016776
and dword [ebp - 0x14], 0
jmp 0x1001672c
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x40a3
jge 0x10016774
and dword [ebp - 0x18], 0
jmp 0x10016742
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x29f1
jge 0x10016772
mov eax, dword [ebp - 0xc]
or eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
sub ecx, dword [ebp - 0x18]
or eax, ecx
cdq
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
push dword [ebp - 0x54]
push dword [ebp - 0x58]
mov ecx, 0x10075b78
call fcn.1000c233
jmp 0x1001673b
jmp 0x10016725
jmp 0x1001670f
jmp 0x100166f9
mov eax, dword [ebp - 0x34]
mov eax, dword [eax]
sub eax, 0xc
cdq
mov ecx, 0x1a5
idiv ecx
sub eax, 0xc
mov ecx, dword [ebp - 0x38]
mov dword [ecx], eax
cmp dword [ebp - 0x1c], 0x3bd2
jge 0x100167a6
mov edx, dword [ebp - 0x3c]
mov ecx, 0x10075b78
call fcn.1000e4aa
jmp 0x100167f6
jmp 0x100167f6
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x48], eax
push 0
push 0xbe
push dword [ebp - 0x44]
push 0x5b5d
push 0x56f6
push dword [ebp - 0x48]
push 0x1316
push 0x1055
push 0x50cc
call fcn.10014acc
add esp, 0x24
mov esp, ebp
pop ebp
ret
Function at 0x10016c51
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10016c85
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10016c7b
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x10016c83
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x10016c99
push 0x70a4
push 0
push 0x6add
call fcn.10012131
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10018e60
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x10018ed3
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10018ebc
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x10018eba
push 0x7b7b
push 1
push 0x4e72
push 1
push 0x60f0
push 0x6966
call fcn.1001660f
add esp, 0x18
jmp 0x10018ece
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
jmp 0x10019010
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x14], 0x5430
mov dword [ebp - 0x54], str.hul_mqn_lugtgms_lwcvquf_jymmfvmcq_rrr_ihqkx_qsaytxqxr_ovws
cmp dword [ebp - 0x14], 0x5490
jle 0x10018f58
and dword [ebp - 0xc], 0
jmp 0x10018f15
mov eax, dword [ebp - 0xc]
inc eax
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0x506
jge 0x10018f58
and dword [ebp - 0x10], 0
jmp 0x10018f2b
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0x57b2
jge 0x10018f56
mov eax, dword [ebp - 0xc]
cdq
idiv dword [ebp - 0x10]
mov eax, edx
cdq
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edx
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
mov ecx, 0x10075b78
call fcn.1000c233
jmp 0x10018f24
jmp 0x10018f0e
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10018faf
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x10018f90
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x10018fad
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x3c]
call fcn.1000c4ea
mov dword [eax], 0x2fd4
jmp 0x10018f85
jmp 0x10018ffa
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x10018fdd
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 2
jge 0x10018ffa
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x50]
call fcn.1000c4ea
mov dword [eax], 8
jmp 0x10018fd2
cmp dword [ebp - 0x14], 0x50f8
jge 0x10019010
mov edx, dword [ebp - 0x54]
mov ecx, 0x10075b78
call fcn.1000e4aa
mov esp, ebp
pop ebp
ret
Function at 0x1003ed27
Capabilities:
Delete file
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
mov byte [ebp - 4], cl
mov eax, edx
mov dword [ebp - 0x14], 0x4122
cmp dword [ebp - 0x14], 0x4283
push esi
push edi
mov dword [ebp - 0x18], eax
jle 0x1003ed9f
xor edi, edi
xor esi, esi
mov dword [ebp - 0x10], esi
xor ebx, ebx
mov dword [ebp - 0xc], 0x452f
mov dword [ebp - 8], ebx
mov esi, ebx
mov ebx, 0x3ecb
mov eax, esi
mov ecx, 0x10075b78
xor eax, edi
cdq
push edx
push eax
call fcn.1000c233
dec esi
dec ebx
jne 0x1003ed62
mov ebx, dword [ebp - 8]
mov esi, dword [ebp - 0x10]
add ebx, esi
dec dword [ebp - 0xc]
mov dword [ebp - 8], ebx
jne 0x1003ed5b
inc esi
mov dword [ebp - 0x10], esi
cmp esi, 0x3d7d
jl 0x1003ed4f
inc edi
cmp edi, 0x1d40
jl 0x1003ed4a
mov eax, dword [ebp - 0x18]
cmp byte [ebp - 4], 0
je 0x1003edaf
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x1003edb1
inc dword [eax]
cmp dword [ebp - 0x14], 0x402d
jge 0x1003edc9
mov edx, str.tgqulcef_mqa_isjatm_wbtuc_cjc_vothssnpg_fvpocownn_rmjfcua_edqor_dbuxhkb_qxs_nktjovqls
mov ecx, 0x10075b78
call fcn.1000e4aa
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10042d63
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x18], esi
push edi
test dl, dl
je 0x10042eb6
mov dword [esp + 0x14], 0x2721
cmp dword [esp + 0x14], 0x2a88
push 0
pop ebx
jle 0x10042dd6
mov esi, ebx
mov edi, ebx
mov dword [esp + 0x18], ebx
mov eax, ebx
mov ecx, 0x10075b78
xor eax, edi
or eax, esi
cdq
push edx
push eax
call fcn.1000c233
inc ebx
cmp ebx, 0x21ef
jl 0x10042d9a
inc edi
push 0
pop ebx
cmp edi, 0x6df9
jl 0x10042d96
inc esi
cmp esi, 0x774
jl 0x10042d94
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov esi, dword [esp + 0x1c]
cmp dword [esp + 0x14], 0x2441
jge 0x10042def
mov edx, str.smmo_lsg_gfpvulma_upuhhruxp_nyf_rhg_gybrgmc
mov ecx, 0x10075b78
call fcn.1000e4aa
cmp byte [ebp + 0xc], 0
je 0x10042e13
mov edx, dword [ebp + 0x14]
mov dword [edx], ebx
jmp 0x10042e09
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x45307222
inc dword [edx]
cmp dword [edx], 4
jl 0x10042dfc
jmp 0x10042f07
mov dword [esp + 0x18], 0x1cbc
cmp dword [esp + 0x18], 0x1d8a
jle 0x10042e78
mov esi, ebx
mov dword [esp + 0x14], ebx
mov edi, ebx
mov eax, esi
mov dword [esp + 0x1c], ebx
cdq
idiv edi
mov esi, edx
mov eax, esi
mov ecx, 0x10075b78
cdq
idiv ebx
mov eax, edx
cdq
push edx
push eax
call fcn.1000c233
inc ebx
cmp ebx, 0x5f67
jl 0x10042e38
mov esi, dword [esp + 0x14]
inc edi
push 0
pop ebx
cmp edi, 0x5bfe
jl 0x10042e2d
inc esi
mov dword [esp + 0x14], esi
cmp esi, 0x3b06
jl 0x10042e2b
call dword [sym.imp.KERNEL32.dll_GetACP]
mov esi, dword [ebp + 0x18]
mov dword [esi], 0xffffffef
jmp 0x10042e96
push ecx
lea eax, [esp + 0x16]
mov byte [esp + 0x16], bl
push eax
call fcn.10042f0e
inc dword [esi]
pop ecx
pop ecx
cmp dword [esi], 0x1b
jl 0x10042e83
cmp dword [esp + 0x18], 0x1b2b
jge 0x10042f07
mov edx, str.jvlnewl_hejxsyhyq_ofjk_fvpqvxtpk_eqawkqgl_fbfwq
mov ecx, 0x10075b78
call fcn.1000e4aa
jmp 0x10042f07
cmp byte [ebp + 0x10], 0
je 0x10042ef5
push 0x65ca
push 0x55bd
push 0x27a7
push 0x6c98
lea eax, [esp + 0x23]
mov byte [esp + 0x23], 0
push eax
push 0x155b
push 0x1da4
mov edx, 0x6b34
xor cl, cl
call fcn.10043dd0
add esp, 0x1c
jmp 0x10042f07
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10042f07
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetNearestPaletteIndex]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10043b62
Capabilities:
Create thread
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov byte [ebp - 0xc], cl
push ebx
mov ebx, edx
push esi
push edi
test cl, cl
je 0x10043b9e
push 0x1e37
lea eax, [ebp - 5]
mov byte [ebp - 5], 0
push eax
push 0x3d29
push 1
push 1
mov edx, 0x647b
xor cl, cl
call fcn.10043c29
add esp, 0x14
jmp 0x10043c22
mov dword [ebp - 0x10], 0x78fb
cmp dword [ebp - 0x10], 0x7a05
push 0
pop edi
jle 0x10043c02
mov esi, edi
mov ecx, edi
mov eax, esi
sar eax, cl
lea ecx, [ebp - 0x28]
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10043bce
mov eax, dword [eax]
push eax
call fcn.10048abc
pop ecx
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.1000c80a
inc edi
cmp edi, 0x49ee
jl 0x10043bb3
inc esi
push 0
pop edi
cmp esi, 0x5d33
jl 0x10043bb3
push edi
push edi
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
cmp dword [ebp - 0x10], 0x751c
jge 0x10043c16
push str.wlbvrfpb_ebpjhcnbe_vcmcvx_yeuudg
call fcn.10048abc
pop ecx
cmp byte [ebx], 0
je 0x10043c22
push edi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10043c29
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x18], edi
test cl, cl
je 0x10043cfe
cmp byte [ebp + 8], 0
je 0x10043c54
xor esi, esi
push esi
push esi
call dword [sym.imp.USER32.dll_LoadCursorA]
jmp 0x10043d94
mov dword [ebp - 0xc], 0x2c1
mov ebx, 0x10075b78
cmp dword [ebp - 0xc], 0x45f
push 0
pop esi
jle 0x10043cc9
mov edi, esi
mov eax, esi
mov dword [ebp - 4], esi
mov ecx, esi
mov dword [ebp - 8], esi
cdq
idiv ecx
mov dword [ebp - 0x10], esi
mov eax, edx
mov dword [ebp - 0x14], eax
xor eax, esi
mov ecx, ebx
or eax, edi
cdq
push edx
push eax
call fcn.1000c233
mov eax, dword [ebp - 0x14]
inc esi
cmp esi, 0x5b4
jl 0x10043c83
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 4]
inc ecx
mov dword [ebp - 8], ecx
push 0
pop esi
cmp ecx, 0x64c6
jl 0x10043c78
inc eax
mov dword [ebp - 4], eax
cmp eax, 0x33a9
jl 0x10043c73
inc edi
cmp edi, 0x3fd9
jl 0x10043c6e
mov edi, dword [ebp - 0x18]
mov dword [edi], esi
cmp dword [edi], 3
jge 0x10043ce5
mov edx, dword [ebp + 0x10]
mov ecx, dword [edi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0x2fd4
inc dword [edi]
cmp dword [edi], 3
jl 0x10043cd3
cmp dword [ebp - 0xc], 0xffffff08
jge 0x10043d94
mov edx, str.bvqpop_ysuidnf_hennvv_opvqcqp_sulqog
mov ecx, ebx
jmp 0x10043d8f
cmp byte [ebp + 0xc], 0
je 0x10043d1d
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x10043d94
xor esi, esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
jmp 0x10043d94
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0x10043d94
mov dword [ebp - 0xc], 0x15f0
cmp dword [ebp - 0xc], 0x1913
push 0
pop esi
jle 0x10043d72
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x18], esi
mov ecx, esi
mov eax, ebx
shl eax, cl
mov ecx, 0x10075b78
and eax, edi
cdq
push edx
push eax
call fcn.1000c233
inc esi
cmp esi, 0x607e
jl 0x10043d3f
inc ebx
push 0
pop esi
cmp ebx, 0x41a0
jl 0x10043d3c
inc edi
cmp edi, 0x1b64
jl 0x10043d3a
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_WinHelpA]
cmp dword [ebp - 0xc], 0x13db
jge 0x10043d94
mov edx, str.nok_hsqno_oyfcd_lxothoan
mov ecx, 0x10075b78
call fcn.1000e4aa
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10044f34
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x10044f4b
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8
Function at 0x10044f6d
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x1007e014
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x1007e3a0
jl 0x10044f7b
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x1007e644
jl 0x10044fbb
mov ecx, dword [0x1007f390]
xor ecx, dword [0x1007e014]
and ecx, edi
xor ecx, dword [0x1007f390]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x1007e010], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x1007e644]
mov dword [0x1007e9d0], eax
pop esi
ret
Function at 0x10045a4a
Capabilities:
Delete file
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
je 0x10045ab9
mov dword [ebp - 4], 0x51fb
mov ebx, 0x10075b78
cmp dword [ebp - 4], 0x5427
jle 0x10045a92
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, ebx
xor eax, esi
cdq
push edx
push eax
call fcn.1000c233
inc edi
cmp edi, 0x33ec
jl 0x10045a72
inc esi
cmp esi, 0x2e3a
jl 0x10045a70
mov ecx, dword [ebp + 8]
lea eax, [ebp - 8]
and dword [ebp - 8], 0
push eax
call fcn.10041b1a
cmp dword [ebp - 4], 0x5031
jge 0x10045ac1
mov edx, str.dbmp_arrvihhr_psytelaxu
mov ecx, ebx
call fcn.1000e4aa
jmp 0x10045ac1
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret