joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100105a4
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x100105bb
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x100105dd
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x100dfc34
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x100dffc0
jl 0x100105eb
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x100e0264
jl 0x1001062b
mov ecx, dword [0x100e0fb0]
xor ecx, dword [0x100dfc34]
and ecx, edi
xor ecx, dword [0x100e0fb0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x100dfc30], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x100e0264]
mov dword [0x100e05f0], eax
pop esi
ret
Function at 0x10010aac
Capabilities:
Set environment variable

Disassembly:
mov eax, 0x10061c7a
call fcn.10060e94
sub esp, 0x2c
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ecx
je 0x10010c0c
mov dword [ebp + 0x18], 0x6650
cmp dword [ebp + 0x18], 0x69ac
jle 0x10010b03
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x1007cfd8
or eax, edi
cdq
push edx
push eax
call fcn.1000703f
inc ebx
cmp ebx, 0x5b6
jl 0x10010ae0
inc edi
cmp edi, 0x5d40
jl 0x10010ade
and dword [ebp - 4], 0
cmp dword [ebp + 0x18], 0x643d
jge 0x10010b1f
mov edx, str.xisyt_xgbszddrt_qezhbmcte_ikxq_evqpzjuxi_zeivuy_fwcfxiyrt_uad_wskwnkpux
mov ecx, 0x1007cfd8
call fcn.1000b30d
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x14], 0
je 0x10010b52
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x10010c19
mov dword [ebp - 0x14], 0x7758
cmp dword [ebp - 0x14], 0x7b17
jle 0x10010ba7
xor edi, edi
xor ebx, ebx
mov dword [ebp + 0x18], 0x2356
mov eax, ebx
lea ecx, [ebp - 0x38]
cdq
push edx
push eax
call fcn.10001301
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10010b84
mov eax, dword [eax]
push eax
call fcn.10048570
pop ecx
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.1000162e
add ebx, edi
dec dword [ebp + 0x18]
jne 0x10010b6d
inc edi
cmp edi, 0xee1
jl 0x10010b64
cmp dword [ebp - 0x14], 0x73ba
jge 0x10010bbb
push str.ltrgmru_ygbfzhtdn_fxne
call fcn.10048570
pop ecx
mov ecx, dword [ebp + 0x10]
mov dword [ecx], 0
cmp dword [ecx], 0x1d
jg 0x10010c19
mov edi, dword [ebp + 8]
mov edx, dword [ebp - 0x18]
mov dword [ebp + 0x18], 0
jmp 0x10010be6
mov eax, dword [ebp + 0x18]
mov dword [ebp + eax*4 - 0x20], 0x33a79cc0
inc dword [ebp + 0x18]
cmp dword [ebp + 0x18], 2
jl 0x10010bd8
mov eax, dword [edi]
mov ebx, 0xd0e75d5f
cmp ebx, eax
sbb eax, eax
inc eax
mov dword [ebp - 0x20], eax
mov eax, dword [edx]
cmp dword [eax + 0xc], 0
jne 0x10010c19
inc dword [ecx]
cmp dword [ecx], 0x1d
jle 0x10010bcf
jmp 0x10010c19
push ecx
push edx
push dword [ebp + 0xc]
call fcn.10010c2a
add esp, 0xc
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10011522
Capabilities:
Query environment variable
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10011570
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10011564
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10011562
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x1001156e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x10011584
push 0x592b
push 0x1bfa
push 0
call fcn.1001497e
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x10011e19
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10061cc1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x10011e60
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
push 0x6326
push 1
push dword [ebp - 0x28]
call fcn.10011fdd
add esp, 0xc
jmp 0x10011fcc
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x24], 0x583d
mov dword [ebp - 0x58], str.trjj_edjc_qzfbydzj_avkxqqhl_stw
cmp dword [ebp - 0x24], 0x5a08
jle 0x10011ef3
and dword [ebp - 0x18], 0
jmp 0x10011ea2
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x6870
jge 0x10011ee4
and dword [ebp - 0x1c], 0
jmp 0x10011eb8
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3cb9
jge 0x10011ee2
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
shl eax, cl
cdq
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], edx
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
mov ecx, 0x1007cfd8
call fcn.1000703f
jmp 0x10011eb1
jmp 0x10011e9b
push 0x23dd
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10011f41
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x20]
mov dword [eax], 0xfffffffa
jmp 0x10011f2b
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
mov eax, dword [ebp - 0x20]
cmp dword [eax], 0xfffffff8
jl 0x10011f3f
mov eax, dword [ebp - 0x40]
cmp dword [eax], 0
je 0x10011f3d
jmp 0x10011f3f
jmp 0x10011f20
jmp 0x10011f8c
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x10011f6f
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 3
jge 0x10011f8c
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x54]
call fcn.100014fb
mov dword [eax], 0xbe4438b
jmp 0x10011f64
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x5565
jge 0x10011fa6
mov edx, dword [ebp - 0x58]
mov ecx, 0x1007cfd8
call fcn.1000b30d
jmp 0x10011fc2
or dword [ebp - 4], 0xffffffff
jmp 0x10011fcc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100149a0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10061d92
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x44
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10014b59
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x10014b30
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x1c], eax
mov eax, dword [0x100e104c]
and eax, 1
jne 0x10014a27
mov eax, dword [0x100e104c]
or eax, 1
mov dword [0x100e104c], eax
and dword [ebp - 4], 0
mov ecx, 0x100e1070
call fcn.10023d45
push 0x10062fa7
call fcn.10048546
pop ecx
or dword [ebp - 4], 0xffffffff
movzx eax, byte [0x100dfbf1]
test eax, eax
je 0x10014a87
mov ecx, 0x100e1070
call fcn.10023e0a
movzx eax, al
test eax, eax
jne 0x10014a87
push dword [ebp - 0x14]
lea eax, [ebp - 0x18]
push eax
mov ecx, 0x100e1070
call fcn.10023e13
lea eax, [ebp - 0x38]
push eax
mov ecx, 0x100e1070
call fcn.10023dfc
push eax
lea ecx, [ebp - 0x18]
call fcn.10023d32
movzx eax, al
test eax, eax
je 0x10014a87
lea ecx, [ebp - 0x18]
call fcn.10023e28
mov ecx, dword [ebp - 0x1c]
mov eax, dword [eax + 4]
mov dword [ecx], eax
jmp 0x10014b7f
mov eax, dword [ebp - 0x14]
push dword [eax]
lea eax, [ebp - 0x50]
push eax
call fcn.1003280f
pop ecx
pop ecx
mov dword [ebp - 4], 1
lea eax, [ebp - 0x50]
push eax
call fcn.100139b3
pop ecx
mov dword [ebp - 0x20], eax
movzx eax, byte [0x100dfbf1]
test eax, eax
je 0x10014ac7
mov ecx, 0x100e1070
call fcn.10023e0a
movzx eax, al
test eax, eax
jne 0x10014b0c
push dword [ebp - 0x14]
push 0x6aae
push 1
push 0x16e2
lea eax, [ebp - 0x20]
push eax
push 0x100e1070
call fcn.100139ea
add esp, 0x18
push 0x100dfbf1
push 0xe58
push 0x5856
push 1
push 0x7a26
push 0x4baf
push 1
call fcn.10013c41
add esp, 0x1c
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
call fcn.100071d9
jmp 0x10014b7f
mov byte [ebp - 0xd], 0
movzx eax, byte [ebp - 0xd]
test eax, eax
je 0x10014b57
push 0x477
push 0
push 0x1e2a
push 0x1700
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x10014b7f
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
push 0x2959
push 1
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push 0x7fad
call fcn.10011b1f
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1002666d
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
mov dword [esp + 0xc], 0x10c8
mov esi, ecx
cmp dword [esp + 0xc], 0x1443
push edi
mov dword [esp + 0x1c], edx
mov dword [esp + 0x18], esi
jle 0x100266e8
xor edi, edi
mov dword [esp + 0x10], edi
xor ebx, ebx
and dword [esp + 0x14], 0
mov esi, edi
mov edi, dword [esp + 0x14]
mov ecx, ebx
sar esi, cl
mov eax, esi
mov ecx, 0x1007cfd8
xor eax, edi
cdq
push edx
push eax
call fcn.1000703f
inc edi
cmp edi, 0x5daf
jl 0x100266ac
mov edi, dword [esp + 0x10]
inc ebx
cmp ebx, 0x36b0
jl 0x1002669d
inc edi
mov dword [esp + 0x10], edi
cmp edi, 0x2b6a
jl 0x1002669b
mov esi, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
mov eax, esi
and eax, edx
add eax, eax
sub esi, eax
pop edi
lea eax, [edx + esi]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002bf1c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002bf79
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1002bf71
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1002bf6f
push 0x3195
push 0x152f
push 0
push 0x1438
call fcn.1002d90a
add esp, 0x10
jmp 0x1002bf77
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
jmp 0x1002bf8d
push 0
push 0x5339
push 0x647b
call fcn.1002cf48
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x1002c106
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002c138
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
push 0
push 0x36ea
push 0x6b2f
push dword [ebp - 8]
push 0x5eb9
call fcn.10034230
add esp, 0x14
jmp 0x1002c1ab
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1002c1a1
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1002c182
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x1002c19f
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.100014fb
mov dword [eax], 0x125d
jmp 0x1002c177
jmp 0x1002c1ab
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esp, ebp
pop ebp
ret
Function at 0x1002cf74
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002cff7
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002cfeb
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1002cfcc
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1002cfe9
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.100014fb
mov dword [eax], 0x99fb023e
jmp 0x1002cfc1
jmp 0x1002cff5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x1002d025
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 1
push dword [ebp - 0x2c]
call fcn.1002bf91
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x1002d72e
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100625bc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x6c
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x1002d77b
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push 1
push dword [ebp - 0x24]
call fcn.1002d90a
add esp, 0x10
jmp 0x1002d8fc
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1002d8d5
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x18]
mov dword [eax], 0x16
jmp 0x1002d7ed
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax], 0xfffffffd
jle 0x1002d8d3
mov dword [ebp - 0x54], 1
push 2
lea ecx, [ebp - 0x78]
call fcn.1000145c
and dword [ebp - 4], 0
mov dword [ebp - 0x5c], 0
mov dword [ebp - 0x60], 0xaed0f12a
push 4
lea ecx, [ebp - 0x6c]
call fcn.1000145c
mov byte [ebp - 4], 1
mov dword [ebp - 0x14], 0
jmp 0x1002d83a
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 2
jge 0x1002d853
push dword [ebp - 0x14]
lea ecx, [ebp - 0x78]
call fcn.100014fb
mov dword [eax], 0x3f08700d
jmp 0x1002d833
push 0
push 0x53d6
push 0x433b
lea eax, [ebp - 0x6c]
push eax
push 1
push 0x1d99
lea eax, [ebp - 0x14]
push eax
push 1
push 0x209d
push 0x31da
call fcn.1002f488
add esp, 0x28
lea eax, [ebp - 0x78]
push eax
push dword [ebp - 0x4c]
push dword [ebp - 0x18]
push dword [ebp - 0x50]
lea eax, [ebp - 0x54]
push eax
push 0x63b6
lea eax, [ebp - 0x6c]
push eax
push dword [ebp - 0x58]
push 0x3748
lea eax, [ebp - 0x5c]
push eax
lea eax, [ebp - 0x60]
push eax
push 0
call fcn.1002c5a4
add esp, 0x30
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x6c]
call fcn.100014df
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x78]
call fcn.100014df
jmp 0x1002d7e2
jmp 0x1002d8fc
mov byte [ebp - 0xd], 0
movzx eax, byte [ebp - 0xd]
test eax, eax
je 0x1002d8fc
push 0x477
push 0
push 0x1e2a
push 0x1700
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1002d939
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002da6e
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1002d995
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002d990
push 0x16b3
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x1002da6c
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
mov dword [ebp - 0xc], eax
push 0
mov ecx, dword [ebp - 0x48]
call fcn.100014fb
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
sub eax, 5
mov ecx, dword [ebp - 8]
mov ecx, dword [ecx]
add ecx, eax
jne 0x1002d9fd
xor eax, eax
jne 0x1002d9fd
and dword [ebp - 0x10], 0
jmp 0x1002da04
mov dword [ebp - 0x10], 1
cmp dword [ebp - 0x10], 0x9e923e64
je 0x1002da16
mov dword [ebp - 0x14], 1
jmp 0x1002da1a
and dword [ebp - 0x14], 0
push 1
mov ecx, dword [ebp - 0x4c]
call fcn.100014fb
mov ecx, dword [ebp - 0x14]
cmp ecx, dword [eax]
jge 0x1002da34
mov dword [ebp - 0x18], 1
jmp 0x1002da38
and dword [ebp - 0x18], 0
cmp dword [ebp - 0x18], 0xa62a9695
je 0x1002da4a
mov dword [ebp - 0x1c], 1
jmp 0x1002da4e
and dword [ebp - 0x1c], 0
cmp dword [ebp - 0x1c], 0xffff
ja 0x1002da60
mov dword [ebp - 0x20], 1
jmp 0x1002da64
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x50]
mov ecx, dword [ebp - 0x20]
mov dword [eax], ecx
jmp 0x1002da82
push 0
push 0x6c2b
push 0x24c4
call fcn.1002d029
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x1002df52
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002df70
push 0x16b3
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x1002df9d
push 0x3e4
push 0x2e23
push 0x11d5
push 0
push 0x5da5
push 0x5f1d
push 0x35d4
push 0x75d1
call fcn.1002f07c
add esp, 0x20
pop ebp
ret
Function at 0x10035671
Capabilities:
Encode data using xor
Read .ini file

Disassembly:
mov eax, 0x100627ee
call fcn.10060e94
push ecx
push ecx
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, edx
mov byte [ebp - 0x14], cl
je 0x100356ca
test cl, cl
je 0x100356a8
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov dword [eax + ecx*4], 0x603f559c
jmp 0x10035771
mov edx, dword [ebp + 8]
mov dword [edx], 0
jmp 0x100356c0
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xd3d38e20
inc dword [edx]
cmp dword [edx], 1
jl 0x100356b3
jmp 0x10035771
cmp byte [ebp + 0x18], 0
je 0x10035766
mov eax, dword [ebp + 0x1c]
cmp byte [eax], 0
je 0x1003574a
mov dword [ebp + 0xc], 0x2a9
xor esi, esi
cmp dword [ebp + 0xc], 0x405
jle 0x10035723
mov edi, esi
mov ebx, esi
mov eax, ebx
mov ecx, 0x1007cfd8
xor eax, edi
cdq
push edx
push eax
call fcn.1000703f
inc ebx
cmp ebx, 0x760a
jl 0x100356f2
inc edi
cmp edi, 0x2e23
jl 0x100356f0
push esi
push 0x1dc7
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push esi
push 0x54d
call dword [sym.imp.GDI32.dll_CreateHatchBrush]
mov dword [ebp - 4], esi
cmp dword [ebp + 0xc], 0xffffff54
jge 0x1003574a
mov edx, str.soqrvvfjd_vonicku_qhixl_wkwmku_buacnig_umklav_aroegamk_eujzy_tsptuxpn_lfc_ajufgjm
mov ecx, 0x1007cfd8
call fcn.1000b30d
jmp 0x10035771
xor esi, esi
push esi
push esi
push esi
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10035782
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
je 0x100357b3
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x100357c2
push 0x1c94
push 0x5fa8
push 0x75d
xor dl, dl
mov ecx, 0x4084
call fcn.100357c4
add esp, 0xc
pop ebp
ret
cmp byte [edx], 0
je 0x100357c2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop ebp
ret