joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100023b2
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10058c4c
call fcn.10058764
sub esp, 0x14
push ebx
push esi
mov dword [ebp - 0x14], 0x1b75
mov ebx, ecx
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
cmp dword [ebp - 0x14], 0x1cab
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], ebx
jle 0x10002409
mov edi, esi
mov ebx, esi
mov eax, ebx
mov ecx, 0x10073a98
xor eax, edi
cdq
push edx
push eax
call fcn.1000ab96
inc ebx
cmp ebx, 0x15e2
jl 0x100023e3
inc edi
cmp edi, 0x3e1c
jl 0x100023e1
mov ebx, dword [ebp - 0x18]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x14], 0x1ac1
jge 0x10002445
mov edx, str.hxpt_kuuf_utpm_nbt_vpiwwsue_yxucocnjq
mov ecx, 0x10073a98
call fcn.1000d257
jmp 0x10002445
cmp byte [ebp + 0x1c], 0
je 0x10002477
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x100024e7
push 0xa2e
push 0x1e40
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
jmp 0x100024e7
mov edx, dword [ebp + 8]
mov ecx, dword [ebx]
mov eax, dword [edx]
imul eax, dword [ecx]
test eax, eax
je 0x100024a4
mov eax, dword [ebp + 0x20]
mov eax, dword [eax]
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
mov eax, dword [edx]
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp + 0x28]
sete dl
cmp edx, dword [eax]
jg 0x100024a4
mov eax, dword [ebp + 0x30]
mov eax, dword [eax]
mov eax, dword [ebp + 0x2c]
xor edx, edx
mov edi, dword [ebp + 0xc]
inc edx
xor ecx, ecx
mov dword [eax], edx
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
test eax, eax
mov eax, dword [ebx]
sets cl
mov dword [eax + 4], ecx
mov ecx, edx
mov eax, dword [edi]
xor edx, edx
sub ecx, eax
mov eax, dword [ebp + 0x20]
mov eax, dword [eax]
cmp ecx, eax
setl dl
sub edx, 7
jne 0x100024db
cmp dword [edi], esi
je 0x100024de
xor esi, esi
inc esi
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
add eax, esi
mov dword [edi], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000255b
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
xor esi, esi
mov byte [esp + 0xc], dl
push edi
mov edi, ecx
test dl, dl
je 0x10002583
push 0x9d8
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
jmp 0x100025d0
mov dword [edi], esi
cmp dword [edi], 1
jg 0x100025d0
mov ebx, dword [ebp + 0x10]
mov dword [ebx], 1
jmp 0x100025b6
push edi
sub esp, 0x14
mov dword [esp + 0x2c], 0x3e3f36a5
lea edx, [esp + 0x2c]
push ebx
push dword [ebp + 0x1c]
push ecx
xor cl, cl
call fcn.100025d7
add esp, 0x24
dec dword [ebx]
cmp dword [ebx], esi
jge 0x10002595
mov edx, dword [ebp + 0xc]
push esi
push ecx
mov ecx, dword [ebp + 0x1c]
call fcn.100027ad
inc dword [edi]
cmp dword [edi], 1
pop ecx
pop ecx
jle 0x1000258d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002a9c
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
xor ebx, ebx
cmp byte [ebp + 8], bl
je 0x10002ad7
push ebx
push 0x1085
push ebx
push ebx
push 0xc6d
push 0xed8
push 0x20de
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtTextOutA]
jmp 0x10002b26
push 0x6e12
lea eax, [ebp - 8]
mov dword [ebp - 8], ebx
push eax
push 0x69ed
push ebx
push 0x2654
push 0x7917
push 1
push 0x478b
mov dword [ebp - 0xc], 0xfffffff8
lea ecx, [ebp - 0xc]
push 0x12a8
mov edx, 0xa6e
call fcn.10001b31
mov byte [ebp - 1], bl
add esp, 0x24
cmp byte [ebp - 1], bl
je 0x10002b26
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10002bab
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
je 0x10002cb4
cmp byte [ebp + 0x14], 0
je 0x10002bdf
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
jmp 0x10002d03
mov dword [ebp - 0xc], 0x1d21
cmp dword [ebp - 0xc], 0x1f80
push 1
pop edi
jle 0x10002c62
push 0x199b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
xor esi, esi
mov dword [ebp - 8], esi
xor eax, eax
mov dword [ebp - 4], 0x2754
mov dword [ebp + 8], eax
mov esi, dword [ebp + 8]
xor ebx, ebx
mov eax, esi
lea ecx, [ebp - 0x24]
xor eax, ebx
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10002c30
mov eax, dword [eax]
push eax
call fcn.10040afc
pop ecx
push 0
push edi
lea ecx, [ebp - 0x24]
call fcn.1000b217
inc ebx
cmp ebx, 0x968
jl 0x10002c17
mov esi, dword [ebp - 8]
add dword [ebp + 8], esi
dec dword [ebp - 4]
jne 0x10002c12
inc esi
mov dword [ebp - 8], esi
cmp esi, 0x1f9c
jl 0x10002c06
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
mov eax, dword [esi]
cmp dword [esi], 0
jne 0x10002c70
mov eax, dword [esi]
mov eax, dword [esi]
mov edx, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x1c]
mov eax, dword [edx]
mov eax, dword [esi]
mov dword [ecx], eax
mov eax, dword [ecx]
xor ecx, ecx
cmp eax, 0x22a5bc4
setne cl
xor eax, eax
cmp ecx, edi
setg al
xor ecx, ecx
cmp eax, edi
mov eax, dword [esi]
setge cl
add eax, ecx
mov dword [edx], eax
cmp dword [ebp - 0xc], 0x1a63
jge 0x10002d03
push str.fpth_sqkrxdmaf_ssnykd_zdkajjv_ptlcscy_clwjgecmy
call fcn.10040afc
pop ecx
jmp 0x10002d03
cmp byte [ebp + 0xc], 0
je 0x10002cc9
cmp byte [ecx], 0
je 0x10002d03
push 0
call dword [sym.imp.USER32.dll_DestroyMenu]
jmp 0x10002d03
mov dword [edx], 0
cmp dword [edx], 0xc
je 0x10002d03
xor edi, edi
inc edi
mov dword [ebp + 8], 0x576c5165
mov dword [ebp + 8], edi
mov dword [ebp + 8], 0xfffffff8
mov dword [ebp + 8], 8
mov dword [ebp + 8], edi
mov dword [ebp + 8], 0xd68f9855
dec dword [ebp + 8]
inc dword [edx]
cmp dword [edx], 0xc
jne 0x10002cd7
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100030b4
Capabilities:
Get geographical location

Disassembly:
mov eax, 0x10058c6a
call fcn.10058764
sub esp, 0x34
mov byte [ebp - 0x18], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x100031be
cmp byte [ebp + 0xc], 0
je 0x100030f0
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1000328e
xor cl, cl
call fcn.100032fd
jmp 0x1000328e
mov dword [ebp - 0x1c], 0x1ba2
xor ebx, ebx
cmp dword [ebp - 0x1c], 0x1e88
jle 0x10003143
push ebx
push 0xa9f
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointW]
mov esi, ebx
mov edi, ebx
lea eax, [edi + esi]
mov ecx, 0x10073a98
cdq
push edx
push eax
call fcn.1000ab96
inc edi
cmp edi, 0x48cb
jl 0x10003121
inc esi
cmp esi, 0x6147
jl 0x1000311f
mov byte [ebp - 0x11], bl
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1c], 0x193a
jge 0x10003161
mov edx, str.nlzhudfrc_ilmx_xbd
mov ecx, 0x10073a98
call fcn.1000d257
or dword [ebp - 4], 0xffffffff
push 1
push 0x368b
push 0x6e53
push 0x4c3e
push 0xc25
push 0x6602
lea eax, [ebp - 0x11]
mov edx, 0x2cd3
push ebx
push eax
mov ecx, 0x6df5
call fcn.10002e6c
add esp, 0x20
jmp 0x1000328e
xor ebx, ebx
test cl, cl
je 0x10003285
mov dword [ebp - 0x28], 0x12d8
cmp dword [ebp - 0x28], 0x1324
jle 0x10003246
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], 0x3ccd
mov esi, dword [ebp - 0x1c]
mov edi, ebx
mov eax, esi
lea ecx, [ebp - 0x40]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10003206
mov eax, dword [eax]
push eax
call fcn.10040afc
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.1000b217
inc edi
cmp edi, 0x3326
jl 0x100031ea
mov esi, dword [ebp - 0x24]
add dword [ebp - 0x1c], esi
dec dword [ebp - 0x20]
jne 0x100031e5
inc esi
mov dword [ebp - 0x24], esi
cmp esi, 0x7dde
jl 0x100031db
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowInfo]
cmp dword [ebp - 0x28], 0x1231
jge 0x1000325a
push str.xaedg_yqhhed_tmuiidtik_neoxshcj_urhtu_gvgdpyxi_ejmjur_rktrpznvk_kqezklu_zyyzcpno_bsux_rrhmglo_ivfuge
call fcn.10040afc
pop ecx
mov esi, dword [ebp + 8]
mov dword [esi], 0x13
jmp 0x1000327e
mov byte [ebp - 0x12], bl
cmp byte [ebp - 0x12], 0
je 0x1000327c
push 0x9d8
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
dec dword [esi]
cmp dword [esi], 0xffffffe7
je 0x10003265
jmp 0x1000328e
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_UnionRect]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100054e9
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10058d37
call fcn.10058764
sub esp, 0x2c
push ebx
push esi
mov dword [ebp - 0x18], 0x76cd
mov ebx, edx
cmp dword [ebp - 0x18], 0x7a54
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ebx
jle 0x1000555c
xor esi, esi
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
add eax, ebx
lea ecx, [edi + esi]
xor eax, ecx
mov ecx, 0x10073a98
cdq
push edx
push eax
call fcn.1000ab96
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x1c0e
jl 0x1000551c
inc ebx
cmp ebx, 0x3714
jl 0x10005517
inc edi
cmp edi, 0x7869
jl 0x10005515
inc esi
cmp esi, 0x742a
jl 0x10005513
mov ebx, dword [ebp - 0x1c]
cmp byte [ebp + 0x18], 0
je 0x1000560f
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1000557b
push 0
push 0x19ed
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
mov dword [ebp - 0x14], 0x8d
cmp dword [ebp - 0x14], 0x1db
jle 0x100055f9
push 0
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
xor esi, esi
xor edi, edi
lea eax, [edi + esi]
cdq
lea ecx, [ebp - 0x34]
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100055af
mov eax, dword [eax]
push eax
call fcn.10040afc
pop ecx
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.1000b217
inc edi
cmp edi, 0x633
jl 0x10005597
inc esi
cmp esi, 0x4212
jl 0x10005595
push 0x3ec
push 0
push 0xc55
push 0x114e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
cmp dword [ebp - 0x14], 0xfffffe58
jge 0x10005652
push str.uvmiu_izj_cvjlgyef_ewo_naatkib_knn_rixuh_tor_dez_mvwjra
call fcn.10040afc
pop ecx
jmp 0x10005652
mov esi, dword [ebp + 0x10]
xor ecx, ecx
push 6
mov edx, dword [esi]
mov eax, dword [esi]
sub edx, eax
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
sub edx, eax
mov eax, dword [esi]
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0xffffffff
pop ecx
setle al
sub ecx, eax
mov eax, dword [esi]
add ecx, eax
mov eax, dword [ebp + 0x1c]
cmp ecx, dword [eax]
jne 0x10005642
mov eax, dword [ebx]
mov ecx, dword [esi]
xor edx, edx
mov eax, dword [ebx]
cmp ecx, eax
mov eax, dword [ebp + 0x20]
setl dl
mov dword [eax], edx
mov dword [ebp - 4], 2
cmp dword [ebp - 0x18], 0x75d8
jge 0x10005671
mov edx, str.ybha_lwzij_lwlefvbgm_fuzd
mov ecx, 0x10073a98
call fcn.1000d257
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005bf7
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10058d4b
call fcn.10058764
sub esp, 0x14
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x10005c44
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x10005c33
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x84bc9c3d
inc dword [edx]
cmp dword [edx], 3
jl 0x10005c21
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [edx], 0
je 0x10005c33
xor dl, dl
call fcn.10002370
mov dword [ebp - 0x1c], 0x291
cmp dword [ebp - 0x1c], 0x60d
jle 0x10005cac
xor esi, esi
mov dword [ebp - 0x18], esi
mov ebx, esi
mov dword [ebp - 0x14], 0x379
xor edi, edi
xor esi, esi
mov eax, ebx
mov ecx, 0x10073a98
xor eax, esi
xor eax, edi
cdq
push edx
push eax
call fcn.1000ab96
inc esi
cmp esi, 0x680a
jl 0x10005c72
inc edi
cmp edi, 0x8eb
jl 0x10005c70
dec ebx
dec dword [ebp - 0x14]
jne 0x10005c6e
mov esi, dword [ebp - 0x18]
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x521f
jl 0x10005c65
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x1d2
jge 0x10005c33
mov edx, str.athjwva_qgfrbeao_yvcusbh_wnxhovu_rjrmt_jgt_ftoue_wxwvl_qcjjv_gqerdo_qvowtgyst_jotj_hdcr_wxndpm
mov ecx, 0x10073a98
call fcn.1000d257
jmp 0x10005c33
Function at 0x10015b54
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10015b85
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
push dword [ebp - 8]
push 1
push 0x3e4c
push dword [ebp - 0xc]
call fcn.10015bca
add esp, 0x10
jmp 0x10015bc6
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10015bb4
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x10015bc6
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
mov esp, ebp
pop ebp
ret

Function at 0x10016fc3
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10017011
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10016fef
call dword [sym.imp.USER32.dll_WaitMessage]
jmp 0x1001700f
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1001700f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x1001702e
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push 0x30b8
push 0x50b7
push 0
call fcn.100140f7
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x1001ef45
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
mov byte [esp], dl
push esi
mov esi, ecx
test dl, dl
je 0x1001ef93
mov edx, dword [ebp + 8]
mov eax, dword [edx]
mov eax, dword [edx]
cmp dword [edx], 0
jne 0x1001ef64
mov eax, dword [edx]
mov eax, dword [edx]
mov eax, dword [esi]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [ecx]
xor ecx, ecx
cmp eax, 0x22a5bc4
setne cl
xor eax, eax
cmp ecx, 1
setg al
xor ecx, ecx
cmp eax, 1
mov eax, dword [edx]
setge cl
add eax, ecx
mov dword [esi], eax
jmp 0x1001ef9d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10026140
Capabilities:
Set environment variable

Disassembly:
mov eax, 0x10059945
call fcn.10058764
sub esp, 0x30
push ebx
push esi
mov dword [ebp - 0x24], 0x1b78
cmp dword [ebp - 0x24], 0x1d33
push edi
mov dword [ebp - 0x10], esp
jle 0x100261c2
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
xor edi, edi
mov dword [ebp - 0x20], edi
mov ecx, edi
mov dword [ebp - 0x1c], 0x23e1
mov edi, dword [ebp - 0x14]
mov dword [ebp - 0x18], ecx
lea eax, [edi + ebx]
or eax, ecx
mov ecx, 0x10073a98
cdq
push edx
push eax
call fcn.1000ab96
mov ecx, dword [ebp - 0x18]
dec ecx
dec dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
jne 0x1002617e
mov edi, dword [ebp - 0x20]
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x1f60
jl 0x1002616f
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x4556
jl 0x1002616a
inc ebx
cmp ebx, 0x48ed
jl 0x10026165
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x1873
jge 0x100261de
mov edx, str.oxzfwuz_bmkvzxswi_nqjrh_iyalpw_eixucvfj
mov ecx, 0x10073a98
call fcn.1000d257
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x18], 0
je 0x1002635d
mov edi, dword [ebp + 0x44]
mov dword [edi], 0xffffffe6
jmp 0x100262b9
push 0x45be
push edi
push 0x1c58
push 0x593e
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x8f0d
push eax
lea eax, [ebp - 0x28]
mov dword [ebp - 0x28], 0xf9c77509
push eax
push dword [ebp + 8]
mov dword [ebp - 0x30], 0x315bfeb1
mov edx, 0x5711
push dword [ebp + 0x2c]
mov dword [ebp - 0x34], 0x456014ef
mov cl, 1
push 0
push 0x7628
push 0x7d55
mov dword [ebp - 0x38], 0x32e88240
push 0
call fcn.100266ac
push 0x7f44
push 0x154e
lea eax, [ebp - 0x30]
mov edx, 0x1a3
push eax
push 1
push dword [ebp + 0x38]
lea eax, [ebp - 0x34]
push dword [ebp + 0x40]
lea ecx, [ebp - 0x38]
push eax
push dword [ebp + 0x3c]
lea eax, [ebp - 0x28]
push 0x4363
push edi
push 0
push eax
lea eax, [ebp - 0x2c]
push eax
push dword [ebp + 0x14]
push 0x170
push dword [ebp + 0x2c]
call fcn.10025adb
add esp, 0x70
inc dword [edi]
cmp dword [edi], 0xfffffffb
jg 0x10026214
mov dword [ebp - 0x20], 0x542f
cmp dword [ebp - 0x20], 0x56ba
jle 0x10026322
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
xor ecx, ecx
mov dword [ebp - 0x24], ecx
add eax, ebx
shl eax, cl
mov ecx, 0x10073a98
or eax, edi
cdq
push edx
push eax
call fcn.1000ab96
mov ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x14]
inc ecx
mov dword [ebp - 0x24], ecx
cmp ecx, 0x4399
jl 0x100262e0
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x7408
jl 0x100262db
inc ebx
cmp ebx, 0x7274
jl 0x100262d6
inc edi
cmp edi, 0x34ef
jl 0x100262d4
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x529c
jge 0x10026341
mov edx, str.aqhbktnbm_gcjegw_ubo_ytedw_mbrucqdx_oxcayb_yqphvvieo_jjwsvmw_mzjz_rrj_zeo_gsept_emewxohn_zonu
mov ecx, 0x10073a98
call fcn.1000d257
jmp 0x1002636f
mov eax, dword [ebp + 0x34]
cmp byte [eax], 0
je 0x1002636f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100266ac
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10059985
call fcn.10058764
sub esp, 0x30
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x18], cl
je 0x100267bf
test cl, cl
je 0x100266f9
mov dword [edx], 0
cmp dword [edx], 3
jge 0x1002689f
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [edx]
cmp dword [edx], 3
jl 0x100266e2
jmp 0x1002689f
mov dword [ebp - 0x20], 0x3a82
cmp dword [ebp - 0x20], 0x3c91
jle 0x10026754
xor esi, esi
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x1c], 0x2421
mov dword [ebp + 0x14], eax
and eax, edi
mov ecx, 0x10073a98
xor eax, esi
cdq
push edx
push eax
call fcn.1000ab96
mov eax, dword [ebp + 0x14]
add eax, ebx
dec dword [ebp - 0x1c]
mov dword [ebp + 0x14], eax
jne 0x1002671b
inc ebx
cmp ebx, 0x56e7
jl 0x1002670f
inc edi
cmp edi, 0x1eae
jl 0x1002670d
inc esi
cmp esi, 0x1ab2
jl 0x1002670b
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x37b8
jge 0x10026770
mov edx, str.euekp_gtfudx_efrsnv_pvjkflnj
mov ecx, 0x10073a98
call fcn.1000d257
mov eax, dword [ebp + 0x2c]
or dword [ebp - 4], 0xffffffff
push 0x1a
pop esi
mov ecx, dword [eax]
cmp ecx, esi
jge 0x100267a4
mov eax, dword [ebp + 0x34]
movzx edx, word [eax]
add edx, ecx
jmp 0x100267b1
mov eax, ecx
cdq
idiv esi
mov eax, dword [ebp + 0xc]
movzx eax, word [eax]
add edx, eax
mov ecx, dword [ebp + 0x28]
push edx
call fcn.1000ad33
jmp 0x1002689f
cmp byte [ebp + 8], 0
je 0x100267f4
push 0x1968
push 1
push 0x3ea0
push 0
lea eax, [ebp + 0x17]
mov byte [ebp + 0x17], 0
push 1
push eax
mov edx, 0x65be
mov ecx, 0x62a8
call fcn.10026485
add esp, 0x18
jmp 0x1002689f
mov dword [ebp - 0x20], 0x6872
cmp dword [ebp - 0x20], 0x6af7
jle 0x10026845
xor esi, esi
xor edi, edi
lea eax, [edi + esi]
cdq
lea ecx, [ebp - 0x38]
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10026820
mov eax, dword [eax]
push eax
call fcn.10040afc
pop ecx
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.1000b217
inc edi
cmp edi, 0x1dc3
jl 0x10026808
inc esi
cmp esi, 0x191e
jl 0x10026806
mov esi, dword [ebp + 0x30]
xor ecx, ecx
push 6
mov edx, dword [esi]
mov eax, dword [esi]
sub edx, eax
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
sub edx, eax
mov eax, dword [esi]
cmp edx, eax
setg cl
xor eax, eax
cmp ecx, 0xffffffff
pop ecx
setle al
sub ecx, eax
mov eax, dword [esi]
add ecx, eax
mov eax, dword [ebp + 0x20]
cmp ecx, dword [eax]
mov ecx, dword [ebp + 0x1c]
jne 0x1002687b
mov eax, dword [ecx]
mov ecx, dword [ecx]
xor edx, edx
mov eax, dword [esi]
cmp eax, ecx
mov eax, dword [ebp + 0x18]
setl dl
mov dword [eax], edx
cmp dword [ebp - 0x20], 0x6663
jge 0x1002689f
push str.zwuhpfdba_xqqieiyg_gngutwzy_xssqg_claf_lofjiz_fakm_dxtdm_xaxbk_odc
call fcn.10040afc
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10027a7c
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov dword [0x10396a14], ecx
inc edx
mov esi, 0x270
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
mov dword [edx*4 + 0x10396a14], ecx
inc edx
cmp edx, esi
jl 0x10027a91
mov dword [0x10396a10], esi
pop esi
pop ebp
ret 8

Function at 0x10027ab7
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x10396a14
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x10396da0
jl 0x10027ac5
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x10397044
jl 0x10027b05
mov ecx, dword [0x10397d90]
xor ecx, dword [0x10396a14]
and ecx, edi
xor ecx, dword [0x10397d90]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x10396a10], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10397044]
mov dword [0x103973d0], eax
pop esi
ret

Function at 0x10027e32
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10059a22
call fcn.10058764
sub esp, 0x14
cmp byte [ebp + 0x1c], 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edi
mov esi, ecx
je 0x10027e7b
mov dword [esi], 0
cmp dword [esi], 3
jge 0x10027f0f
mov edx, dword [ebp + 0x10]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 1
inc dword [esi]
cmp dword [esi], 3
jl 0x10027e64
jmp 0x10027f0f
mov dword [ebp - 0x18], 0x2884
cmp dword [ebp - 0x18], 0x2a75
jle 0x10027ed2
xor esi, esi
mov dword [ebp - 0x14], esi
xor ebx, ebx
and dword [ebp - 0x20], 0
mov edi, ebx
and edi, esi
mov esi, dword [ebp - 0x20]
mov eax, edi
mov ecx, 0x10073a98
xor eax, esi
cdq
push edx
push eax
call fcn.1000ab96
inc esi
cmp esi, 0x1624
jl 0x10027e9d
mov esi, dword [ebp - 0x14]
inc ebx
cmp ebx, 0x261b
jl 0x10027e92
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x1cae
jl 0x10027e90
mov edi, dword [ebp - 0x1c]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x2707
jge 0x10027f0d
mov edx, str.pwlz_bestamu_ptf_qtzhrj_oqoy_unbbm_lhusy_hvfgxhrt
mov ecx, 0x10073a98
call fcn.1000d257
jmp 0x10027f0d
inc dword [edi]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret