joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100261d8
Capabilities:
Delete file
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
cmp byte [ebp + 0x10], 0
mov eax, ecx
push ebx
push esi
push edi
push 0
mov dword [esp + 0x18], eax
pop esi
je 0x1002628f
mov dword [esp + 0x10], 0x538f
cmp dword [esp + 0x10], 0x56ac
jle 0x10026267
mov edi, esi
mov ebx, esi
mov dword [esp + 0xc], 0x2ef8
mov eax, ebx
lea ecx, [esp + 0x20]
cdq
push edx
push eax
call fcn.10002548
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002622d
mov eax, dword [eax]
push eax
call fcn.10040f4c
pop ecx
push esi
push 1
lea ecx, [esp + 0x28]
call fcn.1000afb2
add ebx, edi
dec dword [esp + 0xc]
jne 0x10026215
inc edi
cmp edi, 0x6a42
jl 0x1002620b
push 1
push 0x2636
push 0xde8
call dword [sym.imp.USER32.dll_AttachThreadInput]
mov eax, dword [esp + 0x14]
lea ecx, [esp + 0xc]
mov dword [esp + 0xc], esi
push ecx
mov ecx, eax
call fcn.10028dbf
cmp dword [esp + 0x10], 0x5380
jge 0x10026349
push str.qlkwdbmph_whlm_jscibh_wzz_dxkyv_vpq_lbhmsz_sphxkyilx_aayz_cab_ecoyycn_zpgxrfyii_ijcnjzv_wddhtzb
jmp 0x10026343
mov dword [esp + 0x14], 0x1cf4
cmp dword [esp + 0x14], 0x1ed4
jle 0x10026327
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
mov edi, esi
mov dword [esp + 0xc], esi
mov ebx, esi
mov dword [esp + 0x10], esi
mov ecx, ebx
mov dword [esp + 0x18], edi
mov ebx, edi
mov edi, esi
sar ebx, cl
mov ecx, edi
mov eax, ebx
shl eax, cl
lea ecx, [esp + 0x38]
cdq
push edx
push eax
call fcn.10002548
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100262e0
mov eax, dword [eax]
push eax
call fcn.10040f4c
pop ecx
push esi
push 1
lea ecx, [esp + 0x40]
call fcn.1000afb2
inc edi
cmp edi, 0x61b2
jl 0x100262c4
mov ebx, dword [esp + 0x10]
mov edi, dword [esp + 0xc]
inc ebx
mov dword [esp + 0x10], ebx
cmp ebx, 0x74b9
jl 0x100262b8
inc edi
mov dword [esp + 0xc], edi
cmp edi, 0x147d
jl 0x100262b2
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push 0x6e3
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
cmp dword [esp + 0x14], 0x192f
jge 0x10026349
push str.bohcrut_lmfkmzc_ahrdmo_lweh_iihibmf_pdbwy_znlxlrad_vini_oxwt_nzcnjsry_txfnnqx_cjarvl
call fcn.10040f4c
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100267de
Capabilities:
Connect pipe

Disassembly:
mov eax, 0x10058494
call fcn.100574a0
sub esp, 0x40
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x30], esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10026999
mov dword [ebp - 0x28], 0x56cb
xor ebx, ebx
cmp dword [ebp - 0x28], 0x58ee
jle 0x100268b7
push ebx
push 0x2111
push 0x20a4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
mov esi, ebx
mov dword [ebp - 0x24], ebx
mov edi, ebx
mov dword [ebp - 0x20], ebx
mov eax, esi
mov esi, ebx
cdq
idiv edi
mov eax, edx
mov dword [ebp - 0x2c], eax
mov edi, eax
mov dword [ebp - 0x1c], 0x45de
mov eax, edi
lea ecx, [ebp - 0x48]
cdq
push edx
push eax
call fcn.10002548
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10026869
mov eax, dword [eax]
push eax
call fcn.10040f4c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x48]
call fcn.1000afb2
add edi, esi
dec dword [ebp - 0x1c]
jne 0x10026852
mov eax, dword [ebp - 0x2c]
dec esi
cmp esi, 0xffff9db9
jg 0x10026849
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x24]
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x5967
jl 0x1002683d
inc esi
mov dword [ebp - 0x24], esi
cmp esi, 0x26c8
jl 0x10026838
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov esi, dword [ebp - 0x30]
cmp dword [ebp - 0x28], 0x5429
jge 0x100268cb
push str.vyrugyzeb_hnlejnw_dfdbg_yukbwrkz_nuyulvbol
call fcn.10040f4c
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 8], 0
je 0x10026978
mov dword [esi], 0x1a
jmp 0x100268fb
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x100268f9
push 0x5e03
push ecx
mov dl, 1
call fcn.1002571d
pop ecx
pop ecx
dec dword [esi]
cmp dword [esi], 0xffffffe9
je 0x100268e1
mov dword [ebp - 0x28], 0x729d
cmp dword [ebp - 0x28], 0x7674
jle 0x1002693a
mov esi, ebx
mov edi, ebx
mov eax, esi
mov ecx, 0x10072d38
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.1000aa66
inc edi
cmp edi, 0x2307
jl 0x10026914
inc esi
cmp esi, 0x170c
jl 0x10026912
mov dword [ebp - 4], 2
cmp dword [ebp - 0x28], 0x7148
jge 0x10026959
mov edx, str.wow_ogbywef_kqx_fynlqr_vmc_stsvdhab_ogqpcny_lmvmmz_ahp
mov ecx, 0x10072d38
call fcn.1000cc60
jmp 0x100269e7
mov edx, dword [ebp + 0x1c]
mov dword [edx], ebx
cmp dword [edx], 2
jge 0x100269e7
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xea75c96
inc dword [edx]
cmp dword [edx], 2
jl 0x10026985
jmp 0x100269e7
cmp byte [ebp + 0x24], 0
je 0x100269c4
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x100269e7
mov esi, dword [ebp + 0x20]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x924b
inc dword [edx]
cmp dword [edx], 1
jl 0x100269b0
jmp 0x100269e7
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x100269e7
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xdf491560
inc dword [edx]
cmp dword [edx], 3
jl 0x100269d5
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10028be8
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x100585e1
call fcn.100574a0
sub esp, 0x38
and dword [ebp - 0x20], 0
push ebx
push esi
mov ebx, ecx
mov esi, edx
push edi
mov dword [ebp - 0x1c], ebx
push 0x10028e6e
xor eax, eax
inc eax
push fcn.1002355e
push eax
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2c]
push 0xc
push eax
call fcn.10041090
sub esp, 0xc
mov byte [ebp - 4], 2
lea eax, [ebp + 8]
mov ecx, esp
lea edi, [ebp - 0x2c]
push eax
call fcn.10028d16
mov edx, edi
mov ecx, esi
call fcn.100269f8
mov dword [ebp - 0x14], 0x1ba0
add esp, 0xc
cmp dword [ebp - 0x14], 0x1bc4
jle 0x10028cd6
push 0
push 0x22
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
xor edi, edi
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x10], 0x6c75
mov ecx, esi
lea eax, [ebx + edi]
sar eax, cl
lea ecx, [ebp - 0x44]
cdq
push edx
push eax
call fcn.10002548
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10028c93
mov eax, dword [eax]
push eax
call fcn.10040f4c
pop ecx
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.1000afb2
dec esi
dec dword [ebp - 0x10]
jne 0x10028c77
mov esi, dword [ebp - 0x14]
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x69c
jl 0x10028c6d
inc ebx
cmp ebx, 0x3ec5
jl 0x10028c68
inc edi
cmp edi, 0x7afc
jl 0x10028c66
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ebx, dword [ebp - 0x1c]
lea eax, [ebp - 0x2c]
mov ecx, ebx
push eax
call fcn.10028e28
xor eax, eax
inc eax
push 0x10028e6e
push eax
mov dword [ebp - 0x20], eax
mov byte [ebp - 4], al
lea eax, [ebp - 0x2c]
push 0xc
push eax
call fcn.10040ceb
lea ecx, [ebp + 8]
call fcn.10028f28
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10029a34
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x10058631
push eax
mov dword fs:[0], esp
sub esp, 0x1c
cmp byte [ebp + 0x14], 0
push esi
push edi
mov edi, edx
je 0x10029a8c
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push dword [eax]
lea eax, [esp + 0x10]
push eax
call fcn.1002e424
xor esi, esi
mov ecx, edi
push eax
mov dword [esp + 0x30], esi
call fcn.1002e4d2
push esi
push 1
lea ecx, [esp + 0x10]
call fcn.1000b1c0
jmp 0x10029aa2
xor esi, esi
push esi
push 0x8d2
push esi
push esi
push 0xd8c
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, dword [esp + 0x24]
pop edi
mov dword fs:[0], ecx
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10029f4c
Capabilities:
Set environment variable

Disassembly:
mov eax, 0x1005867b
call fcn.100574a0
sub esp, 0x30
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
je 0x1002a007
mov dword [ebp - 0x18], 0x48cf
cmp dword [ebp - 0x18], 0x4a9d
jle 0x10029fa6
xor edi, edi
mov ebx, edi
mov esi, 0x766b
mov eax, ebx
mov ecx, 0x10072d38
cdq
push edx
push eax
call fcn.1000aa66
dec ebx
dec esi
jne 0x10029f87
inc edi
cmp edi, 0xdf7
jl 0x10029f80
mov esi, dword [ebp - 0x1c]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x471c
jge 0x10029fe1
mov edx, str.nhnfoexe_dzwg_juzerkqud_kch_mtchdg_qffslqzb
mov ecx, 0x10072d38
call fcn.1000cc60
jmp 0x10029fe1
mov dword [esi], 0
cmp dword [esi], 4
jge 0x1002a097
mov edx, dword [ebp + 0xc]
mov ecx, dword [esi]
mov eax, dword [edx]
and dword [eax + ecx*4], 0
inc dword [esi]
cmp dword [esi], 4
jl 0x10029ff3
jmp 0x1002a097
mov dword [ebp - 0x24], 0x5a8a
cmp dword [ebp - 0x24], 0x5e1f
jle 0x1002a07b
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
xor esi, esi
mov dword [ebp - 0x20], esi
mov ebx, 0x4ddd
xor edi, edi
mov dword [ebp - 0x18], ebx
mov esi, edi
mov ebx, 0xf1c
mov eax, esi
lea ecx, [ebp - 0x3c]
cdq
push edx
push eax
call fcn.10002548
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002a04e
mov eax, dword [eax]
push eax
call fcn.10040f4c
pop ecx
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.1000afb2
dec esi
dec ebx
jne 0x1002a037
mov esi, dword [ebp - 0x20]
add edi, esi
dec dword [ebp - 0x18]
jne 0x1002a030
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x7989
jl 0x1002a026
push 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
cmp dword [ebp - 0x24], 0x58c4
jge 0x1002a097
push str.wffrh_vnvotkkt_iptziiakm_aus_qwc_uaog_qppif_qwxa_fpikem_dawoiht_pneshkj_uhnddxlhh
call fcn.10040f4c
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002bbcc
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10058815
call fcn.100574a0
sub esp, 0x58
push ebx
push esi
mov dword [ebp - 0x24], 0x1cc1
cmp dword [ebp - 0x24], 0x1f27
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x30], ecx
jle 0x1002bc7b
xor esi, esi
mov dword [ebp - 0x20], esi
xor edi, edi
mov dword [ebp - 0x1c], edi
mov ecx, edi
mov dword [ebp - 0x18], esi
mov edi, esi
xor ebx, ebx
sar edi, cl
mov dword [ebp - 0x18], edi
mov ecx, ebx
mov dword [ebp - 0x2c], edi
xor esi, esi
shl edi, cl
mov ecx, esi
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0x4c]
cdq
push edx
push eax
call fcn.10002548
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002bc35
mov eax, dword [eax]
push eax
call fcn.10040f4c
pop ecx
push 0
push 1
lea ecx, [ebp - 0x4c]
call fcn.1000afb2
inc esi
cmp esi, 0x49f
jl 0x1002bc1a
mov edi, dword [ebp - 0x18]
inc ebx
cmp ebx, 0x9f9
jl 0x1002bc11
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x133b
jl 0x1002bc03
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x705c
jl 0x1002bbfe
cmp dword [ebp - 0x24], 0x1b47
jge 0x1002bc8f
push str.dpltzxhpk_flsbhc_fuzck_jpyjaqx_oxqow_afbe_ktagstqb
call fcn.10040f4c
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], 0x5b50
cmp dword [ebp - 0x1c], 0x5d8c
jle 0x1002bcf8
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x24], 0x1e9f
xor edi, edi
mov eax, ebx
lea ecx, [ebp - 0x64]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10002548
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002bccc
mov eax, dword [eax]
push eax
call fcn.10040f4c
pop ecx
push 0
push 1
lea ecx, [ebp - 0x64]
call fcn.1000afb2
inc edi
cmp edi, 0xc2
jl 0x1002bcb0
add ebx, esi
dec dword [ebp - 0x24]
jne 0x1002bcae
inc esi
cmp esi, 0x72ac
jl 0x1002bca5
cmp byte [ebp + 0x10], 0
je 0x1002bdb1
mov dword [ebp - 0x20], 0x4aac
cmp dword [ebp - 0x20], 0x4c7e
jle 0x1002bd49
xor esi, esi
xor edi, edi
mov dword [ebp - 0x24], 0xe62
xor ebx, ebx
mov eax, edi
mov ecx, 0x10072d38
xor eax, ebx
cdq
push edx
push eax
call fcn.1000aa66
inc ebx
cmp ebx, 0x4d0c
jl 0x1002bd1f
add edi, esi
dec dword [ebp - 0x24]
jne 0x1002bd1d
inc esi
cmp esi, 0x6f99
jl 0x1002bd14
mov ecx, dword [ebp - 0x28]
mov ebx, dword [ebp - 0x30]
mov esi, dword [ebp + 8]
mov eax, dword [ecx + 4]
sub eax, dword [ecx]
sar eax, 2
mov dword [ebx], eax
jmp 0x1002bd72
and dword [ebp - 0x34], 0
lea eax, [ebp - 0x34]
push eax
call fcn.1002e71f
inc dword [ebx]
mov eax, dword [ebx]
mov ecx, dword [ebp - 0x28]
cmp eax, dword [esi]
jl 0x1002bd5e
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x47b2
jge 0x1002bd95
mov edx, str.bhtfrzp_uogeehqvu_jkeldhf_aem_qbrxgew
mov ecx, 0x10072d38
call fcn.1000cc60
jmp 0x1002bdd0
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x1002bdd0
push 0x2d4
push 0x25cb
push 1
push ecx
call fcn.10029b40
add esp, 0x10
cmp dword [ebp - 0x1c], 0x5a4f
jge 0x1002bde4
push str.eeqkxbfgv_oypiczz_acayrku_whocw_sruk_ithfb_qfkamvdk
call fcn.10040f4c
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002c8a9
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10058887
call fcn.100574a0
sub esp, 0x34
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], esi
je 0x1002c9cb
sub esp, 0x18
mov ecx, esp
push edx
call fcn.1000ab7b
lea ecx, [ebp - 0x28]
call fcn.1002b9ec
add esp, 0x18
xor ebx, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], 0x316d
cmp dword [ebp - 0x14], 0x32a1
jle 0x1002c933
mov edi, ebx
mov esi, ebx
mov dword [ebp - 0x1c], ebx
mov ecx, ebx
mov eax, esi
sar eax, cl
mov ecx, 0x10072d38
xor eax, edi
cdq
push edx
push eax
call fcn.1000aa66
inc ebx
cmp ebx, 0x6c37
jl 0x1002c8fd
inc esi
push 0
pop ebx
cmp esi, 0x7fc1
jl 0x1002c8fa
inc edi
cmp edi, 0x2c55
jl 0x1002c8f8
mov esi, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
cmp dword [ebp - 0x28], eax
je 0x1002c98a
push dword [ebp - 0x1c]
xor ecx, ecx
mov dword [ebp - 0x2c], 7
push eax
push dword [ebp - 0x28]
mov word [ebp - 0x40], cx
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x30], ebx
call fcn.100246f0
mov ecx, dword [ebp + 0x18]
lea edx, [ebp - 0x40]
mov byte [ebp - 4], 1
call fcn.1002c861
lea ecx, [ebp - 0x40]
push ebx
push 1
test eax, eax
jns 0x1002c985
mov byte [esi], 1
call fcn.1000b1c0
lea ecx, [ebp - 0x28]
call fcn.1002901b
jmp 0x1002c9fd
call fcn.1000b1c0
mov byte [ebp - 4], 2
cmp dword [ebp - 0x14], 0x2f13
jge 0x1002c9c7
mov edx, str.ycxybnpp_vzllwu_eqbhszmv_yqnwtqe_ppzce_iwykcpc_enviu_rficnsvsu_dfzh
mov ecx, 0x10072d38
call fcn.1000cc60
jmp 0x1002c9c7
mov byte [esi], bl
jmp 0x1002c97b
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x1002c9fd
push 0x7a22
push 0x6fb1
push 0
push 0x1bda
push 0x7f1f
push 0x757f
mov edx, 0x4553
xor cl, cl
call fcn.10029a34
add esp, 0x18
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002ecc9
Capabilities:
Get file attributes

Disassembly:
mov eax, 0x100589c3
call fcn.100574a0
sub esp, 0x14
push ebx
push esi
mov dword [ebp - 0x18], 0x2906
mov ebx, edx
cmp dword [ebp - 0x18], 0x29c9
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], esi
jle 0x1002ed27
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
xor edi, edi
xor ebx, ebx
lea eax, [ebx + edi]
mov ecx, 0x10072d38
cdq
push edx
push eax
call fcn.1000aa66
inc ebx
cmp ebx, 0x396d
jl 0x1002ed02
inc edi
cmp edi, 0x286
jl 0x1002ed00
mov ebx, dword [ebp - 0x1c]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x26f6
jge 0x1002ed65
mov edx, str.eflsdi_aeb_bbomfeyns_ihi_gljxhko_vjhsb_fquwd_ergghpn
mov ecx, 0x10072d38
call fcn.1000cc60
jmp 0x1002ed65
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0xc], 0
je 0x1002ed8b
mov dword [esi], 0
jmp 0x1002ed84
mov ecx, dword [esi]
mov eax, dword [ebx]
mov dword [eax + ecx*4], 0xfb5d
inc dword [esi]
cmp dword [esi], 1
jl 0x1002ed77
jmp 0x1002edac
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x1002edac
push ecx
push 0x6b58
mov edx, 0x2e54
mov ecx, 0x72ce
call fcn.1002eeba
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002edbd
Capabilities:
Clear file content

Disassembly:
mov eax, 0x100589cd
call fcn.100574a0
sub esp, 0xc
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ebx
je 0x1002ee86
mov dword [ebp - 0x14], 0x514a
cmp dword [ebp - 0x14], 0x526d
jle 0x1002ee2f
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
xor esi, esi
xor edi, edi
xor ebx, ebx
mov ecx, ebx
lea eax, [edi + esi]
shl eax, cl
mov ecx, 0x10072d38
cdq
push edx
push eax
call fcn.1000aa66
inc ebx
cmp ebx, 0x2c3f
jl 0x1002edfd
inc edi
cmp edi, 0x1279
jl 0x1002edfb
inc esi
cmp esi, 0x7292
jl 0x1002edf9
mov ebx, dword [ebp - 0x18]
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x4daf
jge 0x1002ee6a
mov edx, str.fwi_dgbboo_wbs_rdrscpgu_fjmlrlm_mijipaub_zybldzgm
mov ecx, 0x10072d38
call fcn.1000cc60
jmp 0x1002ee6a
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
jmp 0x1002ee7f
mov ecx, dword [edx]
mov eax, dword [ebx]
or dword [eax + ecx*4], 0xffffffff
inc dword [edx]
cmp dword [edx], 3
jl 0x1002ee75
jmp 0x1002eea9
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x1002eea9
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 2
inc dword [edx]
cmp dword [edx], 1
jl 0x1002ee97
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002f83b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [ebp + 0x18], 0
push esi
mov byte [ebp - 4], dl
mov byte [ebp - 8], cl
je 0x1002f895
test dl, dl
je 0x1002f870
xor eax, eax
mov byte [ebp + 0x1b], al
cmp byte [ebp + 0x1b], al
je 0x1002f8d4
push 0xaed
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
jmp 0x1002f8d4
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1002f8d4
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xea75c96
inc dword [edx]
cmp dword [edx], 2
jl 0x1002f881
jmp 0x1002f8d4
test cl, cl
je 0x1002f8be
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1002f8d4
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xea75c96
inc dword [edx]
cmp dword [edx], 2
jl 0x1002f8aa
jmp 0x1002f8d4
xor eax, eax
push eax
push 0x8d2
push eax
push eax
push 0xd8c
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1002fa15
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10058a27
call fcn.100574a0
sub esp, 0x20
mov byte [ebp - 0x18], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x1002fb07
mov dword [ebp - 0x28], 0x515d
xor ebx, ebx
cmp dword [ebp - 0x28], 0x528e
jle 0x1002faba
mov esi, ebx
mov dword [ebp - 0x24], ebx
mov edi, ebx
mov dword [ebp - 0x20], ebx
mov eax, edi
mov dword [ebp - 0x1c], ebx
and eax, esi
mov dword [ebp - 0x2c], eax
mov esi, eax
mov edi, ebx
mov ebx, dword [ebp - 0x1c]
mov eax, edi
mov ecx, 0x10072d38
xor eax, ebx
or eax, esi
cdq
push edx
push eax
call fcn.1000aa66
inc edi
cmp edi, 0x166f
jl 0x1002fa60
inc ebx
push 0
mov dword [ebp - 0x1c], ebx
cmp ebx, 0x4a9a
pop ebx
jl 0x1002fa5b
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x24]
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x71a0
jl 0x1002fa4f
inc esi
mov dword [ebp - 0x24], esi
cmp esi, 0x7bc3
jl 0x1002fa4a
push 0x175b
push 0x539
push ebx
call dword [sym.imp.GDI32.dll_CreatePolygonRgn]
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1002fad0
push 0x6e3
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x28], 0x500e
jge 0x1002faeb
mov edx, str.yigkqid_eddbqdt_ejqmdadas_fthlk_ihgvzifa_ykl
mov ecx, 0x10072d38
call fcn.1000cc60
jmp 0x1002fb2a
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1002fb2a
xor ebx, ebx
mov edx, 0x71fc
push ebx
push ebx
push 0x7794
mov ecx, 0x6b5e
call fcn.1002ecae
add esp, 0xc
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10030d44
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10058aab
call fcn.100574a0
sub esp, 0x2c
cmp byte [ebp + 0x14], 0
mov eax, ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], eax
je 0x10030ebe
mov dword [ebp - 0x14], 0x7418
xor esi, esi
cmp dword [ebp - 0x14], 0x7659
mov edi, 0x10072d38
jle 0x10030db1
mov ebx, esi
mov dword [ebp + 0x14], esi
mov eax, esi
mov ecx, edi
or eax, ebx
cdq
push edx
push eax
call fcn.1000aa66
inc esi
cmp esi, 0x601c
jl 0x10030d85
inc ebx
push 0
pop esi
cmp ebx, 0x45c2
jl 0x10030d82
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
mov eax, dword [ebp - 0x18]
cmp byte [ebp + 0x18], 0
je 0x10030e5a
mov dword [ebp + 0x14], 0x3410
cmp dword [ebp + 0x14], 0x3672
jle 0x10030dff
mov ebx, esi
mov dword [ebp - 0x18], esi
mov eax, esi
mov ecx, edi
xor eax, ebx
cdq
push edx
push eax
call fcn.1000aa66
inc esi
cmp esi, 0x1b13
jl 0x10030dd0
inc ebx
push 0
pop esi
cmp ebx, 0x247e
jl 0x10030dcd
push esi
push 1
push 1
push esi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 4], esi
cmp dword [ebp + 0x14], 0x31e7
jge 0x10030e38
mov edx, str.sggg_tkuiwdb_eassda_uweevhsiw_yvp_isa_asnssnxc_nxbaw_add_pdw_elajpd
mov ecx, edi
call fcn.1000cc60
jmp 0x10030e38
mov eax, dword [ebp - 0x1c]
xor ecx, ecx
mov eax, dword [eax]
mov eax, dword [ebp + 0x38]
mov eax, dword [eax]
cmp eax, 1
mov eax, dword [ebp + 8]
setg cl
mov eax, dword [eax]
sub ecx, eax
mov eax, dword [ebp + 0x30]
mov eax, dword [eax]
mov dword [eax], ecx
jmp 0x10030e83
cmp byte [eax], 0
je 0x10030e83
push 0x223c
push esi
push 0x72e
push 0x1476
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExtFloodFill]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x14], 0x72ae
jge 0x10030e9f
mov edx, str.mkr_zjz_tfd_esea_wqkp_zpwc_tfzt_frelzkk
mov ecx, edi
call fcn.1000cc60
jmp 0x10030f64
cmp byte [ebp + 0x10], 0
je 0x10030eed
mov edx, dword [ebp + 0x28]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x10030f64
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [edx]
cmp dword [edx], 3
jl 0x10030ed9
jmp 0x10030f64
mov dword [ebp + 0x14], 0x4b39
cmp dword [ebp + 0x14], 0x4e12
jle 0x10030f49
xor esi, esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_LookupPrivilegeValueW]
mov edi, esi
mov ebx, esi
mov eax, ebx
lea ecx, [ebp - 0x34]
or eax, edi
cdq
push edx
push eax
call fcn.10002548
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10030f25
mov eax, dword [eax]
push eax
call fcn.10040f4c
pop ecx
push esi
push 1
lea ecx, [ebp - 0x34]
call fcn.1000afb2
inc ebx
cmp ebx, 0x2104
jl 0x10030f0c
inc edi
cmp edi, 0xe3e
jl 0x10030f0a
cmp dword [ebp + 0x14], 0x4752
jge 0x10030f5d
push str.xhvyzqijg_khwthic_ngtrtb
call fcn.10040f4c
pop ecx
mov ecx, dword [ebp + 0x34]
mov eax, dword [ecx]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret