joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10023c07
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005fe53
call fcn.1005ecf4
sub esp, 0x28
push ebx
push esi
mov dword [ebp - 0x30], 0x11ec
mov esi, ecx
cmp dword [ebp - 0x30], 0x1364
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], esi
jle 0x10023c8f
xor edi, edi
mov dword [ebp - 0x24], edi
xor eax, eax
mov dword [ebp - 0x20], eax
xor esi, esi
and eax, edi
mov dword [ebp - 0x2c], eax
mov edi, eax
xor eax, eax
mov dword [ebp - 0x1c], eax
and eax, esi
mov ecx, 0x10079358
xor eax, edi
cdq
push edx
push eax
call fcn.100033d6
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x34b9
jl 0x10023c47
inc esi
cmp esi, 0x16e
jl 0x10023c42
mov eax, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x5bdf
jl 0x10023c39
inc edi
mov dword [ebp - 0x24], edi
cmp edi, 0x6fe5
jl 0x10023c34
mov esi, dword [ebp - 0x18]
cmp byte [ebp + 0x14], 0
je 0x10023cb5
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x10023d84
push 0
push 0x215c
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
jmp 0x10023d84
mov dword [ebp - 0x2c], 0x7b4b
cmp dword [ebp - 0x2c], 0x7db4
jle 0x10023d29
xor edi, edi
mov dword [ebp - 0x28], edi
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov eax, edi
xor esi, esi
cdq
idiv ecx
mov eax, edx
mov dword [ebp - 0x20], eax
xor edi, edi
mov dword [ebp - 0x24], 0x532f
mov ecx, edi
sar eax, cl
mov ecx, 0x10079358
cdq
push edx
push eax
call fcn.100033d6
mov eax, dword [ebp - 0x20]
add edi, esi
dec dword [ebp - 0x24]
jne 0x10023ce4
inc esi
cmp esi, 0x5784
jl 0x10023cdb
mov ecx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x28]
inc ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x6142
jl 0x10023ccf
inc edi
mov dword [ebp - 0x28], edi
cmp edi, 0x3c18
jl 0x10023cca
mov esi, dword [ebp - 0x18]
and dword [ebp - 4], 0
cmp dword [ebp - 0x2c], 0x7a8a
jge 0x10023d64
mov edx, str.mnjk_cidq_xvgrrsnr
mov ecx, 0x10079358
call fcn.1000562f
jmp 0x10023d64
mov dword [esi], 0
cmp dword [esi], 4
jge 0x10023d84
mov edx, dword [ebp + 0xc]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0x6f5020f8
inc dword [esi]
cmp dword [esi], 4
jl 0x10023d72
mov dword [ebp - 4], 2
cmp dword [ebp - 0x30], 0xf84
jge 0x10023da3
mov edx, str.ppxfid_xoceqmjyx_xxapy_iuvwgw_aqdnj_zwfkuyl_xgk
mov ecx, 0x10079358
call fcn.1000562f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10023f03
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005fe5d
call fcn.1005ecf4
sub esp, 0x10
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
je 0x10023f4d
mov edx, dword [ebp + 0x24]
mov dword [edx], 0
cmp dword [edx], 4
jge 0x10023ff8
mov esi, dword [ebp + 0x2c]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x9cc14173
inc dword [edx]
cmp dword [edx], 4
jl 0x10023f36
jmp 0x10023ff8
mov dword [ebp - 0x18], 0x3680
cmp dword [ebp - 0x18], 0x3866
jle 0x10023f97
xor edi, edi
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x14], 0x2f60
mov eax, esi
mov ecx, 0x10079358
xor eax, edi
cdq
push edx
push eax
call fcn.100033d6
add esi, ebx
dec dword [ebp - 0x14]
jne 0x10023f6a
inc ebx
cmp ebx, 0x1791
jl 0x10023f61
inc edi
cmp edi, 0x79d4
jl 0x10023f5f
mov esi, dword [ebp - 0x1c]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x3620
jge 0x10023fd2
mov edx, str.ivvdalrqw_fypdufh_iko_nayzifv_yigcfcqw_tksxiojp_jnggqmxvh_raqq_ntzclmzvw
mov ecx, 0x10079358
call fcn.1000562f
jmp 0x10023fd2
mov dword [esi], 0
cmp dword [esi], 1
jg 0x10023ff8
mov ebx, dword [ebp + 0x20]
mov edi, dword [ebp + 0x1c]
mov eax, dword [edi]
mov edx, dword [edi]
mov ecx, dword [ebx]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
mov eax, dword [esi]
inc dword [esi]
cmp dword [esi], 1
jle 0x10023fe3
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10024be1
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov byte [ebp - 4], dl
mov dword [ebp - 0x14], 0xbdc
cmp dword [ebp - 0x14], 0xd35
push esi
push edi
jle 0x10024c8e
xor edi, edi
xor esi, esi
mov dword [ebp - 0x10], esi
xor eax, eax
mov dword [ebp - 0xc], 0x7262
mov dword [ebp - 8], eax
mov esi, dword [ebp - 8]
xor ebx, ebx
mov ecx, ebx
mov eax, esi
sar eax, cl
lea ecx, [ebp - 0x2c]
and eax, edi
cdq
push edx
push eax
call fcn.10001ac4
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10024c36
mov eax, dword [eax]
push eax
call fcn.10046ccf
pop ecx
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.100038da
inc ebx
cmp ebx, 0x578f
jl 0x10024c19
mov esi, dword [ebp - 0x10]
add dword [ebp - 8], esi
dec dword [ebp - 0xc]
jne 0x10024c14
inc esi
mov dword [ebp - 0x10], esi
cmp esi, 0x184e
jl 0x10024c08
inc edi
cmp edi, 0x3e4d
jl 0x10024c03
push 0x2435
push 0x1d9f
push 0x10db
push 0x9b9
push 0
call dword [sym.imp.USER32.dll_SetRect]
cmp byte [ebp - 4], 0
je 0x10024cab
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10024cb8
push 0x1c1e
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
jmp 0x10024cb8
push 0
push 0x147d
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
cmp dword [ebp - 0x14], 0x834
jge 0x10024ccc
push str.vmpakxoc_nmupsjl_kacebcvl_yhjmxgi_ynetnygm_afojif_vbvu
call fcn.10046ccf
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10024f23
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005fe8d
call fcn.1005ecf4
sub esp, 0x14
mov byte [ebp - 0x14], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x1c], edi
test dl, dl
je 0x10024f6b
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x10025008
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
or dword [eax + ecx*4], 0xffffffff
inc dword [edx]
cmp dword [edx], 1
jl 0x10024f57
jmp 0x10025008
mov dword [ebp - 0x18], 0x2b64
cmp dword [ebp - 0x18], 0x2d8a
jle 0x10024faf
push 0
push 0x29d
call dword [sym.imp.KERNEL32.dll_GetCPInfo]
xor esi, esi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x10079358
xor eax, esi
cdq
push edx
push eax
call fcn.100033d6
inc ebx
cmp ebx, 0x2f5b
jl 0x10024f8c
inc esi
cmp esi, 0x4404
jl 0x10024f8a
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x2a48
jge 0x10024fea
mov edx, str.bmjbxjagk_gcsb_vjzxvry_rrjzxsrwk_yxqru_afbiz_hlcm_itd_fbojep
mov ecx, 0x10079358
call fcn.1000562f
jmp 0x10024fea
mov edx, dword [ebp + 0x14]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [edx]
lea eax, [ecx + 2]
mov dword [edx], eax
call fcn.10023ab7
movzx eax, ax
mov ecx, edi
push eax
call fcn.100101db
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10025129
Capabilities:
Resume thread

Disassembly:
mov eax, 0x1005fea1
call fcn.1005ecf4
sub esp, 0xc
mov byte [ebp - 0x14], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x100251b8
mov dword [ebp - 0x18], 0x6cbe
cmp dword [ebp - 0x18], 0x6e96
jle 0x10025179
xor esi, esi
xor edi, edi
mov ebx, 0x7213
mov eax, edi
mov ecx, 0x10079358
cdq
push edx
push eax
call fcn.100033d6
add edi, esi
dec ebx
jne 0x1002515c
inc esi
cmp esi, 0x344b
jl 0x10025155
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
inc dword [eax]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x6b11
jge 0x1002519c
mov edx, str.qruhcwzw_bfyskmr_secnbg_gqpgeuw_ybof_nyxeqlxuf_reyyr
mov ecx, 0x10079358
call fcn.1000562f
jmp 0x100251c8
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x100251c8
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002646f
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005fed1
call fcn.1005ecf4
sub esp, 0x14
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x10026538
cmp byte [ecx], 0
je 0x1002651c
push 0x4499
push ecx
mov cl, 1
call fcn.10025336
mov dword [ebp - 0x18], 0x87
cmp dword [ebp - 0x18], 0xb2
pop ecx
pop ecx
jle 0x10026500
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
and dword [ebp - 0x1c], 0
mov ebx, esi
mov esi, dword [ebp - 0x1c]
mov ecx, edi
sar ebx, cl
mov eax, ebx
mov ecx, 0x10079358
xor eax, esi
cdq
push edx
push eax
call fcn.100033d6
inc esi
cmp esi, 0x4b38
jl 0x100264ce
mov esi, dword [ebp - 0x14]
inc edi
cmp edi, 0x2e52
jl 0x100264c1
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x5eac
jl 0x100264bf
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0xffffff30
jge 0x1002651c
mov edx, str.dki_jbbj_ndqdiznn_lyzcoe_wqviasek_gzp_qralehm
mov ecx, 0x10079358
call fcn.1000562f
jmp 0x1002653b
add dword [edx], 4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10028ab6
Capabilities:
Modify service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
cmp byte [ebp + 0x14], 0
push ebx
push esi
mov ebx, edx
push edi
mov dword [ebp - 0x14], ebx
je 0x10028be5
mov dword [ebp - 0xc], 0x70c2
cmp dword [ebp - 0xc], 0x7258
jle 0x10028b70
xor ebx, ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov esi, ebx
mov dword [ebp - 8], ebx
mov edi, ebx
mov dword [ebp - 4], ebx
mov ecx, edi
mov dword [ebp - 0x10], esi
mov edi, esi
sar edi, cl
xor esi, esi
mov ecx, esi
mov eax, ebx
shl eax, cl
lea ecx, [ebp - 0x2c]
xor eax, edi
cdq
push edx
push eax
call fcn.10001ac4
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10028b27
mov eax, dword [eax]
push eax
call fcn.10046ccf
pop ecx
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.100038da
inc esi
cmp esi, 0x7f59
jl 0x10028b0a
inc ebx
cmp ebx, 0x3377
jl 0x10028b08
mov edi, dword [ebp - 4]
mov esi, dword [ebp - 8]
inc edi
mov dword [ebp - 4], edi
push 0
pop ebx
cmp edi, 0x4536
jl 0x10028aff
inc esi
mov dword [ebp - 8], esi
cmp esi, 0x357c
jl 0x10028afa
mov ebx, dword [ebp - 0x14]
cmp dword [ebp - 0xc], 0x6fd5
jge 0x10028b84
push str.mslyf_jwfs_mtlrqyvm_nvvcel_zzvegpj_dzfwzg_mnuc_aqrjbgoj_yzq_ssdlf_ucklnfgkf_oetii
call fcn.10046ccf
pop ecx
mov eax, dword [ebp + 0x2c]
mov edi, dword [ebp + 0x34]
push 0xfffffffffffffff8
mov eax, dword [eax]
mov dword [eax + 4], 0x1ccf
mov edx, dword [edi]
mov eax, dword [ebp + 0x20]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x1c]
mov esi, dword [eax]
imul esi, dword [ecx + edx*4]
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [ebp + 0x28]
mov eax, dword [eax]
cmp eax, ecx
mov eax, dword [edi]
setge dl
xor ecx, ecx
cmp esi, edx
setle cl
imul eax, ecx
pop ecx
cmp ecx, eax
mov eax, dword [ebp + 0xc]
sbb ecx, ecx
neg ecx
mov dword [eax], ecx
xor ecx, ecx
mov eax, dword [eax]
cmp eax, 0x1ccf
mov eax, dword [ebp + 8]
sete cl
mov eax, dword [eax]
sub ecx, eax
mov eax, dword [ebp + 0x30]
mov dword [eax], ecx
jmp 0x10028bf3
mov eax, dword [ebp + 0x24]
mov ecx, dword [ecx]
mov edx, dword [eax]
mov eax, dword [ebp + 0x18]
sub edx, ecx
mov dword [eax], edx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003845d
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100384de
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100384d4
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100384b5
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x100384d2
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.100035ec
mov dword [eax], 6
jmp 0x100384aa
jmp 0x100384dc
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
jmp 0x100384f2
push 0x52f0
push 0x3ed
push 0
call fcn.1003625c
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1003b2e1
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100604c3
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1003b33a
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x24]
push 0x33b6
push dword [ebp - 0x28]
push 1
push dword [ebp - 0x2c]
call fcn.1003b4a9
add esp, 0x14
jmp 0x1003b498
lea eax, [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x20], 0x7267
mov dword [ebp - 0x34], str.jrjbm_xxjzh_jtabg_ykypywcbt_tkvgru_ttf_nnmzspd_sjpqwzrz
cmp dword [ebp - 0x20], 0x751b
jle 0x1003b3cf
and dword [ebp - 0x18], 0
jmp 0x1003b36a
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x5be4
jge 0x1003b3c5
and dword [ebp - 0x1c], 0
jmp 0x1003b380
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0xabe
jge 0x1003b3c3
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], edx
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
lea ecx, [ebp - 0x78]
call fcn.10001ac4
pop ecx
pop ecx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
call fcn.100033b6
push eax
call fcn.10046ccf
pop ecx
lea ecx, [ebp - 0x78]
call fcn.100033ac
jmp 0x1003b379
jmp 0x1003b363
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x70f3
jge 0x1003b3eb
push dword [ebp - 0x34]
call fcn.10046ccf
pop ecx
jmp 0x1003b407
or dword [ebp - 4], 0xffffffff
jmp 0x1003b411
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x1003b44d
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x1003b44b
push 0x5f3f
push 0
push 0x156b
call fcn.10030b4b
add esp, 0xc
jmp 0x1003b498
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x1003b47b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 2
jge 0x1003b498
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x58]
call fcn.100035ec
mov dword [eax], 1
jmp 0x1003b470
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003d94e
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
mov byte [ebp - 8], cl
push ebx
push esi
push edi
test cl, cl
je 0x1003d970
push 0
push 0x147d
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
jmp 0x1003db29
mov dword [ebp - 0x24], 0xffffffff
mov dword [ebp - 0x14], 0x1599
cmp dword [ebp - 0x14], 0x180f
push 1
pop esi
jle 0x1003d9e1
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
xor edi, edi
xor ebx, ebx
mov ecx, ebx
mov eax, edi
shl eax, cl
lea ecx, [ebp - 0x4c]
cdq
push edx
push eax
call fcn.10001ac4
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003d9b5
mov eax, dword [eax]
push eax
call fcn.10046ccf
pop ecx
push 0
push esi
lea ecx, [ebp - 0x4c]
call fcn.100038da
inc ebx
cmp ebx, 0x40e6
jl 0x1003d99a
inc edi
cmp edi, 0xe50
jl 0x1003d998
push 0
call dword [sym.imp.GDI32.dll_CreateFontIndirectW]
mov dword [ebp - 0x20], 0
cmp dword [ebp - 0x14], 0x134b
jge 0x1003d9fc
push str.lywxxe_auzgffvfo_pkxdixy_ubsmlbd_vazd_ipwtnggug_hki_fpm_ivg_wjuwo_fqjjlibp_tpus_mwvumy
call fcn.10046ccf
pop ecx
mov dword [ebp - 0x1c], 0xcdcb363f
mov eax, 0x909b7928
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x1c], 0x1c50
cmp dword [ebp - 0x1c], 0x1dc2
jle 0x1003da95
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x18], edi
xor eax, eax
mov dword [ebp - 0xc], 0x5e0
mov dword [ebp - 0x10], eax
xor edi, edi
and eax, edi
lea ecx, [ebp - 0x64]
and eax, ebx
cdq
push edx
push eax
call fcn.10001ac4
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003da55
mov eax, dword [eax]
push eax
call fcn.10046ccf
pop ecx
push 0
push esi
lea ecx, [ebp - 0x64]
call fcn.100038da
mov eax, dword [ebp - 0x10]
inc edi
cmp edi, 0x311c
jl 0x1003da3c
mov edi, dword [ebp - 0x18]
add eax, edi
dec dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
jne 0x1003da3a
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x6fbc
jl 0x1003da2e
inc ebx
cmp ebx, 0x4ed5
jl 0x1003da29
mov dword [ebp - 0xc], 0
cmp dword [ebp - 0x1c], 0x187b
jge 0x1003dab0
push str.xjvckyrc_ezc_fwedwboai_rgwg_aqtsyby_brvpkd_scbrokcfu_qqwykylc
call fcn.10046ccf
pop ecx
mov dword [ebp - 0x10], 0xd3388a01
mov dword [ebp - 0x18], 0xa3e8
mov eax, dword [ebp - 0xc]
dec dword [ebp - 0xc]
test eax, eax
je 0x1003db1f
mov eax, dword [ebp - 0xc]
imul eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov edx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x10]
dec edx
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
cmp eax, edx
setne cl
imul ecx, dword [ebp - 0x1c]
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
add eax, dword [ebp - 0x24]
je 0x1003daf8
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
cmp dword [ebp - 0x28], 0
je 0x1003db07
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x28]
xor edx, edx
mov eax, dword [ebp - 0x14]
cmp eax, ecx
setle dl
cmp edx, dword [ebp - 0x14]
jne 0x1003db1f
cmp dword [ebp - 0x10], 0
jne 0x1003db21
xor esi, esi
mov eax, dword [ebp - 0x20]
sub esi, eax
mov dword [ebp - 0x2c], esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0xa3b790
Capabilities:
Hash data using md4
Initialize hashing via wincrypt

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
push edi
push 0xf0000040
push 1
push 0
push 0
lea edi, [esi + 4]
mov dword [esi], 0
push esi
mov dword [edi], 0
call dword [sym.imp.ADVAPI32.dll_CryptAcquireContextW]
test eax, eax
je 0xa3b7cf
push edi
push 0
push 0
push 0x8002
push dword [esi]
call dword [sym.imp.ADVAPI32.dll_CryptCreateHash]
pop edi
pop esi
pop ebp
ret

Function at 0xa53d42
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a539bf

Function at 0xa5a3f5
Capabilities:
Read file on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00a5a26b

Function at 0x4749af
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4746cc
mov edi, 0xf36da154
add edi, 0xba34cb30
call fcn.004749f5
add edi, 0x1c0fa0a8
add edi, 0xa81f6b50
xor dword [ecx], eax
inc edi
add edi, 1
add ecx, 2
push ebx
pop ebx
add edi, ebx
sub ebx, 0x24e3bd25
cmp ecx, edx
jl fcn.004749af
or ebx, ebx
ret
Function at 0x4013c0
Capabilities:
Encode data using xor

Disassembly:
jmp 0x412d00
push esi
push edi
mov edi, dword [esp + 0x10]
xor esi, esi
test edi, edi
je 0x412eaa
push ebx
mov ebx, dword [esp + 0x10]
nop word [eax + eax]
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
sub byte [esi + ebx], 0x5a
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xe3
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0x49
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x8b
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x9e
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
add esp, 0x44
push eax
call fcn.004013a7
add byte [esi + ebx], 0xae
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xc9
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x86
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xdb
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xdf
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x79
add esp, 0x40
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 7
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
xor byte [esi + ebx], 0xa4
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0xdb
push str.Protocol_of_Mind
push 0x512be0
call fcn.0040349f
push eax
call fcn.004013a7
add byte [esi + ebx], 0x22
add esp, 0x30
inc esi
cmp esi, edi
jb 0x412d20
pop ebx
pop edi
pop esi
ret

Function at 0x4035da
Capabilities:
Terminate process

Disassembly:
jmp 0x451bc9
push 0x17
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
test eax, eax
je 0x451bda
push 5
pop ecx
int 0x29
push esi
push 1
mov esi, 0xc0000417
push esi
push 2
call fcn.00405907
add esp, 0xc
push esi
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop esi
ret

Function at 0x40370b
Capabilities:
Query environment variable

Disassembly:
jmp 0x49b072
mov edi, edi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
mov esi, eax
test esi, esi
jne 0x49b083
pop esi
ret
push ebx
push edi
push esi
call fcn.0049af59
mov ebx, eax
sub ebx, esi
and ebx, 0xfffffffe
push ebx
call fcn.00403fda
mov edi, eax
pop ecx
pop ecx
test edi, edi
je 0x49b0ab
push ebx
push esi
push edi
call fcn.004056fa
add esp, 0xc
push 0
call fcn.00406244
pop ecx
push esi
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsW]
mov eax, edi
pop edi
pop ebx
pop esi
ret