joyce8/EMBER2024-capa huggingface dataset:
Function at 0x16a4120
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.GVD1
lea edi, [esi - 0x1270000]
push edi
or ebp, 0xffffffff
jmp 0x16a4142
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x16a4149
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
mov al, byte [edi]
jb 0x16a4138
mov eax, 1
add ebx, ebx
jne 0x16a415d
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x16a416e
jne 0x16a417e
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x16a417e
dec eax
add ebx, ebx
jne 0x16a417a
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x16a4152
xor ecx, ecx
sub eax, 3
jb 0x16a4196
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x16a420a
sar eax, 1
mov ebp, eax
jmp 0x16a41a1
add ebx, ebx
jne 0x16a41a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x16a41ae
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x16a41d2
inc ecx
add ebx, ebx
jne 0x16a41be
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x16a41b3
jne 0x16a41cf
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x16a41b3
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
mov al, byte [edi + ecx]
jbe 0x16a41f4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x16a41e6
jmp 0x16a413e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x16a41f4
add edi, ecx
jmp 0x16a413e
pop esi
mov edi, esi
mov ecx, 0x346a
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x16a4212
cmp byte [edi], 0x16
jne 0x16a4212
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov eax, ebx
loop 0x16a4217
lea edi, [esi + 0x12a1000]
mov eax, dword [edi]
or eax, eax
je 0x16a4286
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x12a57f8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x12a58e8]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x16a4244
mov ecx, edi
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x12a58ec]
or eax, eax
je 0x16a4280
mov dword [ebx], eax
add ebx, 4
jmp 0x16a4261
call dword [esi + 0x12a58f0]
popal
jmp 0x46b748

Function at 0x401219
Capabilities:
Terminate process

Disassembly:
mov eax, dword fs:[0]
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x40501c
push 0x40109a
push eax
mov dword fs:[0], esp
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
push eax
fnstcw word [esp]
or word [esp], 0x300
fldcw word [esp]
add esp, 4
push 0
push 0
push 0x405028
push 0x405024
push 0x405020
call sub.CRTDLL.DLL___GetMainArgs
push dword [0x405028]
push dword [0x405024]
push dword [0x405020]
mov dword [0x405014], esp
call fcn.0040129c
add esp, 0x18
xor ecx, ecx
mov dword [ebp - 4], ecx
push eax
call sub.CRTDLL.DLL_exit
leave
ret
Function at 0x407010
Capabilities:
Enumerate pe sections

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
xor edx, edx
push ebx
push esi
push edi
mov ecx, dword [eax + 0x3c]
add ecx, eax
movzx eax, word [ecx + 0x14]
movzx ebx, word [ecx + 6]
add eax, 0x18
add eax, ecx
test ebx, ebx
je 0x40704e
mov edi, dword [ebp + 0xc]
mov esi, dword [eax + 0xc]
cmp edi, esi
jb 0x407046
mov ecx, dword [eax + 8]
add ecx, esi
cmp edi, ecx
jb 0x407050
inc edx
add eax, 0x28
cmp edx, ebx
jb 0x407036
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret

Function at 0x407120
Capabilities:
Parse pe header

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
mov eax, 0x5a4d
cmp word [ecx], ax
jne 0x407151
mov eax, dword [ecx + 0x3c]
add eax, ecx
cmp dword [eax], 0x4550
jne 0x407151
mov ecx, 0x10b
cmp word [eax + 0x18], cx
jne 0x407151
mov eax, 1
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
mov ebx, 0x40de38
nop
mov ecx, 0x74db2c01
nop
test eax, eax
nop
nop
nop
nop
je 0x43304e
nop
nop
nop
nop
nop
nop
nop
nop
xor dword [eax], ecx
inc eax
nop
nop
nop
nop
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
inc eax
nop
nop
nop
nop
nop
nop
inc eax
nop
nop
nop
cmp eax, ebx
nop
jne 0x433024
nop
nop
nop
nop
nop
mov eax, section..rdata
mov ebx, 0x4304d8
nop
nop
mov ecx, 0x13501151
nop
test eax, eax
nop
nop
nop
nop
nop
je 0x433084
nop
nop
nop
nop
xor dword [eax], ecx
nop
nop
add eax, 4
nop
nop
nop
cmp eax, ebx
nop
nop
nop
nop
nop
nop
nop
nop
jne 0x43306c
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x1000235e
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
push esi
xor esi, esi
mov byte [esp + 4], cl
push edi
mov edi, edx
test cl, cl
je 0x100023a3
mov dword [edi], esi
jmp 0x1000239d
push esi
lea eax, [esp + 0x10]
mov dword [esp + 0x10], 0x786f
push eax
push 1
push esi
mov edx, 0x3e20
mov ecx, 0x1b16
call fcn.1000286f
add esp, 0x10
dec dword [edi]
cmp dword [edi], esi
jge 0x10002378
jmp 0x100023ad
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100024b2
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005d8bf
call fcn.1005d360
sub esp, 0x20
push ebx
push esi
mov byte [ebp - 0x14], cl
mov dword [ebp - 0x24], 0x5795
cmp dword [ebp - 0x24], 0x5a50
push edi
mov dword [ebp - 0x10], esp
jle 0x10002534
xor esi, esi
mov dword [ebp - 0x20], esi
xor edi, edi
mov dword [ebp - 0x1c], edi
mov eax, edi
xor ebx, ebx
and eax, esi
mov dword [ebp - 0x28], eax
mov esi, eax
xor edi, edi
mov ecx, edi
mov eax, ebx
shl eax, cl
mov ecx, 0x10078bb8
xor eax, esi
cdq
push edx
push eax
call fcn.100055e4
inc edi
cmp edi, 0xa6e
jl 0x100024ef
inc ebx
cmp ebx, 0x6ea3
jl 0x100024ed
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x62e0
jl 0x100024e2
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x7a34
jl 0x100024dd
cmp byte [ebp - 0x14], 0
je 0x1000254b
mov byte [ebp - 0x15], 0
cmp byte [ebp - 0x15], 0
je 0x1000256d
call fcn.10002696
jmp 0x1000256d
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1000256d
push 0x134d
push 0xf6
push 0x124f
push 0x3bf
call dword [sym.imp.USER32.dll_CheckRadioButton]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x55c7
jge 0x10002589
mov edx, str.iqjpf_goxyahyov_vpp_eoff_mpn_ocxuz_vivqhij
mov ecx, 0x10078bb8
call fcn.10009472
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002701
Capabilities:
Start service

Disassembly:
mov eax, 0x1005d8c9
call fcn.1005d360
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x18], 0x6029
mov edi, edx
cmp dword [ebp - 0x18], 0x60db
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x28], ecx
jle 0x10002755
xor ebx, ebx
xor edi, edi
lea eax, [edi + ebx]
mov ecx, 0x10078bb8
cdq
push edx
push eax
call fcn.100055e4
inc edi
cmp edi, 0x1450
jl 0x10002730
inc ebx
cmp ebx, 0x32a
jl 0x1000272e
mov edi, dword [ebp - 0x14]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x5dda
jge 0x10002790
mov edx, str.hcmzmstr_bzlylljh_rltmlxyzw_lcifrg_rsdfdr_oxgtjoi_ujuz_pnf_hsaskxisf_fxcjzbvj
mov ecx, 0x10078bb8
call fcn.10009472
jmp 0x10002790
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 8], 0
je 0x10002858
mov dword [ebp - 0x20], 0x4879
cmp dword [ebp - 0x20], 0x4b41
jle 0x10002822
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
xor eax, eax
mov dword [ebp - 0x18], eax
xor edi, edi
xor eax, ebx
mov dword [ebp - 0x24], eax
mov ebx, eax
mov eax, ebx
lea ecx, [ebp - 0x40]
or eax, edi
cdq
push edx
push eax
call fcn.10001ace
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100027e6
mov eax, dword [eax]
push eax
call fcn.1004699c
pop ecx
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.10005d35
inc edi
cmp edi, 0x6b35
jl 0x100027cd
mov eax, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x36f6
jl 0x100027c4
inc ebx
mov dword [ebp - 0x1c], ebx
cmp ebx, 0x7805
jl 0x100027bf
mov edi, dword [ebp - 0x14]
cmp dword [ebp - 0x20], 0x44ce
jge 0x10002836
push str.necieoifp_sng_azubzxbyg_wofoqr_okfncbhwb_izkwr_rxv_ntjmnn_osg_ztua_zmhov_xdscsyqpr_wzc
call fcn.1004699c
pop ecx
mov dword [edi], 0
cmp dword [edi], 3
jge 0x1000285e
mov edx, dword [ebp - 0x28]
mov ecx, dword [edi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0xc2039807
inc dword [edi]
cmp dword [edi], 3
jl 0x10002844
jmp 0x1000285e
mov eax, dword [ebp + 0xc]
and dword [eax], 0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000297d
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
mov dword [esp + 0x10], 0x1bc5
mov ebx, edx
cmp dword [esp + 0x10], 0x1d9a
push esi
push edi
mov dword [esp + 0x1c], ebx
jle 0x10002a31
push 0
push 0x17ed
call dword [sym.imp.USER32.dll_MapDialogRect]
xor edi, edi
xor ebx, ebx
xor esi, esi
xor eax, eax
mov dword [esp + 0x14], 0x31bb
mov dword [esp + 0x10], eax
xor eax, ebx
lea ecx, [esp + 0x20]
xor eax, edi
cdq
push edx
push eax
call fcn.10001ace
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100029e0
mov eax, dword [eax]
push eax
call fcn.1004699c
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.10005d35
mov eax, dword [esp + 0x10]
add eax, esi
dec dword [esp + 0x14]
mov dword [esp + 0x10], eax
jne 0x100029c6
inc esi
cmp esi, 0x52d8
jl 0x100029b8
inc ebx
cmp ebx, 0x7110
jl 0x100029b6
inc edi
cmp edi, 0x5e7e
jl 0x100029b4
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ebx, dword [esp + 0x1c]
cmp dword [esp + 0x18], 0x19fe
jge 0x10002a46
push str.cozqxjwad_hvuk_vqc_tuj_vmrk_wea
call fcn.1004699c
pop ecx
cmp byte [ebp + 8], 0
je 0x10002ad4
mov dword [esp + 0x10], 0xfe0a8eac
mov dword [esp + 0x10], 0xffffffe5
jmp 0x10002a81
mov byte [esp + 0xf], 0
cmp byte [esp + 0xf], 0
je 0x10002a7d
push 0
push 0x510
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayLock]
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 0xfffffffb
jle 0x10002a62
mov dword [esp + 0x10], 0
jmp 0x10002acb
mov dword [esp + 0x18], 0x6e5b
xor ecx, ecx
mov dword [esp + 0x1c], 0xca31
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x10]
cmp eax, 0x4caf14c9
setge cl
xor eax, eax
test ecx, ecx
setg al
mov dword [esp + 0x1c], eax
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 6
jle 0x10002a92
jmp 0x10002af1
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
jmp 0x10002aec
mov ecx, dword [edx]
mov eax, dword [ebx]
mov dword [eax + ecx*4], 3
inc dword [edx]
cmp dword [edx], 1
jl 0x10002adf
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002bb4
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov dword [esp + 4], 0x62e3
cmp dword [esp + 4], 0x64c1
push esi
push edi
jle 0x10002c22
xor esi, esi
xor edi, edi
xor ebx, ebx
lea eax, [ebx + edi]
or eax, esi
lea ecx, [esp + 0x10]
cdq
push edx
push eax
call fcn.10001ace
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10002bf3
mov eax, dword [eax]
push eax
call fcn.1004699c
pop ecx
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.10005d35
inc ebx
cmp ebx, 0x615d
jl 0x10002bd8
inc edi
cmp edi, 0x13a2
jl 0x10002bd6
inc esi
cmp esi, 0xa27
jl 0x10002bd4
cmp dword [esp + 0xc], 0x627f
jge 0x10002c37
push str.ksauh_mxlssu_tey_hfltl_rhnwkaj_fgprr_sxvpnnnxy_nxl_jdkfrjo
call fcn.1004699c
pop ecx
cmp byte [ebp + 0x14], 0
je 0x10002c62
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x10002c74
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 6
inc dword [edx]
cmp dword [edx], 3
jl 0x10002c4e
jmp 0x10002c74
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x10002c74
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000e088
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1000e0b5
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], eax
push 0x43c1
push 1
push 0x17b
push dword [ebp - 8]
call fcn.1000e12c
add esp, 0x10
jmp 0x1000e128
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1000e0dd
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x1000e128
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1000e10b
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 2
jge 0x1000e128
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x20]
call fcn.10005887
mov dword [eax], 0x16744fa7
jmp 0x1000e100
mov esp, ebp
pop ebp
ret
Function at 0x10010590
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x20]
test eax, eax
je 0x1001062e
lea eax, [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001060e
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x100105f2
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x1001060c
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x1c]
call fcn.10005887
or dword [eax], 0xffffffff
jmp 0x100105e7
jmp 0x1001062c
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1001062c
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x10010653
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 0
push dword [ebp - 0x34]
call fcn.1000ea6a
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10015481
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005e01c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x50
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1001554f
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1001553f
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
push dword [ebp - 0x34]
mov eax, dword [ebp - 0x38]
push dword [eax]
mov eax, dword [ebp - 0x3c]
push dword [eax]
lea eax, [ebp - 0x5c]
push eax
call fcn.1000f03a
add esp, 0x10
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
and dword [ebp - 4], 0
push dword [ebp - 0x44]
mov ecx, dword [ebp - 0x48]
call fcn.100174e2
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x5c]
call fcn.100058eb
jmp 0x1001554d
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x1001556b
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x50], eax
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
push 0
call fcn.1000dc4e
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x10018e9c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov byte [ebp - 8], dl
test cl, cl
je 0x10018ed4
test dl, dl
je 0x10018eba
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ecx], eax
jmp 0x10018f14
xor eax, eax
push eax
mov byte [ebp - 1], al
lea eax, [ebp - 1]
push eax
push ecx
mov ecx, 0x2a74
call fcn.10018e4d
add esp, 0xc
jmp 0x10018f14
cmp byte [ebp + 0x14], 0
je 0x10018eef
xor eax, eax
mov byte [ebp - 2], al
cmp byte [ebp - 2], al
je 0x10018f14
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x10018f14
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x10018f14
push esi
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 3
inc dword [edx]
cmp dword [edx], 1
jl 0x10018f01
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001b711
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0x10], 0
mov byte [ebp - 4], dl
je 0x1001b74a
cmp byte [ebp + 0x14], 0
je 0x1001b738
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1001b786
xor eax, eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
jmp 0x1001b786
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
jmp 0x1001b786
test dl, dl
je 0x1001b761
cmp byte [ecx], 0
je 0x1001b786
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x1001b786
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1001b786
push esi
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [edx]
cmp dword [edx], 2
jl 0x1001b773
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001c6d6
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
mov byte [esp], dl
push ebx
push esi
push edi
test cl, cl
je 0x1001c895
cmp byte [ebp + 0xc], 0
je 0x1001c867
mov dword [esp + 0x14], 0x3c56
cmp dword [esp + 0x14], 0x3ff7
push 0
pop esi
jle 0x1001c759
mov edi, esi
mov dword [esp + 0x10], esi
mov ebx, edi
mov edi, 0x5278
mov eax, ebx
lea ecx, [esp + 0x28]
cdq
push edx
push eax
call fcn.10001ace
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001c731
mov eax, dword [eax]
push eax
call fcn.1004699c
pop ecx
push esi
push 1
lea ecx, [esp + 0x30]
call fcn.10005d35
dec ebx
dec edi
jne 0x1001c719
mov edi, dword [esp + 0x10]
inc edi
mov dword [esp + 0x10], edi
cmp edi, 0x45ea
jl 0x1001c712
cmp dword [esp + 0x14], 0x3af6
jge 0x1001c76e
push str.ueswirtfq_wlgprlk_nssascq_ufrxozwdn_wlbidop_nnuhevlcf_pphk_mbdocimbi_vxli_lixwdqf_vwacfqwf
call fcn.1004699c
pop ecx
mov dword [esp + 0x20], 0x298c
cmp dword [esp + 0x20], 0x2aaa
jle 0x1001c80f
mov edi, esi
mov dword [esp + 0x1c], esi
mov ebx, esi
mov dword [esp + 0x18], esi
mov eax, ebx
mov dword [esp + 0x10], 0x5516
mov dword [esp + 0x14], eax
mov ebx, eax
xor ebx, edi
mov edi, esi
mov eax, ebx
lea ecx, [esp + 0x40]
or eax, edi
cdq
push edx
push eax
call fcn.10001ace
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001c7be
mov eax, dword [eax]
push eax
call fcn.1004699c
pop ecx
push esi
push 1
lea ecx, [esp + 0x48]
call fcn.10005d35
inc edi
cmp edi, 0x7a7c
jl 0x1001c7a4
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
dec eax
dec dword [esp + 0x10]
mov dword [esp + 0x14], eax
jne 0x1001c79e
mov ebx, dword [esp + 0x18]
inc ebx
mov dword [esp + 0x18], ebx
cmp ebx, 0x480d
jl 0x1001c790
inc edi
mov dword [esp + 0x1c], edi
cmp edi, 0x54a7
jl 0x1001c78a
cmp dword [esp + 0x20], 0x2970
jge 0x1001c824
push str.ojohjf_rbooklix_xnsuv_tga_vtjo_xikqr_efjigwio_rymwz_naoyg_tmvcd_mvmpc_qrre_hfsh
call fcn.1004699c
pop ecx
mov ebx, dword [ebp + 0x2c]
cmp dword [ebx], esi
jbe 0x1001c8bb
push 0x1a
pop edi
call fcn.10019c54
push 0x34
xor edx, edx
pop ecx
div ecx
mov eax, edx
cmp eax, edi
jge 0x1001c84c
mov ecx, dword [ebp + 0x20]
movsx edx, byte [ecx]
jmp 0x1001c855
cdq
idiv edi
mov eax, dword [ebp + 0x18]
movsx eax, byte [eax]
mov ecx, dword [ebp + 8]
add edx, eax
push edx
call fcn.1001737a
inc esi
cmp esi, dword [ebx]
jb 0x1001c832
jmp 0x1001c8bb
mov eax, dword [ebp + 0x30]
push 0x1a
pop edi
mov ecx, dword [eax]
cmp ecx, edi
jge 0x1001c87d
mov eax, dword [ebp + 0x34]
movzx edx, word [eax]
add edx, ecx
jmp 0x1001c88a
mov eax, ecx
cdq
idiv edi
mov eax, dword [ebp + 0x10]
movzx eax, word [eax]
add edx, eax
mov ecx, dword [ebp + 0x24]
push edx
call fcn.100172bc
jmp 0x1001c8bb
test dl, dl
je 0x1001c8a8
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x1c]
push dword [eax]
call fcn.100173ae
jmp 0x1001c8bb
mov eax, dword [ebp + 0x28]
cmp byte [eax], 0
je 0x1001c8bb
xor esi, esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001ca54
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x1001ca6b
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x1001ca8d
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x1010c604
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x1010c990
jl 0x1001ca9b
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x1010cc34
jl 0x1001cadb
mov ecx, dword [0x1010d980]
xor ecx, dword [0x1010c604]
and ecx, edi
xor ecx, dword [0x1010d980]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x1010c600], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x1010cc34]
mov dword [0x1010cfc0], eax
pop esi
ret

Function at 0x1001cb68
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005e2e6
call fcn.1005d360
sub esp, 0x10
push ebx
push esi
mov dword [ebp - 0x14], 0x18a7
mov eax, ecx
cmp dword [ebp - 0x14], 0x1c84
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], eax
jle 0x1001cbca
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, edi
mov ecx, 0x10078bb8
cdq
idiv ebx
xor edx, esi
mov eax, edx
cdq
push edx
push eax
call fcn.100055e4
inc ebx
cmp ebx, 0x490c
jl 0x1001cb96
inc edi
cmp edi, 0x4a35
jl 0x1001cb94
inc esi
cmp esi, 0x7f08
jl 0x1001cb92
mov eax, dword [ebp - 0x18]
push eax
push 0x65db
lea edx, [ebp - 0x1c]
call fcn.1001dda4
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x174b
pop ecx
pop ecx
jge 0x1001cbf6
mov edx, str.oqndjzu_ynlpgegne_skeuyce_ecvucnxej_xogbhap_rwsgpbxmd_tgg_cgzkz_ekj_fwxyn_txnleia_sblmoiek_seoydjt_zmw
mov ecx, 0x10078bb8
call fcn.10009472
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret