joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100025df
Capabilities:
Encode data using xor
Get disk information

Disassembly:
mov eax, 0x10050118
call fcn.1004fab8
sub esp, 0x20
mov byte [ebp - 0x18], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10002621
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x10002610
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x10002638
push 0x24d8
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov dword [ebp - 0x2c], 0x74eb
cmp dword [ebp - 0x2c], 0x7834
jle 0x100026a0
mov edi, ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x24], 0x800d
mov esi, ebx
mov dword [ebp - 0x1c], 0x4f45
mov ebx, dword [ebp - 0x20]
mov eax, esi
mov ecx, 0x10067998
xor eax, edi
cdq
push edx
push eax
call fcn.100032d3
add esi, ebx
dec dword [ebp - 0x1c]
jne 0x10002663
mov esi, dword [ebp - 0x28]
add ebx, esi
dec dword [ebp - 0x24]
push 0
mov dword [ebp - 0x20], ebx
pop ebx
jne 0x10002657
inc esi
mov dword [ebp - 0x28], esi
cmp esi, 0x1bd9
jl 0x1000264d
inc edi
cmp edi, 0x4e36
jl 0x1000264a
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x2c], 0x71f7
jge 0x10002610
mov edx, str.ayku_basgbz_qra_wqs_ggrrdej_cbrka
mov ecx, 0x10067998
call fcn.100056ca
jmp 0x10002610

Function at 0x100026de
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10050122
call fcn.1004fab8
sub esp, 0x14
push ebx
push esi
mov dword [ebp - 0x1c], 0x3574
mov ebx, ecx
cmp dword [ebp - 0x1c], 0x3918
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], ebx
jle 0x10002745
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov ebx, 0x6d24
xor esi, esi
mov eax, edi
mov ecx, 0x10067998
xor eax, esi
cdq
push edx
push eax
call fcn.100032d3
inc esi
cmp esi, 0x2d64
jl 0x10002714
mov esi, dword [ebp - 0x18]
add edi, esi
dec ebx
jne 0x10002712
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0xd27
jl 0x1000270b
mov ebx, dword [ebp - 0x20]
cmp byte [ebp + 8], 0
je 0x1000276f
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x1000277e
push 0x6c62
push 1
push 0
mov edx, 0x22d1
xor cl, cl
call fcn.10001ceb
add esp, 0xc
jmp 0x1000277e
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ecx
push eax
mov ecx, ebx
call fcn.10003b78
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x346e
jge 0x1000279a
mov edx, str.nnsvgf_zeqbk_virdz_hyouj_kqehsqbr_bpi_uxbzjucex_lkdwbnw_jsuzeu_zpayfahrh_guqr
mov ecx, 0x10067998
call fcn.100056ca
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003b78
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x10003b8f
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x10003bb1
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x10068b24
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x10068eb0
jl 0x10003bbf
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x10069154
jl 0x10003bff
mov ecx, dword [0x10069ea0]
xor ecx, dword [0x10068b24]
and ecx, edi
xor ecx, dword [0x10069ea0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x10068b20], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10069154]
mov dword [0x100694e0], eax
pop esi
ret
Function at 0x100064b5
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
mov dword [esp + 0xc], 0x353
cmp dword [esp + 0xc], 0x660
push esi
push edi
jle 0x1000652d
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
xor esi, esi
xor edi, edi
xor ebx, ebx
mov ecx, ebx
lea eax, [edi + esi]
sar eax, cl
lea ecx, [esp + 0x18]
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100064fe
mov eax, dword [eax]
push eax
call fcn.100379e3
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.1000384d
inc ebx
cmp ebx, 0x453a
jl 0x100064e1
inc edi
cmp edi, 0x4b20
jl 0x100064df
inc esi
cmp esi, 0x314e
jl 0x100064dd
cmp byte [ebp + 8], 0
je 0x1000653d
push 0
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
jmp 0x10006556
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x10006556
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
cmp dword [esp + 0x14], 0x1cd
jge 0x1000656b
push str.vil_gablafqqu_cmntrvug_vabvldd_ipduhw_ajuntbqy_uge_vnyknqy_ppkcf_garti_kpga_gjrurq
call fcn.100379e3
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100065ef
Capabilities:
Suspend thread

Disassembly:
mov eax, 0x100502c2
call fcn.1004fab8
sub esp, 0x1c
mov byte [ebp - 0x18], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10006630
push 0
push ecx
lea edx, [ebp - 0x11]
mov byte [ebp - 0x11], 0
mov ecx, 0x7b5
call fcn.100063b3
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x24], 0x7ca0
cmp dword [ebp - 0x24], 0x7f0d
jle 0x1000669a
xor esi, esi
mov dword [ebp - 0x20], esi
xor edi, edi
mov dword [ebp - 0x1c], edi
mov ecx, edi
mov dword [ebp - 0x28], esi
xor ebx, ebx
shl esi, cl
xor edi, edi
mov ecx, edi
mov eax, ebx
sar eax, cl
mov ecx, 0x10067998
or eax, esi
cdq
push edx
push eax
call fcn.100032d3
inc edi
cmp edi, 0x6e80
jl 0x10006655
inc ebx
cmp ebx, 0x185a
jl 0x10006653
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x70b7
jl 0x1000664a
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x5f7f
jl 0x10006645
mov byte [ebp - 0x12], 0
cmp byte [ebp - 0x12], 0
je 0x100066ac
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x7a5e
jge 0x1000661f
mov edx, str.xge_ndgar_rpmfzx_ksqwnmtl_hpvmb
mov ecx, 0x10067998
call fcn.100056ca
jmp 0x1000661f
Function at 0x10006906
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov byte [esp + 0x14], dl
je 0x10006949
test dl, dl
je 0x1000692b
mov dword [ecx], 1
jmp 0x10006a00
push 0x1db1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextAlign]
jmp 0x10006a00
xor ebx, ebx
cmp byte [ebp + 0xc], bl
je 0x100069f3
mov byte [esp + 0x13], bl
mov dword [esp + 0x1c], 0x4c0
cmp dword [esp + 0x1c], 0x821
jle 0x100069c6
mov esi, ebx
mov edi, ebx
mov ecx, ebx
mov dword [esp + 0x18], ebx
mov eax, edi
sar eax, cl
lea ecx, [esp + 0x20]
xor eax, esi
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10006990
mov eax, dword [eax]
push eax
call fcn.100379e3
pop ecx
push ebx
push 1
lea ecx, [esp + 0x28]
call fcn.1000384d
mov ecx, dword [esp + 0x18]
inc ecx
mov dword [esp + 0x18], ecx
cmp ecx, 0x7300
jl 0x10006974
inc edi
cmp edi, 0x7681
jl 0x1000696e
inc esi
cmp esi, 0x3dd0
jl 0x1000696c
cmp byte [esp + 0x13], bl
je 0x100069dc
push ebx
push ebx
mov dl, 1
mov ecx, 0x49d7
call fcn.10006906
pop ecx
pop ecx
cmp dword [esp + 0x1c], 0x46c
jge 0x10006a00
push str.tlcrce_lmwi_ozzaqiw_cxrur_zxvsmlldd_mqxjphhu_brwtltl_zyteu_lnivgla_uqiczmpu_hfo_dcrslwqd_blyhc_xaqywn
call fcn.100379e3
pop ecx
jmp 0x10006a00
push 0x24d8
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000934e
Capabilities:
Get disk information
Suspend thread

Disassembly:
mov eax, 0x100503d2
call fcn.1004fab8
sub esp, 0x10
push ebx
push esi
mov dword [ebp - 0x18], 0x5337
cmp dword [ebp - 0x18], 0x5707
push edi
mov dword [ebp - 0x10], esp
jle 0x100093b1
push 0x1668
push 0x8f5
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x10067998
or eax, esi
cdq
push edx
push eax
call fcn.100032d3
inc edi
cmp edi, 0x842
jl 0x1000938e
inc esi
cmp esi, 0x4943
jl 0x1000938c
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x523c
jge 0x100093cd
mov edx, str.ckhuqrqss_qnduujpe_zhunxlub_hgx_eaxyt_adty_omqt_uqexdbk
mov ecx, 0x10067998
call fcn.100056ca
cmp byte [ebp + 8], 0
je 0x10009408
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x10009418
push 0x24d8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
jmp 0x10009418
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10009418
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000c963
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x4c
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1000c988
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
push 0
push dword [ebp - 0x10]
call fcn.1000cde8
pop ecx
pop ecx
jmp 0x1000ca7a
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1000ca5c
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1000c9dc
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0x1d
jg 0x1000ca5a
mov dword [ebp - 0x28], 0x76c51653
mov dword [ebp - 8], 0
jmp 0x1000c9fb
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 4
jge 0x1000ca0e
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x4c], 0xa7084bc9
jmp 0x1000c9f4
push 4
pop eax
shl eax, 1
mov dword [ebp + eax - 0x4c], 1
cmp dword [ebp - 0x28], 0
jne 0x1000ca4c
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebp - 0x3c], eax
push 4
pop eax
shl eax, 1
cmp dword [ebp + eax - 0x4c], 0xfffffffd
jne 0x1000ca3e
mov dword [ebp - 0xc], 1
jmp 0x1000ca42
and dword [ebp - 0xc], 0
push 4
pop eax
shl eax, 0
mov eax, dword [ebp + eax - 0x4c]
mov eax, dword [ebp - 0x2c]
mov dword [eax], 0xf928d9ba
jmp 0x1000c9d1
jmp 0x1000ca7a
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x1000ca7a
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov esp, ebp
pop ebp
ret

Function at 0x1000cbba
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1000cbee
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1000cbe2
push 0
call dword [sym.imp.COMDLG32.dll_FindTextW]
jmp 0x1000cbec
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x1000cc0f
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
push 0x5285
push dword [ebp - 8]
push dword [ebp - 0xc]
push 0
call fcn.1000cd07
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1000cc2f
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1000cca0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1000cc6b
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1000cc69
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
jmp 0x1000cc9e
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1000cc9e
push 0x9b4
push 1
push 1
push 0
push 0x5e21
push 0x5ce2
call fcn.1000b145
add esp, 0x18
jmp 0x1000cd03
lea eax, [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1000ccbe
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
jmp 0x1000cd03
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 2
jmp 0x1000cce0
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jl 0x1000cd03
mov byte [ebp - 2], 0
push 0x292a
push 1
lea eax, [ebp - 2]
push eax
push 0
call fcn.1000b00d
add esp, 0x10
jmp 0x1000ccd5
mov esp, ebp
pop ebp
ret

Function at 0x1000cd36
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x28]
test eax, eax
je 0x1000cdb1
lea eax, [ebp + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1000cd8d
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1000cd8b
push 0x24d8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
jmp 0x1000cdaf
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x1000cde4
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
push 0
push 0x1bf0
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push dword [ebp - 0x34]
push dword [ebp - 0x38]
call fcn.1000d1f9
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x1001a46f
Capabilities:
Encode data using xor
Suspend thread

Disassembly:
mov eax, 0x1005066a
call fcn.1004fab8
sub esp, 0x14
mov byte [ebp - 0x14], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x1001a4aa
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1001a499
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x20], 0x72a8
cmp dword [ebp - 0x20], 0x7380
jle 0x1001a514
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x18], edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov edi, edx
xor esi, esi
mov ecx, esi
mov eax, ebx
sar eax, cl
mov ecx, 0x10067998
xor eax, edi
cdq
push edx
push eax
call fcn.100032d3
inc esi
cmp esi, 0x5eb1
jl 0x1001a4cf
inc ebx
cmp ebx, 0x25be
jl 0x1001a4cd
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x739d
jl 0x1001a4c4
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0xcde
jl 0x1001a4bf
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1001a532
push 0x47bb
push 0
push ecx
push ecx
mov edx, 0x2313
call fcn.10019b46
add esp, 0x10
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x726c
jge 0x1001a499
mov edx, str.fnkp_smopom_aqd_klxgel_xfucvicm_upnsz
mov ecx, 0x10067998
call fcn.100056ca
jmp 0x1001a499

Function at 0x1001b41a
Capabilities:
Get file size

Disassembly:
mov eax, 0x100506a4
call fcn.1004fab8
sub esp, 0x24
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
je 0x1001b453
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x20], esi
mov dword [esi], 7
cmp dword [esi], 0xffffffef
jne 0x1001b442
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x18], 0x16db
cmp dword [ebp - 0x18], 0x185c
jle 0x1001b4b0
xor edi, edi
xor ebx, ebx
xor esi, esi
mov ecx, esi
lea eax, [ebx + edi]
sar eax, cl
mov ecx, 0x10067998
cdq
push edx
push eax
call fcn.100032d3
inc esi
cmp esi, 0x3fc7
jl 0x1001b47e
inc ebx
cmp ebx, 0x645c
jl 0x1001b47c
inc edi
cmp edi, 0x48b4
jl 0x1001b47a
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x14], 0
jmp 0x1001b4c7
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x2c], 0xffffffff
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1001b4b9
mov dword [ebp - 4], 4
cmp dword [ebp - 0x18], 0x1545
jge 0x1001b50e
mov edx, str.owszvirrl_blwd_idqqyfxf_eef_nbhyeo_wkkr
mov ecx, 0x10067998
call fcn.100056ca
jmp 0x1001b50e
or dword [ebp - 4], 0xffffffff
xor edx, edx
mov ecx, dword [esi]
mov eax, dword [esi]
cmp ecx, eax
mov eax, dword [ebp - 0x24]
setne dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [esi]
setle bl
xor ecx, ecx
cmp ebx, eax
setge cl
mov dword [ebp - 0x18], ecx
dec dword [esi]
jmp 0x1001b45c
Function at 0x1001b5fa
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 8], 0
mov byte [ebp - 4], cl
je 0x1001b629
test cl, cl
je 0x1001b61a
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x1001b643
call fcn.1001b647
jmp 0x1001b643
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetFocus]
jmp 0x1001b643
cmp byte [ebp + 0x10], 0
je 0x1001b636
mov eax, dword [ebp + 0xc]
inc dword [eax]
jmp 0x1001b643
cmp byte [edx], 0
je 0x1001b643
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov esp, ebp
pop ebp
ret

Function at 0x1001bbfc
Capabilities:
Get disk information

Disassembly:
mov eax, 0x100506ae
call fcn.1004fab8
sub esp, 0x28
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x1001bc9e
mov dword [ebp - 0x18], 0x11e4
cmp dword [ebp - 0x18], 0x151a
jle 0x1001bc4e
xor esi, esi
mov edi, esi
mov ebx, 0x1005
mov eax, edi
mov ecx, 0x10067998
cdq
push edx
push eax
call fcn.100032d3
dec edi
dec ebx
jne 0x1001bc32
inc esi
cmp esi, 0xb2f
jl 0x1001bc2b
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1001bc63
push 0x305
push 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0xed9
jge 0x1001bc7f
mov edx, str.deogbwdy_pgaxlc_gdhtejvq
mov ecx, 0x10067998
call fcn.100056ca
jmp 0x1001bd25
mov dword [ebp - 0x1c], 0x7a93
cmp dword [ebp - 0x1c], 0x7d03
jle 0x1001bd02
xor edi, edi
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x18], 0x4152
mov ecx, ebx
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0x34]
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001bcd6
mov eax, dword [eax]
push eax
call fcn.100379e3
pop ecx
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.1000384d
add ebx, esi
dec dword [ebp - 0x18]
jne 0x1001bcbb
inc esi
cmp esi, 0x7b69
jl 0x1001bcb2
inc edi
cmp edi, 0x4535
jl 0x1001bcb0
push 0x24d8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
cmp dword [ebp - 0x1c], 0x7a26
jge 0x1001bd25
push str.vlgtoyc_uyregrsjx_tfllwq_qiavlvqo_ncl_juvcckp_vnyr_tihxj_mfjiwji_vfc_fkyilwovs_dcvtmald_zwzjjon_ruoetq
call fcn.100379e3
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10026550
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100265b1
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100265a0
mov byte [ebp - 1], 0
push 0x5c4d
push 0
lea eax, [ebp - 1]
push eax
push 0x2cd3
push 0x24af
push 0x1b94
push 0x51f0
push 0x2f9d
call fcn.100294cb
add esp, 0x20
jmp 0x100265af
push 0x24d8
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
jmp 0x100265cf
lea eax, [ebp + 0x10]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
push 0
push dword [ebp - 0xc]
mov eax, dword [ebp - 0x10]
push dword [eax]
call fcn.10024d94
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1002c4b0
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10050a81
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x70
push esi
push edi
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1002c5d2
lea eax, [ebp + 0x14]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1002c5b8
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call fcn.10024bca
mov dword [ebp - 0x14], eax
lea ecx, [ebp - 0x4c]
call fcn.100086c0
and dword [ebp - 4], 0
push 2
push dword [ebp - 0x14]
call fcn.10023323
pop ecx
pop ecx
test eax, eax
jne 0x1002c590
lea eax, [ebp - 0x7c]
push eax
call fcn.10023380
pop ecx
mov esi, eax
lea edi, [ebp - 0x58]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea esi, [ebp - 0x58]
lea edi, [ebp - 0x64]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax]
call fcn.10024c01
mov dword [ebp - 0x24], eax
lea eax, [ebp - 0x64]
push eax
push dword [ebp - 0x24]
push dword [ebp - 0x14]
lea eax, [ebp - 0x70]
push eax
call fcn.10028186
add esp, 0x10
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov byte [ebp - 4], 1
push dword [ebp - 0x2c]
lea ecx, [ebp - 0x4c]
call fcn.1002d199
mov byte [ebp - 4], 0
lea ecx, [ebp - 0x70]
call fcn.10008822
lea eax, [ebp - 0x4c]
push eax
mov ecx, dword [ebp - 0x30]
call fcn.1002d1ce
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
call fcn.10008822
jmp 0x1002c628
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SelectPalette]
jmp 0x1002c628
lea eax, [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x1002c61e
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x1002c61c
push 0
push 0x5d80
push 0x638e
push 0x2c47
push 0x4e04
call fcn.100284f2
add esp, 0x14
jmp 0x1002c628
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret