joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003704c
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov byte [ebp - 8], cl
test dl, dl
je 0x10037096
cmp byte [ebp + 8], 0
je 0x1003706c
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.OLEAUT32.dll_VariantTimeToDosDateTime]
jmp 0x100370bf
lea eax, [ebp - 1]
mov byte [ebp - 1], 0
push eax
push 1
push 0x7512
push 0x7ec9
push 0x67ba
xor dl, dl
mov ecx, 0x1391
call fcn.100354d4
add esp, 0x14
jmp 0x100370bf
test cl, cl
je 0x100370ae
push 0x158
push 0x131f
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
jmp 0x100370bf
xor eax, eax
mov byte [ebp - 2], al
cmp byte [ebp - 2], al
je 0x100370bf
push eax
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esp, ebp
pop ebp
ret

Function at 0x10037551
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005f1a5
call fcn.1005d8a0
sub esp, 0x1c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x100375ac
cmp byte [ebp + 0x10], 0
je 0x10037585
mov dword [ecx], 0xfffffff6
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x10037574
push 1
push 0x71cf
push 0
mov edx, 0x5b29
mov ecx, 0x8e
call fcn.10034b46
add esp, 0xc
jmp 0x10037574
mov dword [ebp - 0x20], 0x609f
cmp dword [ebp - 0x20], 0x6127
jle 0x1003761a
xor edi, edi
xor esi, esi
mov dword [ebp - 0x1c], esi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
and dword [ebp - 0x24], 0
mov eax, esi
cdq
idiv ebx
mov esi, dword [ebp - 0x24]
mov ebx, 0x1cf2
mov dword [ebp - 0x28], edx
mov eax, esi
mov ecx, 0x100788d8
xor eax, edi
cdq
push edx
push eax
call fcn.10001e5c
add esi, dword [ebp - 0x28]
dec ebx
jne 0x100375dc
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 0x18], ebx
cmp ebx, 0x5525
jl 0x100375c8
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x613f
jl 0x100375c3
inc edi
cmp edi, 0x5db8
jl 0x100375be
cmp byte [ebp + 0x18], 0
je 0x1003764b
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
inc dword [eax]
cmp dword [eax], 0
je 0x1003763d
mov eax, dword [ecx]
cmp dword [eax], 0
je 0x10037638
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
xor ecx, ecx
inc ecx
jmp 0x1003763f
xor ecx, ecx
mov eax, dword [ebp + 8]
mov dword [eax], ecx
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
jmp 0x1003765f
push 0x5469
xor dl, dl
mov byte [ebp - 0x12], 0
lea ecx, [ebp - 0x12]
call fcn.10035204
pop ecx
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x5d1c
jge 0x10037574
mov edx, str.xazn_ohfdmru_gyi_bask_rcv_hfrgcsz_mivj
mov ecx, 0x100788d8
call fcn.10003d65
jmp 0x10037574
Function at 0x10037737
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005f1af
call fcn.1005d8a0
sub esp, 0x10
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, edx
mov byte [ebp - 0x14], cl
je 0x10037844
test cl, cl
je 0x10037783
mov eax, dword [ebp + 0x20]
cmp byte [eax], 0
je 0x100378a0
push 0x5ff6
push ecx
push 0
mov edx, 0x478c
call fcn.100371a5
add esp, 0xc
jmp 0x100378a0
mov dword [ebp - 0x18], 0x7a93
cmp dword [ebp - 0x18], 0x7da4
jle 0x100377e8
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
xor esi, esi
mov dword [ebp + 0x18], esi
xor edi, edi
and dword [ebp - 0x1c], 0
mov ebx, esi
mov esi, dword [ebp - 0x1c]
mov ecx, edi
shl ebx, cl
mov eax, ebx
mov ecx, 0x100788d8
xor eax, esi
cdq
push edx
push eax
call fcn.10001e5c
inc esi
cmp esi, 0x5b11
jl 0x100377b6
mov esi, dword [ebp + 0x18]
inc edi
cmp edi, 0x28e5
jl 0x100377a9
inc esi
mov dword [ebp + 0x18], esi
cmp esi, 0x617f
jl 0x100377a7
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x78b0
jge 0x10037804
mov edx, str.ejvbxro_nmm_iyuiezggf_ruwjboav_hna_zpvsxxj_vgrlsozpo_bzhjyopl
mov ecx, 0x100788d8
call fcn.10003d65
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x100378a0
mov esi, dword [ebp + 0x24]
mov ecx, dword [edx]
mov eax, dword [esi]
and dword [eax + ecx*4], 0
inc dword [edx]
cmp dword [edx], 1
jl 0x10037819
jmp 0x100378a0
cmp byte [ebp + 0x14], 0
je 0x10037883
mov esi, dword [ebp + 8]
mov dword [esi], 0
jmp 0x1003787c
push 0x6c39
push 0x30fd
push dword [ebp + 0x1c]
mov edx, esi
mov cl, 1
push 0x49a7
push 1
push 0x49fb
call fcn.10034aff
add esp, 0x18
inc dword [esi]
cmp dword [esi], 4
jl 0x10037855
jmp 0x100378a0
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
jmp 0x1003789b
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x1305
inc dword [edx]
cmp dword [edx], 4
jl 0x1003788e
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10037919
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005f1b9
call fcn.1005d8a0
sub esp, 0x2c
mov byte [ebp - 0x14], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x100379f9
mov dword [ebp - 0x1c], 0x6ec7
cmp dword [ebp - 0x1c], 0x71b1
jle 0x100379ae
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SaveDC]
xor esi, esi
mov ebx, esi
mov dword [ebp - 0x18], 0x659
xor edi, edi
mov ecx, edi
mov eax, ebx
shl eax, cl
lea ecx, [ebp - 0x34]
cdq
push edx
push eax
call fcn.10001a75
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10037983
mov eax, dword [eax]
push eax
call fcn.10047084
pop ecx
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.10002352
inc edi
cmp edi, 0x3c28
jl 0x10037968
dec ebx
dec dword [ebp - 0x18]
jne 0x10037966
inc esi
cmp esi, 0x56b5
jl 0x1003795d
cmp dword [ebp - 0x1c], 0x6ba5
jge 0x100379c2
push str.baz_ezphlzy_czfj_unqeanuyf_ffmklfh_lrbeyug_mjufy_aaetyiu_kamuae_zqxwykta_pkwakgi
call fcn.10047084
pop ecx
mov esi, dword [ebp + 0xc]
or dword [ebp - 4], 0xffffffff
mov dword [esi], 2
jmp 0x100379e3
push ecx
push 1
push ecx
push ecx
mov ecx, dword [ebp + 0x10]
call fcn.10038e33
add esp, 0x10
dec dword [esi]
cmp dword [esi], 0
jge 0x100379d1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], 0x2f20
cmp dword [ebp - 0x1c], 0x2f3b
jle 0x10037a30
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x100788d8
xor eax, esi
cdq
push edx
push eax
call fcn.10001e5c
inc edi
cmp edi, 0x7b2a
jl 0x10037a0d
inc esi
cmp esi, 0x5dc2
jl 0x10037a0b
mov eax, dword [ebp + 0x14]
inc dword [eax]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x2dc6
jge 0x100379e8
mov edx, str.rhmidn_ltt_luermd_ervo_xlo_yojdrkjh_dwfvytz_xalg_jmwrrruk_wnum_khhyxn_xgflnnssq
mov ecx, 0x100788d8
call fcn.10003d65
jmp 0x100379e8
Function at 0x10038190
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005f1d7
call fcn.1005d8a0
sub esp, 0x20
push ebx
push esi
mov byte [ebp - 0x14], cl
mov dword [ebp - 0x28], 0x20a8
cmp dword [ebp - 0x28], 0x222d
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], edx
jle 0x10038209
xor edi, edi
mov dword [ebp - 0x1c], edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
and dword [ebp - 0x20], 0
mov ecx, ebx
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 0x24], edi
sar edi, cl
mov eax, edi
mov ecx, 0x100788d8
or eax, ebx
cdq
push edx
push eax
call fcn.10001e5c
inc ebx
cmp ebx, 0x3639
jl 0x100381d1
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 0x18], ebx
cmp ebx, 0x1429
jl 0x100381c3
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x48ca
jl 0x100381be
cmp byte [ebp + 0x14], 0
je 0x100382fb
cmp byte [ebp + 0x18], 0
je 0x100382d6
mov dword [ebp - 0x24], 0x4865
cmp dword [ebp - 0x24], 0x4898
jle 0x1003828c
xor ebx, ebx
xor eax, eax
mov dword [ebp + 0x14], eax
xor edi, edi
mov dword [ebp - 0x20], edi
mov ecx, edi
mov dword [ebp - 0x18], 0x62ad
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x1c], ecx
lea eax, [edi + ebx]
xor eax, ecx
mov ecx, 0x100788d8
cdq
push edx
push eax
call fcn.10001e5c
mov ecx, dword [ebp - 0x1c]
dec ecx
dec dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
jne 0x10038248
mov edi, dword [ebp - 0x20]
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x31b
jl 0x10038239
mov eax, dword [ebp + 0x14]
inc eax
mov dword [ebp + 0x14], eax
cmp eax, 0x59d5
jl 0x10038234
inc ebx
cmp ebx, 0x2a4
jl 0x1003822f
mov eax, dword [ebp - 0x2c]
cmp byte [eax], 0
je 0x1003829e
push ecx
push 0
call fcn.100389c3
pop ecx
pop ecx
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x454e
jge 0x100382ba
mov edx, str.ila_qteg_tpra_guznk_mgjo_ngsjucm_uklxfeyv_hrfk
mov ecx, 0x100788d8
call fcn.10003d65
jmp 0x10038328
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x10038328
mov edi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [edi]
mov dword [eax + ecx*4], 2
inc dword [edx]
cmp dword [edx], 3
jl 0x100382e7
jmp 0x10038328
cmp byte [ebp - 0x14], 0
je 0x10038323
push 0
push 0x1196
push 0x214a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
jmp 0x10038328
mov eax, dword [ebp + 8]
dec dword [eax]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x28], 0x1ff6
jge 0x10038347
mov edx, str.iwnonx_gdkt_asx_cyfl_fjihwk_xncugbtmk_ein_ynhs_eqi_vftfpa_ztpjegrc
mov ecx, 0x100788d8
call fcn.10003d65
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10038372
Capabilities:
Encode data using xor
Resume thread

Disassembly:
mov eax, 0x1005f1e1
call fcn.1005d8a0
sub esp, 0x1c
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x100383ac
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1003839b
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov esi, dword [ebp + 0x10]
xor ebx, ebx
mov dword [esi], ebx
jmp 0x100383c6
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x100383c4
push ebx
call dword [sym.imp.KERNEL32.dll_GetThreadPriority]
inc dword [esi]
cmp dword [esi], 3
jle 0x100383b5
mov dword [ebp - 0x24], 0x2722
cmp dword [ebp - 0x24], 0x2adc
jle 0x1003842d
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], 0x58c7
mov edi, ebx
mov esi, ebx
mov ebx, dword [ebp - 0x18]
lea eax, [esi + edi]
mov ecx, 0x100788d8
xor eax, ebx
cdq
push edx
push eax
call fcn.10001e5c
inc esi
cmp esi, 0x44e1
jl 0x100383ef
inc edi
push 0
pop ebx
cmp edi, 0x770b
jl 0x100383ea
mov esi, dword [ebp - 0x20]
add dword [ebp - 0x18], esi
dec dword [ebp - 0x1c]
jne 0x100383e8
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0xd8e
jl 0x100383de
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x24], 0x2489
jge 0x1003839b
mov edx, str.nxplqo_gswlacjty_tqbsy_zbh_rxatesn
mov ecx, 0x100788d8
call fcn.10003d65
jmp 0x1003839b

Function at 0x100385d8
Capabilities:
Delete file
Encode data using xor

Disassembly:
mov eax, 0x1005f1eb
call fcn.1005d8a0
sub esp, 0xc
push ebx
push esi
mov dword [ebp - 0x14], 0x7379
mov eax, edx
cmp dword [ebp - 0x14], 0x75d9
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], eax
jle 0x10038687
xor esi, esi
xor edi, edi
xor ebx, ebx
lea eax, [ebx + edi]
mov ecx, 0x100788d8
xor eax, esi
cdq
push edx
push eax
call fcn.10001e5c
inc ebx
cmp ebx, 0x378b
jl 0x1003860a
inc edi
cmp edi, 0x16fd
jl 0x10038608
inc esi
cmp esi, 0x56f7
jl 0x10038606
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0x1111
push 0x3d5
push 0x96e
push 0
push 0x24c6
push 0x472
call edi
mov esi, dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
push 0x22ce
push 0x102f
push 0x31b
push 0x14e8
call edi
push eax
call esi
push eax
call dword [sym.imp.GDI32.dll_MaskBlt]
mov eax, dword [ebp - 0x18]
cmp byte [ebp + 8], 0
je 0x100386a0
cmp byte [eax], 0
je 0x100386a8
push 1
xor dl, dl
mov cl, 1
call fcn.1003704c
pop ecx
jmp 0x100386a8
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x71bb
jge 0x100386c4
mov edx, str.lpmjqezi_hrbtlgeok_qaiyk_ifcv_ysyspg_icdtkfbez_hzyfvia
mov ecx, 0x100788d8
call fcn.10003d65
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10038aa5
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
je 0x10038c3b
mov dword [esp + 0x18], 0x6abd
cmp dword [esp + 0x18], 0x6d64
push 0
pop esi
jle 0x10038b3a
mov dword [esp + 0x14], esi
mov dword [esp + 0xc], esi
mov dword [esp + 0x10], 0x4193
mov edi, dword [esp + 0xc]
mov ebx, esi
mov eax, edi
lea ecx, [esp + 0x28]
cdq
idiv ebx
mov eax, edx
cdq
push edx
push eax
call fcn.10001a75
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10038b03
mov eax, dword [eax]
push eax
call fcn.10047084
pop ecx
push esi
push 1
lea ecx, [esp + 0x30]
call fcn.10002352
inc ebx
cmp ebx, 0x2bda
jl 0x10038ae6
mov edi, dword [esp + 0x14]
add dword [esp + 0xc], edi
dec dword [esp + 0x10]
jne 0x10038ae0
inc edi
mov dword [esp + 0x14], edi
cmp edi, 0x7b31
jl 0x10038ad4
cmp dword [esp + 0x18], 0x67a9
jge 0x10038b4f
push str.heh_btdgks_gndx_lfb_bawbt_pcccdwu_xymp_aclujsrk_jqlb
call fcn.10047084
pop ecx
mov dword [esp + 0x14], 0x4f3
cmp dword [esp + 0x14], 0x80c
jle 0x10038c05
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov edi, esi
mov ebx, esi
mov eax, esi
mov dword [esp + 0xc], esi
mov ecx, esi
mov dword [esp + 0x18], esi
add eax, ebx
xor eax, ecx
lea ecx, [esp + 0x40]
or eax, edi
cdq
push edx
push eax
call fcn.10001a75
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10038b97
mov eax, dword [eax]
push eax
call fcn.10047084
pop ecx
push esi
push 1
lea ecx, [esp + 0x48]
call fcn.10002352
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0xc]
inc ecx
mov dword [esp + 0x18], ecx
cmp ecx, 0x53f9
jl 0x10038b7b
inc eax
mov dword [esp + 0xc], eax
cmp eax, 0x2718
jl 0x10038b75
inc ebx
cmp ebx, 0x5d00
jl 0x10038b6f
inc edi
cmp edi, 0x610e
jl 0x10038b6d
push 0x18ce
push 0x2211
push 0x233
push 0xec2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
mov edx, dword [ebp + 0x10]
cmp dword [edx], esi
jne 0x10038c1c
mov ecx, dword [ebp + 0x14]
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [edx]
imul eax, dword [ecx]
test eax, eax
je 0x10038c1f
xor esi, esi
inc esi
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
cmp dword [esp + 0x14], 0x336
jge 0x10038c8e
push str.pajry_afznwu_isdez_iotg_uth_crzxpp_mthwezuty_afqo_emigxc_pztuz_rnhspww
call fcn.10047084
pop ecx
jmp 0x10038c8e
mov edi, dword [ebp + 0x1c]
xor esi, esi
mov dword [edi], esi
jmp 0x10038c82
push 1
lea ecx, [esp + 0x20]
call fcn.10001fe6
mov dword [esp + 0xc], esi
jmp 0x10038c68
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x1c]
mov dword [eax + ecx*4], 0xbfb2
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 1
jl 0x10038c55
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x1c]
cmp dword [eax], esi
jne 0x10038c89
call fcn.10002048
dec dword [edi]
cmp dword [edi], 0xffffffef
jg 0x10038c44
jmp 0x10038c8e
call fcn.10002048
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10038ca8
Capabilities:
Delete directory

Disassembly:
mov eax, 0x1005f1f5
call fcn.1005d8a0
sub esp, 0x18
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edi
je 0x10038db9
mov dword [ebp - 0x18], 0x4967
cmp dword [ebp - 0x18], 0x4c5f
jle 0x10038d5f
mov dword [ebp - 0x1c], 0x1d46
cmp dword [ebp - 0x1c], 0xc1d
jge 0x10038d31
lea eax, [ebp - 0x14]
mov esi, 0x10066bb8
push eax
push esi
call fcn.10047342
pop ecx
pop ecx
jmp 0x10038d26
dec eax
mov dword [ebp - 0x14], eax
lea eax, [ebp - 0x20]
push eax
push esi
call fcn.10047342
mov eax, dword [ebp - 0x20]
inc eax
cdq
sub eax, edx
sar eax, 1
push eax
push str._ld_n
call fcn.10047084
add esp, 0x10
mov eax, dword [ebp - 0x14]
test eax, eax
jne 0x10038d01
dec eax
mov dword [ebp - 0x14], eax
xor esi, esi
xor ebx, ebx
mov ecx, ebx
mov eax, esi
shl eax, cl
mov ecx, 0x100788d8
cdq
push edx
push eax
call fcn.10001e5c
inc ebx
cmp ebx, 0x6906
jl 0x10038d35
inc esi
cmp esi, 0x471b
jl 0x10038d33
call fcn.100337a3
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x4693
jge 0x10038d9a
mov edx, str.elfxcnmf_qytvpuo_mfvki_whk_ctwpbp
mov ecx, 0x100788d8
call fcn.10003d65
jmp 0x10038d9a
mov edx, dword [ebp + 8]
mov dword [edx], 0
jmp 0x10038db2
mov ecx, dword [edx]
mov eax, dword [edi]
mov dword [eax + ecx*4], 0xa52b3395
inc dword [edx]
cmp dword [edx], 1
jl 0x10038da5
jmp 0x10038dc1
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100395d1
Capabilities:
Get system information on windows

Disassembly:
mov eax, 0x1005f219
call fcn.1005d8a0
sub esp, 0x3c
push ebx
push esi
mov byte [ebp - 0x14], cl
xor esi, esi
mov dword [ebp - 0x28], 0xf7b
cmp dword [ebp - 0x28], 0x1275
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x38], edx
jle 0x10039671
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov ebx, esi
mov edi, 0x100788d8
mov dword [ebp - 0x24], ebx
mov eax, esi
mov dword [ebp - 0x20], esi
mov ecx, eax
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], esi
sar ebx, cl
mov ecx, esi
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x18], ecx
mov eax, ebx
and eax, ecx
mov ecx, edi
and eax, esi
cdq
push edx
push eax
call fcn.10001e5c
mov ecx, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x2650
jl 0x10039624
inc esi
push 0
mov dword [ebp - 0x1c], esi
cmp esi, 0x1a3c
pop esi
jl 0x1003961c
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x6f55
jl 0x10039612
inc ebx
mov dword [ebp - 0x24], ebx
cmp ebx, 0x14b3
jl 0x1003960d
jmp 0x10039676
mov edi, 0x100788d8
cmp byte [ebp - 0x14], 0
je 0x10039789
mov dword [ebp - 0x24], 0x32db
cmp dword [ebp - 0x24], 0x353f
jle 0x100396ba
mov ebx, esi
mov dword [ebp - 0x20], esi
mov ecx, esi
mov eax, ebx
shl eax, cl
mov ecx, edi
cdq
push edx
push eax
call fcn.10001e5c
inc esi
cmp esi, 0x4174
jl 0x10039695
inc ebx
push 0
pop esi
cmp ebx, 0x2096
jl 0x10039692
mov dword [ebp - 0x2c], 0x125d16df
lea ecx, [ebp - 0x44]
mov dword [ebp - 0x30], 8
xor ebx, ebx
mov dword [ebp - 0x38], 0x1836ccb0
inc ebx
mov dword [ebp - 0x38], 0x10d21dfe
mov dword [ebp - 0x38], esi
mov dword [ebp - 0x38], ebx
mov dword [ebp - 0x38], 0xffffffff
push ebx
call fcn.10001fe6
mov dword [ebp - 4], esi
mov dword [ebp - 0x34], 0xfffa
mov dword [ebp - 0x18], esi
jmp 0x1003970e
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x44]
mov dword [eax + ecx*4], 0xe9fb1c03
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x100396fe
push 0x6218
lea eax, [ebp - 0x2c]
mov dl, bl
push eax
push 0x2032
lea eax, [ebp - 0x30]
xor cl, cl
push eax
push 0x5729
push esi
call fcn.10039012
add esp, 0x18
lea eax, [ebp - 0x34]
mov dl, bl
push 0x2c12
push ecx
push ecx
push eax
push ecx
call fcn.100354d4
add esp, 0x14
lea ecx, [ebp - 0x44]
call fcn.10002048
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x24], 0x2f00
jge 0x100397ad
mov edx, str.vvwckscyl_bbxirru_fuwyrd_yyhu_awuyv_nglq_umqfmkgw_fmitwqm_jbw_zzlzssgrb
mov ecx, edi
call fcn.10003d65
jmp 0x100397ad
mov edx, dword [ebp + 0xc]
mov dword [edx], esi
cmp dword [edx], 3
jge 0x100397ad
mov edi, dword [ebp - 0x38]
mov ecx, dword [edx]
mov eax, dword [edi]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [edx]
cmp dword [edx], 3
jl 0x10039796
mov edi, 0x100788d8
mov dword [ebp - 4], 3
cmp dword [ebp - 0x28], 0xcfc
jge 0x100397c9
mov edx, str.zljvdaer_dpcj_kdpln_lgawnldbj_xdaubg_qqbvwmnn_tnjgnzgtu_pabmuh
mov ecx, edi
call fcn.10003d65
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003fdd8
Capabilities:
Delete file

Disassembly:
mov eax, 0x1005f520
call fcn.1005d8a0
sub esp, 0x30
push ebx
push esi
mov byte [ebp - 0x14], cl
mov eax, edx
mov dword [ebp - 0x24], 0x563a
xor esi, esi
cmp dword [ebp - 0x24], 0x593f
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], eax
jle 0x1003fe4b
push 0x13b
push esi
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x1c], esi
lea eax, [esi + ebx]
mov ecx, 0x100788d8
or eax, edi
cdq
push edx
push eax
call fcn.10001e5c
inc esi
cmp esi, 0x6da5
jl 0x1003fe18
inc ebx
push 0
pop esi
cmp ebx, 0x5016
jl 0x1003fe15
inc edi
cmp edi, 0x633a
jl 0x1003fe13
mov eax, dword [ebp - 0x20]
cmp byte [ebp + 0x10], 0
je 0x1003ff01
mov dword [ebp - 0x20], 0x1188
cmp dword [ebp - 0x20], 0x138b
jle 0x1003fec2
mov dword [ebp - 0x1c], esi
mov dword [ebp + 0x10], esi
mov dword [ebp - 0x18], 0x4ace
mov edi, dword [ebp + 0x10]
mov ebx, esi
mov eax, edi
lea ecx, [ebp - 0x3c]
or eax, ebx
cdq
push edx
push eax
call fcn.10001a75
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003fe90
mov eax, dword [eax]
push eax
call fcn.10047084
pop ecx
push esi
push 1
lea ecx, [ebp - 0x3c]
call fcn.10002352
inc ebx
cmp ebx, 0x46a0
jl 0x1003fe77
mov edi, dword [ebp - 0x1c]
add dword [ebp + 0x10], edi
dec dword [ebp - 0x18]
jne 0x1003fe72
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x57d
jl 0x1003fe68
cmp dword [ebp - 0x20], 0xf37
jge 0x1003fed6
push str.uay_iwj_twa_lwpk_nnewwds_anpeuyrk_fvugvrk_gythqak_cozh_hqqcx_izf_wajpvfq_iuvw
call fcn.10047084
pop ecx
cmp byte [ebp - 0x14], 0
je 0x1003fee9
push 0xeed
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
jmp 0x1003ff2c
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1003ff2c
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
jmp 0x1003ff2c
cmp byte [ebp + 0xc], 0
je 0x1003ff25
mov edx, dword [ebp + 0x14]
mov dword [edx], esi
jmp 0x1003ff1e
mov ecx, dword [edx]
mov eax, dword [eax]
mov dword [eax + ecx*4], 0x9b3198a8
inc dword [edx]
mov eax, dword [ebp - 0x20]
cmp dword [edx], 2
jl 0x1003ff0e
jmp 0x1003ff2c
push esi
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0x5492
jge 0x1003ff4b
mov edx, str.pqbzh_oxybqrdxr_twtq_hyiluqlql_fdsmiav_lgktb
mov ecx, 0x100788d8
call fcn.10003d65
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003ff76
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
mov dword [esp + 0x14], 0x3db3
cmp dword [esp + 0x14], 0x3e88
push esi
push edi
jle 0x1004001d
xor esi, esi
mov dword [esp + 0x18], esi
xor ebx, ebx
mov dword [esp + 0x14], 0xdc7
mov dword [esp + 0x10], ebx
xor edi, edi
mov esi, ebx
mov ebx, 0x1c81
mov eax, esi
lea ecx, [esp + 0x20]
cdq
push edx
push eax
call fcn.10001a75
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003ffcd
mov eax, dword [eax]
push eax
call fcn.10047084
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.10002352
add esi, edi
dec ebx
jne 0x1003ffb5
mov ebx, dword [esp + 0x10]
dec edi
cmp edi, 0xffffbfa1
jg 0x1003ffae
mov esi, dword [esp + 0x18]
add ebx, esi
dec dword [esp + 0x14]
mov dword [esp + 0x10], ebx
jne 0x1003ffac
inc esi
mov dword [esp + 0x18], esi
cmp esi, 0x652b
jl 0x1003ff9e
push 0x2480
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
cmp byte [ebp + 8], 0
je 0x10040043
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10040053
push ecx
push 0x6e1b
push 1
push ecx
mov ecx, 0x52fe
call fcn.1003f677
add esp, 0x10
jmp 0x10040053
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp + 0x10]
push eax
call fcn.10040b8f
cmp dword [esp + 0x1c], 0x3a6d
jge 0x10040068
push str.flvmckmxz_oijoi_yvxmhdlwo_vifoj_tbrndjndc_pqw_cwm_jjwbnvxf
call fcn.10047084
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret