joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10007353
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060bac
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100074b0
lea eax, [ebp + 8]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0x1e9e
mov dword [ebp - 0x2c], str.fujajfw_ukhlnni_zmin_ktvbc_lyfdobxca_gmvpt_uzoqqn_azwauked_hebgegd
cmp dword [ebp - 0x20], 0x2199
jle 0x10007435
push 0xbcb
push 0x1d8f
push 0xd21
push 0xde2
push 0x1fc6
push 0
push 0
push 0
push 0
push 0xa11
call dword [sym.imp.USER32.dll_DrawStateW]
and dword [ebp - 0x18], 0
jmp 0x100073db
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x18c
jge 0x10007435
and dword [ebp - 0x1c], 0
jmp 0x100073f1
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x6066
jge 0x10007433
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
push dword [ebp - 0x30]
push dword [ebp - 0x34]
lea ecx, [ebp - 0x4c]
call fcn.10001311
pop ecx
pop ecx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
call fcn.100013aa
push eax
call fcn.10048d40
pop ecx
lea ecx, [ebp - 0x4c]
call fcn.100013a0
jmp 0x100073ea
jmp 0x100073d4
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10007465
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x10007463
push 0x5e43
push 0
push 1
push 1
push 0x2b4e
call fcn.1000ba16
add esp, 0x14
jmp 0x10007472
push 0x178
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x1d3c
jge 0x10007488
push dword [ebp - 0x2c]
call fcn.10048d40
pop ecx
jmp 0x100074a4
or dword [ebp - 4], 0xffffffff
jmp 0x100074ae
jmp 0x100074b8
push 1
call fcn.10007342
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000c736
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x8c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1000c8a4
mov eax, dword [ebp + 0x38]
mov dword [ebp - 0x58], eax
lea eax, [ebp + 0x34]
mov dword [ebp - 0x80], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x7c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x60], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0x78], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x68], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x80]
movzx eax, byte [eax]
test eax, eax
je 0x1000c7a0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
jmp 0x1000c8a2
mov eax, dword [ebp - 0x58]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x7c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x70], eax
mov eax, dword [ebp - 0x60]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x78]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x68]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x64], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x70]
mov dword [ebp - 0x5c], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x84], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x88], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 4]
xor ecx, ecx
sub ecx, dword [eax]
imul eax, ecx, 0x6ad9
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0xfff7
jne 0x1000c838
mov dword [ebp - 8], 1
jmp 0x1000c83c
and dword [ebp - 8], 0
mov eax, dword [ebp - 0x44]
mov ecx, dword [ebp - 8]
mov dword [eax], ecx
mov eax, dword [ebp - 0x4c]
mov eax, dword [eax]
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 4]
mov ecx, dword [ebp - 4]
mov ecx, dword [ecx]
cmp dword [eax], ecx
jl 0x1000c864
mov dword [ebp - 0xc], 1
jmp 0x1000c868
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0xc]
dec eax
dec eax
neg eax
mov ecx, dword [ebp - 0x54]
cmp eax, dword [ecx]
je 0x1000c87f
mov dword [ebp - 0x10], 1
jmp 0x1000c883
and dword [ebp - 0x10], 0
mov eax, dword [ebp - 0x5c]
mov eax, dword [eax]
cmp dword [ebp - 0x10], eax
jle 0x1000c896
mov dword [ebp - 0x18], 1
jmp 0x1000c89a
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 0x64]
mov ecx, dword [ebp - 0x18]
mov dword [eax], ecx
jmp 0x1000c8c2
lea eax, [ebp + 0x14]
mov dword [ebp - 0x6c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x74], eax
mov eax, dword [ebp - 0x6c]
push dword [eax]
push 0
push dword [ebp - 0x74]
call fcn.100051b7
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1000d784
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060da0
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1000d8d8
lea eax, [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1000d7e4
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x1000d7df
push 0x4008
push 1
push 1
call fcn.1000cddc
add esp, 0xc
jmp 0x1000d8d6
mov dword [ebp - 0x24], 0x2cf9
mov dword [ebp - 0x30], str.lkswwmwp_ywlme_tubznnq_ukg_oybkcmhpu
cmp dword [ebp - 0x24], 0x2eba
jle 0x1000d88a
and dword [ebp - 0x18], 0
jmp 0x1000d80c
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x5422
jge 0x1000d882
and dword [ebp - 0x1c], 0
jmp 0x1000d822
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x556d
jge 0x1000d880
and dword [ebp - 0x20], 0
jmp 0x1000d838
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x7dd4
jge 0x1000d87e
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
lea ecx, [ebp - 0x58]
call fcn.10001311
pop ecx
pop ecx
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
call fcn.100013aa
push eax
call fcn.10048d40
pop ecx
lea ecx, [ebp - 0x58]
call fcn.100013a0
jmp 0x1000d831
jmp 0x1000d81b
jmp 0x1000d805
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetProcessTimes]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x2955
jge 0x1000d8b0
push dword [ebp - 0x30]
call fcn.10048d40
pop ecx
jmp 0x1000d8cc
or dword [ebp - 4], 0xffffffff
jmp 0x1000d8d6
jmp 0x1000d8fe
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push 0
push 0x4f8e
push 0x10d6
call fcn.1000526f
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10017630
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061272
call fcn.10060588
sub esp, 0x18
mov byte [ebp - 0x14], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10017733
mov dword [ebp - 0x20], 0x24f
cmp dword [ebp - 0x20], 0x406
jle 0x100176c6
push 0
call dword [sym.imp.OLEAUT32.dll_VariantCopy]
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x18], edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov eax, edx
mov dword [ebp - 0x24], eax
mov esi, eax
xor edi, edi
and esi, ebx
mov eax, esi
mov ecx, 0x1007cb18
xor eax, edi
cdq
push edx
push eax
call fcn.10010bb7
inc edi
cmp edi, 0x2825
jl 0x10017682
mov eax, dword [ebp - 0x24]
inc ebx
cmp ebx, 0x3cc7
jl 0x1001767c
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x2831
jl 0x10017670
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x7d4c
jl 0x1001766b
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0xfffffeb9
jge 0x100176e2
mov edx, str.ypaiy_cylwrmp_znj_hqniaaf_dcascyxru_gctkh_onxvy_toy_qlorpnyd
mov ecx, 0x1007cb18
call fcn.100134d2
mov eax, dword [ebp + 0x1c]
or dword [ebp - 4], 0xffffffff
mov esi, dword [eax]
mov eax, dword [ebp + 0x24]
mov edx, dword [eax]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [edx + esi*4]
cmp eax, dword [ecx + esi*4]
jle 0x10017743
push 0x50cf
push 0x6847
push dword [ebp + 0x20]
mov ecx, 0x72d7
call fcn.10018782
add esp, 0xc
jmp 0x10017743
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
mov eax, dword [ebp + 0x14]
sar ecx, 2
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10019b8f
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
cmp byte [ebp + 0x30], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x10019c49
mov dword [esp + 0xc], 0x557e
cmp dword [esp + 0xc], 0x585a
jle 0x10019c09
xor esi, esi
xor edi, edi
mov ecx, edi
mov eax, esi
sar eax, cl
lea ecx, [esp + 0x10]
cdq
push edx
push eax
call fcn.10001311
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10019bd9
mov eax, dword [eax]
push eax
call fcn.10048d40
pop ecx
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.10001516
inc edi
cmp edi, 0x244c
jl 0x10019bbd
inc esi
cmp esi, 0x3065
jl 0x10019bbb
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp dword [esp + 0xc], 0x5543
jge 0x10019c1e
push str.fgr_rei_jmetsdocp_jggnz_phtt_pvxu_ahtc_tno_xrtzxznnk_vkqiioo_zpylfp_wgyqzms_irzxas_dnkvwqgfm
call fcn.10048d40
pop ecx
mov edx, dword [ebp + 0x34]
mov ecx, dword [ebp + 0x1c]
mov eax, dword [edx]
mov eax, dword [ebp + 0x38]
mov eax, dword [eax]
mov eax, dword [ecx]
mov eax, dword [ecx]
mov ecx, dword [ebp + 0x18]
mov eax, dword [ecx]
mov eax, dword [ecx]
imul ecx, dword [edx], 5
xor edx, edx
mov eax, dword [ebx]
cmp ecx, dword [eax]
mov eax, dword [ebp + 0x14]
setne dl
mov dword [eax], edx
jmp 0x10019c64
mov edx, dword [ebp + 0x24]
mov ecx, dword [edx]
lea eax, [ecx + 2]
mov dword [edx], eax
call fcn.100198f3
mov ecx, dword [ebp + 0x10]
movzx eax, ax
push eax
call fcn.10010d54
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10019f4c
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov dword [esp + 4], ecx
push ebx
push esi
push edi
cmp ecx, 0xa
jg 0x1001a0bd
mov eax, dword [0x1007e744]
sub eax, dword [0x1007e740]
and eax, 0xfffffffc
cmp eax, 0x10
jne 0x1001a095
push 0x1007e740
mov ecx, 0x1007e74c
call fcn.100239ad
mov esi, dword [0x1007e74c]
xor edx, edx
mov cl, 1
mov dword [esp + 0x10], esi
movzx ecx, cl
mov ebx, dword [esi + 4]
mov edi, dword [esi]
lea eax, [edi + ebx]
cmp eax, dword [0x1007e71c]
cmovne ecx, edx
mov edx, dword [esi + 0xc]
mov esi, dword [esi + 8]
and dword [esp + 0x14], 0
movzx ecx, cl
lea eax, [esi + edx]
cmp eax, dword [0x1007dc8c]
lea eax, [esi + edi]
cmovne ecx, dword [esp + 0x14]
and dword [esp + 0x14], 0
cmp eax, dword [0x1007e728]
lea eax, [edx + ebx]
movzx ecx, cl
cmovne ecx, dword [esp + 0x14]
and dword [esp + 0x14], 0
cmp eax, dword [0x1007e720]
lea eax, [edx + edi]
movzx ecx, cl
cmovne ecx, dword [esp + 0x14]
xor edx, edx
cmp eax, dword [0x1007dc88]
lea eax, [esi + ebx]
movzx ecx, cl
cmovne ecx, edx
cmp eax, dword [0x1007e724]
movzx ecx, cl
cmovne ecx, edx
test cl, cl
jne 0x1001a0c4
mov edx, dword [0x1007e750]
mov ebx, dword [esp + 0x10]
cmp ebx, edx
je 0x1001a0bd
lea ecx, [edx - 4]
cmp ebx, ecx
je 0x1001a0bd
push 4
pop edi
jmp 0x1001a043
cmp ecx, ebx
je 0x1001a08f
mov esi, ecx
sub ecx, edi
mov eax, dword [ecx]
cmp eax, dword [esi]
jge 0x1001a03f
mov edi, edx
mov ebx, eax
lea edi, [edi - 4]
cmp ebx, dword [edi]
jge 0x1001a051
mov eax, dword [edi]
mov dword [ecx], eax
mov dword [edi], ebx
jmp 0x1001a076
sub edx, 4
cmp esi, edx
je 0x10019f8b
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [esi], eax
add esi, 4
mov dword [edx], ecx
cmp esi, edx
jne 0x1001a060
jmp 0x10019f8b
sub edx, edi
cmp ebx, edx
je 0x1001a0bd
mov ecx, dword [ebx]
mov eax, dword [edx]
mov dword [ebx], eax
add ebx, edi
mov dword [edx], ecx
cmp ebx, edx
jne 0x1001a07f
jmp 0x1001a0bd
inc ecx
call fcn.10019f4c
lea eax, [esp + 0x10]
mov ecx, 0x1007e740
push eax
call fcn.10023a97
mov ecx, dword [esp + 0x10]
lea ecx, [ecx + 1]
call fcn.10019f4c
sub dword [0x1007e744], 4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [esp + 0x10]
mov esi, 0x1007cb18
push dword [eax + 4]
push ecx
push dword [eax]
mov ecx, esi
call fcn.1002389b
mov ecx, eax
call fcn.10025a8a
pop ecx
mov ecx, eax
call fcn.1002389b
push eax
call fcn.10025c41
mov eax, dword [0x1007e74c]
pop ecx
push dword [eax + 0xc]
push ecx
push dword [eax + 8]
mov ecx, esi
call fcn.1002389b
mov ecx, eax
call fcn.10025a8a
pop ecx
mov ecx, eax
call fcn.1002389b
push eax
call fcn.10025c41
pop ecx
push 0
call fcn.10049e4c
int3
Function at 0x1001aa20
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061414
call fcn.10060588
sub esp, 0x34
cmp byte [ebp + 0x1c], 0
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], esi
je 0x1001abd1
mov dword [ebp - 0x1c], 0x2ba7
cmp dword [ebp - 0x1c], 0x2d8f
jle 0x1001aaf0
push 0x245e
push 0x2260
push 0
push 0x6c8
call dword [sym.imp.USER32.dll_CreateCaret]
xor edi, edi
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov eax, ebx
xor esi, esi
xor eax, edi
mov dword [ebp + 0x1c], eax
mov edi, eax
xor ebx, ebx
mov dword [ebp + 0x1c], 0x5426
mov eax, ebx
lea ecx, [ebp - 0x3c]
or eax, edi
cdq
push edx
push eax
call fcn.10001311
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001aaa9
mov eax, dword [eax]
push eax
call fcn.10048d40
pop ecx
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.10001516
add ebx, esi
dec dword [ebp + 0x1c]
jne 0x1001aa90
inc esi
cmp esi, 0x2af4
jl 0x1001aa87
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
inc ebx
mov dword [ebp - 0x14], ebx
cmp ebx, 0x6937
jl 0x1001aa7c
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x584a
jl 0x1001aa77
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x24]
cmp dword [ebp - 0x1c], 0x293c
jge 0x1001ab04
push str.mufnf_sykv_tesraskb_moiqkovp_butqrgz_xhddlvdq_xca
call fcn.10048d40
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x18], 0
je 0x1001ab2d
mov dword [esi], 0
jmp 0x1001ab23
mov ecx, dword [esi]
mov eax, dword [ebx]
mov dword [eax + ecx*4], 0xd64de8cc
inc dword [esi]
cmp dword [esi], 2
jl 0x1001ab16
jmp 0x1001ac0f
mov dword [ebp - 0x18], 0x447e
cmp dword [ebp - 0x18], 0x458d
jle 0x1001ab89
xor edi, edi
xor esi, esi
mov dword [ebp - 0x1c], esi
mov ebx, esi
mov dword [ebp + 0x1c], 0x249b
xor esi, esi
mov eax, ebx
mov ecx, 0x1007cb18
xor eax, esi
xor eax, edi
cdq
push edx
push eax
call fcn.10010bb7
inc esi
cmp esi, 0x2c82
jl 0x1001ab4f
dec ebx
dec dword [ebp + 0x1c]
jne 0x1001ab4d
mov esi, dword [ebp - 0x1c]
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x745b
jl 0x1001ab44
inc edi
cmp edi, 0x6f8c
jl 0x1001ab3f
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov eax, dword [ebp + 0x14]
mov dword [eax], edx
mov dword [ebp - 4], 2
cmp dword [ebp - 0x18], 0x4125
jge 0x1001ab28
mov edx, str.znokp_uznr_wdbtp_uotvbqcc_xeaatwxiu_pieijbk_oanmybmi_thyfm
mov ecx, 0x1007cb18
call fcn.100134d2
jmp 0x1001ab28
cmp byte [ebp + 0x20], 0
je 0x1001abf2
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1001ac0f
push 0
push 0
push 0xfe4
push 0
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
jmp 0x1001ac0f
mov esi, dword [ebp + 0x10]
mov eax, dword [esi]
mov dword [eax], 0x19
jmp 0x1001ac08
call fcn.1001f09a
mov eax, dword [esi]
dec dword [eax]
mov eax, dword [esi]
cmp dword [eax], 0xc
je 0x1001abff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001ad2f
Capabilities:
Terminate process

Disassembly:
mov eax, 0x1006141e
call fcn.10060588
sub esp, 0x10
push ebx
push esi
mov byte [ebp - 0x14], dl
mov dword [ebp - 0x1c], 0x24ac
cmp dword [ebp - 0x1c], 0x2671
push edi
mov dword [ebp - 0x10], esp
jle 0x1001ad8b
push 0x178
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
xor esi, esi
xor edi, edi
mov ecx, edi
mov eax, esi
shl eax, cl
mov ecx, 0x1007cb18
cdq
push edx
push eax
call fcn.10010bb7
inc edi
cmp edi, 0x2e27
jl 0x1001ad66
inc esi
cmp esi, 0x31ea
jl 0x1001ad64
cmp byte [ebp - 0x14], 0
je 0x1001ada1
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x1001adb6
call dword [sym.imp.USER32.dll_EndMenu]
jmp 0x1001adb6
mov byte [ebp - 0x15], 0
cmp byte [ebp - 0x15], 0
je 0x1001adb6
push 0x1ae2
call dword [sym.imp.USER32.dll_DestroyWindow]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x23fa
jge 0x1001add2
mov edx, str.vdoj_ytqotogmn_tactt_scqtexuyd_bhhs
mov ecx, 0x1007cb18
call fcn.100134d2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001b8fc
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
push esi
push edi
mov edi, edx
mov esi, ecx
je 0x1001b9b1
cmp byte [ebp + 0x24], 0
je 0x1001b941
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x1001b9e9
mov esi, dword [ebp + 0x2c]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 1
inc dword [edx]
cmp dword [edx], 3
jl 0x1001b92a
jmp 0x1001b9e9
mov eax, dword [ebp + 0x28]
xor ecx, ecx
mov edx, dword [ebp + 0x34]
mov eax, dword [eax]
mov eax, dword [edx]
cmp eax, 0xfffffffd
mov eax, dword [ebp + 0x14]
sete cl
mov eax, dword [eax]
imul ecx, dword [eax]
test ecx, ecx
je 0x1001b973
cmp dword [edx], 0
je 0x1001b973
mov eax, dword [ebp + 0x20]
mov eax, dword [eax]
cmp dword [eax], 0
je 0x1001b973
xor ecx, ecx
inc ecx
jmp 0x1001b975
xor ecx, ecx
mov eax, dword [edx]
xor edx, edx
cmp eax, ecx
mov eax, dword [esi]
setge dl
xor ecx, ecx
cmp eax, edx
setge cl
xor eax, eax
cmp eax, ecx
mov eax, dword [ebp + 0x30]
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
cmp dword [eax], 0
je 0x1001b99a
mov eax, dword [esi]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov eax, dword [ebp + 0x3c]
mov eax, dword [eax]
cmp dword [eax], 0xd38bc6a5
sbb eax, eax
inc eax
mov dword [edi], eax
jmp 0x1001b9e9
cmp byte [ebp + 0x10], 0
je 0x1001b9dc
mov edx, dword [ebp + 0x38]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1001b9e9
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 7
inc dword [edx]
cmp dword [edx], 2
jl 0x1001b9c8
jmp 0x1001b9e9
push 0x178
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
pop edi
pop esi
pop ebp
ret
Function at 0x1001d19b
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100614ea
call fcn.10060588
sub esp, 0x14
mov byte [ebp - 0x14], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x1001d25f
mov dword [ebp - 0x1c], 0x54c4
cmp dword [ebp - 0x1c], 0x55fe
jle 0x1001d204
xor esi, esi
mov dword [ebp - 0x18], esi
mov edi, esi
mov ebx, 0x654c
xor esi, esi
mov eax, edi
mov ecx, 0x1007cb18
xor eax, esi
cdq
push edx
push eax
call fcn.10010bb7
inc esi
cmp esi, 0x765
jl 0x1001d1d7
dec edi
dec ebx
jne 0x1001d1d5
mov esi, dword [ebp - 0x18]
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x787c
jl 0x1001d1ce
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x5424
jge 0x1001d220
mov edx, str.umj_ikg_ccmjxe_fsiunoa_xlonahve_vvvakwex
mov ecx, 0x1007cb18
call fcn.100134d2
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1001d261
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xea75c96
inc dword [edx]
cmp dword [edx], 2
jl 0x1001d231
jmp 0x1001d261
dec dword [ecx]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001d44d
Capabilities:
Get disk size

Disassembly:
mov eax, 0x100614fe
call fcn.10060588
sub esp, 0x34
cmp byte [ebp + 0xc], 0
mov eax, ecx
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x1c], eax
je 0x1001d533
mov dword [ebp - 0x20], 0x6e97
cmp dword [ebp - 0x20], 0x7009
jle 0x1001d4fd
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
xor edi, edi
xor esi, esi
mov dword [ebp - 0x18], edi
inc esi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov eax, edi
cdq
idiv ebx
mov ebx, 0x4833
mov edi, edx
mov eax, edi
lea ecx, [ebp - 0x3c]
cdq
push edx
push eax
call fcn.10001311
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001d4c4
mov eax, dword [eax]
push eax
call fcn.10048d40
pop ecx
push 0
push esi
lea ecx, [ebp - 0x3c]
call fcn.10001516
inc edi
dec ebx
jne 0x1001d4ad
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
inc ebx
mov dword [ebp - 0x14], ebx
cmp ebx, 0x64a3
jl 0x1001d4a1
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x384b
jl 0x1001d49c
mov eax, dword [ebp - 0x1c]
jmp 0x1001d500
xor esi, esi
inc esi
mov ecx, dword [ebp + 0x18]
mov dword [ecx], esi
jmp 0x1001d511
mov eax, dword [eax]
or dword [eax], 0xffffffff
dec dword [ecx]
mov eax, dword [ebp - 0x1c]
cmp dword [ecx], 0
jge 0x1001d507
cmp dword [ebp - 0x20], 0x6e55
jge 0x1001d605
push str.yhbb_oixswg_tzoct_wzcfxa_hivgatsg_vfz_hijbnvqd_swa
call fcn.10048d40
pop ecx
jmp 0x1001d605
mov dword [ebp - 0x20], 0x48e4
cmp dword [ebp - 0x20], 0x4919
jle 0x1001d576
xor esi, esi
mov edi, esi
mov ebx, 0x2996
mov eax, edi
mov ecx, 0x1007cb18
cdq
push edx
push eax
call fcn.10010bb7
dec edi
dec ebx
jne 0x1001d54c
inc esi
cmp esi, 0x5f64
jl 0x1001d545
push 0x1b61
call dword [sym.imp.USER32.dll_GetSysColorBrush]
mov ebx, dword [ebp - 0x24]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x4598
jge 0x1001d5b4
mov edx, str.uiat_hdbxu_yzbreomrm_bhbdopfbn_ntir_hdfh_vni_gxjfxcep_zwrh
mov ecx, 0x1007cb18
call fcn.100134d2
jmp 0x1001d5b4
mov edi, dword [ebp + 0x14]
cmp dword [edi], 0
jne 0x1001d5be
mov eax, dword [edi]
mov eax, dword [ebp + 0x10]
xor esi, esi
mov ecx, dword [ebp + 0x1c]
inc esi
mov dword [eax], esi
mov eax, dword [ecx]
mov eax, dword [ecx]
mov eax, dword [edi]
mov eax, dword [ebp + 0x20]
mov ecx, dword [eax]
mov edx, ecx
mov eax, dword [edx]
mov dword [ebp - 0x20], eax
mov eax, dword [edi]
add eax, dword [ecx + 4]
xor ecx, ecx
cmp eax, dword [edx + 0xc]
mov edx, dword [ebp - 0x20]
setge cl
xor eax, eax
cmp ecx, edx
setge al
dec eax
je 0x1001d5f9
test edx, edx
jne 0x1001d5fb
xor esi, esi
cmp esi, 8
sbb eax, eax
inc eax
add eax, dword [ebx]
mov dword [edi], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret