joyce8/EMBER2024-capa huggingface dataset:
Function at 0x406624
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406648
xor eax, eax
test eax, eax
je 0x40665b
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40665b
xor ecx, ecx
jmp 0x40665e
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406787
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4698ec], 0
push esi
jne 0x4067be
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406798
mov dword [ecx*4 + 0x4698e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406793
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4067ef
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4698e8]
xor eax, esi
inc ecx
dec edx
jne 0x4067d1
pop edi
not eax
pop esi
ret 0xc

Function at 0x43b643
Capabilities:
Encode data using xor

Disassembly:
push 0x43b3c1
pop edi
add ebx, 0x6b9ae33c
sub edx, edx
call fcn.0043b684
or ebx, edx
sub ebx, edx
sub ebx, 0xa5f5a9ae
xor dword [eax], edi
add edx, 0xccd47cb
inc ebx
add ebx, 0x22a24a1
inc eax
sub ebx, ebx
or ebx, edx
mov edx, ebx
cmp eax, ecx
jne fcn.0043b643
inc edx
ret
Function at 0x100020d4
Capabilities:
Create pipe

Disassembly:
mov eax, 0x1005bec3
call fcn.1005b9e8
sub esp, 0x2c
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edx
je 0x10002235
mov dword [ebp - 0x18], 0x227c
cmp dword [ebp - 0x18], 0x235d
jle 0x1000212e
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x14], 0x7024
mov eax, ebx
mov ecx, 0x100761b8
cdq
push edx
push eax
call fcn.100062df
add ebx, edi
dec dword [ebp - 0x14]
jne 0x1000210f
inc edi
cmp edi, 0x6fc7
jl 0x10002106
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x1fd0
jge 0x1000214a
mov edx, str.fslcho_dbxh_fyqmivvy_bvhqeek_jhkauk_eylcfgysc_qzyzykzaz_kmwla
mov ecx, 0x100761b8
call fcn.10008b0d
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], 0x6e8d
cmp dword [ebp - 0x1c], 0x7123
jle 0x100021ad
push 0xa19
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
xor edi, edi
mov dword [ebp - 0x14], edi
mov ebx, edi
mov dword [ebp - 0x18], 0x50a6
xor edi, edi
lea eax, [ebx + edi]
mov ecx, 0x100761b8
cdq
push edx
push eax
call fcn.100062df
inc edi
cmp edi, 0x4400
jl 0x1000217f
dec ebx
dec dword [ebp - 0x18]
jne 0x1000217d
mov edi, dword [ebp - 0x14]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x22c2
jl 0x10002174
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x6ad5
jge 0x100021cc
mov edx, str.uytfmprc_mwllv_stlcizge_ouk_jgvf_mbgavlw_nyowb_hfrkqhod_iegbpopf_lzfc_jocupqndc_yhko
mov ecx, 0x100761b8
call fcn.10008b0d
mov eax, dword [ebp + 0xc]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
push 0xffffffffffffffff
push dword [eax]
lea eax, [ebp - 0x38]
push eax
call fcn.100065b6
mov ecx, dword [ebp - 0x20]
push eax
mov dword [ebp - 4], 4
call fcn.10006676
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.10006f39
jmp 0x1000223a
mov eax, dword [ebp + 0x14]
neg dword [eax]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009f25
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005c29f
call fcn.1005b9e8
sub esp, 0x20
push ebx
push esi
mov dword [ebp - 0x28], 0xb74
cmp dword [ebp - 0x28], 0xc1c
push edi
mov dword [ebp - 0x10], esp
jle 0x10009fb1
xor edi, edi
mov dword [ebp - 0x24], edi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
xor eax, eax
mov dword [ebp - 0x18], edi
mov ecx, ebx
mov dword [ebp - 0x1c], eax
sar edi, cl
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [ebp - 0x2c], edi
xor edi, eax
mov eax, edi
mov ecx, 0x100761b8
or eax, ebx
cdq
push edx
push eax
call fcn.100062df
inc ebx
cmp ebx, 0x303c
jl 0x10009f68
mov eax, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x1110
jl 0x10009f61
mov ebx, dword [ebp - 0x20]
mov edi, dword [ebp - 0x24]
inc ebx
mov dword [ebp - 0x20], ebx
cmp ebx, 0x4c36
jl 0x10009f52
inc edi
mov dword [ebp - 0x24], edi
cmp edi, 0x7107
jl 0x10009f4d
cmp byte [ebp + 8], 0
je 0x1000a059
mov dword [ebp - 0x20], 0x7ca6
cmp dword [ebp - 0x20], 0x7fa4
jle 0x1000a005
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x24], eax
and eax, ebx
mov ecx, 0x100761b8
xor eax, edi
cdq
push edx
push eax
call fcn.100062df
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp eax, 0x730d
jl 0x10009fd4
inc ebx
cmp ebx, 0x3e1a
jl 0x10009fcf
inc edi
cmp edi, 0x57f9
jl 0x10009fcd
mov byte [ebp - 0x11], 0
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x7a05
jge 0x1000a025
mov edx, str.hlj_sxmxf_nkwvasmbg_bzohgnqm_ryg_bjguufuk_ajk_mhyhdaznl
mov ecx, 0x100761b8
call fcn.10008b0d
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x11]
push ecx
push eax
push 0x6ef9
xor dl, dl
call fcn.10009a4a
add esp, 0xc
jmp 0x1000a06b
mov byte [ebp - 0x12], 0
cmp byte [ebp - 0x12], 0
je 0x1000a06b
push 0
call dword [sym.imp.USER32.dll_CreateIconIndirect]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x28], 0x7a6
jge 0x1000a08a
mov edx, str.gjge_pfjszaepu_wlzangna_tetdksrf_zxj_jeql_tyomy_aevohgn
mov ecx, 0x100761b8
call fcn.10008b0d
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a36d
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005c2a9
call fcn.1005b9e8
sub esp, 0x28
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], cl
je 0x1000a3cf
test cl, cl
je 0x1000a39a
mov eax, dword [edx]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x1000a4f5
mov byte [ebp + 0xf], 0
cmp byte [ebp + 0xf], 0
je 0x1000a4f5
push 0x1e86
push 0
push 1
push 0
push 0x6913
mov edx, 0x6399
mov ecx, 0x71bf
call fcn.1000a0df
add esp, 0x14
jmp 0x1000a4f5
mov dword [ebp + 0xc], 0x86e
cmp dword [ebp + 0xc], 0x9f3
jle 0x1000a42e
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
lea ecx, [ebp - 0x34]
or eax, edi
or eax, esi
cdq
push edx
push eax
call fcn.10001341
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000a400
mov eax, dword [eax]
push eax
call fcn.10044ce0
pop ecx
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.100014ca
inc ebx
cmp ebx, 0x3d80
jl 0x1000a3e5
inc edi
cmp edi, 0x1161
jl 0x1000a3e3
inc esi
cmp esi, 0x26d0
jl 0x1000a3e1
cmp dword [ebp + 0xc], 0x606
jge 0x1000a442
push str.qxmnrej_zdkdr_mzrj_ecd_dbdrxtzu_rsobnc
call fcn.10044ce0
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x10], 0
je 0x1000a4ef
mov dword [ebp - 0x1c], 0x5d1e
cmp dword [ebp - 0x1c], 0x5f5d
jle 0x1000a4ac
xor esi, esi
mov dword [ebp - 0x18], esi
xor ebx, ebx
mov dword [ebp + 0xc], 0x30a2
xor edi, edi
xor esi, esi
lea eax, [esi + edi]
mov ecx, 0x100761b8
xor eax, ebx
cdq
push edx
push eax
call fcn.100062df
inc esi
cmp esi, 0x21fb
jl 0x1000a472
inc edi
cmp edi, 0x2d8d
jl 0x1000a470
mov esi, dword [ebp - 0x18]
add ebx, esi
dec dword [ebp + 0xc]
jne 0x1000a46e
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x3a29
jl 0x1000a465
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x5b73
jge 0x1000a4cb
mov edx, str.anlqbnvyu_zcxz_muxjvpzij_wkqrdxos_kds
mov ecx, 0x100761b8
call fcn.10008b0d
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov dword [ecx + 4], eax
jmp 0x1000a4f5
mov eax, dword [ebp + 0x14]
and dword [eax], 0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100105e9
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005c541
call fcn.1005b9e8
sub esp, 0x2c
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x1001060c
mov eax, dword [ebp + 0x18]
inc dword [eax]
jmp 0x10010721
mov dword [ebp - 0x1c], 0x14e1
cmp dword [ebp - 0x1c], 0x1604
jle 0x10010680
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
lea eax, [ebx + edi]
or eax, ecx
lea ecx, [ebp - 0x38]
or eax, esi
cdq
push edx
push eax
call fcn.10001341
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10010643
mov eax, dword [eax]
push eax
call fcn.10044ce0
pop ecx
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.100014ca
mov ecx, dword [ebp - 0x14]
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x832
jl 0x10010627
inc ebx
cmp ebx, 0x1ef5
jl 0x10010622
inc edi
cmp edi, 0x30fd
jl 0x10010620
inc esi
cmp esi, 0xb79
jl 0x1001061e
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x1001070d
mov dword [ebp - 0x18], 0x6f0f
cmp dword [ebp - 0x18], 0x717a
jle 0x100106e0
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
and dword [ebp - 0x20], 0
mov ebx, edi
and ebx, esi
mov esi, dword [ebp - 0x20]
mov eax, ebx
mov ecx, 0x100761b8
xor eax, esi
cdq
push edx
push eax
call fcn.100062df
inc esi
cmp esi, 0x794f
jl 0x100106ae
mov esi, dword [ebp - 0x14]
inc edi
cmp edi, 0x29ef
jl 0x100106a3
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x3660
jl 0x100106a1
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x6be6
jge 0x1001070d
mov edx, str.lnrsg_ooei_anoypjjaq_gjuidq_keu_mpkhd_gxfodlp_vkruwyj_xcduzoygh
mov ecx, 0x100761b8
call fcn.10008b0d
cmp dword [ebp - 0x1c], 0x1190
jge 0x10010721
push str.gexeim_fwqr_ggsdo_uirznir_izd_kwaaue_fzh_ttdd_dnlblkpkc_njzbsiqjv
call fcn.10044ce0
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100121f7
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005c59f
call fcn.1005b9e8
sub esp, 0x14
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], dl
mov byte [ebp - 0x18], cl
je 0x10012247
test cl, cl
je 0x10012238
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0x10]
push dword [eax]
call fcn.100127c8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x2010
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
jmp 0x10012227
test dl, dl
je 0x10012266
push 0x3246
lea eax, [ebp + 0xf]
mov byte [ebp + 0xf], 0
push eax
push 0
push ecx
push ecx
call fcn.100105e9
add esp, 0x14
jmp 0x10012227
mov dword [ebp - 0x20], 0xb09
cmp dword [ebp - 0x20], 0xc03
jle 0x100122d9
xor edi, edi
xor esi, esi
mov dword [ebp - 0x1c], esi
xor ebx, ebx
mov dword [ebp + 0xc], 0x7cba
xor esi, esi
mov eax, ebx
mov ecx, 0x100761b8
cdq
idiv esi
xor edx, edi
mov eax, edx
cdq
push edx
push eax
call fcn.100062df
inc esi
cmp esi, 0x3425
jl 0x10012288
mov esi, dword [ebp - 0x1c]
add ebx, esi
dec dword [ebp + 0xc]
jne 0x10012286
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x57f6
jl 0x1001227d
inc edi
cmp edi, 0x24ce
jl 0x10012278
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0
call esi
push eax
call dword [sym.imp.USER32.dll_SetWindowTextA]
jmp 0x100122df
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0xae3
jge 0x10012227
mov edx, str.stj_pwg_mcgt_vmznwve_fdcdpmy_qgff_dhelvwrgq_bmar
mov ecx, 0x100761b8
call fcn.10008b0d
jmp 0x10012227

Function at 0x1001296e
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov dword [0x100b73d4], ecx
inc edx
mov esi, 0x270
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
mov dword [edx*4 + 0x100b73d4], ecx
inc edx
cmp edx, esi
jl 0x10012983
mov dword [0x100b73d0], esi
pop esi
pop ebp
ret 8
Function at 0x100129a9
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x100b73d4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x100b7760
jl 0x100129b7
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x100b7a04
jl 0x100129f7
mov ecx, dword [0x100b8750]
xor ecx, dword [0x100b73d4]
and ecx, edi
xor ecx, dword [0x100b8750]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x100b73d0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x100b7a04]
mov dword [0x100b7d90], eax
pop esi
ret
Function at 0x1002d509
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002d568
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002d550
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x1002d54e
push 1
push 0
call fcn.1002d499
pop ecx
pop ecx
jmp 0x1002d566
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002d566
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x1002d570
push 1
call fcn.1002d488
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x10030e7d
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005ca12
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10030fad
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x20], 0x4fc3
mov dword [ebp - 0x30], str.hsd_kocvy_ibaeykvs_xmaycfgv
cmp dword [ebp - 0x20], 0x5050
jle 0x10030f58
and dword [ebp - 0x14], 0
jmp 0x10030ee5
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x773c
jge 0x10030f40
and dword [ebp - 0x18], 0
jmp 0x10030efb
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2e03
jge 0x10030f3e
and dword [ebp - 0x1c], 0
jmp 0x10030f11
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x751c
jge 0x10030f3c
mov eax, dword [ebp - 0x14]
or eax, dword [ebp - 0x18]
or eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
push dword [ebp - 0x44]
push dword [ebp - 0x48]
mov ecx, 0x100761b8
call fcn.100062df
jmp 0x10030f0a
jmp 0x10030ef4
jmp 0x10030ede
push 0
push 0x184c
push 0
push 0
push 0x1181
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 1
push dword [ebp - 0x2c]
call fcn.10031001
add esp, 0x10
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x4dab
jge 0x10030f85
mov edx, dword [ebp - 0x30]
mov ecx, 0x100761b8
call fcn.10008b0d
jmp 0x10030fa1
or dword [ebp - 4], 0xffffffff
jmp 0x10030fab
jmp 0x10030ff0
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x10030fcd
push 0
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
jmp 0x10030ff0
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x10030ff0
push 0
push 0x2010
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10036127
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
mov byte [esp + 4], cl
push ebx
push esi
push edi
test dl, dl
je 0x100362bb
cmp byte [ebp + 0x10], 0
je 0x100361a4
mov edi, dword [ebp + 0x1c]
xor ecx, ecx
mov esi, dword [ebp + 8]
mov eax, dword [edi]
test eax, eax
mov eax, dword [edi]
setne cl
mov dword [esi], eax
mov eax, dword [ebp + 0xc]
xor edx, edx
mov eax, dword [eax]
cmp ecx, eax
mov eax, dword [edi]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, 0xe64fd9e2
setg cl
xor edx, edx
sub eax, ecx
mov ecx, dword [edi]
imul ecx, eax
test ecx, ecx
setle dl
imul eax, dword [esi], 0xb392
xor ebx, ebx
cmp eax, edx
jg 0x10036194
mov eax, dword [ebp + 0x14]
cmp dword [eax], ebx
je 0x10036194
inc ebx
mov eax, dword [ebp + 0x18]
cmp ebx, 0xffffffff
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
jmp 0x100362f1
mov dword [esp + 0x20], 0x66e
cmp dword [esp + 0x20], 0x9c7
push 0
pop ebx
jle 0x10036207
push 0xb78
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov esi, ebx
mov edi, ebx
mov eax, edi
lea ecx, [esp + 0x28]
or eax, esi
cdq
push edx
push eax
call fcn.10001341
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100361e2
mov eax, dword [eax]
push eax
call fcn.10044ce0
pop ecx
push ebx
push 1
lea ecx, [esp + 0x30]
call fcn.100014ca
inc edi
cmp edi, 0x7b18
jl 0x100361c8
inc esi
cmp esi, 0x1c1f
jl 0x100361c6
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], 0
je 0x100362a4
mov dword [esp + 0x1c], 0x4c3
cmp dword [esp + 0x1c], 0x7e9
jle 0x1003628a
mov edi, ebx
mov esi, ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x14], 0x52b7
mov eax, esi
lea ecx, [esp + 0x40]
xor eax, edi
cdq
push edx
push eax
call fcn.10001341
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10036256
mov eax, dword [eax]
push eax
call fcn.10044ce0
pop ecx
push ebx
push 1
lea ecx, [esp + 0x48]
call fcn.100014ca
dec esi
dec dword [esp + 0x14]
jne 0x1003623c
mov esi, dword [esp + 0x18]
inc esi
mov dword [esp + 0x18], esi
cmp esi, 0x4203
jl 0x10036230
inc edi
cmp edi, 0x6590
jl 0x1003622a
call fcn.1003664c
cmp dword [esp + 0x1c], 0x32f
jge 0x100362a4
push str.zqq_tklurbuw_eaeubtz_kfaxvblk_rylxflk_evzronttn_owi
call fcn.10044ce0
pop ecx
cmp dword [esp + 0x20], 0x37f
jge 0x100362f1
push str.exx_mkgdblkg_ojyrg
call fcn.10044ce0
pop ecx
jmp 0x100362f1
test cl, cl
je 0x100362d7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
jmp 0x100362f1
xor ebx, ebx
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], bl
je 0x100362f1
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10036921
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005cb1a
call fcn.1005b9e8
sub esp, 0x1c
mov eax, edx
mov dword [ebp - 0x28], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x10036968
cmp byte [ebp + 0x10], 0
je 0x10036959
mov eax, dword [ebp + 8]
inc dword [eax]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0x2010
call dword [sym.imp.KERNEL32.dll_IsDBCSLeadByteEx]
jmp 0x10036948
cmp byte [ebp + 0xc], 0
je 0x1003697d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
jmp 0x10036948
mov dword [ebp - 0x20], 0x2cd5
xor esi, esi
cmp dword [ebp - 0x20], 0x2ee1
jle 0x10036a06
mov dword [ebp - 0x14], esi
mov edi, esi
mov dword [ebp - 0x1c], esi
mov ebx, esi
mov dword [ebp - 0x18], esi
mov eax, edi
mov dword [ebp - 0x24], esi
cdq
idiv ebx
mov esi, dword [ebp - 0x14]
mov edi, dword [ebp - 0x24]
mov ebx, edx
mov ecx, edi
mov eax, ebx
sar eax, cl
mov ecx, 0x100761b8
xor eax, esi
cdq
push edx
push eax
call fcn.100062df
inc edi
cmp edi, 0x515c
jl 0x100369ac
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 0x18], ebx
push 0
pop esi
cmp ebx, 0x3d6e
jl 0x1003699c
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x67e1
jl 0x10036997
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x9b
jl 0x10036992
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov eax, dword [ebp - 0x28]
cmp byte [eax], 0
je 0x10036a1a
push esi
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x20], 0x2aca
jge 0x10036948
mov edx, str.lhnx_dlc_enmgf_qpyso_qermkovno_hgjsyjx
mov ecx, 0x100761b8
call fcn.10008b0d
jmp 0x10036948
Function at 0x10036aac
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov byte [ebp - 8], dl
mov ebx, ecx
je 0x10036ae3
test dl, dl
je 0x10036ad6
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
jmp 0x10036b8b
push 0
call dword [sym.imp.USER32.dll_CreateIconIndirect]
jmp 0x10036b8b
cmp byte [ebp + 0xc], 0
je 0x10036b07
mov byte [ebp + 0x13], 0
cmp byte [ebp + 0x13], 0
je 0x10036b8b
push 0xb78
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x10036b8b
mov dword [ebp + 0x10], 0x78be
cmp dword [ebp + 0x10], 0x7a3e
jle 0x10036b72
xor esi, esi
xor edi, edi
mov ecx, edi
mov eax, esi
shl eax, cl
lea ecx, [ebp - 0x20]
cdq
push edx
push eax
call fcn.10001341
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10036b36
mov eax, dword [eax]
push eax
call fcn.10044ce0
pop ecx
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.100014ca
inc edi
cmp edi, 0x588
jl 0x10036b1b
inc esi
cmp esi, 0x52d2
jl 0x10036b19
push 0x10f8
push 0xada
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetClassLongA]
cmp dword [ebp + 0x10], 0x75db
jge 0x10036b86
push str.zhinq_rzvyw_qdfrxc_noyyblfba
call fcn.10044ce0
pop ecx
mov eax, dword [ebp + 8]
mov dword [ebx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003743d
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
test cl, cl
je 0x10037456
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10037468
push 0
call dword [sym.imp.GDI32.dll_CreatePatternBrush]
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10037468
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
pop ebp
ret