joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10023329
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005b95b
call fcn.1005a5c0
sub esp, 0x24
push ebx
push esi
mov dword [ebp - 0x14], 0x6c1
mov ebx, edx
cmp dword [ebp - 0x14], 0x8f1
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ebx
jle 0x1002338b
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, edi
mov ecx, 0x10077318
cdq
idiv ebx
xor edx, esi
mov eax, edx
cdq
push edx
push eax
call fcn.1000f05b
inc ebx
cmp ebx, 0x722c
jl 0x10023357
inc edi
cmp edi, 0x5231
jl 0x10023355
inc esi
cmp esi, 0x1a3d
jl 0x10023353
mov ebx, dword [ebp - 0x18]
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x425
jge 0x100233c6
mov edx, str.stm_yqgtz_sbokh_rmayp_yetrb_utp_zwpm
mov ecx, 0x10077318
call fcn.10013928
jmp 0x100233c6
mov esi, dword [ebp + 0xc]
or dword [ebp - 4], 0xffffffff
cmp dword [esi], 0xffffffff
je 0x10023401
mov edx, 0x6f10
xor cl, cl
call fcn.100208e2
push 0xffffffffffffffff
push dword [esi]
lea eax, [ebp - 0x30]
mov ecx, ebx
push eax
call fcn.100244ab
push eax
mov ecx, ebx
call fcn.1000f1ab
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.1000fe44
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002342a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005b965
call fcn.1005a5c0
sub esp, 0x10
push ebx
push esi
mov byte [ebp - 0x14], dl
mov ebx, ecx
mov dword [ebp - 0x18], 0x12d2
cmp dword [ebp - 0x18], 0x1583
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ebx
jle 0x1002348c
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x10077318
xor eax, edi
or eax, esi
cdq
push edx
push eax
call fcn.1000f05b
inc ebx
cmp ebx, 0x5e7c
jl 0x1002345b
inc edi
cmp edi, 0x51a
jl 0x10023459
inc esi
cmp esi, 0x4c04
jl 0x10023457
mov ebx, dword [ebp - 0x1c]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x1150
jge 0x100234c7
mov edx, str.krxh_asnq_whcbot
mov ecx, 0x10077318
call fcn.10013928
jmp 0x100234c7
cmp byte [ebp - 0x14], 0
je 0x100234d5
mov eax, dword [ebp + 0xc]
and dword [eax], 0
jmp 0x100234ee
cmp byte [ebx], 0
je 0x100234ee
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_UpdateColors]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002562d
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0xc], 0
je 0x10025651
push 0x1dd5
push 0x1350
push 0
push 0x587
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
pop ebp
ret
mov eax, dword [ebp + 8]
dec dword [eax]
pop ebp
ret
Function at 0x10025658
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005bade
call fcn.1005a5c0
sub esp, 0x24
push ebx
push esi
mov dword [ebp - 0x28], 0x186b
mov eax, edx
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
cmp dword [ebp - 0x28], 0x1b54
mov dword [ebp - 0x2c], eax
jle 0x1002570b
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
mov edi, esi
mov dword [ebp - 0x20], esi
mov ebx, esi
mov dword [ebp - 0x1c], esi
mov ecx, ebx
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x18], esi
sar edi, cl
mov ebx, esi
mov dword [ebp - 0x14], 0x7755
mov esi, dword [ebp - 0x18]
mov eax, ebx
mov ecx, 0x10077318
xor eax, edi
cdq
push edx
push eax
call fcn.1000f05b
add ebx, esi
dec dword [ebp - 0x14]
jne 0x100256ae
inc esi
push 0
mov dword [ebp - 0x18], esi
cmp esi, 0x42fe
pop esi
jl 0x100256a2
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
inc ebx
mov dword [ebp - 0x1c], ebx
cmp ebx, 0x65d3
jl 0x10025698
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x712d
jl 0x10025693
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetClipBox]
mov eax, dword [ebp - 0x2c]
cmp byte [ebp + 8], 0
je 0x10025715
dec dword [eax]
jmp 0x10025761
mov dword [ebp - 0x2c], 0x19c4
cmp dword [ebp - 0x2c], 0xa9d
jge 0x1002574c
lea eax, [ebp - 0x24]
push eax
push 0x100639fc
call fcn.10043a7b
xor eax, eax
inc eax
cmp dword [ebp - 0x24], 2
cmovle eax, dword [ebp - 0x24]
push eax
push str._ld_n
call fcn.10043d63
add esp, 0x10
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10025761
push esi
push 0x218b
push esi
call dword [sym.imp.ADVAPI32.dll_ControlService]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x28], 0x176d
jge 0x1002577c
mov edx, str.qvtlmtgos_dlwxmolva_oam_ywhhkpifr_sxupgoau_cru_psghuz_yucmh_sys_loi
mov ecx, 0x10077318
call fcn.10013928
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100260c4
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
je 0x10026131
cmp byte [ebp + 0x18], 0
je 0x10026116
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x10026267
push 1
push 0x4c55
push ecx
push 0x2d65
push 0x23ca
push ecx
mov edx, 0x6cdc
mov ecx, 0x59ea
call fcn.100257de
add esp, 0x18
jmp 0x10026267
mov eax, dword [ebp + 0x14]
mov ecx, edx
push dword [esp + 0x24]
push dword [eax + 4]
push dword [eax]
push dword [edx + 4]
call fcn.100289bd
jmp 0x10026267
cmp byte [ebp + 0x10], 0
je 0x10026255
mov edx, dword [ebp + 0xc]
push 0
pop ebx
mov dword [edx], 0x1a
jmp 0x10026193
mov dword [esp + 0x14], 0xfffffffd
mov dword [esp + 0x14], ebx
jmp 0x10026163
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x28], ebx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 4
jl 0x10026157
mov dword [esp + 0x14], ebx
jmp 0x1002618a
mov dword [esp + 0x20], ebx
cmp dword [esp + 0x20], ebx
jne 0x10026191
mov ecx, dword [esp + 0x34]
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x28], ecx
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 3
jle 0x10026170
dec dword [edx]
cmp dword [edx], 0xffffffff
jne 0x10026149
mov dword [esp + 0x20], 0x32c2
cmp dword [esp + 0x20], 0x3467
jle 0x1002623e
push 0x2399
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov esi, ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x18], ebx
mov dword [esp + 0x14], 0x78d6
and dword [esp + 0x24], 0
mov edi, ebx
xor edi, esi
mov esi, dword [esp + 0x24]
mov eax, edi
lea ecx, [esp + 0x38]
or eax, esi
cdq
push edx
push eax
call fcn.10001aa4
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100261f4
mov eax, dword [eax]
push eax
call fcn.10043d63
pop ecx
push 0
push 1
lea ecx, [esp + 0x40]
call fcn.1000fb16
inc esi
cmp esi, 0x54dd
jl 0x100261da
mov edi, dword [esp + 0x18]
add ebx, edi
dec dword [esp + 0x14]
mov esi, dword [esp + 0x1c]
jne 0x100261cd
inc edi
mov dword [esp + 0x18], edi
push 0
pop ebx
cmp edi, 0x3bc
jl 0x100261c5
inc esi
mov dword [esp + 0x1c], esi
cmp esi, 0x1cac
jl 0x100261c1
cmp dword [esp + 0x20], 0x30b3
jge 0x10026267
push str.floxy_juwfzjr_yhuyopx_qmiihhpxv_hinjmfq_jqf_rzanych
call fcn.10043d63
pop ecx
jmp 0x10026267
cmp byte [ecx], 0
je 0x10026267
push 0xd5d
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002670e
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005bb18
call fcn.1005a5c0
sub esp, 0xc
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], edi
je 0x10026737
push 0xb
pop eax
mov word [ecx], ax
jmp 0x100267c4
mov dword [ebp - 0x14], 0x516f
cmp dword [ebp - 0x14], 0x52c0
jle 0x10026776
push 0
call dword [sym.imp.COMDLG32.dll_GetOpenFileNameW]
xor esi, esi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x10077318
xor eax, esi
cdq
push edx
push eax
call fcn.1000f05b
inc ebx
cmp ebx, 0x6f2c
jl 0x10026753
inc esi
cmp esi, 0x58fd
jl 0x10026751
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x5038
jge 0x100267b1
mov edx, str.gxwob_qcndg_awcdwk_hregq_cbaoleot_hivnqlpr_vbnexi_usw_rlngwy_niwc_iseixxnxy_iepatv_zmloa_mhjwqf
mov ecx, 0x10077318
call fcn.10013928
jmp 0x100267b1
cmp byte [edi], 0
je 0x100267c4
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002a7af
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1005bd59
call fcn.1005a5c0
sub esp, 0x24
push ebx
push esi
mov dword [ebp - 0x24], 0x3e40
cmp dword [ebp - 0x24], 0x3ed5
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x30], ecx
jle 0x1002a84c
push 0
push 0x81e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
xor esi, esi
mov dword [ebp - 0x20], esi
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
mov ecx, edi
xor ebx, ebx
shl esi, cl
mov dword [ebp - 0x18], esi
mov ecx, ebx
mov dword [ebp - 0x28], esi
xor edi, edi
shl esi, cl
mov eax, esi
mov ecx, 0x10077318
and eax, edi
cdq
push edx
push eax
call fcn.1000f05b
inc edi
cmp edi, 0x13d0
jl 0x1002a808
mov esi, dword [ebp - 0x18]
inc ebx
cmp ebx, 0x2a05
jl 0x1002a7ff
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x36d8
jl 0x1002a7f3
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x4fb9
jl 0x1002a7ee
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x3c6c
jge 0x1002a868
mov edx, str.lqj_ywvydsucp_clrevfka_dspqvtz_yiqslmxuj_fvoyone_ckonric_lyj_bminqezth_vvtwe_oddgrv_ewescuho_jayr
mov ecx, 0x10077318
call fcn.10013928
push dword [ebp - 0x2c]
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x11]
push dword [ebp - 0x30]
push eax
push 0
push 0x3d15
call fcn.1002ac57
mov al, byte [ebp - 0x11]
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002f923
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002f988
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1002f961
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov byte [eax], 1
jmp 0x1002f986
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1002f986
push 0
push 0x119b
push 0
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x1002f99c
push 1
push 0x17f7
push 0x6ca3
call fcn.1002c14b
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1003b84a
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x10], 0
je 0x1003b873
cmp byte [ecx], 0
je 0x1003b898
push 0x1dd5
push 0x1350
push 0
push 0x587
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
pop ebp
ret
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1003b898
push esi
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 1
inc dword [edx]
cmp dword [edx], 2
jl 0x1003b885
pop esi
pop ebp
ret

Function at 0x1003ba50
Capabilities:
Encode data using xor

Disassembly:
jmp 0x1003be66
mov eax, 0x1005c1f1
call fcn.1005a5c0
sub esp, 0x40
mov byte [ebp - 0x18], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x1003bea3
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x1003bfd1
push ecx
push 0x623a
push 0
call fcn.1003bb86
add esp, 0xc
jmp 0x1003bfd1
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x38], 0xa9683648
mov dword [ebp - 0x3c], 0xb0ae28de
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x1c], 0xcc1
cmp dword [ebp - 0x1c], 0x1024
jle 0x1003bf03
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x10077318
xor eax, edi
or eax, esi
cdq
push edx
push eax
call fcn.1000f05b
inc ebx
cmp ebx, 0x6976
jl 0x1003bed5
inc edi
cmp edi, 0x7a81
jl 0x1003bed3
inc esi
cmp esi, 0x11e8
jl 0x1003bed1
mov dword [ebp - 0x20], 5
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0xc70
jge 0x1003bf29
mov edx, str.npi_qprvwehm_ysogx_vsbuum_ole_aemzo_zes_ozpyahjh_msgrbel_gsfdlrj
mov ecx, 0x10077318
call fcn.10013928
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x4c]
push 4
pop esi
mov dword [ebp - 0x34], 0xe136dc99
push esi
call fcn.1000f33d
lea eax, [ebp - 0x40]
mov dword [ebp - 4], esi
push eax
push 0x48be
push ecx
push 0x213f
push 0x35ac
push 0x1093
lea eax, [ebp - 0x4c]
mov dword [ebp - 0x24], 0xfff7
push eax
push 0x5002
push 0x289e
push 0x2630
push 0x3ae2
xor dl, dl
mov dword [ebp - 0x2c], 0xb11de2a9
mov ecx, 0x245c
call fcn.1003b89a
add esp, 0x2c
lea eax, [ebp - 0x20]
mov dl, 1
push 0x109b
push eax
push ecx
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x481d
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x38]
push eax
lea eax, [ebp - 0x4c]
push eax
lea ecx, [ebp - 0x3c]
call fcn.1003b89a
add esp, 0x2c
lea ecx, [ebp - 0x4c]
call fcn.1000f3c0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003bffc
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
cmp byte [ebp + 0x10], 0
je 0x1003c0ca
mov dword [ebp - 0x14], 0x783c
cmp dword [ebp - 0x14], 0x78bd
jle 0x1003c09b
push ebx
push edi
xor edi, edi
mov dword [ebp - 0x10], edi
mov ebx, edi
mov dword [ebp - 0xc], 0x6c62
mov dword [ebp - 8], ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 4], 0x7f86
xor edi, edi
mov ecx, edi
mov eax, ebx
shl eax, cl
lea ecx, [ebp - 0x30]
cdq
push edx
push eax
call fcn.10001aa4
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003c056
mov eax, dword [eax]
push eax
call fcn.10043d63
pop ecx
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.1000fb16
inc edi
cmp edi, 0x4845
jl 0x1003c03b
dec ebx
dec dword [ebp - 4]
jne 0x1003c039
mov ebx, dword [ebp - 8]
dec ebx
dec dword [ebp - 0xc]
mov dword [ebp - 8], ebx
jne 0x1003c02f
mov edi, dword [ebp - 0x10]
inc edi
mov dword [ebp - 0x10], edi
cmp edi, 0x5ced
jl 0x1003c023
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
pop edi
pop ebx
push 0x7bb
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
cmp dword [ebp - 0x14], 0x7682
jge 0x1003c0d8
push str.jaharz_hiju_rpjzs_pjsma_scq_reafuagi_jhbhp_otvtac_lidcjadt
call fcn.10043d63
pop ecx
jmp 0x1003c0d8
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
mov esp, ebp
pop ebp
ret

Function at 0x1003cdcc
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005c27c
call fcn.1005a5c0
sub esp, 0xc
push ebx
push esi
mov dword [ebp - 0x14], 0x1955
mov eax, ecx
cmp dword [ebp - 0x14], 0x1a89
mov ebx, edx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], eax
jle 0x1003ce20
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x10077318
xor eax, esi
cdq
push edx
push eax
call fcn.1000f05b
inc edi
cmp edi, 0x1e00
jl 0x1003cdfa
inc esi
cmp esi, 0xa16
jl 0x1003cdf8
mov eax, dword [ebp - 0x18]
sub esp, 0xc
push 0
push dword [ebp + 0x10]
push ecx
push ecx
push eax
push ecx
push dword [ebp + 8]
mov ecx, ebx
sub esp, 0xc
call fcn.1003ce83
and dword [ebp - 4], 0
add esp, 0x34
cmp dword [ebp - 0x14], 0x182e
jge 0x1003ce58
mov edx, str.peid_vrgptdb_zsxfbmxg_gaondcp_vvht
mov ecx, 0x10077318
call fcn.10013928
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003d5a2
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x1003d5b9
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x1003d5db
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x106ee604
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x106ee990
jl 0x1003d5e9
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x106eec34
jl 0x1003d629
mov ecx, dword [0x106ef980]
xor ecx, dword [0x106ee604]
and ecx, edi
xor ecx, dword [0x106ef980]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x106ee600], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x106eec34]
mov dword [0x106eefc0], eax
pop esi
ret
Function at 0x4033c5
Capabilities:
Delete directory

Disassembly:
push ebp
push ebx
mov edx, 0xa
sub esp, 4
mov dword [esp], 0
dec edx
jne 0x4033cc
mov edx, dword [esp + 0x34]
lea ecx, [esp]
call fcn.00404060
mov dword [esp + 4], 1
push dword [0x40e44c]
call fcn.00408095
push dword [0x40e7a8]
push dword [0x40e7a8]
push 0x40d023
push dword [esp + 0x10]
push dword [esp + 0x10]
call fcn.00404410
lea eax, [esp + 0xc]
push eax
call fcn.0040ab90
mov edx, dword [esp + 8]
xor ecx, ecx
call fcn.0040ac10
jne 0x403492
mov ebx, dword [esp + 4]
mov eax, ebx
mov ecx, 2
cdq
idiv ecx
mov ebx, edx
and ebx, ebx
jne 0x403469
push dword [esp + 8]
call fcn.00404520
push eax
mov ebx, dword [esp + 0x10]
mov ebp, dword [0x40e4c8]
shl ebx, 3
add ebp, ebx
pop eax
mov dword [ebp + 4], eax
mov ebx, dword [esp + 0xc]
inc ebx
mov dword [esp + 0xc], ebx
jmp 0x403490
mov edx, dword [esp + 8]
push dword [0x40e7a8]
call fcn.0040ac40
mov ebx, dword [esp + 0x10]
mov ebp, dword [0x40e4c8]
shl ebx, 3
add ebp, ebx
lea eax, [ebp]
push eax
call fcn.0040ab90
jmp 0x403494
jmp 0x4034a2
mov ebx, dword [esp + 4]
inc ebx
mov dword [esp + 4], ebx
jmp 0x4033f8
push dword [esp + 0xc]
pop eax
mov dword [0x40e3fc], eax
mov dword [esp + 0x10], 0
mov eax, dword [esp + 0xc]
cmp eax, dword [esp + 0x10]
jl 0x4036ce
mov ebx, dword [esp + 0x10]
mov ebp, dword [0x40e4c8]
shl ebx, 3
add ebp, ebx
mov edx, dword [ebp]
push dword [0x40e7a8]
call fcn.0040ac40
lea eax, [esp + 0x18]
push eax
call fcn.0040ab90
push dword [0x40e7a8]
push dword [esp + 0x18]
push dword [0x40e7a8]
mov edx, str.b2eincfile
call fcn.0040ac40
push dword [0x40e7a8]
push dword [0x40e7a8]
mov eax, dword [esp + 0x24]
cdq
push edx
push eax
add dword [esp], 1
adc dword [esp + 4], 0
pop eax
pop edx
push edx
push eax
call fcn.00404380
pop eax
mov edx, dword [0x40d338]
add dword [esp], edx
jmp 0x4111c0
push dword [0x40e7a8]
push dword [0x40e7a8]
push dword [0x40e7a8]
push dword [0x40e7a8]
push dword [0x40e7a8]
push 0x40d14c
push dword [esp + 0x3c]
call fcn.00404850
mov edx, dword [0x40d338]
add dword [esp], edx
call fcn.004041f0
mov edx, dword [0x40d338]
add dword [esp], edx
call fcn.004040c0
pop dword [0x40e7a8]
mov ebx, eax
and ebx, ebx
jle 0x4037bd
push dword [0x40e7a8]
push 0x24
mov edx, dword [0x40e41c]
push dword [0x40e7a8]
call fcn.0040ac40
mov edx, str._r_n_r_n
call fcn.0040ac40
mov edx, dword [esp + 0x30]
call fcn.0040ac40
mov edx, 0x40d14c
call fcn.0040ac40
mov edx, dword [0x40e3f0]
call fcn.0040ac40
inc dword [0x40e7a8]
push dword [0x40e4b4]
mov edx, dword [0x40d338]
add dword [esp + 4], edx
call fcn.004048a4
pop dword [0x40e7a8]
mov dword [esp + 0x18], eax
mov ebx, dword [esp + 0x18]
cmp ebx, 7
jne 0x4037bd
call fcn.00403b05
push dword [0x40e458]
call fcn.004081ac
push dword [0x40e4b0]
call sub.KERNEL32.dll_RemoveDirectoryA
push 0
jmp 0x401fd5
mov eax, 1
jmp 0x4037c6
push dword [esp]
call fcn.0040aca0
push dword [esp + 0x24]
call fcn.0040aca0
push dword [esp + 0x14]
call fcn.0040aca0
push dword [esp + 8]
call fcn.0040aca0
add esp, 0x28
pop ebx
pop ebp
ret 4
Function at 0x40c818
Capabilities:
Link many functions at runtime
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x419428]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov ebx, dword [sym.imp.KERNEL32.dll_EncodePointer]
push esi
push edi
mov dword [ebp - 0x1c], eax
xor esi, esi
mov eax, dword [ebp + 0xc]
push esi
mov dword [ebp - 0x20], eax
call ebx
mov edi, eax
mov dword [ebp - 0x18], edi
call fcn.004075d7
mov dword [ebp - 0x14], eax
cmp dword [0x454f54], esi
jne 0x40c90b
push 0x800
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
jne 0x40c898
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x57
jne 0x40c9eb
push esi
push esi
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
mov edi, eax
test edi, edi
je 0x40c9eb
push str.MessageBoxW
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x40c9eb
push eax
call ebx
push str.GetActiveWindow
push edi
mov dword [0x454f54], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetLastActivePopup
push edi
mov dword [0x454f58], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
push str.GetUserObjectInformationW
push edi
mov dword [0x454f5c], eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x454f64], eax
test eax, eax
je 0x40c908
push str.GetProcessWindowStation
push edi
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call ebx
mov dword [0x454f60], eax
mov edi, dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x40c930
mov eax, dword [ebp - 0x1c]
test eax, eax
je 0x40c923
push eax
call dword [sym.imp.KERNEL32.dll_OutputDebugStringW]
cmp dword [ebp - 0x14], esi
je 0x40c945
push 4
pop eax
jmp 0x40c9ed
cmp dword [ebp - 0x14], esi
je 0x40c945
push dword [0x454f54]
call dword [sym.imp.KERNEL32.dll_DecodePointer]
push 3
jmp 0x40c92a
mov eax, dword [0x454f60]
mov ebx, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, edi
je 0x40c9a3
cmp dword [0x454f64], edi
je 0x40c9a3
push eax
call ebx
push dword [0x454f64]
mov dword [ebp - 0x14], eax
call ebx
mov ecx, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
test ecx, ecx
je 0x40c9a3
test eax, eax
je 0x40c9a3
call ecx
test eax, eax
je 0x40c998
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call dword [ebp - 0x18]
test eax, eax
je 0x40c998
test byte [ebp - 8], 1
jne 0x40c9a3
mov edi, dword [ebp + 0x10]
or edi, 0x200000
jmp 0x40c9d3
mov eax, dword [0x454f58]
cmp eax, edi
je 0x40c9d0
push eax
call ebx
test eax, eax
je 0x40c9d0
call eax
mov esi, eax
test esi, esi
je 0x40c9d0
mov eax, dword [0x454f5c]
cmp eax, edi
je 0x40c9d0
push eax
call ebx
test eax, eax
je 0x40c9d0
push esi
call eax
mov esi, eax
mov edi, dword [ebp + 0x10]
push dword [0x454f54]
call ebx
test eax, eax
je 0x40c9eb
push edi
push dword [ebp - 0x20]
push dword [ebp - 0x1c]
push esi
call eax
jmp 0x40c9ed
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.00403f7e
mov esp, ebp
pop ebp
ret