joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10031960
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
mov byte [esp + 4], dl
push ebx
push esi
push edi
test cl, cl
je 0x100319ad
test dl, dl
je 0x10031988
xor esi, esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
jmp 0x10031aae
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x10031aae
push 0x1dcb
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x10031aae
cmp byte [ebp + 0xc], 0
je 0x10031a2c
xor esi, esi
xor edi, edi
mov dword [esp + 0x18], esi
inc edi
mov dword [esp + 0x1c], 0xfffffff6
mov dword [esp + 0x14], edi
mov dword [esp + 0x14], 3
mov dword [esp + 0x14], esi
mov dword [esp + 0x14], esi
jmp 0x100319ea
mov eax, dword [esp + 0x14]
mov dword [esp + eax*4 + 0x20], 0x3fde
inc dword [esp + 0x14]
cmp dword [esp + 0x14], 2
jl 0x100319da
mov dword [esp + 0x14], edi
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
sub eax, 0xfffffff8
neg eax
sbb eax, eax
inc eax
mov dword [esp + 0x14], eax
mov dword [esp + 0x14], edi
cmp dword [esp + 0x14], esi
jl 0x10031aae
cmp dword [esp + 0x1c], esi
jne 0x10031aae
dec dword [esp + 0x14]
jns 0x10031a17
jmp 0x10031aae
mov dword [esp + 0x18], 0x21db
cmp dword [esp + 0x18], 0x256b
jle 0x10031a91
xor esi, esi
xor edi, edi
mov ebx, esi
inc edi
mov ecx, esi
mov dword [esp + 0x14], esi
mov eax, ebx
sar eax, cl
lea ecx, [esp + 0x28]
cdq
push edx
push eax
call fcn.10001a31
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10031a65
mov eax, dword [eax]
push eax
call fcn.100490c6
pop ecx
push esi
push edi
lea ecx, [esp + 0x30]
call fcn.1000209f
mov ecx, dword [esp + 0x14]
inc ecx
mov dword [esp + 0x14], ecx
cmp ecx, 0x67be
jl 0x10031a4b
inc ebx
cmp ebx, 0x4889
jl 0x10031a45
cmp dword [esp + 0x18], 0x1fa4
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
mov dword [ecx], eax
jge 0x10031aae
push str.gqn_ctkkpe_zkqjzipj_ueob_xwnexdkpe_vgdregi_hqkby_iikg_wqlippq_rqxrqf
call fcn.100490c6
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10031bb9
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [ebp + 0xc], 0
je 0x10031bde
push 0x19d0
xor eax, eax
push eax
push eax
push eax
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
jmp 0x10031c01
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x10031c01
push 0x1fd0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RestoreDC]
mov esp, ebp
pop ebp
ret
Function at 0x10031eb2
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100626a2
call fcn.100612c8
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x20], 0x4a46
mov edi, edx
xor esi, esi
mov dword [ebp - 0x10], esp
cmp dword [ebp - 0x20], 0x4bd1
mov dword [ebp - 0x18], edi
jle 0x10031f36
mov edi, esi
mov dword [ebp - 0x14], esi
mov ebx, esi
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x14], 0x1b72
mov eax, ebx
mov ecx, 0x1007cab8
and eax, esi
xor eax, edi
cdq
push edx
push eax
call fcn.10001cb3
dec ebx
dec dword [ebp - 0x14]
jne 0x10031ef3
mov ebx, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 0x1c], ebx
cmp ebx, 0x5359
jl 0x10031ee9
inc esi
push 0
mov dword [ebp - 0x14], esi
cmp esi, 0x4ecb
pop esi
jl 0x10031ee1
inc edi
cmp edi, 0x5920
jl 0x10031ede
mov edi, dword [ebp - 0x18]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x20], 0x46fe
jge 0x10031f51
mov edx, str.jbf_lgryae_jmdpcxk_hoxnckkyl_tpxjv_dpjj_rfbxpkzaf
mov ecx, 0x1007cab8
call fcn.100036f5
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], 0x4d1d
cmp dword [ebp - 0x1c], 0x4e27
jle 0x10031fea
mov ebx, esi
mov edi, esi
mov eax, esi
mov dword [ebp - 0x14], esi
mov ecx, esi
mov dword [ebp - 0x20], esi
shl eax, cl
lea ecx, [ebp - 0x3c]
and eax, edi
or eax, ebx
cdq
push edx
push eax
call fcn.10001a31
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10031f92
mov eax, dword [eax]
push eax
call fcn.100490c6
pop ecx
push esi
push 1
lea ecx, [ebp - 0x3c]
call fcn.1000209f
mov ecx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x14]
inc ecx
mov dword [ebp - 0x20], ecx
cmp ecx, 0x1a89
jl 0x10031f77
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x2145
jl 0x10031f72
inc edi
cmp edi, 0x6aed
jl 0x10031f6d
inc ebx
cmp ebx, 0x1bf1
jl 0x10031f6b
push esi
push 0xd60
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetTimer]
mov edi, dword [ebp - 0x18]
cmp byte [ebp + 0x1c], 0
je 0x100320b1
mov dword [ebp - 0x20], 0x5a29
cmp dword [ebp - 0x20], 0x5b34
jle 0x10032044
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x24], esi
mov eax, esi
mov ecx, 0x1007cab8
and eax, ebx
or eax, edi
cdq
push edx
push eax
call fcn.10001cb3
inc esi
cmp esi, 0x41cd
jl 0x1003200b
inc ebx
push 0
pop esi
cmp ebx, 0x4b6e
jl 0x10032008
inc edi
cmp edi, 0x6d31
jl 0x10032006
push esi
push esi
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov eax, dword [ebp + 0xc]
mov edx, dword [eax]
mov eax, dword [ebp + 0x20]
mov dword [eax], edx
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x59a0
jge 0x1003206d
mov edx, str.rlitwa_dcexkcjr_vkswhd_pyidmk
mov ecx, 0x1007cab8
call fcn.100036f5
jmp 0x100320ca
mov dword [edi], esi
cmp dword [edi], 4
jge 0x100320ca
mov edx, dword [ebp + 0x18]
mov ecx, dword [edi]
mov eax, dword [edx]
or dword [eax + ecx*4], 0xffffffff
inc dword [edi]
cmp dword [edi], 4
jl 0x100320bb
cmp dword [ebp - 0x1c], 0x4b93
jge 0x100320de
push str.pbxnf_vdtotgou_lfhrxg_fgjdfrbi_wff
call fcn.100490c6
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100326f9
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
cmp byte [ebp + 0xc], 0
mov edx, ecx
push esi
je 0x1003272b
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10032749
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xdebf624
inc dword [edx]
cmp dword [edx], 2
jl 0x10032717
jmp 0x10032749
mov byte [esp + 7], 0
cmp byte [esp + 7], 0
je 0x10032749
push 1
push 0x1fa4
push 0x2114
call dword [sym.imp.USER32.dll_AttachThreadInput]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10033645
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10062701
call fcn.100612c8
sub esp, 0x2c
push ebx
push esi
mov dword [ebp - 0x20], 0x2b01
mov eax, ecx
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
cmp dword [ebp - 0x20], 0x2ebb
mov dword [ebp - 0x1c], eax
jle 0x100336e4
mov edi, esi
mov ebx, esi
mov eax, ebx
lea ecx, [ebp - 0x38]
and eax, edi
cdq
push edx
push eax
call fcn.10001a31
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003368c
mov eax, dword [eax]
push eax
call fcn.100490c6
pop ecx
push esi
push 1
lea ecx, [ebp - 0x38]
call fcn.1000209f
inc ebx
cmp ebx, 0x2102
jl 0x10033673
inc edi
cmp edi, 0x115c
jl 0x10033671
push esi
push 0x242d
push 0x131f
push 0x1008
push 0x223f
push 0x802
push 0x504
push 0x863
push 0xe73
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov eax, dword [ebp - 0x1c]
cmp byte [ebp + 0x10], 0
je 0x10033711
dec dword [eax]
cmp dword [ebp - 0x20], 0x2992
jge 0x10033700
push str.nrtox_gwbzfoxnf_pxapz_ynmomkeo_vncrrmgr_fkzz_jpbrp_puethta_svwyfzz_loe_juybvwlwd_kcbxo_hxetixl_hiisi
call fcn.100490c6
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], 0x2c1b
cmp dword [ebp - 0x1c], 0x2e5c
jle 0x10033772
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x18], esi
mov eax, esi
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
add eax, esi
mov ecx, 0x1007cab8
xor eax, ebx
xor eax, edi
cdq
push edx
push eax
call fcn.10001cb3
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x4f98
jl 0x10033730
inc esi
push 0
mov dword [ebp - 0x18], esi
cmp esi, 0x7c21
pop esi
jl 0x10033728
inc ebx
cmp ebx, 0x1a9c
jl 0x10033725
inc edi
cmp edi, 0x557c
jl 0x10033723
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_RegGetKeySecurity]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x1c], 0x287e
jge 0x100336ec
mov edx, str.lrpw_mvw_yyrg_ilyxgyns
mov ecx, 0x1007cab8
call fcn.100036f5
jmp 0x100336ec
Function at 0x10034046
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x10062729
call fcn.100612c8
sub esp, 0x14
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, edx
mov byte [ebp - 0x14], cl
je 0x1003414a
mov dword [ebp - 0x20], 0x3105
cmp dword [ebp - 0x20], 0x34e7
jle 0x100340de
push 0x805
call dword [sym.imp.GDI32.dll_GetStockObject]
xor esi, esi
mov edi, esi
mov dword [ebp - 0x1c], esi
mov ebx, esi
lea eax, [ebx + edi]
mov dword [ebp - 0x18], 0x2c05
mov dword [ebp + 0x10], eax
mov edi, esi
mov esi, dword [ebp + 0x10]
mov eax, esi
mov ecx, 0x1007cab8
or eax, edi
cdq
push edx
push eax
call fcn.10001cb3
inc edi
cmp edi, 0x3fc8
jl 0x1003409e
dec esi
dec dword [ebp - 0x18]
push 0
mov dword [ebp + 0x10], esi
pop esi
jne 0x10034099
mov edi, dword [ebp - 0x1c]
inc ebx
cmp ebx, 0x2a1e
jl 0x1003408c
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x743a
jl 0x1003408a
jmp 0x100340e0
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [ebp - 0x20], 0x308c
jge 0x10034119
mov edx, str.kogrq_yjbouop_rjauixant_mbswiroo_dblb_dfzjxdqt
mov ecx, 0x1007cab8
call fcn.100036f5
jmp 0x10034119
cmp byte [ebp - 0x14], 0
je 0x10034140
mov edx, dword [ebp + 0x18]
mov dword [edx], esi
cmp dword [edx], 2
jge 0x100341a4
mov esi, dword [ebp + 0x20]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xdebf624
inc dword [edx]
cmp dword [edx], 2
jl 0x1003412c
jmp 0x100341a4
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
jmp 0x100341a4
cmp byte [ebp + 0xc], 0
je 0x1003416c
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x100341a4
xor esi, esi
push esi
push 0x1a9
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x100341a4
mov edi, dword [ebp + 8]
jmp 0x1003419e
push 0x7e20
push 0x7a2f
push 0x7bfa
push ecx
push 0x22a9
push dword [ebp + 0x1c]
xor cl, cl
push 0x328c
push 0x4e0f
push esi
call fcn.100335c6
add esp, 0x24
mov eax, dword [esi]
cmp eax, dword [edi]
jb 0x10034171
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100344b0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x10], 0
push ebx
mov ebx, edx
je 0x10034530
cmp byte [ebp + 0x24], 0
je 0x1003451d
mov eax, dword [ebp + 0x18]
mov edx, 0x7a4bedcc
push esi
mov esi, dword [ebp + 0x2c]
push edi
mov eax, dword [eax]
mov dword [esi], eax
mov eax, dword [ebp + 8]
mov dword [ecx], edx
xor ecx, ecx
inc dword [eax]
mov eax, dword [eax]
cmp eax, edx
mov eax, dword [esi]
sete cl
xor edi, edi
xor edx, edx
inc edi
cmp ecx, edi
setle dl
xor ecx, ecx
cmp eax, edx
mov edx, dword [ebp + 0xc]
setl cl
imul ecx, ecx, 0x467
mov eax, dword [edx]
sub ecx, eax
mov dword [ebx], ecx
xor ecx, ecx
cmp dword [ebx], ecx
je 0x10034515
mov eax, dword [ebp + 0x20]
mov eax, dword [eax]
cmp dword [eax + 8], ecx
jne 0x10034517
mov edi, ecx
mov dword [edx], edi
pop edi
pop esi
jmp 0x1003455f
mov eax, dword [ebp + 0x28]
mov ecx, dword [ebp + 0x30]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp + 0x14]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x1003455f
cmp byte [ebp + 0x1c], 0
je 0x1003454a
xor ecx, ecx
mov byte [ebp + 0x13], cl
cmp byte [ebp + 0x13], cl
je 0x1003455f
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x1003455f
mov byte [ebp + 0x13], 0
cmp byte [ebp + 0x13], 0
je 0x1003455f
push 0x128c
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
pop ebx
pop ebp
ret

Function at 0x10034707
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1006273d
call fcn.100612c8
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0x14], 0xf7f
mov edi, edx
cmp dword [ebp - 0x14], 0xff4
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], edi
jle 0x10034762
xor esi, esi
xor ebx, ebx
lea eax, [ebx + esi]
mov ecx, 0x1007cab8
cdq
push edx
push eax
call fcn.10001cb3
inc ebx
cmp ebx, 0x2e5a
jl 0x10034733
inc esi
cmp esi, 0x4d60
jl 0x10034731
push 0
push 0x2072
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0xda3
jge 0x1003479d
mov edx, str.slcntpzh_efpsxyu_utgkt_ddnz_qchq_brvs
mov ecx, 0x1007cab8
call fcn.100036f5
jmp 0x1003479d
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x10], 0
je 0x100347ec
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10034815
push 0x3eda
push 0x17d6
push 0x1dbd
push 0x353b
push 1
push 0x40b5
push 0x5ccc
push 0
push 0x3871
push 0x6cf2
mov dl, 1
mov ecx, 0x2567
call fcn.1003251c
add esp, 0x28
jmp 0x10034815
mov esi, dword [ebp + 8]
mov dword [esi], 1
jmp 0x10034810
push 0x6d38
push edi
push ecx
push 0x459e
push ecx
xor dl, dl
call fcn.10033f11
add esp, 0x14
dec dword [esi]
cmp dword [esi], 0
jge 0x100347f7
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003518d
Capabilities:
Get session user name

Disassembly:
mov eax, 0x1006275b
call fcn.100612c8
sub esp, 0x18
mov eax, ecx
mov dword [ebp - 0x20], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10035290
cmp byte [ebp + 0x14], 0
je 0x100351db
push 0x28f4
push ecx
push 1
push ecx
lea eax, [ebp - 0x11]
mov byte [ebp - 0x11], 0
push eax
push 0x976
mov ecx, 0x5b60
call fcn.100323f4
add esp, 0x18
jmp 0x100352cf
mov dword [ebp - 0x18], 0x553c
xor esi, esi
cmp dword [ebp - 0x18], 0x5911
jle 0x10035245
push 0x1c1
push esi
call dword [sym.imp.USER32.dll_CharLowerBuffW]
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x1c], esi
mov eax, ebx
mov ecx, 0x1007cab8
cdq
idiv esi
mov eax, edi
sub eax, edx
cdq
push edx
push eax
call fcn.10001cb3
inc esi
cmp esi, 0x71a5
jl 0x10035200
inc ebx
push 0
pop esi
cmp ebx, 0x70b8
jl 0x100351fd
inc edi
cmp edi, 0x5482
jl 0x100351fb
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_TranslateMDISysAccel]
mov eax, dword [ebp - 0x20]
cmp byte [eax], 0
je 0x10035252
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x18], 0x532f
jge 0x100351d6
mov edx, str.vfqobdw_anphitsc_vocjmdx_bkdv_ztyoiye_uxdq
mov ecx, 0x1007cab8
call fcn.100036f5
jmp 0x100351d6
cmp byte [ebp + 0xc], 0
je 0x100352bb
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
cmp dword [edx], 4
jge 0x100352cf
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xe48d327c
inc dword [edx]
cmp dword [edx], 4
jl 0x100352a7
jmp 0x100352cf
push 0x2440
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetClassNameW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10035419
Capabilities:
Get system information on windows

Disassembly:
mov eax, 0x10062765
call fcn.100612c8
sub esp, 0x2c
cmp byte [ebp + 0x1c], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
je 0x100355af
mov dword [ebp - 0x1c], 0x70c0
xor esi, esi
cmp dword [ebp - 0x1c], 0x718e
jle 0x100354ae
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_RegLoadKeyW]
mov dword [ebp - 0x18], esi
mov ebx, esi
mov dword [ebp - 0x14], 0x6534
mov edi, esi
mov dword [ebp + 0x1c], 0x208b
mov eax, edi
lea ecx, [ebp - 0x38]
cdq
push edx
push eax
call fcn.10001a31
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003547f
mov eax, dword [eax]
push eax
call fcn.100490c6
pop ecx
push esi
push 1
lea ecx, [ebp - 0x38]
call fcn.1000209f
add edi, ebx
dec dword [ebp + 0x1c]
jne 0x10035468
mov edi, dword [ebp - 0x18]
add ebx, edi
dec dword [ebp - 0x14]
jne 0x1003545f
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0xf43
jl 0x10035456
cmp dword [ebp - 0x1c], 0x6e25
jge 0x100354c2
push str.mkvpjhe_ccrvpxl_boijuz_mcs_bkz_qiy_jungf_prob_zjcnliet_pws
call fcn.100490c6
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x10], 0
je 0x1003558e
mov dword [ebp - 0x14], 0x26a0
cmp dword [ebp - 0x14], 0x2758
jle 0x10035549
push esi
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov dword [ebp - 0x18], esi
mov dword [ebp + 0x1c], esi
mov dword [ebp - 0x1c], 0x7f62
mov edi, dword [ebp + 0x1c]
mov ebx, esi
mov eax, edi
mov dword [ebp - 0x20], esi
cdq
idiv ebx
mov edi, dword [ebp - 0x20]
mov esi, edx
mov eax, esi
mov ecx, 0x1007cab8
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001cb3
inc edi
cmp edi, 0x2497
jl 0x10035506
mov edi, dword [ebp + 0x1c]
inc ebx
push 0
pop esi
cmp ebx, 0x5675
jl 0x100354f9
mov edi, dword [ebp - 0x18]
add dword [ebp + 0x1c], edi
dec dword [ebp - 0x1c]
jne 0x100354f4
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x1dad
jl 0x100354ea
mov dword [ebp - 4], 2
cmp dword [ebp - 0x14], 0x23e8
jge 0x10035568
mov edx, str.iuce_jyku_czr_echlozz_xrghpn_vfqayof_ffiqbovin_xxiso_zxjgoebo_wno_zhctz_lyludgvdw
mov ecx, 0x1007cab8
call fcn.100036f5
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
jmp 0x100355e0
mov edx, dword [ebp + 0x14]
mov dword [edx], esi
cmp dword [edx], 2
jge 0x100355e0
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x7f4ea14c
inc dword [edx]
cmp dword [edx], 2
jl 0x1003559b
jmp 0x100355e0
cmp byte [ebp + 0x20], 0
je 0x100355c6
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
jmp 0x100355e0
mov dword [edx], 0
jmp 0x100355db
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 1
inc dword [edx]
cmp dword [edx], 1
jl 0x100355ce
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003567d
Capabilities:
Get disk information
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov edi, edx
mov esi, ecx
mov dword [esp + 0x20], edi
je 0x100357a7
cmp byte [ebp + 0xc], 0
je 0x100356c7
mov dword [esi], 0
cmp dword [esi], 1
jge 0x10035847
mov edx, dword [ebp + 0x14]
mov ecx, dword [esi]
mov eax, dword [edx]
or dword [eax + ecx*4], 0xffffffff
inc dword [esi]
cmp dword [esi], 1
jl 0x100356b3
jmp 0x10035847
mov dword [esp + 0x24], 0x2b1f
cmp dword [esp + 0x24], 0x2b6b
push 0
pop ebx
jle 0x10035771
mov esi, ebx
mov dword [esp + 0x20], ebx
mov dword [esp + 0x1c], ebx
mov dword [esp + 0x14], esi
mov dword [esp + 0x18], 0x6dca
mov edi, dword [esp + 0x14]
mov esi, ebx
mov eax, edi
lea ecx, [esp + 0x28]
or eax, esi
cdq
push edx
push eax
call fcn.10001a31
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10035716
mov eax, dword [eax]
push eax
call fcn.100490c6
pop ecx
push ebx
push 1
lea ecx, [esp + 0x30]
call fcn.1000209f
inc esi
cmp esi, 0x40c4
jl 0x100356fc
mov edi, dword [esp + 0x1c]
add dword [esp + 0x14], edi
dec dword [esp + 0x18]
jne 0x100356f6
mov esi, dword [esp + 0x20]
inc edi
mov dword [esp + 0x1c], edi
cmp edi, 0x588c
jl 0x100356ea
inc esi
mov dword [esp + 0x20], esi
cmp esi, 0x406f
jl 0x100356e6
push ebx
push ebx
push 0x24f0
push 0x48d
push ebx
call dword [sym.imp.USER32.dll_InsertMenuA]
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x10035789
push 0xb5b
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
cmp dword [esp + 0x24], 0x287d
jge 0x10035847
push str.jxhgz_wrnrx_uwjxce_wtsnml_rtm
call fcn.100490c6
pop ecx
jmp 0x10035847
cmp byte [ebp + 0x10], 0
push 0
je 0x10035841
mov dword [esp + 0x28], 0x1221
cmp dword [esp + 0x28], 0x12bf
pop ebx
jle 0x1003580d
mov esi, ebx
mov edi, ebx
mov eax, edi
lea ecx, [esp + 0x40]
xor eax, esi
cdq
push edx
push eax
call fcn.10001a31
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100357e4
mov eax, dword [eax]
push eax
call fcn.100490c6
pop ecx
push ebx
push 1
lea ecx, [esp + 0x48]
call fcn.1000209f
inc edi
cmp edi, 0x7b45
jl 0x100357ca
inc esi
cmp esi, 0x49a8
jl 0x100357c8
mov edi, dword [esp + 0x20]
cmp dword [esp + 0x24], 0xf5f
jge 0x10035822
push str.gcnad_yesq_fay_spen_ycturs_woqpk_mvqjzqc_cni_raacsncnk_ikfq_nlso_nuguqhm
call fcn.100490c6
pop ecx
mov dword [edi], ebx
jmp 0x1003583a
push ebx
push 0x1b67
mov ecx, 0x3e08
call fcn.100326f9
inc dword [edi]
pop ecx
pop ecx
cmp dword [edi], 2
jle 0x10035826
jmp 0x10035847
call dword [sym.imp.KERNEL32.dll_ResumeThread]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003b3bc
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
cmp byte [ebp + 0x24], 0
push esi
je 0x1003b43c
mov esi, dword [ebp + 0x1c]
xor edx, edx
mov eax, dword [esi]
mov eax, dword [ebp + 0x28]
cmp dword [eax], edx
jne 0x1003b416
mov dword [esp + 8], 4
mov byte [esp + 7], dl
cmp byte [esp + 7], dl
je 0x1003b3f4
push edx
push edx
call dword [sym.imp.KERNEL32.dll_LoadResource]
push dword [ebp + 8]
mov ecx, dword [ebp + 0x18]
lea eax, [esp + 0xc]
push 0x3d97
push esi
push eax
push 0x5eb
xor dl, dl
call fcn.1003b1c5
add esp, 0x14
jmp 0x1003b463
push ecx
push dword [ebp + 8]
lea eax, [esp + 0x14]
mov dword [esp + 0x14], 0xfffffff7
push eax
push ecx
mov edx, 0x433b
mov ecx, 0x6e4d
call fcn.1003d88d
add esp, 0x10
jmp 0x1003b463
mov ecx, dword [ebp + 0x20]
lea eax, [esp + 0x10]
push 0xffffffffffffffff
push dword [edx]
push eax
call fcn.100408bf
mov ecx, dword [ebp + 0x20]
push eax
call fcn.1001de2b
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.1000737d
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003b941
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10062add
call fcn.100612c8
sub esp, 0x48
cmp byte [ebp + 0x24], 0
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x24], ecx
je 0x1003ba70
mov dword [ebp - 0x18], 0x379b
cmp dword [ebp - 0x18], 0x39d8
jle 0x1003b9cf
push 0xabc
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindow]
xor esi, esi
mov dword [ebp + 0x24], esi
xor edi, edi
and dword [ebp - 0x20], 0
mov ebx, edi
and ebx, esi
mov esi, dword [ebp - 0x20]
mov eax, ebx
mov ecx, 0x1007cab8
xor eax, esi
cdq
push edx
push eax
call fcn.10001cb3
inc esi
cmp esi, 0x62c4
jl 0x1003b99a
mov esi, dword [ebp + 0x24]
inc edi
cmp edi, 0x6af6
jl 0x1003b98f
inc esi
mov dword [ebp + 0x24], esi
cmp esi, 0x3090
jl 0x1003b98d
mov ebx, dword [ebp - 0x1c]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x34fd
jge 0x1003ba0a
mov edx, str.qsnajvzf_eivlveov_qpkidxpa_vyzdfrsrc_rditk_ekkexlfc_fjz_yzcpnx_klq
mov ecx, 0x1007cab8
call fcn.100036f5
jmp 0x1003ba0a
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x14], 0
je 0x1003ba3d
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x1003bb0c
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
and dword [eax + ecx*4], 0
inc dword [edx]
cmp dword [edx], 3
jl 0x1003ba29
jmp 0x1003bb0c
mov eax, dword [ebp + 8]
mov ecx, dword [ebp - 0x24]
push 0xffffffffffffffff
push dword [eax]
lea eax, [ebp - 0x3c]
push eax
call fcn.100408bf
push eax
mov ecx, ebx
mov dword [ebp - 4], 2
call fcn.1004096d
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.1000737d
jmp 0x1003bb0c
mov dword [ebp + 0x24], 0x74ba
cmp dword [ebp + 0x24], 0x74e8
jle 0x1003bad4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_DeleteDC]
xor esi, esi
mov edi, esi
mov ebx, 0x5f3
mov eax, edi
lea ecx, [ebp - 0x54]
cdq
push edx
push eax
call fcn.10001a31
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003bab4
mov eax, dword [eax]
push eax
call fcn.100490c6
pop ecx
push 0
push 1
lea ecx, [ebp - 0x54]
call fcn.1000209f
dec edi
dec ebx
jne 0x1003ba9d
inc esi
cmp esi, 0x681a
jl 0x1003ba96
cmp byte [ebp + 0xc], 0
je 0x1003baed
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x20]
mov eax, dword [eax]
mov dword [eax + ecx*4], 0x3592
jmp 0x1003baf8
push 0x128c
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp dword [ebp + 0x24], 0x7410
jge 0x1003bb0c
push str.iefn_htbuekla_vkbykegzy_nqoiv_xtatrcao
call fcn.100490c6
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret