joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10022b98
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x10022be9
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x18], eax
push 0x666d
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0
push dword [ebp - 0x14]
push dword [ebp - 0x18]
push 0x7730
call fcn.10026de0
add esp, 0x20
jmp 0x10022c43
lea eax, [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x10022c0d
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10022c0b
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x10022c43
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x10022c43
push 0
push 0x76e1
push 0x51b7
push 0x15b1
push 1
push 0x525e
push 0x5cb
push 0x6dab
call fcn.1001dad2
add esp, 0x20
mov esp, ebp
pop ebp
ret
Function at 0x1002999a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10060d37
call fcn.1005fb28
sub esp, 0x58
push ebx
push esi
mov byte [ebp - 0x1c], dl
mov al, cl
mov dword [ebp - 0x30], 0x488b
cmp dword [ebp - 0x30], 0x4c63
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x15], al
jle 0x10029a35
xor esi, esi
mov dword [ebp - 0x28], esi
xor edi, edi
mov dword [ebp - 0x24], edi
lea ebx, [edi + esi]
mov dword [ebp - 0x20], 0x2104
mov esi, ebx
mov edi, 0x653c
mov eax, esi
lea ecx, [ebp - 0x4c]
cdq
push edx
push eax
call fcn.10001ade
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100299f7
mov eax, dword [eax]
push eax
call fcn.1004752f
pop ecx
push 0
push 1
lea ecx, [ebp - 0x4c]
call fcn.10013e9b
inc esi
dec edi
jne 0x100299e0
dec ebx
dec dword [ebp - 0x20]
jne 0x100299d9
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x28]
inc edi
mov dword [ebp - 0x24], edi
cmp edi, 0x3e2b
jl 0x100299cf
inc esi
mov dword [ebp - 0x28], esi
cmp esi, 0x543d
jl 0x100299ca
mov al, byte [ebp - 0x15]
test al, al
je 0x10029b09
cmp byte [ebp - 0x1c], 0
je 0x10029af5
mov dword [ebp - 0x2c], 0x89f
cmp dword [ebp - 0x2c], 0xab7
jle 0x10029acd
xor esi, esi
mov dword [ebp - 0x20], esi
xor ebx, ebx
mov dword [ebp - 0x24], 0x30af
mov dword [ebp - 0x28], ebx
xor edi, edi
mov ecx, edi
mov dword [ebp - 0x34], ebx
xor esi, esi
shl ebx, cl
mov eax, ebx
lea ecx, [ebp - 0x64]
xor eax, esi
cdq
push edx
push eax
call fcn.10001ade
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10029a8c
mov eax, dword [eax]
push eax
call fcn.1004752f
pop ecx
push 0
push 1
lea ecx, [ebp - 0x64]
call fcn.10013e9b
inc esi
cmp esi, 0x50ab
jl 0x10029a73
mov ebx, dword [ebp - 0x28]
inc edi
cmp edi, 0x3e86
jl 0x10029a6a
mov esi, dword [ebp - 0x20]
add ebx, esi
dec dword [ebp - 0x24]
mov dword [ebp - 0x28], ebx
jne 0x10029a68
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x293d
jl 0x10029a5c
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
cmp dword [ebp - 0x2c], 0x533
jge 0x10029ba0
push str.vqrj_otox_issmrobd_pmmt_wixx_npj_psahorig_jwlxflxj_mtxq_fjpyhkgtg_ynlhbvyf_cconjwm_fchocan_skdhobyz
call fcn.1004752f
pop ecx
jmp 0x10029ba0
push 0
push 0
push 0x952
call dword [sym.imp.USER32.dll_EnumChildWindows]
jmp 0x10029ba0
cmp byte [ebp + 0x10], 0
je 0x10029b9b
mov dword [ebp - 0x28], 0x6c3c
cmp dword [ebp - 0x28], 0x6cd5
jle 0x10029b5a
xor esi, esi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x2c], 0x38fe
mov eax, ebx
mov ecx, 0x1007d058
xor eax, esi
cdq
push edx
push eax
call fcn.100136b0
add ebx, edi
dec dword [ebp - 0x2c]
jne 0x10029b30
inc edi
cmp edi, 0x4f16
jl 0x10029b27
inc esi
cmp esi, 0x2d41
jl 0x10029b25
mov dword [ebp - 4], 2
cmp dword [ebp - 0x28], 0x68b9
jge 0x10029b79
mov edx, str.ofzhjxz_payudzjhx_nert_zzoektw_nhamzduwd_bje_iyx_fbjpxf_htsptuxbs_dzhxsbroa_asg
mov ecx, 0x1007d058
call fcn.100160b3
mov eax, dword [ebp + 0xc]
and dword [eax], 0
jmp 0x10029ba0
mov eax, dword [ebp + 0x14]
dec dword [eax]
cmp dword [ebp - 0x30], 0x453b
jge 0x10029bb4
push str.fpjw_sgjl_tctu_jbpcomjh_rdyvwdq_xie_speqw_fss_bgnz
call fcn.1004752f
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10029bc5
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10060d41
call fcn.1005fb28
sub esp, 0x18
push ebx
push esi
mov dword [ebp - 0x20], 0x1349
mov esi, edx
cmp dword [ebp - 0x20], 0x140d
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], esi
jle 0x10029c4e
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x1c], edi
mov eax, edi
mov dword [ebp - 0x18], 0x5ead
mov dword [ebp - 0x14], eax
mov esi, eax
mov edi, 0x7311
mov eax, esi
mov ecx, 0x1007d058
xor eax, ebx
cdq
push edx
push eax
call fcn.100136b0
dec esi
dec edi
jne 0x10029c07
mov eax, dword [ebp - 0x14]
dec eax
dec dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
jne 0x10029c00
mov edi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x5ebf
jl 0x10029bf4
inc ebx
cmp ebx, 0x4e00
jl 0x10029bef
push 0x6fd
call dword [sym.imp.KERNEL32.dll_IsValidCodePage]
mov esi, dword [ebp - 0x24]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x115c
jge 0x10029c89
mov edx, str.hnsoivx_ykykbsr_fhthpumu_kttf_aytwyjouw_trc_pigah_xurv_ghw_tpkovbsd
mov ecx, 0x1007d058
call fcn.100160b3
jmp 0x10029c89
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0xc], 0
je 0x10029ca0
mov eax, dword [ebp + 8]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x10029cc0
mov dword [esi], 0
cmp dword [esi], 1
jge 0x10029cc0
mov edx, dword [ebp + 0x14]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0xe97ee8c4
inc dword [esi]
cmp dword [esi], 1
jl 0x10029cae
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10029e5a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10060d55
call fcn.1005fb28
sub esp, 0x10
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
je 0x10029f4a
mov dword [ebp - 0x14], 0xbd3
cmp dword [ebp - 0x14], 0xc46
jle 0x10029ed9
push 0
push 0
call dword [sym.imp.USER32.dll_CharUpperBuffW]
xor esi, esi
mov dword [ebp + 0x10], esi
xor edi, edi
and dword [ebp - 0x18], 0
mov ebx, esi
mov esi, dword [ebp - 0x18]
mov ecx, edi
shl ebx, cl
mov eax, ebx
mov ecx, 0x1007d058
xor eax, esi
cdq
push edx
push eax
call fcn.100136b0
inc esi
cmp esi, 0x7099
jl 0x10029ea7
mov esi, dword [ebp + 0x10]
inc edi
cmp edi, 0x2783
jl 0x10029e9a
inc esi
mov dword [ebp + 0x10], esi
cmp esi, 0x42a9
jl 0x10029e98
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0xbc7
jge 0x10029ef5
mov edx, str.vnft_kxvgd_ygejjbag_hiacshga_qpszpnwk_wqkn_ueftxjb
mov ecx, 0x1007d058
call fcn.100160b3
cmp byte [ebp + 8], 0
je 0x10029f3a
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x10029f76
mov esi, dword [ebp + 0x24]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x44fb66c1
inc dword [edx]
cmp dword [edx], 3
jl 0x10029f0c
jmp 0x10029f76
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0x10029f76
call dword [sym.imp.KERNEL32.dll_GetConsoleCP]
jmp 0x10029f76
cmp byte [ebp + 0x20], 0
je 0x10029f59
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [edx], eax
jmp 0x10029f76
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
jmp 0x10029f71
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x44ad
inc dword [edx]
cmp dword [edx], 3
jl 0x10029f64
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003287f
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x10032896
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x100328b8
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x1418b384
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x1418b710
jl 0x100328c6
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x1418b9b4
jl 0x10032906
mov ecx, dword [0x1418c700]
xor ecx, dword [0x1418b384]
and ecx, edi
xor ecx, dword [0x1418c700]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x1418b380], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x1418b9b4]
mov dword [0x1418bd40], eax
pop esi
ret

Function at 0x10032eb6
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006128f
call fcn.1005fb28
sub esp, 0x18
push ebx
push esi
mov dword [ebp - 0x1c], 0x3644
cmp dword [ebp - 0x1c], 0x37ed
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x24], ecx
jle 0x10032f2a
xor esi, esi
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x18], 0x7ade
mov dword [ebp - 0x14], eax
xor eax, edi
mov ecx, 0x1007d058
or eax, esi
cdq
push edx
push eax
call fcn.100136b0
mov eax, dword [ebp - 0x14]
add eax, ebx
dec dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
jne 0x10032ef1
inc ebx
cmp ebx, 0x4b9e
jl 0x10032ee5
inc edi
cmp edi, 0x465b
jl 0x10032ee3
inc esi
cmp esi, 0x1002
jl 0x10032ee1
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x3548
jge 0x10032f46
mov edx, str.egpliz_extew_wyilrash_atcp_hwcscoy_fpti
mov ecx, 0x1007d058
call fcn.100160b3
cmp byte [ebp + 8], 0
je 0x10032f74
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov dword [eax], ecx
jmp 0x10032f85
push ecx
push dword [ebp + 0x10]
mov ecx, dword [ebp + 0x18]
call fcn.10036829
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003760a
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
cmp byte [ebp + 0x10], 0
mov eax, edx
push ebx
push esi
push edi
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
je 0x1003763a
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x100376d5
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x100376d5
mov dword [ebp - 0xc], 0x7bd
cmp dword [ebp - 0xc], 0xafe
jle 0x100376ba
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 8], ecx
mov eax, ebx
cdq
idiv ecx
mov eax, edi
mov ecx, edx
shl eax, cl
lea ecx, [ebp - 0x2c]
xor eax, esi
cdq
push edx
push eax
call fcn.10001ade
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10037677
mov eax, dword [eax]
push eax
call fcn.1004752f
pop ecx
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.10013e9b
mov ecx, dword [ebp - 8]
inc ecx
mov dword [ebp - 8], ecx
cmp ecx, 0x5944
jl 0x10037655
inc ebx
cmp ebx, 0x68cb
jl 0x10037650
inc edi
cmp edi, 0x64c0
jl 0x1003764e
inc esi
cmp esi, 0x47f3
jl 0x1003764c
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0x14]
mov ecx, dword [ecx]
cmp dword [ebp - 0xc], 0x5b7
mov eax, dword [eax]
mov dword [eax + 4], ecx
jge 0x100376d5
push str.yhfg_dyefzq_jaybn_cldv_zuvlwff_yunmjd_totqlx
call fcn.1004752f
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100376dc
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov ebx, edx
mov edi, ecx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x20], edi
je 0x100377ec
mov dword [ebp - 0x18], 0x31b6
cmp dword [ebp - 0x18], 0x339b
push 0
pop esi
jle 0x10037794
mov dword [ebp - 0x14], esi
mov edi, esi
mov dword [ebp - 0x10], 0xefa
mov dword [ebp - 0xc], edi
mov ebx, edi
mov dword [ebp - 8], 0x2356
mov esi, ebx
mov edi, 0x7ac7
mov eax, esi
lea ecx, [ebp - 0x38]
cdq
push edx
push eax
call fcn.10001ade
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10037746
mov eax, dword [eax]
push eax
call fcn.1004752f
pop ecx
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.10013e9b
dec esi
dec edi
jne 0x1003772f
dec ebx
dec dword [ebp - 8]
jne 0x10037728
mov edi, dword [ebp - 0xc]
dec edi
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], edi
jne 0x1003771f
mov esi, dword [ebp - 0x14]
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x6569
jl 0x10037713
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
cmp dword [ebp - 0x18], 0x2e6b
jge 0x100377a8
push str.uow_mity_bsnaus_ohmsibxo_pgauelu_pmfqfxayl_jelx_pbxhtzoq_dbsthrr_spnh_zgjext_ueaix
call fcn.1004752f
pop ecx
mov edx, dword [ebp + 0x18]
cmp dword [edx], esi
jne 0x100377e2
cmp dword [edx], 1
mov esi, dword [ebp + 8]
jb 0x100377b9
mov eax, dword [esi]
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
mov eax, dword [ebp + 0x30]
mov dword [eax], 1
imul ecx, dword [ecx], 0x6a6b
mov eax, dword [ebp + 0x2c]
neg ecx
sbb ecx, ecx
neg ecx
mov dword [eax], ecx
mov eax, dword [edx]
mov eax, dword [edi]
add eax, dword [edi]
mov dword [esi], eax
mov eax, dword [esi]
mov eax, dword [ebx]
mov dword [ebx], 0xfffffffb
jmp 0x10037806
mov eax, dword [ebp + 0x20]
cmp byte [eax], 0
je 0x10037806
push 0x8c6
push 0x21cb
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10037c28
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov byte [ebp - 4], dl
push esi
test dl, dl
je 0x10037c44
push 0x166a
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x10037c67
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10037c67
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xc327405e
inc dword [edx]
cmp dword [edx], 2
jl 0x10037c55
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10039d90
Capabilities:
Accept command line arguments
Encode data using xor
Resume thread

Disassembly:
mov eax, 0x10061637
call fcn.1005fb28
sub esp, 0x28
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x10039f12
mov dword [ebp - 0x18], 0x343d
cmp dword [ebp - 0x18], 0x3724
jle 0x10039e0f
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
xor esi, esi
mov edi, esi
mov dword [ebp + 0x10], esi
mov ebx, edi
mov edi, 0x2a3d
mov eax, ebx
lea ecx, [ebp - 0x34]
cdq
push edx
push eax
call fcn.10001ade
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10039de8
mov eax, dword [eax]
push eax
call fcn.1004752f
pop ecx
push esi
push 1
lea ecx, [ebp - 0x34]
call fcn.10013e9b
dec ebx
dec edi
jne 0x10039dd1
mov edi, dword [ebp + 0x10]
inc edi
mov dword [ebp + 0x10], edi
cmp edi, 0x7ce1
jl 0x10039dca
jmp 0x10039e11
xor esi, esi
cmp dword [ebp - 0x18], 0x3126
jge 0x10039e25
push str.arbmqqky_yriwf_gpjnkyjz_ckdpnyt_dcefjfhiz_migtzyq_lmq_ikiwv_genewiegy_qno_wgdauqmx
call fcn.1004752f
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x28], 0
je 0x10039e62
mov edi, dword [ebp + 8]
mov dword [edi], esi
jmp 0x10039e58
push ecx
push 0x140b
sub esp, 0x10
push 0x229d
push ecx
push dword [ebp + 0x18]
push ecx
push ecx
push esi
sub esp, 0x18
call fcn.10039201
add esp, 0x48
inc dword [edi]
cmp dword [edi], 0xf
jl 0x10039e36
jmp 0x10039f36
mov dword [ebp - 0x18], 0x188d
cmp dword [ebp - 0x18], 0x1c36
jle 0x10039ec6
push esi
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, esi
mov dword [ebp + 0x10], esi
mov ebx, esi
mov eax, edi
mov dword [ebp - 0x1c], esi
cdq
idiv ebx
mov edi, edx
mov eax, edi
mov ecx, 0x1007d058
xor eax, esi
cdq
push edx
push eax
call fcn.100136b0
inc esi
cmp esi, 0x660e
jl 0x10039e8a
mov edi, dword [ebp + 0x10]
inc ebx
push 0
pop esi
cmp ebx, 0x17f5
jl 0x10039e80
inc edi
mov dword [ebp + 0x10], edi
cmp edi, 0x5dbe
jl 0x10039e7e
push esi
call dword [sym.imp.USER32.dll_DestroyIcon]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x18], 0x171f
jge 0x10039ee5
mov edx, str.yjwbobdp_tngwg_cfyyzhgl_tblrcpyru_diur_etdejitaj_qjdcnhp_oeimb_cxbytabnt_fjjbxqxc_gwlfdup_mdxkaa
mov ecx, 0x1007d058
call fcn.100160b3
mov eax, dword [ebp + 0x24]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax]
mov dword [eax + ecx*4], 0xfffffff7
jmp 0x10039f36
cmp byte [ebp + 0x20], 0
je 0x10039f24
mov eax, dword [ebp + 0x14]
mov ecx, dword [ecx]
mov eax, dword [eax]
mov dword [eax + 4], ecx
jmp 0x10039f36
mov eax, dword [ebp + 0xc]
mov ecx, dword [edx]
sub ecx, dword [eax]
sar ecx, 1
push ecx
mov ecx, dword [ebp + 0x2c]
call fcn.10016d17
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003a482
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006164b
call fcn.1005fb28
sub esp, 0x20
mov byte [ebp - 0x18], cl
push ebx
mov ebx, edx
mov dword [ebp - 0x28], ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x1003a4c8
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x1003a580
push 0x480e
push ecx
mov dl, 1
mov ecx, 0x2c93
call fcn.10037902
pop ecx
pop ecx
jmp 0x1003a580
mov dword [ebp - 0x24], 0x1f79
cmp dword [ebp - 0x24], 0x230b
jle 0x1003a52b
xor esi, esi
mov dword [ebp - 0x20], esi
xor ebx, ebx
mov dword [ebp - 0x1c], 0x553c
xor edi, edi
xor esi, esi
mov eax, edi
mov ecx, 0x1007d058
cdq
idiv esi
xor edx, ebx
mov eax, edx
cdq
push edx
push eax
call fcn.100136b0
inc esi
cmp esi, 0x4e0c
jl 0x1003a4ea
inc edi
cmp edi, 0x5d28
jl 0x1003a4e8
mov esi, dword [ebp - 0x20]
add ebx, esi
dec dword [ebp - 0x1c]
jne 0x1003a4e6
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x7f51
jl 0x1003a4dd
mov ebx, dword [ebp - 0x28]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x1c7d
jge 0x1003a566
mov edx, str.ero_pvddn_nph
mov ecx, 0x1007d058
call fcn.100160b3
jmp 0x1003a566
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
jmp 0x1003a57b
mov ecx, dword [edx]
mov eax, dword [ebx]
or dword [eax + ecx*4], 0xffffffff
inc dword [edx]
cmp dword [edx], 3
jl 0x1003a571
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003a862
Capabilities:
Get common file path

Disassembly:
mov eax, 0x10061655
call fcn.1005fb28
sub esp, 0x2c
push ebx
push esi
mov dword [ebp - 0x1c], 0x6ac7
cmp dword [ebp - 0x1c], 0x6e8f
push edi
mov dword [ebp - 0x10], esp
jle 0x1003a8ed
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov eax, ebx
cdq
idiv ecx
lea ecx, [ebp - 0x34]
and edx, edi
xor edx, esi
mov eax, edx
cdq
push edx
push eax
call fcn.10001ade
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003a8b0
mov eax, dword [eax]
push eax
call fcn.1004752f
pop ecx
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.10013e9b
mov ecx, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x65a4
jl 0x1003a890
inc ebx
cmp ebx, 0x7c73
jl 0x1003a88b
inc edi
cmp edi, 0xaf9
jl 0x1003a889
inc esi
cmp esi, 0x4303
jl 0x1003a887
mov dword [ebp - 0x18], 0x4b28
cmp dword [ebp - 0x18], 0x4df2
jle 0x1003a92c
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x1007d058
or eax, esi
cdq
push edx
push eax
call fcn.100136b0
inc edi
cmp edi, 0x15e4
jl 0x1003a901
inc esi
cmp esi, 0x400e
jl 0x1003a8ff
push 0
call dword [sym.imp.USER32.dll_RegisterClassW]
mov dword [ebp - 4], 1
cmp dword [ebp - 0x18], 0x49cf
jge 0x1003a94b
mov edx, str.jdtgrujzb_umfe_gwg_sek_uqrawjlyv
mov ecx, 0x1007d058
call fcn.100160b3
cmp byte [ebp + 0x18], 0
je 0x1003a982
mov eax, dword [ebp + 0x1c]
cmp byte [eax], 0
je 0x1003a99e
push 0x1ec7
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x1003a99e
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x1003a99e
push 0x8c6
push 0x21cb
push 0
call dword [sym.imp.USER32.dll_EnableMenuItem]
cmp dword [ebp - 0x1c], 0x6a21
jge 0x1003a9b2
push str.tvg_nfmghxgmb_txeri_wkho_mjz_blaeefr_ptalh_uzacr
call fcn.1004752f
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003a9c3
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1006166f
push eax
mov dword fs:[0], esp
sub esp, 0x48
cmp byte [ebp + 0x24], 0
push ebx
push esi
push edi
mov edi, edx
je 0x1003aba8
cmp byte [ebp + 0x20], 0
je 0x1003ab82
mov esi, dword [ebp + 8]
mov dword [esi], 2
cmp dword [esi], 0x1b
jle 0x1003abda
xor ebx, ebx
inc ebx
mov dword [esp + 0x30], 0x9a92
lea ecx, [esp + 0x38]
mov dword [esp + 0x34], 0xc3c39ba0
mov dword [esp + 0x34], 0xa20b95ae
mov dword [esp + 0x18], ebx
mov dword [esp + 0x1c], 0x4c8f0d07
mov dword [esp + 0x34], 0xde0184dc
mov dword [esp + 0x34], 0xfffffffe
mov dword [esp + 0x28], 0xebfb2c41
mov dword [esp + 0x34], 0xffffffff
mov dword [esp + 0x2c], 0xfcdf11bb
mov dword [esp + 0x34], 0x3d6c1dfe
mov dword [esp + 0x24], 0x3086335c
push 4
call fcn.100138f8
and dword [esp + 0x5c], 0
lea ecx, [esp + 0x44]
push 2
call fcn.100138f8
lea eax, [esp + 0x10]
mov byte [esp + 0x5c], bl
push eax
lea eax, [esp + 0x3c]
mov dword [esp + 0x18], 0x1b78cd90
push eax
push ecx
mov dword [esp + 0x2c], ebx
xor cl, cl
call fcn.1003a0a9
add esp, 0xc
mov dword [esp + 0x10], 0
jmp 0x1003aac8
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0x44]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 2
jl 0x1003aab5
mov ecx, dword [ebp + 0xc]
xor dl, dl
call fcn.1003aff2
push 0x7c91
push ebx
lea eax, [esp + 0x1c]
mov edx, dword [ebp + 0x28]
push eax
push 0x6b05
push ecx
lea eax, [esp + 0x2c]
push eax
push dword [ebp + 0xc]
lea eax, [esp + 0x38]
push eax
push esi
push dword [ebp + 0x10]
lea eax, [esp + 0x48]
push eax
lea eax, [esp + 0x64]
push eax
lea eax, [esp + 0x54]
push eax
push edi
push dword [ebp + 0x14]
lea eax, [esp + 0x64]
push eax
push 0x5886
lea eax, [esp + 0x70]
push eax
lea eax, [esp + 0x78]
push eax
push 0x558a
call fcn.1003c155
add esp, 0x50
cmp dword [esp + 0x44], 0
je 0x1003ab51
push dword [esp + 0x44]
call fcn.10047697
xor eax, eax
pop ecx
mov dword [esp + 0x44], eax
mov dword [esp + 0x48], eax
mov dword [esp + 0x4c], eax
or dword [esp + 0x5c], 0xffffffff
cmp dword [esp + 0x38], 0
je 0x1003ab75
push dword [esp + 0x38]
call fcn.10047697
xor eax, eax
pop ecx
mov dword [esp + 0x38], eax
mov dword [esp + 0x3c], eax
mov dword [esp + 0x40], eax
inc dword [esi]
cmp dword [esi], 0x1b
jg 0x1003aa0f
jmp 0x1003abda
mov edx, dword [ebp + 0x1c]
xor ebx, ebx
inc ebx
mov dword [edx], 0
cmp dword [edx], ebx
jge 0x1003abda
mov esi, dword [ebp + 0x2c]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xacd40988
inc dword [edx]
cmp dword [edx], ebx
jl 0x1003ab95
jmp 0x1003abda
cmp byte [ebp + 0x18], 0
je 0x1003abd0
mov byte [esp + 0xf], 0
cmp byte [esp + 0xf], 0
je 0x1003abda
push 0x56c1
push ecx
mov dl, 1
mov ecx, 0x7773
call fcn.1003abec
pop ecx
pop ecx
jmp 0x1003abda
cmp byte [ecx], 0
je 0x1003abda
call fcn.1003a686
mov ecx, dword [esp + 0x54]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret