joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003295b
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1005da20
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0xb8
push ebx
push esi
push edi
push ecx
mov edx, 0x2d26
lea ecx, [esp + 0x94]
call fcn.1003357a
pop ecx
and dword [esp + 0xcc], 0
lea ecx, [esp + 0x44]
push eax
call fcn.1003518c
push 0
push 1
lea ecx, [esp + 0x98]
mov byte [esp + 0xd4], 2
call fcn.10010352
lea ecx, [esp + 0x44]
call fcn.10036b38
push ecx
mov edx, 0x2c29
lea ecx, [esp + 0x30]
call fcn.1003357a
mov edx, 0x2c2a
mov byte [esp + 0xd0], 3
lea ecx, [esp + 0xac]
call fcn.1003357a
pop ecx
mov edx, eax
mov byte [esp + 0xcc], 4
lea ecx, [esp + 0x14]
call fcn.100300df
push 0
push 1
lea ecx, [esp + 0xb0]
mov byte [esp + 0xd4], 6
call fcn.10010352
push ecx
mov edx, 0x2c2b
lea ecx, [esp + 0x64]
call fcn.1003357a
pop ecx
mov edx, eax
mov byte [esp + 0xcc], 7
lea ecx, [esp + 0x20]
call fcn.100300df
push 0
push 1
lea ecx, [esp + 0x68]
mov byte [esp + 0xd4], 9
call fcn.10010352
mov dword [esp + 0xc], 0x3147
cmp dword [esp + 0xc], 0x34ca
jle 0x10032ad8
xor esi, esi
xor ebx, ebx
mov dword [esp + 0x10], 0x441f
xor edi, edi
mov eax, ebx
lea ecx, [esp + 0x78]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001a5f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10032a8e
mov eax, dword [eax]
push eax
call fcn.10044793
pop ecx
push 0
push 1
lea ecx, [esp + 0x80]
call fcn.1001017e
inc edi
cmp edi, 0x5daf
jl 0x10032a71
add ebx, esi
dec dword [esp + 0x10]
jne 0x10032a6f
inc esi
cmp esi, 0x1683
jl 0x10032a65
push 0x152e
push 0xdcd
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CreateCaret]
mov esi, dword [esp + 0x18]
cmp dword [esp + 0x14], esi
je 0x10032b1e
mov eax, dword [esp + 0x24]
sub eax, dword [esp + 0x20]
cdq
push 0x18
pop edi
idiv edi
sub esi, dword [esp + 0x14]
mov ecx, eax
mov eax, esi
cdq
idiv edi
cmp eax, ecx
jne 0x10032b1e
push ecx
lea eax, [esp + 0x30]
mov dl, 1
push eax
push 0x93a
lea eax, [esp + 0x2c]
push eax
push ecx
lea ecx, [esp + 0x28]
call fcn.10032725
add esp, 0x14
cmp dword [esp + 0xc], 0x30cd
jge 0x10032b33
push str.tbzh_gcv_nji_ztsw_fibpe_dwwfmiwwh_mprowplhw_czc_fyxsyieio_qyy
call fcn.10044793
pop ecx
lea ecx, [esp + 0x20]
call fcn.100331fa
lea ecx, [esp + 0x14]
call fcn.100331fa
push 0
push 1
lea ecx, [esp + 0x34]
call fcn.10010352
or dword [esp + 0xcc], 0xffffffff
lea ecx, [esp + 0x44]
call fcn.10036cae
mov ecx, dword [esp + 0xc4]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100371b0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005dc1f
call fcn.1005c418
sub esp, 0x34
push ebx
push esi
mov byte [ebp - 0x14], cl
mov esi, edx
mov dword [ebp - 0x28], 0x5d64
cmp dword [ebp - 0x28], 0x6088
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], esi
jle 0x10037256
xor edi, edi
mov dword [ebp - 0x20], edi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov eax, ebx
xor esi, esi
xor eax, edi
mov dword [ebp - 0x18], eax
mov edi, eax
xor ebx, ebx
mov dword [ebp - 0x18], 0x6c6c
mov eax, ebx
mov ecx, 0x10078798
or eax, edi
cdq
push edx
push eax
call fcn.1000f531
add ebx, esi
dec dword [ebp - 0x18]
jne 0x100371f9
inc esi
cmp esi, 0x2a7b
jl 0x100371f0
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
inc ebx
mov dword [ebp - 0x1c], ebx
cmp ebx, 0x79f3
jl 0x100371e5
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x52aa
jl 0x100371e0
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
call edi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
mov esi, dword [ebp - 0x24]
jmp 0x1003725c
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
cmp byte [ebp - 0x14], 0
je 0x10037330
mov dword [ebp - 0x1c], 0x7982
cmp dword [ebp - 0x1c], 0x7ae1
jle 0x100372cc
xor edi, edi
mov esi, edi
mov dword [ebp - 0x20], 0x6260
xor ebx, ebx
mov ecx, ebx
mov eax, esi
shl eax, cl
lea ecx, [ebp - 0x40]
cdq
push edx
push eax
call fcn.10001a5f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003729e
mov eax, dword [eax]
push eax
call fcn.10044793
pop ecx
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.1001017e
inc ebx
cmp ebx, 0x4d49
jl 0x10037283
dec esi
dec dword [ebp - 0x20]
jne 0x10037281
inc edi
cmp edi, 0x4069
jl 0x10037278
mov esi, dword [ebp - 0x24]
mov dword [esi], 0
cmp dword [esi], 2
jge 0x100372ec
mov edx, dword [ebp + 0x10]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0x6432a276
inc dword [esi]
cmp dword [esi], 2
jl 0x100372da
cmp dword [ebp - 0x1c], 0x796d
jge 0x10037300
push str.vfyrx_qskaqzly_vhlpyinj_lrvgchslt_cilxesv_oojoe_nqcn
call fcn.10044793
pop ecx
mov dword [ebp - 4], 4
cmp dword [ebp - 0x28], 0x5c2b
jge 0x1003731f
mov edx, str.hnedkop_ehmdsascd_zuikgfbb_zeda_loshmq_ibedofm_fjw_otimnh_qzb_vmem_bqlmdlw_hzsaojim_kkfjvqg_jlzx
mov ecx, 0x10078798
call fcn.10012752
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x20], 0x5fa6
cmp dword [ebp - 0x20], 0x6215
jle 0x1003737d
xor esi, esi
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x24], 0x4559
mov eax, edi
mov ecx, 0x10078798
xor eax, esi
cdq
push edx
push eax
call fcn.1000f531
add edi, ebx
dec dword [ebp - 0x24]
jne 0x1003734d
inc ebx
cmp ebx, 0x5960
jl 0x10037344
inc esi
cmp esi, 0x3628
jl 0x10037342
mov edi, dword [sym.imp.USER32.dll_GetDesktopWindow]
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x10037391
call edi
push eax
call edi
push eax
call dword [sym.imp.USER32.dll_SetParent]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x5c9b
jge 0x10037300
mov edx, str.luxl_pmzpgzksy_bxstsub_ego_qzgtcyd_phasdbdc_rkpyee_auhbltm_yaay_fxprssru_vcmrwf_xcqj
mov ecx, 0x10078798
call fcn.10012752
jmp 0x10037300
Function at 0x1003803b
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov byte [ebp - 4], cl
mov dword [ebp - 8], 0x541e
cmp dword [ebp - 8], 0x5482
push esi
push edi
jle 0x10038097
xor esi, esi
xor edi, edi
lea eax, [edi + esi]
cdq
lea ecx, [ebp - 0x20]
push edx
push eax
call fcn.10001a5f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10038072
mov eax, dword [eax]
push eax
call fcn.10044793
pop ecx
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.1001017e
inc edi
cmp edi, 0xb8
jl 0x1003805a
inc esi
cmp esi, 0x527a
jl 0x10038058
cmp byte [ebp - 4], 0
je 0x100380aa
push 0x1910
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x100380c3
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0x121c
push 0
call esi
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
cmp dword [ebp - 8], 0x5177
jge 0x100380d7
push str.ddrlq_eqzniv_ypbsdjalr_phum
call fcn.10044793
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100380f2
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
mov dword [esp + 8], 0x3aa4
mov eax, edx
cmp dword [esp + 8], 0x3e1c
push esi
push edi
mov dword [esp + 0x14], eax
jle 0x1003818e
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov eax, ebx
cdq
idiv ecx
lea ecx, [esp + 0x18]
lea eax, [edi + edx]
or eax, esi
cdq
push edx
push eax
call fcn.10001a5f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003814a
mov eax, dword [eax]
push eax
call fcn.10044793
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.1001017e
mov ecx, dword [esp + 0xc]
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x7709
jl 0x1003812a
inc ebx
cmp ebx, 0x192c
jl 0x10038124
inc edi
cmp edi, 0x28b1
jl 0x10038122
inc esi
cmp esi, 0x648f
jl 0x10038120
mov eax, dword [esp + 0x14]
mov ecx, dword [ebp + 0xc]
mov dl, 1
push 0x395c
push 1
push eax
push 0x1fdc
push dword [ebp + 0x18]
push dword [ebp + 0x10]
push 0x6a59
push dword [ebp + 0x14]
push 0
push dword [ebp + 8]
call fcn.100381d7
add esp, 0x28
cmp dword [esp + 0x10], 0x3755
jge 0x100381d0
push str.sce_sgdwzci_dosopugx_woto_acnq
call fcn.10044793
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10038920
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005dc8e
call fcn.1005c418
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x18], 0x15da
mov edi, edx
cmp dword [ebp - 0x18], 0x16c3
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
jle 0x1003896f
xor esi, esi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x10078798
xor eax, esi
cdq
push edx
push eax
call fcn.1000f531
inc ebx
cmp ebx, 0xe38
jl 0x1003894c
inc esi
cmp esi, 0x2459
jl 0x1003894a
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x14c3
jge 0x100389aa
mov edx, str.swwum_pnov_uehb_xstiy_ssigfwaze_eqzn_uqhnwd
mov ecx, 0x10078798
call fcn.10012752
jmp 0x100389aa
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], 0x20a5
cmp dword [ebp - 0x18], 0xb9c
jge 0x10038a2b
lea eax, [ebp - 0x1c]
push eax
push str._ld_n
call fcn.100444ab
xor ebx, ebx
xor esi, esi
pop ecx
pop ecx
cmp dword [ebp - 0x1c], ebx
jle 0x10038a20
xor edi, edi
lea eax, [ebp - 0x11]
push eax
push 0x1006a440
call fcn.100444ab
cmp byte [ebp - 0x11], 0x28
pop ecx
pop ecx
jne 0x10038a03
push ebx
push 0x100659bc
call fcn.10044793
xor eax, eax
inc eax
sub eax, ebx
mov ebx, eax
jmp 0x10038a15
push edi
push 0x100659bc
call fcn.10044793
xor eax, eax
inc eax
sub eax, edi
mov edi, eax
inc esi
pop ecx
pop ecx
cmp esi, dword [ebp - 0x1c]
jl 0x100389d9
mov edi, dword [ebp - 0x20]
push 0x10078798
call fcn.100412b2
pop ecx
cmp byte [ebp + 0x10], 0
je 0x10038a47
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10038a61
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetKeySecurity]
jmp 0x10038a61
mov edx, dword [ebp + 0x14]
mov ecx, dword [edx]
lea eax, [ecx + 2]
mov dword [edx], eax
call fcn.10036da0
movzx eax, ax
mov ecx, edi
push eax
call fcn.1000f6ce
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10039be1
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005dcd5
call fcn.1005c418
sub esp, 0x30
push ebx
push esi
mov byte [ebp - 0x18], dl
mov dword [ebp - 0x24], 0x47e3
cmp dword [ebp - 0x24], 0x4a00
push edi
mov dword [ebp - 0x10], esp
jle 0x10039c48
xor esi, esi
xor edi, edi
mov ebx, 0x2944
mov eax, edi
lea ecx, [ebp - 0x3c]
cdq
push edx
push eax
call fcn.10001a5f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10039c27
mov eax, dword [eax]
push eax
call fcn.10044793
pop ecx
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.1001017e
add edi, esi
dec ebx
jne 0x10039c10
inc esi
cmp esi, 0x1800
jl 0x10039c09
cmp byte [ebp - 0x18], 0
je 0x10039c91
lea eax, [ebp - 0x19]
mov byte [ebp - 0x19], 0
push eax
push 0x7b75
push ecx
push ecx
mov edx, 0x2fe8
xor cl, cl
call fcn.10039578
add esp, 0x10
cmp dword [ebp - 0x24], 0x45ed
jge 0x10039c80
push str.vez_omavbloh_yilykbplk_isnreif_yizj_ygejxo_iskk_vrejca_dnjqeyck_yxnk_cmgxhgy_bhxwbd_amslvr
call fcn.10044793
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x20], 0x5472
cmp dword [ebp - 0x20], 0x57ee
jle 0x10039cd5
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x10078798
xor eax, edi
or eax, esi
cdq
push edx
push eax
call fcn.1000f531
inc ebx
cmp ebx, 0x57ea
jl 0x10039ca7
inc edi
cmp edi, 0x6148
jl 0x10039ca5
inc esi
cmp esi, 0x7a20
jl 0x10039ca3
mov eax, dword [ebp + 8]
mov dword [eax], 0
cmp dword [eax], 1
jge 0x10039cf3
mov ecx, dword [ebp + 0x14]
mov dword [ecx], 0x78cd908f
inc dword [eax]
cmp dword [eax], 1
jl 0x10039ce6
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x534c
jge 0x10039c6c
mov edx, str.cmhyjgamo_gnx_igy_dupo
mov ecx, 0x10078798
call fcn.10012752
jmp 0x10039c6c
Function at 0x1003a390
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005dce9
call fcn.1005c418
sub esp, 0x34
cmp byte [ebp + 0x20], 0
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edx
mov dword [ebp - 0x20], ebx
je 0x1003a461
mov dword [ebp - 0x1c], 0x26ea
cmp dword [ebp - 0x1c], 0x295e
jle 0x1003a43a
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x14], edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov edi, edx
xor esi, esi
mov ecx, esi
mov eax, ebx
shl eax, cl
lea ecx, [ebp - 0x3c]
and eax, edi
cdq
push edx
push eax
call fcn.10001a5f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003a3f7
mov eax, dword [eax]
push eax
call fcn.10044793
pop ecx
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.1001017e
inc esi
cmp esi, 0x4927
jl 0x1003a3da
inc ebx
cmp ebx, 0x52b4
jl 0x1003a3d8
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x3f61
jl 0x1003a3cf
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x296e
jl 0x1003a3ca
cmp dword [ebp - 0x1c], 0x24fe
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp - 0x24]
mov eax, dword [eax]
mov dword [ecx], eax
jge 0x1003a52a
push str.yzxtynio_ocsx_emh
call fcn.10044793
pop ecx
jmp 0x1003a52a
mov dword [ebp - 0x18], 0x4a2c
cmp dword [ebp - 0x18], 0x4da3
jle 0x1003a4b8
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
and dword [ebp - 0x24], 0
mov ebx, edi
and ebx, esi
mov esi, dword [ebp - 0x24]
mov eax, ebx
mov ecx, 0x10078798
xor eax, esi
cdq
push edx
push eax
call fcn.1000f531
inc esi
cmp esi, 0x1d96
jl 0x1003a483
mov esi, dword [ebp - 0x1c]
inc edi
cmp edi, 0x4c25
jl 0x1003a478
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x3bdc
jl 0x1003a476
mov ebx, dword [ebp - 0x20]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x18], 0x482b
jge 0x1003a4f6
mov edx, str.nhq_pak_pfao_odtr_cctmmliyh_qymdtxib
mov ecx, 0x10078798
call fcn.10012752
jmp 0x1003a4f6
mov esi, dword [ebp + 0xc]
xor ecx, ecx
mov eax, dword [esi]
cmp eax, 5
mov eax, dword [esi]
setne cl
xor edx, edx
cmp eax, ecx
mov eax, dword [ebx]
setne dl
xor ecx, ecx
cmp edx, dword [eax + 4]
mov eax, dword [esi]
setne cl
xor edx, edx
inc edx
sub edx, ecx
neg edx
sbb edx, edx
neg edx
sub edx, eax
mov eax, dword [ebp + 0x18]
mov dword [eax], edx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003ac55
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005dd11
call fcn.1005c418
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x14], 0x1ded
mov edi, edx
cmp dword [ebp - 0x14], 0x2128
mov ebx, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
jle 0x1003acac
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x10078798
xor eax, esi
cdq
push edx
push eax
call fcn.1000f531
inc edi
cmp edi, 0x5be2
jl 0x1003ac86
inc esi
cmp esi, 0x6df2
jl 0x1003ac84
mov edi, dword [ebp - 0x18]
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x1bcf
jge 0x1003acea
mov edx, str.wubgs_nabtajmtd_xhplm
mov ecx, 0x10078798
call fcn.10012752
jmp 0x1003acea
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x10], 0
je 0x1003ad02
mov eax, dword [ebp + 0x24]
push 3
pop ecx
mov eax, dword [eax]
sub ecx, eax
mov dword [edi], ecx
jmp 0x1003ad3c
mov esi, dword [ebp + 0x18]
mov dword [esi], 0
jmp 0x1003ad37
mov edx, dword [ebp + 0x14]
lea eax, [ebp - 0x20]
push eax
push ecx
push dword [ebp + 0xc]
mov dword [ebp - 0x20], 0x7d2ae857
mov ecx, ebx
push 0
push 0x4418
push 0x1f87
call fcn.1003849f
add esp, 0x18
inc dword [esi]
cmp dword [esi], 2
jle 0x1003ad0d
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003b11f
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005dd1b
call fcn.1005c418
sub esp, 0xc
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x1003b1ce
mov dword [ebp - 0x14], 0x7e8
cmp dword [ebp - 0x14], 0xae7
jle 0x1003b180
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x10078798
xor eax, edi
xor eax, esi
cdq
push edx
push eax
call fcn.1000f531
inc ebx
cmp ebx, 0x358c
jl 0x1003b152
inc edi
cmp edi, 0x63e3
jl 0x1003b150
inc esi
cmp esi, 0x4e88
jl 0x1003b14e
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x5c1
jge 0x1003b19c
mov edx, str.ixsnrhcy_linqvz_gtwybl_zbvxnvqg_xdh_zoout_ezgyaaql_aaicdyxc_glbjiyhbw_uuakzvgea_ldxs_ajlz
mov ecx, 0x10078798
call fcn.10012752
mov eax, dword [ebp + 0x18]
xor edx, edx
mov ecx, dword [eax]
mov eax, dword [eax]
cmp ecx, eax
mov eax, dword [ebp + 0xc]
setl dl
mov eax, dword [eax]
mov dword [eax + 4], edx
jmp 0x1003b1e0
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1003b1e0
mov ecx, 0x7428
call fcn.1003a882
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003b1f1
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1005dd25
call fcn.1005c418
sub esp, 0x2c
cmp byte [ebp + 0x2c], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
mov byte [ebp - 0x14], dl
je 0x1003b263
cmp byte [ebp + 0x10], 0
je 0x1003b237
mov edx, dword [ebp + 0x20]
mov dword [edx], 0
jmp 0x1003b22d
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x76acb8f2
inc dword [edx]
cmp dword [edx], 3
jl 0x1003b220
jmp 0x1003b3c0
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x1003b3c0
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x3531f145
inc dword [edx]
cmp dword [edx], 3
jl 0x1003b24c
jmp 0x1003b3c0
mov dword [ebp - 0x20], 0x355c
cmp dword [ebp - 0x20], 0x38b8
jle 0x1003b2e3
push 0x2389
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x18], edi
mov dword [ebp + 0x2c], esi
mov ecx, edi
xor ebx, ebx
shl esi, cl
mov dword [ebp + 0x2c], esi
mov ecx, ebx
mov dword [ebp - 0x24], esi
xor edi, edi
sar esi, cl
mov eax, esi
mov ecx, 0x10078798
or eax, edi
cdq
push edx
push eax
call fcn.1000f531
inc edi
cmp edi, 0xb08
jl 0x1003b29f
mov esi, dword [ebp + 0x2c]
inc ebx
cmp ebx, 0x4eaa
jl 0x1003b296
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x2e9b
jl 0x1003b28a
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x31ff
jl 0x1003b285
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x3495
jge 0x1003b2ff
mov edx, str.wsle_slue_jdtcjj_gikcqwfj
mov ecx, 0x10078798
call fcn.10012752
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x14], 0
je 0x1003b363
mov esi, dword [ebp + 0x1c]
mov dword [esi], 0xffffffe8
cmp dword [esi], 0xffffffed
jne 0x1003b3c0
mov edi, dword [ebp + 0x24]
mov ecx, dword [ebp + 0x28]
lea edx, [ebp - 0x28]
push 0
push dword [ebp + 0x14]
mov dword [ebp - 0x28], 0x2e255bb5
call fcn.10037005
cmp dword [edi], 0
pop ecx
pop ecx
jne 0x1003b3c0
inc dword [esi]
cmp dword [esi], 0xffffffed
je 0x1003b31e
jmp 0x1003b3c0
mov esi, dword [ebp + 0x30]
mov dword [esi], 0xffffffef
jmp 0x1003b3bb
push ecx
push dword [ebp + 0x18]
lea eax, [ebp - 0x2c]
mov dword [ebp - 0x2c], 0x51cd
push esi
push eax
mov dword [ebp - 0x38], 0x71f09a2b
lea eax, [ebp - 0x30]
mov dword [ebp - 0x34], 0xfffffffd
lea edx, [ebp - 0x34]
mov dword [ebp - 0x30], 0xa07c
lea ecx, [ebp - 0x38]
push eax
call fcn.1003bd80
mov byte [ebp + 0x2f], 0
add esp, 0x14
cmp byte [ebp + 0x2f], 0
je 0x1003b3b9
push 0
push ecx
call fcn.10039540
pop ecx
pop ecx
dec dword [esi]
cmp dword [esi], 0xffffffe5
jle 0x1003b36e
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003b72e
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005dd2f
call fcn.1005c418
sub esp, 0xc
cmp byte [ebp + 0x18], 0
mov eax, ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], dl
mov dword [ebp - 0x18], eax
je 0x1003b823
cmp byte [ebp + 0xc], 0
je 0x1003b788
mov byte [ebp + 0x1b], 0
cmp byte [ebp + 0x1b], 0
je 0x1003b783
push 0x7cec
push 0x685c
push 0x1017
push 1
mov dl, 1
mov ecx, 0x75db
call fcn.1003867f
add esp, 0x10
jmp 0x1003b890
xor ebx, ebx
mov byte [ebp + 0x1b], bl
cmp byte [ebp + 0x1b], bl
je 0x1003b783
mov dword [ebp + 0x18], 0x7822
cmp dword [ebp + 0x18], 0x7aac
jle 0x1003b7dd
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x18], ebx
mov eax, edi
mov ecx, 0x10078798
cdq
idiv ebx
xor edx, esi
mov eax, edx
cdq
push edx
push eax
call fcn.1000f531
inc ebx
cmp ebx, 0x115a
jl 0x1003b7a9
inc edi
push 0
pop ebx
cmp edi, 0x6ba4
jl 0x1003b7a6
inc esi
cmp esi, 0x1506
jl 0x1003b7a4
push ebx
mov ecx, 0x4bb9
call fcn.1003a5ce
mov dword [ebp - 4], ebx
cmp dword [ebp + 0x18], 0x76ec
pop ecx
jge 0x1003b783
mov edx, str.rjsdoiga_znllggcx_omy_izkg_yeldcjc_vfsyuja_dvx_wkmxtotb_xxk
mov ecx, 0x10078798
call fcn.10012752
jmp 0x1003b783
test dl, dl
je 0x1003b863
mov edx, dword [ebp + 8]
xor ebx, ebx
mov dword [edx], ebx
cmp dword [edx], 2
jg 0x1003b890
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
mov dword [esi], ebx
cmp dword [esi], 2
jg 0x1003b85a
mov ecx, dword [edx]
mov eax, dword [eax]
cmp dword [eax + ecx*4], ebx
jne 0x1003b857
cmp dword [edi], ebx
jne 0x1003b857
inc dword [esi]
cmp dword [esi], 2
mov eax, dword [ebp - 0x18]
jle 0x1003b840
mov eax, dword [ebp - 0x18]
inc dword [edx]
cmp dword [edx], 2
jle 0x1003b839
jmp 0x1003b890
push 0x253d
push 0x1396
push 0x1453
push 0x7cb
push 0x1d29
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003bbd6
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005dd43
call fcn.1005c418
sub esp, 0x24
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov byte [ebp - 0x14], dl
je 0x1003bca9
cmp byte [ebp + 0x18], 0
je 0x1003bc9a
mov dword [ebp + 0x14], 0x315f
cmp dword [ebp + 0x14], 0x33bd
jle 0x1003bc68
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
xor esi, esi
xor edi, edi
mov ecx, edi
mov eax, esi
shl eax, cl
lea ecx, [ebp - 0x30]
cdq
push edx
push eax
call fcn.10001a5f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003bc3b
mov eax, dword [eax]
push eax
call fcn.10044793
pop ecx
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.1001017e
inc edi
cmp edi, 0x1ae8
jl 0x1003bc20
inc esi
cmp esi, 0x7ad3
jl 0x1003bc1e
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
cmp dword [ebp + 0x14], 0x2f08
jge 0x1003bc7c
push str.urpx_dkhqxqo_rjbzyg_bivzsbsx_jbcjqorg_tpbei_yahmrowqi_vreka_hpa_ycvvkalg
call fcn.10044793
pop ecx
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov ecx, dword [ebx]
mov eax, dword [ecx + eax*4]
mov dword [ecx + 0xc], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDlgCtrlID]
jmp 0x1003bc89
mov dword [ebp - 0x18], 0x4347
cmp dword [ebp - 0x18], 0x452c
jle 0x1003bd08
xor esi, esi
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp + 0x14], eax
xor eax, ebx
mov ecx, 0x10078798
xor eax, edi
xor eax, esi
cdq
push edx
push eax
call fcn.1000f531
mov eax, dword [ebp + 0x14]
inc eax
mov dword [ebp + 0x14], eax
cmp eax, 0x6161
jl 0x1003bcc4
inc ebx
cmp ebx, 0x3a35
jl 0x1003bcbf
inc edi
cmp edi, 0x4a9e
jl 0x1003bcbd
inc esi
cmp esi, 0x1bfb
jl 0x1003bcbb
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
cmp byte [ebp - 0x14], 0
je 0x1003bd25
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1003bd3e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_IsWindow]
jmp 0x1003bd3e
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1003bd3e
push 1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x18], 0x4196
jge 0x1003bc89
mov edx, str.qcy_udjfzer_zostq_gang_wcbj_gpazufw_jtqat_foo_pnsr_ixrefsbuz_eexacxwdm_rnkuebvs_udmo
mov ecx, 0x10078798
call fcn.10012752
jmp 0x1003bc89