joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002ba79
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
je 0x1002baa4
cmp byte [ebp + 0x10], 0
je 0x1002ba95
cmp byte [ecx], 0
je 0x1002bad7
push ecx
call fcn.1002bfb9
jmp 0x1002bab7
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x1002bad7
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
cmp byte [ebp + 0xc], 0
je 0x1002baba
lea eax, [ebp + 0xb]
mov byte [ebp + 0xb], 0
push eax
call fcn.1002faf7
pop ecx
pop ebp
ret
cmp byte [edx], 0
je 0x1002bad7
push 0
push 1
push 1
mov edx, 0x515c
mov ecx, 0x6dbc
call fcn.1002cc0b
add esp, 0xc
pop ebp
ret

Function at 0x1002be97
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005ba52
call fcn.1005a9e0
sub esp, 0x14
push ebx
push esi
mov dword [ebp - 0x1c], 0x675d
mov esi, ecx
cmp dword [ebp - 0x1c], 0x69c8
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], esi
jle 0x1002bf2b
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x18], edi
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov eax, edi
mov edi, 0x2f4d
cdq
idiv ecx
mov esi, edx
mov eax, esi
mov ecx, 0x10076818
xor eax, ebx
cdq
push edx
push eax
call fcn.10001a30
dec esi
dec edi
jne 0x1002bed7
mov ecx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x11b2
jl 0x1002becb
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x7697
jl 0x1002bec6
inc ebx
cmp ebx, 0x8d8
jl 0x1002bec1
push 0x153
push 0x687
push 0x1536
call dword [sym.imp.USER32.dll_SetClassLongA]
mov esi, dword [ebp - 0x20]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x66ce
jge 0x1002bf66
mov edx, str.txghywums_byzarf_btbounclx_way_whlvtpev_ougrknjn_jhlfigya_zngigrtds
mov ecx, 0x10076818
call fcn.1000349f
jmp 0x1002bf66
cmp byte [ebp + 0x18], 0
je 0x1002bf8b
mov dword [esi], 0
cmp dword [esi], 2
jge 0x1002bfa8
mov edx, dword [ebp + 0x10]
mov ecx, dword [esi]
mov eax, dword [edx]
or dword [eax + ecx*4], 0xffffffff
inc dword [esi]
cmp dword [esi], 2
jl 0x1002bf7a
jmp 0x1002bfa8
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x1002bfa8
push 0x172b
push 0xd26
push 0xd10
call dword [sym.imp.KERNEL32.dll_MulDiv]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002f480
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x1005bb28
call fcn.1005a9e0
sub esp, 0x64
mov byte [ebp - 0x14], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x1002f61d
mov dword [ebp - 0x20], 0x627d
cmp dword [ebp - 0x20], 0x62ee
jle 0x1002f502
xor edi, edi
xor esi, esi
mov dword [ebp - 0x1c], esi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov eax, esi
cdq
idiv ebx
mov ebx, 0x6b3b
mov esi, edx
mov eax, esi
mov ecx, 0x10076818
and eax, edi
cdq
push edx
push eax
call fcn.10001a30
dec esi
dec ebx
jne 0x1002f4c6
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 0x18], ebx
cmp ebx, 0x6802
jl 0x1002f4ba
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x719d
jl 0x1002f4b5
inc edi
cmp edi, 0x1005
jl 0x1002f4b0
mov dword [ebp - 0x24], 0xadae
lea ecx, [ebp - 0x54]
mov dword [ebp - 0x34], 0
push 4
call fcn.10001b45
and dword [ebp - 4], 0
lea ecx, [ebp - 0x48]
xor ebx, ebx
mov dword [ebp - 0x3c], 0x62e65251
inc ebx
mov dword [ebp - 0x28], 0x2506
push ebx
call fcn.10001b45
mov byte [ebp - 4], bl
mov dword [ebp - 0x2c], 0xffffffff
mov dword [ebp - 0x38], 0xfffffff8
mov dword [ebp - 0x30], 0xffffffff
mov dword [ebp - 0x18], 0
jmp 0x1002f566
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x54]
and dword [eax + ecx*4], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 4
jl 0x1002f559
mov dword [ebp - 0x18], 0
jmp 0x1002f585
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x48]
mov dword [eax + ecx*4], 0x7f17
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], ebx
jl 0x1002f575
lea eax, [ebp - 0x48]
push eax
lea eax, [ebp - 0x24]
push eax
push 0x484e
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
push ebx
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x54]
push eax
lea eax, [ebp - 0x34]
push eax
push 0x1041
push ebx
push ebx
lea edx, [ebp - 0x38]
lea ecx, [ebp - 0x3c]
call fcn.1002c35b
add esp, 0x30
cmp dword [ebp - 0x48], 0
je 0x1002f5d0
push dword [ebp - 0x48]
call fcn.10044367
pop ecx
cmp dword [ebp - 0x54], 0
je 0x1002f5df
push dword [ebp - 0x54]
call fcn.10044367
pop ecx
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x5ef8
jge 0x1002f5fe
mov edx, str.ptez_vrwmyoa_uoecdjs_pdj
mov ecx, 0x10076818
call fcn.1000349f
jmp 0x1002f6a7
cmp byte [ecx], 0
je 0x1002f62a
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 0x1c], 0x64bf
cmp dword [ebp - 0x1c], 0x6586
jle 0x1002f693
xor ebx, ebx
xor esi, esi
inc ebx
xor edi, edi
xor ecx, ecx
mov dword [ebp - 0x20], ecx
lea eax, [edi + esi]
and eax, ecx
lea ecx, [ebp - 0x6c]
cdq
push edx
push eax
call fcn.10003aad
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002f660
mov eax, dword [eax]
push eax
call fcn.100445e8
pop ecx
push 0
push ebx
lea ecx, [ebp - 0x6c]
call fcn.10001e5d
mov ecx, dword [ebp - 0x20]
inc ecx
mov dword [ebp - 0x20], ecx
cmp ecx, 0x6ace
jl 0x1002f646
inc edi
cmp edi, 0x44e4
jl 0x1002f641
inc esi
cmp esi, 0x485c
jl 0x1002f63f
cmp dword [ebp - 0x1c], 0x6330
jge 0x1002f6a7
push str.ncztpvge_qubs_mfpncnvf_ahkwjxi_tbkfklduj
call fcn.100445e8
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002fb12
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005bb46
call fcn.1005a9e0
sub esp, 0x10
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, edx
je 0x1002fb81
mov eax, dword [esi]
mov dword [eax], 3
jmp 0x1002fb69
push ecx
push 0x6a6b
push 0x7735
push 1
push ecx
push 0xfce
push ecx
lea eax, [ebp - 0x11]
mov byte [ebp - 0x11], 0
push eax
mov edx, 0xd52
mov ecx, 0x231c
call fcn.100303a9
mov eax, dword [esi]
add esp, 0x20
dec dword [eax]
mov eax, dword [esi]
cmp dword [eax], 0
jge 0x1002fb37
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x18], 0xebb
cmp dword [ebp - 0x18], 0x1033
jle 0x1002fbb8
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x10076818
xor eax, esi
cdq
push edx
push eax
call fcn.10001a30
inc edi
cmp edi, 0x10a0
jl 0x1002fb95
inc esi
cmp esi, 0x6429
jl 0x1002fb93
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1002fbd7
push 0x229a
push 0
push 0x1160
push 0x4c7
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0xd04
jge 0x1002fb70
mov edx, str.udspjf_xuntqjnvu_gooijubwx_ugy_jji_chyouaf_ryaimgcu
mov ecx, 0x10076818
call fcn.1000349f
jmp 0x1002fb70
Function at 0x1002fe01
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x1005bb62
call fcn.1005a9e0
sub esp, 0x38
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edi
je 0x1002ff75
cmp byte [ebp + 0x14], 0
je 0x1002fe38
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x1002ff8c
mov dword [ebp - 0x2c], 0x62cf
cmp dword [ebp - 0x2c], 0x64fa
jle 0x1002fe74
xor ebx, ebx
xor edi, edi
mov ecx, edi
mov eax, ebx
sar eax, cl
mov ecx, 0x10076818
cdq
push edx
push eax
call fcn.10001a30
inc edi
cmp edi, 0x556b
jl 0x1002fe4c
inc ebx
cmp ebx, 0x350c
jl 0x1002fe4a
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x28], 0x27b1
cmp dword [ebp - 0x28], 0x27bd
jle 0x1002ff0e
xor eax, eax
mov dword [ebp + 0x10], eax
xor ebx, ebx
mov dword [ebp - 0x20], ebx
xor edi, edi
mov eax, ebx
mov dword [ebp - 0x1c], 0x7d63
mov ebx, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
xor eax, ebx
lea ecx, [ebp - 0x44]
cdq
push edx
push eax
call fcn.10003aad
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002feba
mov eax, dword [eax]
push eax
call fcn.100445e8
pop ecx
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.10001e5d
mov eax, dword [ebp - 0x18]
add eax, edi
dec dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
jne 0x1002fea3
mov ebx, dword [ebp - 0x20]
inc edi
cmp edi, 0x3b2c
jl 0x1002fe94
inc ebx
mov dword [ebp - 0x20], ebx
cmp ebx, 0x46fa
jl 0x1002fe92
mov eax, dword [ebp + 0x10]
inc eax
mov dword [ebp + 0x10], eax
cmp eax, 0x468e
jl 0x1002fe8d
push 0x12ef
call dword [sym.imp.USER32.dll_ShowCaret]
mov edi, dword [ebp - 0x24]
mov dword [edi], 0
jmp 0x1002ff1a
jne 0x1002ff1f
inc dword [edi]
cmp dword [edi], 0
jle 0x1002ff16
cmp dword [ebp - 0x28], 0x26d2
jge 0x1002ff33
push str.rfdu_wnvz_jxnmbih
call fcn.100445e8
pop ecx
mov dword [ebp - 4], 2
cmp dword [ebp - 0x2c], 0x6286
jge 0x1002fe33
mov edx, str.lcs_lutz_htu_tgab_dkjzbf_hkzkjx_plvrreiwa_pipufvve_gqxys
mov ecx, 0x10076818
call fcn.1000349f
jmp 0x1002fe33
cmp byte [ebp + 0xc], 0
je 0x1002ff84
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [edx], eax
jmp 0x1002ff8c
push 0
call dword [sym.imp.USER32.dll_CreateIconIndirect]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100303a9
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x1005bb6c
call fcn.1005a9e0
sub esp, 0x38
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x10], esp
xor esi, esi
mov dword [ebp - 0x28], ebx
cmp byte [ebp + 0x18], 0
mov dword [ebp - 0x2c], ecx
je 0x10030468
mov dword [ebp - 0x18], 0xb18
cmp dword [ebp - 0x18], 0xd62
jle 0x1003041d
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], 0x364f
mov ecx, esi
mov eax, edi
shl eax, cl
mov ecx, 0x10076818
cdq
push edx
push eax
call fcn.10001a30
add esi, ebx
dec dword [ebp - 0x14]
jne 0x100303ee
inc ebx
push 0
pop esi
cmp ebx, 0x6440
jl 0x100303e4
inc edi
cmp edi, 0x4956
jl 0x100303e2
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1003042e
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_EnumResourceTypesW]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x18], 0xaf4
jge 0x10030449
mov edx, str.hfznbbss_jwdbppk_edrfakx_fqiw
mov ecx, 0x10076818
call fcn.1000349f
jmp 0x10030560
mov dword [ebp - 0x1c], 0x192b
cmp dword [ebp - 0x1c], 0x1c49
jle 0x100304f2
push 0x1246
push esi
push 0x14d9
call dword [sym.imp.GDI32.dll_Polygon]
mov edi, esi
mov dword [ebp - 0x14], esi
mov ebx, esi
mov dword [ebp - 0x18], esi
mov eax, edi
mov edi, esi
cdq
idiv ebx
mov ebx, 0x6940
mov dword [ebp - 0x24], edx
mov eax, edi
lea ecx, [ebp - 0x44]
cdq
push edx
push eax
call fcn.10003aad
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100304b9
mov eax, dword [eax]
push eax
call fcn.100445e8
pop ecx
push esi
push 1
lea ecx, [ebp - 0x44]
call fcn.10001e5d
add edi, dword [ebp - 0x24]
dec ebx
jne 0x100304a2
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x14]
inc ebx
mov dword [ebp - 0x18], ebx
cmp ebx, 0x15ad
jl 0x10030493
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x256a
jl 0x1003048e
mov ebx, dword [ebp - 0x28]
cmp dword [ebp - 0x1c], 0x1586
jge 0x10030506
push str.plkmmjod_lzzhb_dma_dbbkaapes_fkq_dggri_ulqvdiflh_vnsjpky_hyypq_kavrn_tswcnpqdm
call fcn.100445e8
pop ecx
mov edi, dword [ebp + 0x20]
cmp dword [ebx], esi
jne 0x10030536
mov ecx, dword [edi]
mov eax, dword [ebx]
add eax, dword [ecx + 4]
je 0x10030527
mov edx, dword [ebx]
mov ecx, dword [edi]
mov eax, dword [ecx + 4]
cmp eax, dword [ecx + edx*4]
jg 0x10030527
xor ecx, ecx
inc ecx
jmp 0x10030529
mov ecx, esi
xor eax, eax
cmp ecx, 8
setne al
cmp eax, 0xfffffffa
je 0x10030539
xor esi, esi
inc esi
mov eax, dword [ebx]
xor ecx, ecx
mov eax, dword [edi]
cmp esi, dword [eax + 4]
mov eax, dword [ebp + 0x10]
setle cl
mov dword [eax], ecx
mov eax, dword [eax]
mov eax, dword [ebx]
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax]
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov eax, dword [edi]
mov dword [eax], 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10031217
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005bb92
call fcn.1005a9e0
sub esp, 0x10
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], cl
je 0x1003126b
test cl, cl
je 0x1003125b
mov byte [ebp + 0x17], 0
cmp byte [ebp + 0x17], 0
je 0x1003124a
xor dl, dl
mov cl, 1
call fcn.10030e4d
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_VerSetConditionMask]
jmp 0x1003124a
cmp byte [ebp + 0x10], 0
je 0x10031278
mov eax, dword [ebp + 8]
inc dword [eax]
jmp 0x1003124a
mov dword [edx], 0xfffffff2
cmp dword [edx], 0xffffffef
jne 0x10031293
mov eax, dword [ebp + 0xc]
mov dword [eax], 0xfffffffa
dec dword [edx]
cmp dword [edx], 0xffffffef
je 0x10031286
mov dword [ebp - 0x18], 0x7bb6
cmp dword [ebp - 0x18], 0x7da2
jle 0x100312ea
xor esi, esi
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp + 0x14], eax
and eax, ebx
mov ecx, 0x10076818
xor eax, edi
or eax, esi
cdq
push edx
push eax
call fcn.10001a30
mov eax, dword [ebp + 0x14]
inc eax
mov dword [ebp + 0x14], eax
cmp eax, 0x3962
jl 0x100312ae
inc ebx
cmp ebx, 0x4b5f
jl 0x100312a9
inc edi
cmp edi, 0x24da
jl 0x100312a7
inc esi
cmp esi, 0x71a7
jl 0x100312a5
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x7a0b
jge 0x1003124a
mov edx, str.teupvvcim_qvvekkyi_ruux_pijmvry_gwfysnq_kfenwp_phcxtua_bpyncgfb_qrc_ffkf_jwtiela_duehxun
mov ecx, 0x10076818
call fcn.1000349f
jmp 0x1003124a
Function at 0x10035e6c
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005bdbf
call fcn.1005a9e0
sub esp, 0x24
mov byte [ebp - 0x14], dl
mov dword [ebp - 0x2c], ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10035fa8
mov dword [ebp - 0x24], 0x773b
cmp dword [ebp - 0x24], 0x7856
jle 0x10035f0e
push 0x3f9
call dword [sym.imp.USER32.dll_GetSysColorBrush]
xor esi, esi
mov edi, esi
mov dword [ebp - 0x20], esi
mov ebx, esi
mov dword [ebp - 0x1c], esi
mov ecx, ebx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x18], esi
sar edi, cl
mov ebx, esi
mov esi, dword [ebp - 0x18]
mov eax, edi
mov ecx, 0x10076818
xor eax, ebx
xor eax, esi
cdq
push edx
push eax
call fcn.10001a30
inc ebx
cmp ebx, 0x2015
jl 0x10035ec3
inc esi
push 0
mov dword [ebp - 0x18], esi
cmp esi, 0x2390
pop esi
jl 0x10035ebe
mov ebx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
inc ebx
mov dword [ebp - 0x1c], ebx
cmp ebx, 0x7a28
jl 0x10035eb4
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x3668
jl 0x10035eaf
jmp 0x10035f10
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [ebp - 0x24], 0x75e2
jge 0x10035f49
mov edx, str.xyozu_rwfq_ttjulymid_aces_qjuj_hoo_julehs
mov ecx, 0x10076818
call fcn.1000349f
jmp 0x10035f49
mov edi, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x10]
cmp dword [edi], esi
jne 0x10035f7c
mov ecx, dword [ebx]
mov eax, dword [edi]
add eax, dword [ecx + 4]
je 0x10035f6d
mov edx, dword [edi]
mov ecx, dword [ebx]
mov eax, dword [ecx + 4]
cmp eax, dword [ecx + edx*4]
jg 0x10035f6d
xor ecx, ecx
inc ecx
jmp 0x10035f6f
mov ecx, esi
xor eax, eax
cmp ecx, 8
setne al
cmp eax, 0xfffffffa
je 0x10035f7f
xor esi, esi
inc esi
mov eax, dword [edi]
xor ecx, ecx
mov eax, dword [ebx]
cmp esi, dword [eax + 4]
mov eax, dword [ebp + 0xc]
setle cl
mov dword [eax], ecx
mov eax, dword [eax]
mov eax, dword [edi]
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov eax, dword [ebx]
mov dword [eax], 1
jmp 0x10035fbd
push 0x215a
xor esi, esi
push esi
push esi
push 0x1df8
push esi
call dword [sym.imp.SHELL32.dll_ExtractIconExW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100364e2
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005bde7
call fcn.1005a9e0
sub esp, 0xc
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
je 0x10036596
mov dword [ebp - 0x14], 0x7628
cmp dword [ebp - 0x14], 0x7931
jle 0x1003654d
push 0x1c20
push 0x7d1
push 0x107d
call dword [sym.imp.USER32.dll_SetWindowLongW]
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x10076818
xor eax, esi
cdq
push edx
push eax
call fcn.10001a30
inc edi
cmp edi, 0x72af
jl 0x1003652a
inc esi
cmp esi, 0x1b06
jl 0x10036528
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x75a4
jge 0x10036569
mov edx, str.xmazdarm_erm_srehzypqh_lpb_qprcwxu_xva_jkacd_yjkyjk
mov ecx, 0x10076818
call fcn.1000349f
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov dword [eax + ecx*4], 0x9951ea66
jmp 0x100365b5
mov dword [edx], 0
cmp dword [edx], 3
jg 0x100365b5
mov esi, dword [ebp + 0x18]
mov ecx, dword [esi]
mov eax, dword [edi]
cmp dword [eax + ecx*4], 0
jne 0x100365b5
inc dword [edx]
cmp dword [edx], 3
jle 0x100365a4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10037214
Capabilities:
Get graphical window text

Disassembly:
mov eax, 0x1005be29
call fcn.1005a9e0
sub esp, 0x1c
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x24], ebx
je 0x100372fd
mov dword [ebp - 0x1c], 0xff5
cmp dword [ebp - 0x1c], 0x1256
jle 0x100372af
xor edi, edi
mov dword [ebp - 0x18], edi
mov ebx, edi
mov dword [ebp - 0x14], 0x36ed
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x10076818
and eax, esi
or eax, ebx
cdq
push edx
push eax
call fcn.10001a30
inc edi
cmp edi, 0x6c6f
jl 0x1003725d
inc esi
cmp esi, 0x29e3
jl 0x1003725b
dec ebx
dec dword [ebp - 0x14]
jne 0x10037259
mov edi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x7971
jl 0x10037250
push 0x1962
push 0
push 0x1c6e
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov esi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x24]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0xd16
jge 0x100372ed
mov edx, str.nhuoyibam_cbxzv_ldnyhth_vhzu_icuvfrp_rpdojgpbd_qbwi_aqpy
mov ecx, 0x10076818
call fcn.1000349f
jmp 0x100372ed
mov eax, dword [ebp + 8]
mov ecx, dword [ebx]
cmp ecx, dword [eax]
je 0x10037312
mov eax, dword [esi]
mov dword [esi + 4], eax
jmp 0x10037312
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x10037312
push 1
mov edx, 0x4d72
call fcn.1003603b
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10037323
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x24], 0
push esi
push edi
mov edi, edx
je 0x1003736a
cmp byte [ebp + 0xc], 0
je 0x10037345
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
pop edi
pop esi
pop ebp
ret
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x10037341
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 5
inc dword [edx]
cmp dword [edx], 3
jl 0x10037356
jmp 0x10037341
cmp byte [ebp + 0x1c], 0
je 0x100373a9
mov esi, dword [ebp + 0x20]
mov dword [esi], 3
jmp 0x100373a2
push 0x7838
push edi
push dword [ebp + 0x10]
lea eax, [ebp + 0x24]
mov dword [ebp + 0x24], 1
push eax
xor dl, dl
mov ecx, 0x14aa
call fcn.100364c6
mov eax, dword [edi]
add esp, 0x10
dec dword [esi]
cmp dword [esi], 0
jge 0x1003737b
jmp 0x10037341
cmp byte [ecx], 0
je 0x10037341
pop edi
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
Function at 0x1003dff2
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x1003e031
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0x14]
mov eax, dword [edi + 4]
sub eax, dword [edi]
sar eax, 2
mov dword [esi], eax
jmp 0x1003e02b
and dword [esp + 0xc], 0
lea eax, [esp + 0xc]
push eax
mov ecx, edi
call fcn.1003f188
inc dword [esi]
mov eax, dword [esi]
cmp eax, dword [ebx]
jl 0x1003e016
jmp 0x1003e037
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003e2e6
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
cmp byte [ebp + 8], 0
push ebx
push esi
mov esi, edx
mov ebx, ecx
push edi
mov dword [esp + 0x14], esi
je 0x1003e330
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov eax, dword [edi + 4]
sub eax, dword [edi]
sar eax, 2
mov dword [esi], eax
jmp 0x1003e327
and dword [esp + 0x10], 0
lea eax, [esp + 0x10]
push eax
mov ecx, edi
call fcn.1003f188
inc dword [esi]
mov eax, dword [esi]
cmp eax, dword [ebx]
jl 0x1003e312
jmp 0x1003e3b8
mov dword [esp + 0xc], 0xa07
cmp dword [esp + 0xc], 0xcdd
jle 0x1003e393
xor esi, esi
xor edi, edi
mov eax, esi
lea ecx, [esp + 0x18]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10003aad
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003e363
mov eax, dword [eax]
push eax
call fcn.100445e8
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.10001e5d
inc edi
cmp edi, 0x6fca
jl 0x1003e346
inc esi
cmp esi, 0x561b
jl 0x1003e344
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov esi, dword [esp + 0x14]
cmp dword [esp + 0xc], 0x6a2
jge 0x1003e3a8
push str.tzknoz_tbvlcjrv_gdmux_pqpstd_zsodxzdp_tmbz_soqlt_yudhop
call fcn.100445e8
pop ecx
cmp byte [esi], 0
je 0x1003e3b8
push 0x4e7
call dword [sym.imp.USER32.dll_HideCaret]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10040585
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1005bb58
call fcn.1005a9e0
sub esp, 0x20
push ebx
push esi
mov esi, edx
test cl, cl
je 0x100405f1
cmp byte [ebp + 0xc], 0
je 0x100405c5
mov eax, dword [ebp + 0x1c]
cmp byte [eax], 0
je 0x10040705
xor ebx, ebx
push ebx
push 0x2062
push ebx
push 0x14a2
call dword [sym.imp.GDI32.dll_SetWinMetaFileBits]
jmp 0x10040705
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x10040705
mov esi, dword [ebp + 0x24]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 5
inc dword [edx]
cmp dword [edx], 3
jl 0x100405da
jmp 0x10040705
cmp byte [ebp + 8], 0
je 0x10040627
mov eax, dword [ebp + 0x20]
push edi
push 0x1a
pop edi
mov ecx, dword [eax]
cmp ecx, edi
jge 0x1004060e
mov eax, dword [ebp + 0x14]
movzx edx, word [eax]
add edx, ecx
jmp 0x10040618
mov eax, ecx
cdq
idiv edi
movzx eax, word [esi]
add edx, eax
mov ecx, dword [ebp + 0x18]
push edx
call fcn.1002acd4
pop edi
jmp 0x10040705
xor esi, esi
lea ecx, [ebp - 0x2c]
inc esi
xor ebx, ebx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], 0xffffffff
mov dword [ebp - 0x18], 0x1fc80ae7
mov dword [ebp - 0x1c], 0x92079655
push esi
call fcn.10001b45
lea eax, [ebp - 0x2c]
mov dword [ebp - 4], ebx
push eax
lea edx, [ebp - 0x20]
call fcn.100401b5
mov byte [ebp - 0xd], bl
pop ecx
cmp byte [ebp - 0xd], bl
je 0x1004066e
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov eax, dword [ebp - 0x14]
xor ecx, ecx
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x18]
test eax, eax
setg cl
xor edx, edx
mov dword [ebp - 0x18], ecx
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp - 0x14]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setl dl
xor ebx, ebx
cmp edx, eax
setle bl
xor ecx, ecx
imul ebx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp eax, ebx
mov eax, dword [ebp - 0x2c]
setge cl
mov dword [eax], ecx
xor ecx, ecx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x14]
cmp eax, esi
mov eax, dword [ebp - 0x1c]
setg cl
xor edx, edx
cmp eax, ecx
setne dl
xor ecx, ecx
imul edx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
cmp edx, eax
mov eax, dword [ebp - 0x14]
setg cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp - 0x14]
push dword [ebp - 0x2c]
setl dl
xor ecx, ecx
cmp edx, eax
setne cl
mov dword [ebp - 0x14], ecx
call fcn.10044367
pop ecx
mov ecx, dword [ebp - 0xc]
pop esi
pop ebx
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret