joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001a318
Capabilities:
Clear file content

Disassembly:
mov eax, 0x1006152b
call fcn.10060598
sub esp, 0x44
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x1001a3cc
mov dword [ebp - 0x14], 0x153a
cmp dword [ebp - 0x14], 0x1584
jle 0x1001a386
xor esi, esi
xor edi, edi
mov ebx, 0x278b
mov eax, edi
lea ecx, [ebp - 0x38]
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001a365
mov eax, dword [eax]
push eax
call fcn.10049ba3
pop ecx
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.10004a46
add edi, esi
dec ebx
jne 0x1001a34e
inc esi
cmp esi, 0x3444
jl 0x1001a347
cmp dword [ebp - 0x14], 0x141b
jge 0x1001a39a
push str.kudey_prq_apzo_lzpummed_oumv_ajsqfqkhv_olwel_fuoxwme_jyqtkvaif
call fcn.10049ba3
pop ecx
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x50]
push 0x21
pop edx
call fcn.10002b63
push ecx
push ecx
mov ecx, dword [ebp + 8]
push eax
mov dword [ebp - 4], 2
call fcn.1001daf1
push 0
push 1
lea ecx, [ebp - 0x50]
call fcn.10004bb8
jmp 0x1001a502
mov dword [ebp - 0x18], 0x6bee
cmp dword [ebp - 0x18], 0x6df2
jle 0x1001a4c0
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov dword [ebp - 0x14], 0x2328
cmp dword [ebp - 0x14], 0x1181
jge 0x1001a46a
lea eax, [ebp - 0x1c]
mov ebx, 0x1007c1f8
push eax
mov ecx, ebx
call fcn.1001be95
mov esi, dword [ebp - 0x1c]
push esi
call fcn.1001c4e0
xor edi, edi
test esi, esi
jle 0x1001a42c
mov eax, dword [0x1007d22c]
mov ecx, ebx
lea eax, [eax + edi*4]
push eax
call fcn.1001be95
inc edi
cmp edi, esi
jl 0x1001a417
or edi, 0xffffffff
xor ecx, ecx
test esi, esi
jle 0x1001a458
mov eax, dword [0x1007d22c]
push 2
pop edx
add eax, 8
cmp edx, esi
jge 0x1001a44e
cmp dword [eax], 0
jne 0x1001a44e
inc ecx
add eax, 4
inc edx
inc edi
add eax, 4
inc ecx
inc edx
cmp ecx, esi
jl 0x1001a440
push edi
mov ecx, 0x1007c0d8
call fcn.10016787
push eax
call fcn.1001735e
pop ecx
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
and dword [ebp - 0x20], 0
mov ebx, esi
mov esi, dword [ebp - 0x20]
mov ecx, edi
sar ebx, cl
mov ecx, esi
mov eax, ebx
sar eax, cl
mov ecx, 0x1007c0d8
cdq
push edx
push eax
call fcn.100042cb
inc esi
cmp esi, 0x701
jl 0x1001a47e
mov esi, dword [ebp - 0x14]
inc edi
cmp edi, 0x6ab3
jl 0x1001a471
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x3f7
jl 0x1001a46f
push 0
push 0
push 1
push 0
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [ebp - 4], 3
cmp dword [ebp - 0x18], 0x6994
jge 0x1001a4df
mov edx, str.paquerqhe_thltki_inxofgu_tzek_mlhzsntxm_mphctp_uvztba_blwj_yfhxf_vxw_tinuvbd_rcngubllc_josdzau
mov ecx, 0x1007c0d8
call fcn.10006d07
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1001a502
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xa9f65634
inc dword [edx]
cmp dword [edx], 2
jl 0x1001a4f0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001aaba
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0xc], 0
mov byte [ebp - 4], dl
je 0x1001aaf6
cmp byte [ebp + 0x10], 0
je 0x1001aaec
mov eax, dword [ebp + 0x18]
mov ecx, dword [ecx]
mov edx, dword [eax]
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
cmp eax, dword [ecx + edx*4]
jle 0x1001ab30
mov eax, dword [ebp + 0x20]
mov dword [eax], 1
jmp 0x1001ab30
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x1001ab30
test dl, dl
je 0x1001ab0b
mov byte [ebp + 0xf], 0
cmp byte [ebp + 0xf], 0
je 0x1001ab30
call fcn.1001888c
jmp 0x1001ab30
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x1001ab30
push esi
mov esi, dword [ebp + 0x1c]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x20d70069
inc dword [edx]
cmp dword [edx], 3
jl 0x1001ab1d
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1001f4f1
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
je 0x1001f501
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov eax, dword [ebp + 0xc]
movzx eax, byte [eax]
add dword [edx], eax
pop ebp
ret

Function at 0x1001f626
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0x14], 0
mov byte [ebp - 4], cl
je 0x1001f668
cmp byte [ebp + 8], 0
je 0x1001f661
xor ecx, ecx
mov byte [ebp + 0x17], cl
cmp byte [ebp + 0x17], cl
je 0x1001f6b1
push ecx
push 0x68a5
push 0x64d6
push 1
mov edx, 0x6b37
xor cl, cl
call fcn.1001f50b
add esp, 0x10
jmp 0x1001f6b1
mov eax, dword [ebp + 0x10]
dec dword [eax]
jmp 0x1001f6b1
test cl, cl
je 0x1001f6a4
mov dword [edx], 0xffffffeb
cmp dword [edx], 0xfffffff6
jl 0x1001f6b1
push esi
mov esi, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp + 0x14], 0xf6f6d779
mov eax, dword [ebp + 0x14]
cmp dword [ebp + 0x14], ecx
je 0x1001f695
cmp dword [esi], ecx
je 0x1001f695
xor eax, eax
inc eax
jmp 0x1001f697
mov eax, ecx
mov dword [ebp + 0x14], eax
inc dword [edx]
cmp dword [edx], 0xfffffff6
jge 0x1001f67d
pop esi
jmp 0x1001f6b1
xor ecx, ecx
push ecx
push ecx
push ecx
push ecx
push ecx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov esp, ebp
pop ebp
ret

Function at 0x1002091a
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
push ebx
mov dword [esp + 0xc], 0x3e67
mov eax, edx
cmp dword [esp + 0xc], 0x3fbd
mov ebx, ecx
push esi
push edi
mov dword [esp + 0x18], eax
mov dword [esp + 0x1c], ebx
jle 0x100209bd
push 0xab6
push 0xd84
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
xor edi, edi
xor esi, esi
mov dword [esp + 0x10], esi
mov ebx, esi
mov esi, 0x1065
mov eax, ebx
lea ecx, [esp + 0x20]
or eax, edi
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10020983
mov eax, dword [eax]
push eax
call fcn.10049ba3
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.10004a46
dec ebx
dec esi
jne 0x10020969
mov esi, dword [esp + 0x10]
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0x1377
jl 0x10020962
inc edi
cmp edi, 0x1092
jl 0x1002095c
mov eax, dword [esp + 0x18]
mov ebx, dword [esp + 0x1c]
cmp eax, 0x7e9ff226
jae 0x100209ce
add dword [0x10078ae8], 0x23022e29
cmp dword [esp + 0x14], 0x3da1
jge 0x100209e3
push str.agazuk_ahoeyia_eoo_yeujki_iuzij_mcybozl
call fcn.10049ba3
pop ecx
mov eax, dword [0x1007e7a0]
test al, 1
jne 0x10020a00
or eax, 1
mov dword [0x1007e7a0], eax
call fcn.1003547e
mov dword [0x1007e758], eax
jmp 0x10020a05
mov eax, dword [0x1007e758]
mov eax, dword fs:[eax]
pop edi
pop esi
mov dword [ebx], eax
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10024b88
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10024bd4
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10024bb6
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x10024bd2
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
push 0
mov ecx, dword [ebp - 0x10]
call fcn.1000461c
mov dword [eax], 0xd5aa0404
jmp 0x10024be2
push 0x519c
push 1
call fcn.100242ac
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret

Function at 0x10025a96
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10061992
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x10025af5
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
push 0x5e49
push dword [ebp - 0x20]
push 0x60c5
push 0x21eb
push dword [ebp - 0x24]
push 0x7d98
push 0
call fcn.10034d5c
add esp, 0x1c
jmp 0x10025bf1
mov dword [ebp - 0x1c], 0x265d
mov dword [ebp - 0x28], str.avp_fvveyeypo_dtarkfeqm_fycc_jadcs_zfxkztvmk_wthhcwg_vxo_moqnqaqj_vwddij_hnwhc_amjproh
cmp dword [ebp - 0x1c], 0x286f
jle 0x10025b5b
and dword [ebp - 0x14], 0
jmp 0x10025b19
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x6cb8
jge 0x10025b5b
and dword [ebp - 0x18], 0
jmp 0x10025b2f
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x5cc2
jge 0x10025b59
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sar eax, cl
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
mov ecx, 0x1007c0d8
call fcn.100042cb
jmp 0x10025b28
jmp 0x10025b12
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3c], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x25c8
jge 0x10025b7b
mov edx, dword [ebp - 0x28]
mov ecx, 0x1007c0d8
call fcn.10006d07
jmp 0x10025b97
or dword [ebp - 4], 0xffffffff
jmp 0x10025ba1
lea eax, [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10025bcb
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
and dword [eax], 0
jmp 0x10025bf1
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
movzx eax, byte [eax]
test eax, eax
je 0x10025bf1
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10032603
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10032675
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10032669
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
push dword [ebp - 0x18]
call fcn.100270df
pop ecx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
push dword [eax]
push dword [ebp - 0x20]
call fcn.100325a5
pop ecx
pop ecx
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
jmp 0x100326da
push 0
push 0
call dword [sym.imp.SHELL32.dll_Shell_NotifyIconW]
jmp 0x100326da
lea eax, [ebp + 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x100326b4
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100326b2
push 0x417e
push 1
push 0x14fd
push 1
push 0x881
call fcn.10023b82
add esp, 0x14
jmp 0x100326da
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x100326da
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov esp, ebp
pop ebp
ret
Function at 0x1003933c
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov byte [esp + 4], dl
push ebx
push esi
push edi
test dl, dl
je 0x1003935b
mov eax, dword [ebp + 8]
add dword [eax], 0xfffffffe
jmp 0x100393dd
mov eax, dword [ebp + 0x10]
push 0
pop ebx
cmp byte [eax], 0
je 0x10039371
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov dword [esp + 0x14], 0x7d7
cmp dword [esp + 0x14], 0xb1b
jle 0x100393c8
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
sar eax, cl
lea ecx, [esp + 0x18]
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100393a3
mov eax, dword [eax]
push eax
call fcn.10049ba3
pop ecx
push ebx
push 1
lea ecx, [esp + 0x20]
call fcn.10004a46
inc edi
cmp edi, 0xf95
jl 0x10039387
inc esi
cmp esi, 0x6189
jl 0x10039385
cmp dword [esp + 0x14], 0x70b
jge 0x100393dd
push str.xji_dxsaore_rjraghs_bsgedqyd_vvbl_foliqdn_zfy
call fcn.10049ba3
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10039add
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov byte [esp + 0x10], cl
mov byte [esp + 0x14], 1
je 0x10039b91
mov dword [esp + 0x1c], 0x5458
cmp dword [esp + 0x1c], 0x55a4
jle 0x10039b70
xor esi, esi
mov dword [esp + 0x18], esi
xor edi, edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov esi, edx
mov eax, esi
lea ecx, [esp + 0x20]
or eax, ebx
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10039b39
mov eax, dword [eax]
push eax
call fcn.10049ba3
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.10004a46
inc ebx
cmp ebx, 0x5a2
jl 0x10039b1f
mov esi, dword [esp + 0x18]
inc edi
cmp edi, 0x72ad
jl 0x10039b16
inc esi
mov dword [esp + 0x18], esi
cmp esi, 0x30df
jl 0x10039b14
cmp dword [esp + 0x1c], 0x52b0
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
jge 0x10039bbd
push str.mwsngr_ghjnnkdgb_prvqauy
call fcn.10049ba3
pop ecx
jmp 0x10039bbd
test cl, cl
je 0x10039ba9
push 0x1d14
push 0
push 0x1089
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x10039bbd
mov byte [esp + 0xf], 0
cmp byte [esp + 0xf], 0
je 0x10039bbd
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003a2de
Capabilities:
Get disk information

Disassembly:
mov eax, 0x10061f44
call fcn.10060598
sub esp, 0x14
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x18], dl
mov dword [ebp - 0x1c], esi
je 0x1003a3ed
mov dword [ebp + 0x10], 0x7286
cmp dword [ebp + 0x10], 0x729b
jle 0x1003a33d
xor edi, edi
xor ebx, ebx
mov eax, edi
mov ecx, 0x1007c0d8
cdq
idiv ebx
mov eax, edx
cdq
push edx
push eax
call fcn.100042cb
inc ebx
cmp ebx, 0xc37
jl 0x1003a317
inc edi
cmp edi, 0x30db
jl 0x1003a315
and dword [ebp - 4], 0
cmp dword [ebp + 0x10], 0x6f13
jge 0x1003a378
mov edx, str.swhyatqm_vxh_uwoe
mov ecx, 0x1007c0d8
call fcn.10006d07
jmp 0x1003a378
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 8], 0
je 0x1003a3c8
mov byte [ebp + 0x13], 0
cmp byte [ebp + 0x13], 0
je 0x1003a423
push 0x129d
push 0xa70
push 1
push 0x66ab
push 0x4950
push 0x574a
push 0
push 0
push 0x4b52
mov edx, 0x95
mov ecx, 0x43f2
call fcn.1003b805
add esp, 0x24
jmp 0x1003a423
mov dword [esi], 0xffffffeb
jmp 0x1003a3e6
mov ecx, dword [ebp + 0xc]
lea eax, [ebp - 0x20]
mov dword [ebp - 0x20], 0xf6f6d779
push eax
call fcn.1003a9da
inc dword [esi]
pop ecx
cmp dword [esi], 0xfffffff6
jge 0x1003a3d0
jmp 0x1003a423
test dl, dl
je 0x1003a403
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x1003a423
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
jmp 0x1003a423
mov esi, dword [ebp + 0x18]
mov dword [esi], 0
jmp 0x1003a41e
mov byte [ebp - 0x11], 0
lea ecx, [ebp - 0x11]
xor dl, dl
call fcn.1003abfe
inc dword [esi]
cmp dword [esi], 1
jne 0x1003a40e
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003a61b
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
mov byte [esp + 4], dl
mov eax, ecx
mov dword [esp + 0x20], eax
push ebx
push esi
push edi
test dl, dl
je 0x1003a6f4
mov dword [esp + 0x20], 0x206a
cmp dword [esp + 0x20], 0x23ad
jle 0x1003a6db
xor esi, esi
mov edi, esi
mov dword [esp + 0x1c], esi
mov ebx, esi
mov dword [esp + 0x18], esi
mov eax, esi
mov dword [esp + 0x14], esi
xor eax, ebx
mov ebx, esi
xor eax, edi
mov dword [esp + 0x24], eax
mov edi, eax
mov eax, edi
lea ecx, [esp + 0x30]
or eax, ebx
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003a689
mov eax, dword [eax]
push eax
call fcn.10049ba3
pop ecx
push esi
push 1
lea ecx, [esp + 0x38]
call fcn.10004a46
inc ebx
cmp ebx, 0x7249
jl 0x1003a66f
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x1c]
inc eax
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x14], eax
cmp eax, 0x1335
jl 0x1003a663
inc ebx
mov dword [esp + 0x18], ebx
cmp ebx, 0x10ab
jl 0x1003a65d
inc edi
mov dword [esp + 0x1c], edi
cmp edi, 0x37d
jl 0x1003a657
mov eax, dword [esp + 0x2c]
inc dword [eax]
cmp dword [esp + 0x20], 0x1f3c
jge 0x1003a701
push str.nsldrujb_bnmcwadp_rot_biasoccu_lqc_agjxfj_gyotgkz
call fcn.10049ba3
pop ecx
jmp 0x1003a701
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003a72c
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061f58
call fcn.10060598
sub esp, 0x10
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], dl
mov dword [ebp - 0x1c], esi
je 0x1003a797
test dl, dl
je 0x1003a785
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x1003a774
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x41ad
inc dword [edx]
cmp dword [edx], 1
jl 0x1003a762
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1003a774
push 0
call dword [sym.imp.GDI32.dll_CreateBitmapIndirect]
jmp 0x1003a774
cmp byte [ebp + 0x18], 0
je 0x1003a7aa
push 0x1fd9
call dword [sym.imp.USER32.dll_IsWindow]
jmp 0x1003a774
mov dword [ebp - 0x18], 0x3af9
cmp dword [ebp - 0x18], 0x3c29
jle 0x1003a7fe
xor edi, edi
xor ebx, ebx
xor esi, esi
mov dword [ebp + 8], 0x5d15
mov eax, esi
mov ecx, 0x1007c0d8
xor eax, edi
cdq
push edx
push eax
call fcn.100042cb
add esi, ebx
dec dword [ebp + 8]
jne 0x1003a7c7
inc ebx
cmp ebx, 0x6fbc
jl 0x1003a7be
inc edi
cmp edi, 0x1415
jl 0x1003a7bc
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
mov esi, dword [ebp - 0x1c]
mov dword [esi], 0
cmp dword [esi], 1
jge 0x1003a81e
mov edx, dword [ebp + 0x14]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0x9b69b2e4
inc dword [esi]
cmp dword [esi], 1
jl 0x1003a80c
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x39b5
jge 0x1003a774
mov edx, str.iusewd_cozuvgv_ujdoeijav_ejp_yvqvdk_fznlfp_fevxth_wqtodpzoz_ahcb_egbxeb_wwa_guqtflaad_xtkp
mov ecx, 0x1007c0d8
call fcn.10006d07
jmp 0x1003a774
Function at 0x1003a85d
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061f62
call fcn.10060598
sub esp, 0x34
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], ecx
je 0x1003a89b
mov esi, dword [ebp + 0x14]
mov dword [esi], 0
jmp 0x1003a891
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0x588c5561
inc dword [esi]
cmp dword [esi], 4
jl 0x1003a884
jmp 0x1003a9a4
mov dword [ebp - 0x14], 0x6a28
xor esi, esi
cmp dword [ebp - 0x14], 0x6a70
jle 0x1003a8d4
mov edi, esi
mov ebx, esi
mov eax, ebx
mov ecx, 0x1007c0d8
xor eax, edi
cdq
push edx
push eax
call fcn.100042cb
inc ebx
cmp ebx, 0x5cff
jl 0x1003a8b1
inc edi
cmp edi, 0x1649
jl 0x1003a8af
mov dword [ebp - 4], esi
cmp dword [ebp - 0x14], 0x66b6
jge 0x1003a8ef
mov edx, str.mssmseuzq_jaqwvj_dpfry_riaxsgzyr_lny_lpwisiezx_btttumk_mthdxlvnv_nbgod_bdoivaive_agej_efx
mov ecx, 0x1007c0d8
call fcn.10006d07
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], 0x2146
cmp dword [ebp - 0x1c], 0x2304
jle 0x1003a96d
mov edi, esi
mov dword [ebp - 0x18], esi
mov ebx, esi
mov dword [ebp - 0x14], esi
mov ecx, ebx
mov dword [ebp - 0x20], edi
mov ebx, edi
mov dword [ebp - 0x24], esi
shl ebx, cl
mov edi, esi
mov eax, ebx
lea ecx, [ebp - 0x40]
or eax, edi
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003a934
mov eax, dword [eax]
push eax
call fcn.10049ba3
pop ecx
push esi
push 1
lea ecx, [ebp - 0x40]
call fcn.10004a46
inc edi
cmp edi, 0x3f54
jl 0x1003a91b
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
inc ebx
mov dword [ebp - 0x14], ebx
cmp ebx, 0x176c
jl 0x1003a90d
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x693c
jl 0x1003a908
cmp dword [ebp - 0x1c], 0x1e2b
jge 0x1003a981
push str.pbhajo_hpuil_ddt_zicr_cwutaatod_fhgph_mjom
call fcn.10049ba3
pop ecx
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp - 0x28]
mov ecx, dword [eax]
mov eax, dword [edx]
cmp dword [eax + ecx*4], esi
jne 0x1003a99c
mov eax, dword [ebp + 0x20]
mov ecx, dword [eax]
mov eax, dword [edx]
cmp dword [eax + ecx*4], esi
je 0x1003a99f
xor esi, esi
inc esi
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003aab9
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
test cl, cl
je 0x1003aadc
cmp byte [ebp + 0x1c], 0
je 0x1003aacd
mov eax, dword [ebp + 0xc]
dec dword [eax]
pop ebp
ret
cmp byte [edx], 0
je 0x1003ab2c
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop ebp
ret
cmp byte [ebp + 0x20], 0
push esi
je 0x1003ab08
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x1003ab2b
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x11ca4b38
inc dword [edx]
cmp dword [edx], 1
jl 0x1003aaf4
jmp 0x1003ab2b
mov edx, dword [ebp + 0x18]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1003ab2b
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [edx]
cmp dword [edx], 2
jl 0x1003ab19
pop esi
pop ebp
ret