joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000c1c3
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
je 0x1000c2b5
mov dword [esp + 0x14], 0x3005
cmp dword [esp + 0x14], 0x338d
jle 0x1000c27a
xor ebx, ebx
xor esi, esi
mov dword [esp + 0x10], esi
xor edi, edi
mov dword [esp + 0xc], edi
and dword [esp + 0x1c], 0
mov ecx, edi
mov edi, esi
mov dword [esp + 0x18], esi
mov esi, dword [esp + 0x1c]
sar edi, cl
mov ecx, esi
mov eax, edi
shl eax, cl
lea ecx, [esp + 0x20]
xor eax, ebx
cdq
push edx
push eax
call fcn.10001af4
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000c22e
mov eax, dword [eax]
push eax
call fcn.10048e5f
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.1000330e
inc esi
cmp esi, 0x6528
jl 0x1000c210
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
inc edi
mov dword [esp + 0xc], edi
cmp edi, 0x3d12
jl 0x1000c1fd
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0x2f6d
jl 0x1000c1f7
inc ebx
cmp ebx, 0x73b5
jl 0x1000c1f1
push 0x1891
push 0x1438
push 0x1c22
push 0x10d4
push 0x133c
push 0x12cf
call dword [sym.imp.GDI32.dll_PatBlt]
cmp dword [esp + 0x14], 0x2ed7
jge 0x1000c2bd
push str.trtnbuzx_wlg_wqqvk_zxlayrvkw_fllm_hbrwjnjf_elxw_xfyptz_jmqxhxvf_jpqn
call fcn.10048e5f
pop ecx
jmp 0x1000c2bd
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10011817
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x100118b7
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1001185f
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x100118b5
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [eax], 0xa44f34d8
mov eax, 0xa44f34d8
cmp eax, 1
jg 0x1001189f
mov dword [ebp - 4], 1
jmp 0x100118a3
and dword [ebp - 4], 0
mov eax, dword [ebp - 0x28]
push dword [eax]
mov ecx, dword [ebp - 0x2c]
call fcn.10003037
mov ecx, dword [ebp - 4]
mov dword [eax], ecx
jmp 0x100118d9
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x30]
push 0x7830
push 0xba6
push 0x4043
push 0
call fcn.10015905
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x10025f24
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x10], 0
je 0x10025f3d
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
pop ebp
ret
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10025f5f
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffffb
inc dword [edx]
cmp dword [edx], 2
jl 0x10025f4c
pop esi
pop ebp
ret

Function at 0x1002809d
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10060cae
call fcn.1005fa24
sub esp, 0xc
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
je 0x100280e3
mov dword [edx], 0
jmp 0x100280cd
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [edx]
cmp dword [edx], 3
jl 0x100280c0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x14], 0x39ff
xor esi, esi
cmp dword [ebp - 0x14], 0x3dcc
jle 0x10028141
push esi
push 0x1f12
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_ReadProcessMemory]
mov edi, esi
mov ebx, esi
mov eax, ebx
mov ecx, 0x1007cff8
xor eax, edi
cdq
push edx
push eax
call fcn.10002e68
inc ebx
cmp ebx, 0x1087
jl 0x10028108
inc edi
cmp edi, 0x71ca
jl 0x10028106
push esi
push 0x20d1
push 0x1d80
push 0x1a3d
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatA]
mov eax, dword [ebp + 0xc]
mov dword [eax], 0xa44f34d8
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x14], 0x3804
mov dword [eax + edx*4], 1
jge 0x100280d2
mov edx, str.azyxo_jtueoubri_xrj_ohsjbe_ijrkryrct_ouqvsj
mov ecx, 0x1007cff8
call fcn.100050b8
jmp 0x100280d2
Function at 0x100289d8
Capabilities:
Connect pipe

Disassembly:
mov eax, 0x10060cf4
call fcn.1005fa24
sub esp, 0x10
mov byte [ebp - 0x18], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10028a25
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x10028a14
push 0x66cf
push 1
push 1
xor dl, dl
mov ecx, 0x6687
call fcn.10028c88
add esp, 0xc
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
mov byte [ebp - 0x12], bl
mov dword [ebp - 0x1c], 0x20bd
cmp dword [ebp - 0x1c], 0x23c1
jle 0x10028a6b
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
shl eax, cl
mov ecx, 0x1007cff8
cdq
push edx
push eax
call fcn.10002e68
inc edi
cmp edi, 0x52b2
jl 0x10028a46
inc esi
cmp esi, 0x15e
jl 0x10028a44
push ecx
push 0x67d7
push ebx
lea ecx, [ebp - 0x12]
call fcn.10027e61
add esp, 0xc
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1c], 0x1d58
jge 0x10028a14
mov edx, str.qbzykncnk_heqveefok_tyvn_iabsoaoyl_uizawq_nwwvcelhe_wyxz_ijr_cjkoo_dbwvio_qdkmn_qdqcxjif_cqsl_psfktlnjb
mov ecx, 0x1007cff8
call fcn.100050b8
jmp 0x10028a14
Function at 0x1002a5a0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x1002a5b7
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x1002a5d9
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x10080934
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x10080cc0
jl 0x1002a5e7
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x10080f64
jl 0x1002a627
mov ecx, dword [0x10081cb0]
xor ecx, dword [0x10080934]
and ecx, edi
xor ecx, dword [0x10081cb0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x10080930], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10080f64]
mov dword [0x100812f0], eax
pop esi
ret
Function at 0x1002a73b
Capabilities:
Get keyboard layout

Disassembly:
mov eax, 0x10060dcf
call fcn.1005fa24
sub esp, 0x1c
push ebx
push esi
mov dword [ebp - 0x20], 0x5702
mov eax, ecx
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
cmp dword [ebp - 0x20], 0x5863
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x28], eax
jle 0x1002a7f4
push 0x26c4
push ebx
push 0x22dc
push 0x9f6
call dword [sym.imp.USER32.dll_GetDlgItemTextA]
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x14], edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov eax, edx
mov dword [ebp - 0x24], eax
mov esi, eax
mov ecx, ebx
xor edi, edi
shl esi, cl
mov eax, esi
mov ecx, 0x1007cff8
or eax, edi
cdq
push edx
push eax
call fcn.10002e68
inc edi
cmp edi, 0x34cb
jl 0x1002a7a0
mov eax, dword [ebp - 0x24]
inc ebx
cmp ebx, 0x5d06
jl 0x1002a798
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x45ac
jl 0x1002a78c
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x1a3
jl 0x1002a787
push 0x1551
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov eax, dword [ebp - 0x28]
xor ebx, ebx
lea esi, [eax + eax]
test esi, esi
je 0x1002a820
mov edi, dword [ebp + 8]
push 0x35
pop ecx
xor edx, edx
mov eax, ebx
div ecx
mov eax, dword [ebp - 0x1c]
mov ecx, dword [eax + ebx*4]
mov edx, dword [edi + edx*4]
call fcn.10025f18
mov ecx, dword [ebp - 0x1c]
mov dword [ecx + ebx*4], eax
inc ebx
cmp ebx, esi
jb 0x1002a7fe
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x53b2
jge 0x1002a83c
mov edx, str.kaweif_uzsmg_oszwvkl_cdb_bndgen_efp
mov ecx, 0x1007cff8
call fcn.100050b8
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002f2a7
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060eed
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x60
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1002f462
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1002f438
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x28], 0x6290
mov dword [ebp - 0x3c], str.dfxxfxgk_wcztcmu_brzesl_lwksbylc_rilybjej
cmp dword [ebp - 0x28], 0x6413
jle 0x1002f3c3
and dword [ebp - 0x18], 0
jmp 0x1002f323
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x5bd3
jge 0x1002f39b
and dword [ebp - 0x1c], 0
jmp 0x1002f339
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x7e4c
jge 0x1002f399
and dword [ebp - 0x20], 0
jmp 0x1002f34f
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x2ff0
jge 0x1002f397
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
shl eax, cl
cdq
mov dword [ebp - 0x58], eax
mov dword [ebp - 0x54], edx
push dword [ebp - 0x54]
push dword [ebp - 0x58]
lea ecx, [ebp - 0x70]
call fcn.10001af4
pop ecx
pop ecx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
call fcn.10002e48
push eax
call fcn.10048e5f
pop ecx
lea ecx, [ebp - 0x70]
call fcn.10002e3e
jmp 0x1002f348
jmp 0x1002f332
jmp 0x1002f31c
push 0
push 0x24c9
push 0xc9e
push 0xeb1
push 0x1763
push 0xc15
push 0x1d3d
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [eax], 0
jmp 0x1002f3df
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
mov eax, dword [ebp - 0x24]
cmp dword [eax], 0xc
jle 0x1002f3fa
mov byte [ebp - 0x11], 0
lea eax, [ebp - 0x11]
push eax
push 0
call fcn.10031f8c
pop ecx
pop ecx
jmp 0x1002f3d4
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x5f41
jge 0x1002f410
push dword [ebp - 0x3c]
call fcn.10048e5f
pop ecx
jmp 0x1002f42c
or dword [ebp - 4], 0xffffffff
jmp 0x1002f436
jmp 0x1002f460
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x1002f460
push 0x1c04
push 0x6a2
push 0
call dword [sym.imp.USER32.dll_InflateRect]
jmp 0x1002f483
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x50], eax
push dword [ebp - 0x4c]
push 1
push 0x35a9
push dword [ebp - 0x50]
call fcn.1002d6f0
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10031fab
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10032014
lea eax, [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10031fe5
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10031fe3
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x10032012
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10032012
push 0
push 0x12a1
push 0xc99
push 0x7dd
call dword [sym.imp.GDI32.dll_MoveToEx]
jmp 0x10032035
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
push 0x13a9
push dword [ebp - 0x18]
push 1
push dword [ebp - 0x1c]
call fcn.10030eae
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x10033997
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100339e1
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x100339d7
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100339d5
push 0
push 0x7ac4
push 0x2cf8
call fcn.10034983
add esp, 0xc
jmp 0x100339df
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x100339fe
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
push dword [ebp - 0xc]
push 0
push 0x3f1b
push 0x31c4
call fcn.1002d741
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1003b696
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100612ee
call fcn.1005fa24
sub esp, 0x18
push ebx
push esi
mov dword [ebp - 0x20], 0x682e
mov esi, edx
cmp dword [ebp - 0x20], 0x68c5
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], esi
jle 0x1003b714
xor edi, edi
mov dword [ebp - 0x1c], edi
mov esi, edi
mov dword [ebp - 0x18], 0x1f3d
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov edi, ebx
mov ebx, 0x6175
mov eax, esi
mov ecx, 0x1007cff8
xor eax, edi
cdq
push edx
push eax
call fcn.10002e68
dec edi
dec ebx
jne 0x1003b6d8
mov ebx, dword [ebp - 0x14]
inc ebx
mov dword [ebp - 0x14], ebx
cmp ebx, 0x3080
jl 0x1003b6d1
dec esi
dec dword [ebp - 0x18]
jne 0x1003b6cc
mov edi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x2bc6
jl 0x1003b6c3
mov esi, dword [ebp - 0x24]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x665f
jge 0x1003b74f
mov edx, str.ihcgd_lgszz_wdazpf_cpakjti_kpbs_zgwafn_fwegcic_sohmeq_jvfrok_eai_ozubfiqse
mov ecx, 0x1007cff8
call fcn.100050b8
jmp 0x1003b74f
cmp byte [ebp + 0x10], 0
je 0x1003b77a
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x1003b79a
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [edx]
cmp dword [edx], 3
jl 0x1003b766
jmp 0x1003b79a
mov dword [esi], 0
cmp dword [esi], 2
jge 0x1003b79a
mov edx, dword [ebp + 0xc]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0x81438367
inc dword [esi]
cmp dword [esi], 2
jl 0x1003b788
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003c841
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1006138f
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x88
mov byte [esp + 4], cl
push ebx
push esi
push edi
test cl, cl
je 0x1003ca64
mov dword [esp + 0x1c], 0x3079
cmp dword [esp + 0x1c], 0x3211
push 0
pop ebx
jle 0x1003c8e2
mov esi, ebx
mov ebx, esi
mov dword [esp + 0x18], 0x1909
xor edi, edi
mov ecx, edi
mov eax, ebx
shl eax, cl
lea ecx, [esp + 0x78]
cdq
push edx
push eax
call fcn.10001af4
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003c8b0
mov eax, dword [eax]
push eax
call fcn.10048e5f
pop ecx
push 0
push 1
lea ecx, [esp + 0x80]
call fcn.1000330e
inc edi
cmp edi, 0x466b
jl 0x1003c894
dec ebx
dec dword [esp + 0x18]
jne 0x1003c892
inc esi
cmp esi, 0x40c8
jl 0x1003c888
xor ebx, ebx
cmp dword [esp + 0x1c], 0x2d75
jge 0x1003c8f7
push str.mbrvs_wpfvghnd_actyd_ghc_evar
call fcn.10048e5f
pop ecx
or dword [esp + 0x9c], 0xffffffff
lea ecx, [esp + 0x48]
push 0x7c
pop eax
mov word [esp + 0x14], ax
xor eax, eax
push 7
mov word [esp + 0x1a], ax
pop edi
mov word [esp + 0x48], ax
lea eax, [esp + 0x14]
push eax
mov dword [esp + 0x60], edi
mov dword [esp + 0x5c], ebx
call fcn.100033fa
mov edx, dword [ebp + 0xc]
lea eax, [esp + 0x48]
push eax
lea ecx, [esp + 0x30]
mov dword [esp + 0xa0], 2
call fcn.1003c4ca
pop ecx
push ebx
push 1
lea ecx, [esp + 0x50]
mov byte [esp + 0xa4], 4
call fcn.10003819
push 0xd
pop eax
push 2
mov ecx, ebx
mov dword [esp + 0x18], ebx
mov word [esp + 0x3c], 0x4501
mov byte [esp + 0x3e], bl
mov dword [esp + 0x3f], 0xb7df0404
mov dword [esp + 0x43], 0x302b548
mov word [esp + 0x47], 0x2a03
mov word [esp + 0x26], ax
pop esi
mov dword [esp + 0x18], ecx
cmp esi, 4
jne 0x1003c9a4
push 5
pop ecx
mov dword [esp + 0x18], ecx
mov esi, edi
jmp 0x1003c9f3
movzx edx, byte [esp + esi + 0x39]
mov eax, esi
sub eax, ecx
push 1
push 0x1a00
push 1
movzx eax, byte [esp + eax + 0x42]
push 0xf5e
push 0x5a31
movzx ecx, word [esp + eax*2 + 0x34]
mov eax, ecx
and eax, edx
add eax, eax
sub ecx, eax
movzx eax, byte [esp + esi + 0x4c]
add ecx, edx
lea edx, [esp + 0x2c]
mov word [esp + eax*2 + 0x34], cx
mov cl, 1
call fcn.1003c583
mov ecx, dword [esp + 0x2c]
add esp, 0x14
push 0xd
pop eax
add esi, 2
cmp esi, eax
jb 0x1003c994
xor eax, eax
mov dword [esp + 0x74], edi
mov word [esp + 0x28], ax
lea ecx, [esp + 0x60]
mov word [esp + 0x60], ax
lea eax, [esp + 0x20]
push eax
mov dword [esp + 0x74], ebx
call fcn.100033fa
xor eax, eax
mov byte [esp + 0x9c], 5
lea edi, [esp + 0x20]
stosd dword es:[edi], eax
lea edx, [esp + 0x2c]
stosd dword es:[edi], eax
stosw word es:[edi], ax
lea eax, [esp + 0x60]
push eax
push 1
call fcn.1003c763
pop ecx
pop ecx
mov ecx, dword [ebp + 0x18]
lea eax, [esp + 0x2c]
push eax
call fcn.1003ef5e
push ebx
push 1
lea ecx, [esp + 0x68]
call fcn.10003819
lea ecx, [esp + 0x2c]
call fcn.1003f3e9
jmp 0x1003ca6b
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov dword [edx], eax
mov ecx, dword [esp + 0x94]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003cead
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061441
call fcn.1005fa24
sub esp, 0x38
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], ebx
je 0x1003cfa2
mov dword [ebp - 0x20], 0x32fc
cmp dword [ebp - 0x20], 0x3480
jle 0x1003cf5c
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov eax, edi
and dword [ebp - 0x24], 0
cdq
mov edi, esi
idiv ebx
mov esi, dword [ebp - 0x24]
mov ecx, edx
shl edi, cl
mov eax, edi
lea ecx, [ebp - 0x40]
or eax, esi
cdq
push edx
push eax
call fcn.10001af4
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003cf16
mov eax, dword [eax]
push eax
call fcn.10048e5f
pop ecx
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.1000330e
inc esi
cmp esi, 0x3b71
jl 0x1003cefd
mov esi, dword [ebp - 0x1c]
inc ebx
mov edi, dword [ebp - 0x18]
cmp ebx, 0x6fd3
jl 0x1003ceeb
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x1666
jl 0x1003cee9
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x7fbb
jl 0x1003cee4
mov ebx, dword [ebp - 0x28]
cmp dword [ebp - 0x20], 0x3161
jge 0x1003cf70
push str.fdu_jzqg_idjmzfl_bjfhd_nuznkqill_kiuoneph_ima_vxp_pjglv_ugyj_pcr_vnr_klsxpkvuz
call fcn.10048e5f
pop ecx
mov edi, dword [ebp + 0xc]
or dword [ebp - 4], 0xffffffff
mov esi, dword [ebp + 0x24]
mov eax, dword [edi + 4]
sub eax, dword [edi]
sar eax, 2
mov dword [esi], eax
jmp 0x1003cf99
and dword [ebp - 0x24], 0
lea eax, [ebp - 0x24]
push eax
mov ecx, edi
call fcn.1003f13b
inc dword [esi]
mov eax, dword [esi]
cmp eax, dword [ebx]
jl 0x1003cf86
jmp 0x1003d065
mov dword [ebp - 0x1c], 0x6d8c
cmp dword [ebp - 0x1c], 0x7062
jle 0x1003cffb
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x20], ecx
lea eax, [ebx + edi]
xor eax, ecx
mov ecx, 0x1007cff8
xor eax, esi
cdq
push edx
push eax
call fcn.10002e68
mov ecx, dword [ebp - 0x20]
inc ecx
mov dword [ebp - 0x20], ecx
cmp ecx, 0x6f75
jl 0x1003cfbd
inc ebx
cmp ebx, 0x1b0c
jl 0x1003cfb8
inc edi
cmp edi, 0x1a36
jl 0x1003cfb6
inc esi
cmp esi, 0x5a8
jl 0x1003cfb4
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x6b79
jge 0x1003d01a
mov edx, str.yizzn_xrnwt_rpogkuy_abpoh_ndp_qyfmwloxm_knxxqmoos_lwfuzfcv_juc
mov ecx, 0x1007cff8
call fcn.100050b8
mov esi, dword [ebp + 0x20]
or dword [ebp - 4], 0xffffffff
mov dword [esi], 0xffffffee
cmp dword [esi], 6
jg 0x1003d065
mov edi, dword [ebp + 0x10]
push 0x5389
push 1
push ecx
push dword [ebp + 0x18]
mov dword [ebp - 0x28], 0xffffffff
mov ecx, 0x3579
mov dword [ebp - 0x28], 0
mov dword [ebp - 0x28], 0
call fcn.1003dec1
mov eax, dword [edi]
add esp, 0x10
inc dword [esi]
cmp dword [esi], 6
jle 0x1003d02f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003ddd0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100614e5
call fcn.1005fa24
sub esp, 0x30
cmp byte [ebp + 8], 0
mov eax, edx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x20], ecx
je 0x1003de2a
push ecx
mov edx, 0xeeb
lea ecx, [ebp - 0x38]
call fcn.1003a7cf
and dword [ebp - 4], 0
push ecx
mov ecx, dword [ebp + 0xc]
push eax
call fcn.100056a3
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.10003819
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x18], 0x7c19
cmp dword [ebp - 0x18], 0x7dfd
jle 0x1003de74
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, edi
mov ecx, 0x1007cff8
cdq
idiv ebx
xor edx, esi
mov eax, edx
cdq
push edx
push eax
call fcn.10002e68
inc ebx
cmp ebx, 0x1da9
jl 0x1003de40
inc edi
cmp edi, 0xfdf
jl 0x1003de3e
inc esi
cmp esi, 0x4b21
jl 0x1003de3c
mov eax, dword [ebp - 0x1c]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.1003ed31
mov ecx, dword [ebp - 0x20]
mov dword [ebp - 4], 1
cmp dword [ebp - 0x18], 0x7b16
mov dword [ecx], eax
jge 0x1003de19
mov edx, str.dpliqiksr_urjochf_nbquevd_cgwwnzcn_zorfz_frpfe_elesub_cjvji_dio_eybjy_izxonwaqj
mov ecx, 0x1007cff8
call fcn.100050b8
jmp 0x1003de19

Function at 0x1003dfe3
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100614ef
call fcn.1005fa24
sub esp, 0x14
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], cl
je 0x1003e0c6
cmp byte [ebp + 0x10], 0
je 0x1003e01e
mov ecx, dword [edx + 4]
sub ecx, dword [edx]
push dword [ebp + 8]
mov edx, dword [edx]
call fcn.10026669
pop ecx
jmp 0x1003e0dd
mov dword [ebp - 0x20], 0x694c
cmp dword [ebp - 0x20], 0x6cdd
jle 0x1003e07e
xor edi, edi
xor esi, esi
mov dword [ebp - 0x1c], esi
xor ebx, ebx
mov dword [ebp - 0x18], 0x18cc
xor esi, esi
mov dword [ebp + 0xc], 0x6a2
mov eax, esi
mov ecx, 0x1007cff8
xor eax, edi
cdq
push edx
push eax
call fcn.10002e68
add esi, ebx
dec dword [ebp + 0xc]
jne 0x1003e047
mov esi, dword [ebp - 0x1c]
add ebx, esi
dec dword [ebp - 0x18]
jne 0x1003e03e
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0xbcc
jl 0x1003e035
inc edi
cmp edi, 0x3c42
jl 0x1003e030
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x67b4
jge 0x1003e09a
mov edx, str.rcecdt_gobotsks_uvbmbak_cqtijt_khbwohtq_ldtrrio_gvs_tcmaz_gmnc_ieovw_rsxeayjjm_vasokh
mov ecx, 0x1007cff8
call fcn.100050b8
mov eax, dword [ebp + 0x18]
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
mov eax, dword [ebp + 0x14]
sar ecx, 2
mov dword [eax], ecx
jmp 0x1003e0dd
test cl, cl
je 0x1003e0d2
call dword [sym.imp.USER32.dll_GetDoubleClickTime]
jmp 0x1003e0dd
push 0x81c
call dword [sym.imp.KERNEL32.dll_IsProcessorFeaturePresent]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret