joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000f6aa
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x1000f6c1
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x1000f6e3
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x1013d854
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x1013dbe0
jl 0x1000f6f1
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x1013de84
jl 0x1000f731
mov ecx, dword [0x1013ebd0]
xor ecx, dword [0x1013d854]
and ecx, edi
xor ecx, dword [0x1013ebd0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x1013d850], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x1013de84]
mov dword [0x1013e210], eax
pop esi
ret
Function at 0x10014ccb
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005d488
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10014d3d
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x10014d18
push 0x1e31
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x10014d38
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x10014d38
push 0
push 0x6681
push 0x2e83
call fcn.10015459
add esp, 0xc
jmp 0x10014e34
lea eax, [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10014d63
push 0x832
call dword [sym.imp.USER32.dll_SetCapture]
jmp 0x10014e34
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x10014d8d
push 0x2045
push 0x3118
push 0
call fcn.10018a93
add esp, 0xc
mov dword [ebp - 0x20], 0x3a4d
mov dword [ebp - 0x38], str.gpfeitdld_zcazvppj_bcopg_gzho_ibnvnd_uti_jdeifxs_nsvz_lcdtdaalh_bebxm_wjxwwtd_bgyidn_trgqdcpaa
cmp dword [ebp - 0x20], 0x3dd4
jle 0x10014df4
and dword [ebp - 0x18], 0
jmp 0x10014db1
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x393e
jge 0x10014df4
and dword [ebp - 0x1c], 0
jmp 0x10014dc7
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x147f
jge 0x10014df2
mov eax, dword [ebp - 0x18]
cdq
idiv dword [ebp - 0x1c]
mov eax, edx
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
mov ecx, 0x10078fb8
call fcn.10001d2f
jmp 0x10014dc0
jmp 0x10014daa
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x3a09
jge 0x10014e0e
mov edx, dword [ebp - 0x38]
mov ecx, 0x10078fb8
call fcn.10003c4d
jmp 0x10014e2a
or dword [ebp - 4], 0xffffffff
jmp 0x10014e34
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10015295
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005d4a6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x100152e0
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
push 1
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
call fcn.10015459
add esp, 0xc
jmp 0x10015448
lea eax, [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x10015431
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov dword [ebp - 0x24], 0x4302
mov dword [ebp - 0x44], str.qhzmwl_dxw_nezrt_xyav_aodiibq
cmp dword [ebp - 0x24], 0x4478
jle 0x100153d2
push 0
push 0
push 0x1d14
push 0
push 0
call dword [sym.imp.USER32.dll_DialogBoxParamA]
and dword [ebp - 0x14], 0
jmp 0x1001533b
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x770e
jge 0x100153d2
and dword [ebp - 0x18], 0
jmp 0x10015355
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x62ce
jge 0x100153cd
and dword [ebp - 0x1c], 0
jmp 0x1001536b
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x6139
jge 0x100153cb
and dword [ebp - 0x20], 0
jmp 0x10015381
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x1a23
jge 0x100153c9
mov eax, dword [ebp - 0x14]
and eax, dword [ebp - 0x18]
xor eax, dword [ebp - 0x1c]
xor eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x64]
call fcn.10001a85
pop ecx
pop ecx
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
call fcn.10001d0f
push eax
call fcn.10045794
pop ecx
lea ecx, [ebp - 0x64]
call fcn.10001d05
jmp 0x1001537a
jmp 0x10015364
jmp 0x1001534e
jmp 0x10015334
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
movzx eax, byte [eax]
test eax, eax
je 0x100153f3
push 0x1e31
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x4070
jge 0x10015409
push dword [ebp - 0x44]
call fcn.10045794
pop ecx
jmp 0x10015425
or dword [ebp - 4], 0xffffffff
jmp 0x1001542f
jmp 0x10015448
push 0
push 0x1ecf
push 0x580
push 0x104
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100170c7
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10017163
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1001711f
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1001711d
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x10017161
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
mov dword [ebp - 0x34], eax
push dword [ebp - 0x30]
lea eax, [ebp - 0x34]
push eax
mov ecx, dword [ebp - 0x38]
call fcn.1001c5da
mov ecx, eax
call fcn.1000f476
jmp 0x10017177
push 0
push 0x284a
push 0x33f0
call fcn.10015459
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x10017fad
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1001801f
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10018005
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10018003
push 0x2b20
push 1
push 0x2bb0
push 0x4ae
push 0x2296
push 1
push 1
push 0x74b8
push 0x1bfd
call fcn.10015b06
add esp, 0x24
jmp 0x1001801a
push 0
push 0x25bc
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x100180ab
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10018061
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
push 0
mov ecx, dword [ebp - 0x1c]
call fcn.10001f58
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
jmp 0x100180ab
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x100180ab
push 0
push 0x1409
push 0x1bf8
push 0x1f27
push 0x1e0c
push 0x1be
push 0x2f5
push 0x24fd
push 0x477
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_AllocateAndInitializeSid]
mov esp, ebp
pop ebp
ret
Function at 0x10021529
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x10]
mov dword [esp + 0x14], eax
xor eax, eax
jmp 0x10021579
cmp dword [edi + 0x14], 0x10
jb 0x1002154c
mov ecx, dword [edi]
jmp 0x1002154e
mov ecx, edi
mov bl, byte [ecx + eax]
lea edx, [eax + 0x55]
mov cl, bl
call fcn.10034fe2
movsx esi, al
xor edx, edx
movsx eax, bl
add eax, dword [esp + 0x10]
push 0x19
pop ecx
div ecx
mov eax, dword [esp + 0x10]
mov ecx, edx
shl esi, cl
add dword [esp + 0x14], esi
inc eax
mov dword [esp + 0x10], eax
cmp dword [edi + 0x10], eax
ja 0x10021542
mov dword [esp + 0x18], 0x6cd
cmp dword [esp + 0x18], 0x6f2
jle 0x100215fe
xor esi, esi
mov dword [esp + 0x18], esi
xor edi, edi
mov dword [esp + 0x10], edi
xor ebx, ebx
mov dword [esp + 0x1c], edi
xor edi, esi
xor esi, esi
mov eax, esi
mov ecx, 0x10078fb8
xor eax, ebx
or eax, edi
cdq
push edx
push eax
call fcn.10001d2f
inc esi
cmp esi, 0x2aae
jl 0x100215aa
inc ebx
cmp ebx, 0x5094
jl 0x100215a8
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x18]
inc edi
mov dword [esp + 0x10], edi
cmp edi, 0x3205
jl 0x100215a0
inc esi
mov dword [esp + 0x18], esi
cmp esi, 0x73e2
jl 0x1002159a
push 1
push 0x1e8d
call dword [sym.imp.USER32.dll_GetSystemMenu]
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100269ea
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005da49
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10026a63
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10026a53
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x10026a51
push 0x1e31
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x10026a5e
push 0x832
call dword [sym.imp.USER32.dll_SetCapture]
jmp 0x10026b72
mov dword [ebp - 0x24], 0x7635
mov dword [ebp - 0x3c], str.jgqwjztav_qmddsjwi_dvhgiweae_djrzqinm_pbjhuf_orazap_cjwcrftxh_azwdi_uivlcvw_ycpscltvg_wgts_qwhzzgpb_kbmxbdf_nviqt
cmp dword [ebp - 0x24], 0x795e
jle 0x10026b22
and dword [ebp - 0x14], 0
jmp 0x10026a8b
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x4bc3
jge 0x10026b22
and dword [ebp - 0x18], 0
jmp 0x10026aa5
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x50eb
jge 0x10026b1d
and dword [ebp - 0x1c], 0
jmp 0x10026abb
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x547d
jge 0x10026b1b
and dword [ebp - 0x20], 0
jmp 0x10026ad1
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x4096
jge 0x10026b19
mov eax, dword [ebp - 0x14]
or eax, dword [ebp - 0x18]
or eax, dword [ebp - 0x1c]
or eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
push dword [ebp - 0x40]
push dword [ebp - 0x44]
lea ecx, [ebp - 0x5c]
call fcn.10001a85
pop ecx
pop ecx
mov dword [ebp - 0x38], eax
mov ecx, dword [ebp - 0x38]
call fcn.10001d0f
push eax
call fcn.10045794
pop ecx
lea ecx, [ebp - 0x5c]
call fcn.10001d05
jmp 0x10026aca
jmp 0x10026ab4
jmp 0x10026a9e
jmp 0x10026a84
push 0x2da0
push 0
push 0x655c
call fcn.100217e8
add esp, 0xc
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x746c
jge 0x10026b4c
push dword [ebp - 0x3c]
call fcn.10045794
pop ecx
jmp 0x10026b68
or dword [ebp - 4], 0xffffffff
jmp 0x10026b72
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10028784
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005dacd
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], 0x764
mov dword [ebp - 0x20], str.gbwathl_ssx_akdq_njhymx_yogtjg_kpzwn_fnaheb_wyw_hjos_cey
cmp dword [ebp - 0x1c], 0x87e
jle 0x10028812
and dword [ebp - 0x14], 0
jmp 0x100287ca
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x7d07
jge 0x1002880a
and dword [ebp - 0x18], 0
jmp 0x100287e0
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x4078
jge 0x10028808
mov eax, dword [ebp - 0x14]
or eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
push dword [ebp - 0x24]
push dword [ebp - 0x28]
mov ecx, 0x10078fb8
call fcn.10001d2f
jmp 0x100287d9
jmp 0x100287c3
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
push dword [ebp + 8]
push 1
push dword [ebp + 0x10]
push dword [ebp + 0xc]
call fcn.10028876
add esp, 0x10
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x513
jge 0x1002883f
mov edx, dword [ebp - 0x20]
mov ecx, 0x10078fb8
call fcn.10003c4d
jmp 0x1002885b
or dword [ebp - 4], 0xffffffff
jmp 0x10028865
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10037e7a
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
push ebx
mov dword [esp + 0x10], 0x7c7b
mov ebx, edx
cmp dword [esp + 0x10], 0x7ef2
push esi
push edi
mov dword [esp + 0x1c], ebx
jle 0x10037ee1
xor esi, esi
xor edi, edi
lea eax, [edi + esi]
cdq
lea ecx, [esp + 0x20]
push edx
push eax
call fcn.10001a85
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10037ebb
mov eax, dword [eax]
push eax
call fcn.10045794
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.1000224a
inc edi
cmp edi, 0x42b8
jl 0x10037ea2
inc esi
cmp esi, 0x7bad
jl 0x10037ea0
cmp byte [ebp + 0xc], 0
je 0x10037f86
mov dword [esp + 0x14], 0x48b0
cmp dword [esp + 0x14], 0x4c40
jle 0x10037f58
xor esi, esi
mov ebx, esi
mov dword [esp + 0x10], 0x391f
xor edi, edi
mov ecx, edi
mov eax, ebx
sar eax, cl
lea ecx, [esp + 0x38]
cdq
push edx
push eax
call fcn.10001a85
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10037f27
mov eax, dword [eax]
push eax
call fcn.10045794
pop ecx
push 0
push 1
lea ecx, [esp + 0x40]
call fcn.1000224a
inc edi
cmp edi, 0x954
jl 0x10037f0b
dec ebx
dec dword [esp + 0x10]
jne 0x10037f09
inc esi
cmp esi, 0x6988
jl 0x10037eff
mov ebx, dword [esp + 0x1c]
cmp dword [esp + 0x14], 0x4645
jge 0x10037f6d
push str.xxmowknkh_xogj_uoao_uvhak_xvu_jhknkg
call fcn.10045794
pop ecx
cmp byte [ebx], 0
je 0x10037f9d
xor eax, eax
push eax
push 0x25bc
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x10037f9d
push 0
push 0x1ecf
push 0x580
push 0x104
call dword [sym.imp.GDI32.dll_SetWindowOrgEx]
cmp dword [esp + 0x18], 0x7b14
jge 0x10037fb2
push str.snbhqtfs_lwo_gmyvgyyfl_wigdvwa_ntyui_pge_ejomovzqg_mfniq_jqdytwizw_tqpps_rdsxk_bzpv
call fcn.10045794
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10038029
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005df32
call fcn.1005c4f8
sub esp, 0x1c
mov byte [ebp - 0x14], dl
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10038189
mov dword [ebp - 0x20], 0x66de
xor esi, esi
cmp dword [ebp - 0x20], 0x68aa
jle 0x1003809d
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x24], esi
mov ecx, esi
mov eax, ebx
sar eax, cl
mov ecx, 0x10078fb8
xor eax, edi
cdq
push edx
push eax
call fcn.10001d2f
inc esi
cmp esi, 0x1015
jl 0x10038062
inc ebx
push 0
pop esi
cmp ebx, 0x7c37
jl 0x1003805f
inc edi
cmp edi, 0x69f
jl 0x1003805d
push esi
push esi
call dword [sym.imp.USER32.dll_CopyRect]
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x100380b2
push esi
push 0x1232
push esi
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
mov dword [ebp - 4], esi
mov dword [ebp - 0x24], 0x1a86
cmp dword [ebp - 0x24], 0xa7e
jge 0x10038155
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x18]
push eax
push str._d__d__d
call fcn.10045c3e
mov eax, dword [ebp - 0x18]
xor ecx, ecx
push 4
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.10040a01
mov ecx, dword [ebp - 0x18]
xor edi, edi
inc edi
add esp, 0x14
mov ebx, eax
mov dword [ebp - 0x24], ebx
cmp ecx, edi
jl 0x10038127
add ebx, 4
push ebx
push 0x10067400
call fcn.10045c3e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x18]
inc edi
add ebx, 4
cmp edi, ecx
jle 0x1003810c
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
mov edi, esi
mov edx, dword [ebp - 0x1c]
test ecx, ecx
jle 0x10038140
cmp eax, edx
je 0x10038148
mov eax, dword [ebx + eax*4]
inc esi
inc edi
cmp edi, ecx
jl 0x10038133
or ecx, 0xffffffff
cmp eax, edx
cmovne esi, ecx
push esi
push 0x10067f98
call fcn.10045794
pop ecx
pop ecx
cmp dword [ebp - 0x20], 0x668a
jge 0x1003816d
mov edx, str.hgjtdia_wjacqtvdl_ifsz_doglllx_iyqjcv_weox_hjufplvnl_umxl_hyal_tjhd_gidll_rgdobkv_hychrytcr_bad
mov ecx, 0x10078fb8
call fcn.10003c4d
jmp 0x100381a6
mov edx, dword [ebp + 8]
mov dword [edx], 0
jmp 0x100381a1
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xc74a
inc dword [edx]
cmp dword [edx], 3
jl 0x10038194
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100381cd
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
mov byte [esp + 8], cl
mov ebx, edx
mov dword [esp + 0xc], 0x4a20
cmp dword [esp + 0xc], 0x4da2
push esi
push edi
jle 0x10038238
xor esi, esi
xor edi, edi
mov eax, esi
lea ecx, [esp + 0x18]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001a85
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10038212
mov eax, dword [eax]
push eax
call fcn.10045794
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.1000224a
inc edi
cmp edi, 0x66e6
jl 0x100381f5
inc esi
cmp esi, 0x2924
jl 0x100381f3
cmp dword [esp + 0x14], 0x4691
jge 0x1003824d
push str.rehlhy_gcx_qyndgqo_wjy_vtjl_kqjgdfsq_sbfjkrlor_zngfflxg_zwxgt_hmttklayp_dmsfeuges_nsryswl_ooobv_zuanfoal
call fcn.10045794
pop ecx
cmp byte [esp + 0x10], 0
je 0x1003825e
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
jmp 0x1003827b
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
jmp 0x10038276
mov ecx, dword [edx]
mov eax, dword [ebx]
mov dword [eax + ecx*4], 0xf47
inc dword [edx]
cmp dword [edx], 3
jl 0x10038269
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10038463
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1005df4e
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x28
cmp byte [ebp + 0x1c], 0
push ebx
push esi
push edi
mov dword [esp + 0x14], edx
mov byte [esp + 0xc], cl
je 0x100384ba
cmp byte [ebp + 0x18], 0
je 0x100384a5
push 0
call dword [sym.imp.KERNEL32.dll_GlobalLock]
jmp 0x1003864b
push 0x1e31
xor edi, edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x1003864b
test cl, cl
je 0x100384fe
mov eax, dword [ebp + 0x14]
mov dword [eax], 0
cmp dword [eax], 0xc
jl 0x1003864b
mov ecx, dword [ebp + 0x20]
mov dword [esp + 0x14], 0xe91c
mov dword [ecx], 0xffffffef
jmp 0x100384ed
mov dword [esp + 0x14], 0xffffffff
inc dword [ecx]
cmp dword [ecx], 0x19
jg 0x100384e3
inc dword [eax]
cmp dword [eax], 0xc
jge 0x100384d3
jmp 0x1003864b
mov ebx, dword [ebp + 0x10]
mov dword [ebx], 0xfffffffe
cmp dword [ebx], 0x10
jg 0x1003864b
mov esi, dword [ebp + 0xc]
xor edi, edi
mov ecx, dword [ebp + 8]
mov dword [esp + 0x10], 0x12d2c87
imul eax, dword [esp + 0x10], 7
mov dword [ecx], eax
cmp dword [ecx], 0xa6c9cd49
mov esi, dword [esi]
sbb eax, eax
inc eax
imul esi, eax
mov eax, dword [edx]
xor edx, edx
mov dword [eax + 8], esi
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [eax]
cmp ecx, eax
mov eax, dword [esp + 0x10]
sete dl
xor ecx, ecx
cmp eax, esi
mov eax, dword [esp + 0x10]
mov esi, dword [ebp + 0xc]
setge cl
add ecx, edx
xor edx, edx
imul ecx, ecx, 0xb1a7
cmp ecx, eax
setle dl
imul edx, dword [esi]
test edx, edx
jne 0x100385ba
cmp dword [esp + 0x10], edi
jne 0x100385ba
mov dword [esp + 0x18], 0x4ddc8777
mov dword [esp + 0x10], edi
cmp dword [esp + 0x10], 3
jge 0x100385a1
mov edx, dword [esp + 0x14]
mov ecx, dword [esp + 0x10]
mov eax, dword [edx]
mov dword [eax + ecx*4], edi
inc dword [esp + 0x10]
cmp dword [esp + 0x10], 3
jl 0x1003858d
push ecx
push ebx
push ecx
push ecx
push 0x3cb3
xor dl, dl
lea ecx, [esp + 0x2c]
call fcn.1003840a
add esp, 0x14
jmp 0x10038638
push 1
lea ecx, [esp + 0x28]
call fcn.10001eb9
push edi
push 0x81b
push 1
push 0x7ad3
push 0x3088
lea eax, [esp + 0x34]
mov dword [esp + 0x50], edi
push eax
push 0x618
lea eax, [esp + 0x40]
mov edx, 0x6548
push eax
push 0x76dd
push edi
mov ecx, 0x3ce
call fcn.1003b2d2
add esp, 0x28
mov dword [esp + 0x10], edi
jmp 0x10038623
lea eax, [esp + 0x24]
mov dword [esp + 0x1c], 0x80090ae7
push eax
lea edx, [esp + 0x20]
call fcn.1003a38a
inc dword [esp + 0x14]
pop ecx
cmp dword [esp + 0x10], 2
jle 0x10038608
or dword [esp + 0x3c], 0xffffffff
lea ecx, [esp + 0x24]
call fcn.10001f3c
mov eax, dword [esp + 0x10]
inc dword [ebx]
cmp dword [ebx], 0x10
mov edx, dword [esp + 0x14]
jle 0x10038515
mov ecx, dword [esp + 0x34]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret