joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10034bf0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
pushal
call 0x10034bff
pop dword [ebp - 0x44]
mov eax, 0x28185588
sub eax, 0x18150989
sub dword [ebp - 0x44], eax
mov dword [ebp - 0x54], 0xd75df2c5
add dword [ebp - 0x54], 0x76f45286
mov dword [ebp - 0x50], 0x937ca6a7
add dword [ebp - 0x50], 0x9eb6a59e
mov dword [ebp - 0x4c], 0x729beefd
add dword [ebp - 0x4c], 0xd9b05531
mov dword [ebp - 0x48], 0x551639a2
add dword [ebp - 0x48], 0xaae9c65e
lea eax, [ebp - 0x54]
push eax
mov eax, 0x661deb60
sub eax, 0x560d5aec
add eax, dword [ebp - 0x44]
call dword [eax]
mov dword [ebp - 0x54], 0x42791de7
sub dword [ebp - 0x54], 0xce06b491
mov dword [ebp - 0x50], 0x32572184
add dword [ebp - 0x50], 0xf153ff1
mov dword [ebp - 0x4c], 0xf47dcb4d
add dword [ebp - 0x4c], 0x6ef1a11f
mov dword [ebp - 0x48], 0xf89fc0c0
sub dword [ebp - 0x48], 0xf89fc0c0
lea ebx, [ebp - 0x54]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x44]
call dword [eax]
push 0x40
push 0x1000
push 0x44e67
push 0
call eax
mov ecx, 0x38d1
mov ebx, eax
mov esi, 0x3be71405
sub esi, 0x2bcff605
add esi, dword [ebp - 0x44]
mov edi, 0xe01d385e
sub edi, 0xd04b8d39
add dword [ebp - 0x38], 0xbc6bab6c
mov edx, dword [esi]
xor dword [ebp - 0xc], ecx
add edx, edi
xor dword [ebp - 0x1c], 0x1222f364
mov dword [ebx], edx
xor dword [ebp - 4], 0x1a18e049
add ebx, 0x6ed16071
sub ebx, 0x6ed1606d
add esi, 0x3471af9a
add esi, 0xcb8e506a
loop 0x10034d16
add eax, 0xfa18e607
sub eax, 0xfa180ff0
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x67e972be
sub ecx, 0x57e972be
add ecx, dword [ebp - 0x44]
call ebx
leave
ret
Function at 0x10001f5c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp byte [ebp + 0x2c], 0
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
mov dword [ebp - 0xc], edi
mov dword [ebp - 8], ebx
je 0x10001fa0
cmp byte [ebp + 0xc], 0
je 0x10001f8a
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x28]
mov dword [eax], ecx
jmp 0x10002078
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x20]
mov eax, dword [eax]
mov dword [eax + ecx*4], 1
jmp 0x10002078
cmp byte [ebp + 0x30], 0
je 0x10001fb3
mov ecx, dword [ebp + 0x24]
mov eax, dword [ebp + 0x18]
mov dword [ecx], eax
jmp 0x10002078
mov dword [ebp - 4], 0xf73
cmp dword [ebp - 4], 0x1176
jle 0x10002013
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp + 0x2c], ecx
mov eax, ebx
sar eax, cl
mov ecx, 0x1007bbb8
xor eax, edi
xor eax, esi
cdq
push edx
push eax
call fcn.1000cbc0
mov ecx, dword [ebp + 0x2c]
inc ecx
mov dword [ebp + 0x2c], ecx
cmp ecx, 0x44aa
jl 0x10001fce
inc ebx
cmp ebx, 0x6310
jl 0x10001fc9
inc edi
cmp edi, 0x19d2
jl 0x10001fc7
inc esi
cmp esi, 0x6ae3
jl 0x10001fc5
mov ebx, dword [ebp - 8]
mov edi, dword [ebp - 0xc]
cmp dword [ebp - 4], 0xdbd
jge 0x1000202b
mov edx, str.bunneqyqd_fctikws_eoqwdpi_linaqegwp_fxelpbcha_drqe_xphlnv_ffno_obrb_wocymwsr_ofab_dnogrpww
mov ecx, 0x1007bbb8
call fcn.1000ee07
mov eax, dword [ebx]
xor ecx, ecx
mov esi, dword [ebp + 0x1c]
cmp eax, 1
setne cl
cmp ecx, 0xfff8
sbb eax, eax
inc eax
cmp eax, 0xf7e813a3
mov eax, dword [esi]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
mov eax, dword [ebx]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esi]
setle cl
xor edx, edx
sub ecx, eax
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
cmp dword [eax + 0xc], ecx
mov eax, dword [esi]
setge dl
xor ecx, ecx
cmp edx, eax
setg cl
mov dword [edi], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002125
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp byte [ebp + 8], 0
push ebx
push esi
mov ebx, ecx
push edi
mov dword [ebp - 0x14], ebx
je 0x100021df
mov dword [ebp - 0xc], 0x5890
cmp dword [ebp - 0xc], 0x58ea
jle 0x100021a9
xor esi, esi
mov dword [ebp - 8], esi
xor edi, edi
mov dword [ebp - 4], edi
mov eax, edi
xor ebx, ebx
and eax, esi
mov dword [ebp - 0x10], eax
mov esi, eax
xor edi, edi
lea eax, [edi + ebx]
mov ecx, 0x1007bbb8
xor eax, esi
cdq
push edx
push eax
call fcn.1000cbc0
inc edi
cmp edi, 0x4a5a
jl 0x10002164
inc ebx
cmp ebx, 0x761e
jl 0x10002162
mov edi, dword [ebp - 4]
mov esi, dword [ebp - 8]
inc edi
mov dword [ebp - 4], edi
cmp edi, 0x245a
jl 0x10002157
inc esi
mov dword [ebp - 8], esi
cmp esi, 0x65a5
jl 0x10002152
mov ebx, dword [ebp - 0x14]
cmp dword [ebp - 0xc], 0x570e
jge 0x100021c1
mov edx, str.wjdsp_vjihk_nfecuu
mov ecx, 0x1007bbb8
call fcn.1000ee07
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
jmp 0x100021d8
mov ecx, dword [edx]
mov eax, dword [ebx]
cmp dword [eax + ecx*4], 0
jne 0x100021ed
inc dword [edx]
cmp dword [edx], 0
jle 0x100021cc
jmp 0x100021ed
mov eax, dword [ebp + 0x10]
mov ecx, 0xf43b
mov eax, dword [eax]
sub ecx, eax
mov dword [edx], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002d7c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
je 0x10002e44
mov dword [ebp - 8], 0x72ea
cmp dword [ebp - 8], 0x741d
push 0
pop ebx
jle 0x10002e0f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryA]
mov esi, ebx
mov edi, ebx
mov ecx, ebx
mov dword [ebp + 0xc], ebx
lea eax, [edi + esi]
xor eax, ecx
lea ecx, [ebp - 0x20]
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10002dcd
mov eax, dword [eax]
push eax
call fcn.1004d87c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x20]
call fcn.1000d197
mov ecx, dword [ebp + 0xc]
inc ecx
mov dword [ebp + 0xc], ecx
cmp ecx, 0x6b9b
jl 0x10002db3
inc edi
cmp edi, 0x6fd6
jl 0x10002dae
inc esi
cmp esi, 0x1bac
jl 0x10002dac
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_Arc]
cmp dword [ebp - 8], 0x70fd
jge 0x10002e23
push str.cspemrxg_byrukt_rvwhqsldr_ikdpnpf_hblkce_mtapbh_wfdmhc_mdywis_opycjk_mcixqther
call fcn.1004d87c
pop ecx
cmp byte [ebp + 8], 0
push ebx
push ebx
je 0x10002e36
call dword [sym.imp.GDI32.dll_GetDeviceCaps]
jmp 0x10002edf
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SendDlgItemMessageA]
jmp 0x10002edf
cmp byte [ebp + 0x10], 0
je 0x10002ed4
xor ebx, ebx
mov byte [ebp + 0xf], bl
cmp byte [ebp + 0xf], bl
je 0x10002edf
mov dword [ebp + 0xc], 0x57b7
cmp dword [ebp + 0xc], 0x5856
jle 0x10002eb7
mov esi, ebx
mov edi, ebx
mov eax, edi
lea ecx, [ebp - 0x38]
or eax, esi
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10002e89
mov eax, dword [eax]
push eax
call fcn.1004d87c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x38]
call fcn.1000d197
inc edi
cmp edi, 0x62aa
jl 0x10002e70
inc esi
cmp esi, 0x3bc3
jl 0x10002e6e
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_SetScrollPos]
push ebx
call dword [sym.imp.KERNEL32.dll_QueryPerformanceCounter]
cmp dword [ebp + 0xc], 0x56f4
jge 0x10002edf
push str.eybs_fdb_iqvt_qyyng_pfk_obufwaxl_aaa_qnens_atfixdgu_hqv_qqghip
call fcn.1004d87c
pop ecx
jmp 0x10002edf
mov eax, dword [ecx]
mov ecx, 0xf43b
sub ecx, eax
mov dword [edx], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004574
Capabilities:
Get memory capacity

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov byte [ebp - 8], cl
je 0x100045a6
test cl, cl
je 0x10004597
push 0
call dword [sym.imp.GDI32.dll_DeleteDC]
jmp 0x10004636
xor esi, esi
push esi
push esi
call dword [sym.imp.GDI32.dll_GetCurrentPositionEx]
jmp 0x10004636
cmp byte [ebp + 0xc], 0
je 0x10004625
mov dword [ebp + 8], 0x16a0
cmp dword [ebp + 8], 0x17df
push 0
pop esi
jle 0x10004600
mov edi, esi
mov ebx, esi
mov eax, ebx
lea ecx, [ebp - 0x20]
or eax, edi
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100045dc
mov eax, dword [eax]
push eax
call fcn.1004d87c
pop ecx
push esi
push 1
lea ecx, [ebp - 0x20]
call fcn.1000d197
inc ebx
cmp ebx, 0x13f9
jl 0x100045c3
inc edi
cmp edi, 0x5d28
jl 0x100045c1
cmp dword [ebp + 8], 0x12f7
jge 0x10004614
push str.jxt_mrav_wuepa_ekgiyvj_kbrgstgn_jdxaa_ejlxnevqi_tqgiy_bqquq_ctpw_mwuigtkkw_kfyjij
call fcn.1004d87c
pop ecx
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x10004636
push esi
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
jmp 0x10004636
cmp byte [edx], 0
je 0x10004636
xor esi, esi
push esi
push esi
push esi
push esi
call dword [sym.imp.USER32.dll_InsertMenuItemW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000535c
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10062ea8
call fcn.100628e0
sub esp, 0x20
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
je 0x1000539e
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10005501
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x16df251d
inc dword [edx]
cmp dword [edx], 2
jl 0x10005387
jmp 0x10005501
mov dword [ebp - 0x1c], 0x3ea6
cmp dword [ebp - 0x1c], 0x3fe0
jle 0x100053f1
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
xor esi, esi
xor edi, edi
mov dword [ebp - 0x10], 0x36b2
xor ebx, ebx
mov eax, edi
mov ecx, 0x1007bbb8
xor eax, ebx
cdq
push edx
push eax
call fcn.1000cbc0
inc ebx
cmp ebx, 0x7a7c
jl 0x100053c7
add edi, esi
dec dword [ebp - 0x10]
jne 0x100053c5
inc esi
cmp esi, 0x4129
jl 0x100053bc
mov esi, dword [ebp + 0xc]
mov dword [esi], 0
jmp 0x100054e0
push 3
lea ecx, [ebp - 0x28]
call fcn.1000cdd8
and dword [ebp - 4], 0
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x14], 7
mov dword [ebp - 0x18], 0
mov dword [ebp - 0x10], 0
jmp 0x1000543b
mov ecx, dword [ebp - 0x10]
mov eax, dword [ebp - 0x28]
mov dword [eax + ecx*4], 0x2d149feb
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 3
jl 0x1000542b
mov dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 2
jg 0x100054d2
mov dword [ebp - 0x18], 0x73468807
mov dword [ebp - 0x18], 1
mov dword [ebp - 0x18], 0x6e78
cmp dword [ebp - 0x18], 0x70f3
jle 0x100054a7
xor ebx, ebx
xor edi, edi
xor esi, esi
mov dword [ebp - 0x14], 0x2502
mov eax, esi
mov ecx, 0x1007bbb8
and eax, ebx
cdq
push edx
push eax
call fcn.1000cbc0
add esi, edi
dec dword [ebp - 0x14]
jne 0x1000547d
inc edi
cmp edi, 0x7f0b
jl 0x10005474
inc ebx
cmp ebx, 0x6fe5
jl 0x10005472
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x18], 0x6d0b
jge 0x100054c6
mov edx, str.wun_bydbg_aalnptkih_nlscwvkq_emq_kjhxmcwhs_ujbsvkb_muocubgj_efxypikp_tmdisygs_eng
mov ecx, 0x1007bbb8
call fcn.1000ee07
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jle 0x10005452
mov esi, dword [ebp + 0xc]
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.1000ce5b
dec dword [esi]
cmp dword [esi], 0xffffffe8
jne 0x100053ff
cmp dword [ebp - 0x1c], 0x3e8c
jge 0x10005501
mov edx, str.jqxhhe_jtvucu_xcsapr_kwrrimkvd_fdb_cuhqvii_ibhktj_radl
mov ecx, 0x1007bbb8
call fcn.1000ee07
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005512
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
je 0x1000554c
cmp byte [edx], 0
je 0x100055c3
push 1
push 0x1c7f
push 1
push 0x49a4
mov edx, 0x1e5e
mov ecx, 0x27d6
call fcn.10002202
add esp, 0x10
jmp 0x100055c3
cmp byte [ecx], 0
je 0x100055c3
mov dword [ebp - 0xc], 0x369e
cmp dword [ebp - 0xc], 0x3940
jle 0x100055a1
xor esi, esi
mov dword [ebp - 8], esi
mov ebx, 0x162c
xor edi, edi
mov dword [ebp - 4], ebx
xor esi, esi
mov ebx, 0x64c1
mov eax, esi
mov ecx, 0x1007bbb8
cdq
push edx
push eax
call fcn.1000cbc0
add esi, edi
dec ebx
jne 0x10005577
mov esi, dword [ebp - 8]
add edi, esi
dec dword [ebp - 4]
jne 0x10005570
inc esi
mov dword [ebp - 8], esi
cmp esi, 0x7bf0
jl 0x10005566
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
cmp dword [ebp - 0xc], 0x3323
jge 0x100055c3
mov edx, str.tjnse_oqfbxyaxa_yryiplddo_gxgh_ijsmau
mov ecx, 0x1007bbb8
call fcn.1000ee07
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005cb7
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov dword [ebp - 8], 0x2dad
mov esi, edx
cmp dword [ebp - 8], 0x2f9e
push edi
jle 0x10005cf9
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x1007bbb8
xor eax, edi
cdq
push edx
push eax
call fcn.1000cbc0
inc ebx
cmp ebx, 0x3453
jl 0x10005cd6
inc edi
cmp edi, 0x5173
jl 0x10005cd4
cmp byte [ebp + 8], 0
je 0x10005d10
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x10005d2d
xor cl, cl
call fcn.10002d62
jmp 0x10005d2d
mov dword [esi], 0
jmp 0x10005d28
push ecx
mov byte [ebp - 1], 0
lea ecx, [ebp - 1]
call fcn.10001b03
inc dword [esi]
pop ecx
cmp dword [esi], 1
jle 0x10005d18
cmp dword [ebp - 8], 0x2cc5
jge 0x10005d45
mov edx, str.rnixnl_wftqamsdm_qokt_qufh_uglldi_bro_ygmdxkmix_vwvnde_toidvaxet_ddvvq_okyrrog_rboabfqda_gagsmxfg_gttjtmd
mov ecx, 0x1007bbb8
call fcn.1000ee07
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10005f06
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10062ea8
call fcn.100628e0
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x18], 0xba7
cmp dword [ebp - 0x18], 0xe17
push 0
pop ebx
jle 0x10005f6d
mov esi, ebx
mov dword [ebp - 0x14], ebx
mov edi, esi
mov ebx, 0x1a8f
xor esi, esi
mov eax, edi
mov ecx, 0x1007bbb8
xor eax, esi
cdq
push edx
push eax
call fcn.1000cbc0
inc esi
cmp esi, 0x464
jl 0x10005f37
dec edi
dec ebx
jne 0x10005f35
mov esi, dword [ebp - 0x14]
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x3ec
jl 0x10005f2e
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_CheckDlgButton]
cmp byte [ebp + 0x24], 0
je 0x10005fec
xor esi, esi
mov dword [ebp - 0x1c], 0x24a8c6a5
inc esi
lea ecx, [ebp - 0x28]
push esi
call fcn.1000cdd8
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
jmp 0x10005f9e
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x28]
mov dword [eax + ecx*4], 8
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x10005f8e
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10005fd1
push 0x79d5
push 0x42ef
push ebx
push 0x40c7
push 0x72c2
push esi
mov edx, 0x1b98
xor cl, cl
call fcn.10006715
add esp, 0x18
lea eax, [ebp - 0x28]
push eax
lea ecx, [ebp - 0x1c]
call fcn.1000818e
or dword [ebp - 4], 0xffffffff
pop ecx
lea ecx, [ebp - 0x28]
call fcn.1000ce5b
jmp 0x10005ff1
mov eax, dword [ebp + 0x20]
inc dword [eax]
cmp dword [ebp - 0x18], 0xa8f
jge 0x10006009
mov edx, str.bhbpuchax_qicyve_iekytq_mwhqea_luegy_eosovvxsl_imheeq_ftpv_oegq
mov ecx, 0x1007bbb8
call fcn.1000ee07
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000ffd4
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov esi, 0x1007bbb8
je 0x10010046
mov dword [ebp - 8], 0x57f7
cmp dword [ebp - 8], 0x583a
jle 0x1001002e
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 4], eax
and eax, ebx
mov ecx, esi
xor eax, edi
cdq
push edx
push eax
call fcn.1000cbc0
mov eax, dword [ebp - 4]
inc eax
mov dword [ebp - 4], eax
cmp eax, 0x21ce
jl 0x10010000
inc ebx
cmp ebx, 0x7121
jl 0x1000fffb
inc edi
cmp edi, 0x219
jl 0x1000fff9
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
cmp dword [ebp - 8], 0x545b
jge 0x100100aa
mov edx, str.ablocb_lsjcqpxb_lcdo_qvendq_nfpwx_buaboq_gyii_jupehn_bgvs_doe_mbv_mug
jmp 0x100100a3
mov dword [ebp - 8], 0x19df
cmp dword [ebp - 8], 0x1b2b
jle 0x10010085
push 0
push 0
push 0
call dword [sym.imp.GDI32.dll_PlayEnhMetaFile]
xor edi, edi
xor ebx, ebx
lea eax, [ebx + edi]
mov ecx, esi
cdq
push edx
push eax
call fcn.1000cbc0
inc ebx
cmp ebx, 0x3e91
jl 0x10010066
inc edi
cmp edi, 0x6d8c
jl 0x10010064
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp + 0x10]
push eax
call fcn.10013e6b
cmp dword [ebp - 8], 0x16ec
jge 0x100100aa
mov edx, str.vhhqu_yyaa_epgghy_lbcqdjuiy_hpaxyqtp_irfaueg_netrbf_lpxjhifed_ydfxvv_xclnl_mxpaso_ftydnp
mov ecx, esi
call fcn.1000ee07
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100107dd
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
mov byte [ebp - 4], cl
mov dword [ebp - 0x10], 0x2792
cmp dword [ebp - 0x10], 0x2afa
push esi
push edi
jle 0x1001083a
xor esi, esi
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0xc], 0x4206
mov eax, ebx
mov ecx, 0x1007bbb8
and eax, esi
cdq
push edx
push eax
call fcn.1000cbc0
add ebx, edi
dec dword [ebp - 0xc]
jne 0x10010806
inc edi
cmp edi, 0x7f31
jl 0x100107fd
inc esi
cmp esi, 0x4bdc
jl 0x100107fb
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
cmp byte [ebp - 4], 0
je 0x1001085a
mov byte [ebp - 5], 0
cmp byte [ebp - 5], 0
je 0x10010878
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_InsertMenuItemW]
jmp 0x10010878
lea eax, [ebp - 6]
mov byte [ebp - 6], 0
push eax
push 0x2aa
push ecx
push ecx
xor dl, dl
mov ecx, 0x7085
call fcn.1000fe3a
add esp, 0x10
cmp dword [ebp - 0x10], 0x2635
jge 0x10010890
mov edx, str.xencg_nifv_aekk_vgj_fjgyk_jokkot_rgbd_ycgq_vrxbv_uascakwv_nlqrsstpg
mov ecx, 0x1007bbb8
call fcn.1000ee07
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001280f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
push edi
mov byte [esp + 0x10], dl
mov ebx, ecx
mov dword [esp + 0x20], 0x7c34
cmp dword [esp + 0x20], 0x7eff
push 0
mov dword [esp + 0x28], ebx
pop esi
jle 0x100128a9
mov edi, esi
mov dword [esp + 0x1c], esi
mov ebx, esi
mov dword [esp + 0x18], esi
mov eax, edi
mov dword [esp + 0x14], esi
cdq
idiv ebx
mov ebx, edx
mov edi, esi
mov esi, dword [esp + 0x14]
mov eax, ebx
mov ecx, 0x1007bbb8
xor eax, edi
xor eax, esi
cdq
push edx
push eax
call fcn.1000cbc0
inc edi
cmp edi, 0x24b5
jl 0x10012857
inc esi
push 0
mov dword [esp + 0x18], esi
cmp esi, 0x3128
pop esi
jl 0x10012851
mov ebx, dword [esp + 0x18]
mov edi, dword [esp + 0x1c]
inc ebx
mov dword [esp + 0x18], ebx
cmp ebx, 0x410d
jl 0x10012846
inc edi
mov dword [esp + 0x1c], edi
cmp edi, 0x2870
jl 0x10012840
mov ebx, dword [esp + 0x24]
cmp dword [esp + 0x20], 0x7af3
jge 0x100128c2
mov edx, str.gygt_vrghgf_kwffihm_qph_jeynu_pkekvmff_upqhwkhxf
mov ecx, 0x1007bbb8
call fcn.1000ee07
cmp byte [esp + 0x10], 0
je 0x100128ed
mov edi, dword [ebp + 8]
cmp dword [edi], esi
jbe 0x10012914
push ecx
push dword [ebp + 0x30]
mov cl, 1
push 0x251f
push dword [ebp + 0x14]
call fcn.1001241a
add esp, 0x10
inc esi
cmp esi, dword [edi]
jb 0x100128d0
jmp 0x10012914
mov eax, dword [ebp + 0xc]
push 0x1a
pop ecx
cmp dword [eax], ecx
jge 0x100128fe
movzx edx, word [ebx]
add edx, dword [eax]
jmp 0x1001290b
mov eax, dword [eax]
cdq
idiv ecx
mov eax, dword [ebp + 0x28]
movzx eax, word [eax]
add edx, eax
mov ecx, dword [ebp + 0x20]
push edx
call fcn.1000cd5d
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10013e6b
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x10013e82
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x10013ea4
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x10081014
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x100813a0
jl 0x10013eb2
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x10081644
jl 0x10013ef2
mov ecx, dword [0x10082390]
xor ecx, dword [0x10081014]
and ecx, edi
xor ecx, dword [0x10082390]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x10081010], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10081644]
mov dword [0x100819d0], eax
pop esi
ret
Function at 0x100439ac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
push esi
mov dword [esp + 0x14], 0x1c9e
mov esi, edx
cmp dword [esp + 0x14], 0x200b
mov ebx, ecx
push edi
mov dword [esp + 0x20], esi
mov dword [esp + 0x24], ebx
jle 0x10043a41
xor edi, edi
mov dword [esp + 0x14], edi
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x10], eax
lea ecx, [ebx + edi]
xor esi, esi
mov dword [esp + 0x1c], ecx
mov ecx, eax
mov edi, dword [esp + 0x1c]
sar edi, cl
mov eax, edi
mov ecx, 0x1007bbb8
xor eax, esi
cdq
push edx
push eax
call fcn.1000cbc0
inc esi
cmp esi, 0x6332
jl 0x100439f5
mov eax, dword [esp + 0x10]
mov edi, dword [esp + 0x14]
inc eax
mov dword [esp + 0x10], eax
cmp eax, 0x3134
jl 0x100439e4
inc ebx
cmp ebx, 0x525
jl 0x100439de
inc edi
mov dword [esp + 0x14], edi
cmp edi, 0x4f0d
jl 0x100439dc
mov esi, dword [esp + 0x20]
mov ebx, dword [esp + 0x24]
cmp byte [ebp + 0xc], 0
je 0x10043a66
mov dword [esi], 0
cmp dword [esi], 2
jge 0x10043ab6
mov edx, dword [ebp + 8]
mov ecx, dword [esi]
mov eax, dword [edx]
or dword [eax + ecx*4], 0xffffffff
inc dword [esi]
cmp dword [esi], 2
jl 0x10043a55
jmp 0x10043ab6
mov eax, dword [ebx]
xor ecx, ecx
mov esi, dword [ebp + 0x1c]
cmp eax, 1
setne cl
cmp ecx, 0xfff8
sbb eax, eax
inc eax
cmp eax, 0xf7e813a3
mov eax, dword [esi]
sbb ecx, ecx
xor edx, edx
neg ecx
cmp eax, ecx
mov eax, dword [ebx]
setl dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [esi]
setle bl
xor ecx, ecx
sub ebx, eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp dword [eax + 0xc], ebx
mov eax, dword [esi]
setge cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp + 0x18]
setg dl
mov dword [eax], edx
cmp dword [esp + 0x18], 0x1a96
jge 0x10043acf
mov edx, str.impb_kfkxq_htne_opldaed_kfxnla_bledqnxd_avsvsa_jlsoivmk_wgls_ilrtjepdn_nvgio_quce
mov ecx, 0x1007bbb8
call fcn.1000ee07
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100451cf
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
mov dword [esp + 8], 0x625a
mov eax, ecx
cmp dword [esp + 8], 0x6630
mov ebx, edx
push esi
push edi
mov dword [esp + 0x14], eax
jle 0x10045220
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x1007bbb8
xor eax, esi
cdq
push edx
push eax
call fcn.1000cbc0
inc edi
cmp edi, 0x5bbf
jl 0x100451f9
inc esi
cmp esi, 0x38e9
jl 0x100451f7
mov eax, dword [esp + 0x14]
push ecx
push ecx
push dword [ebp + 0xc]
mov ecx, ebx
push eax
push dword [ebp + 0x10]
push dword [ebp + 8]
call fcn.10045256
add esp, 0x18
cmp dword [esp + 0x10], 0x613c
jge 0x1004524f
mov edx, str.btlnhyhbs_qwc_jhkrkdma_gvkh_rxka_mppeaf_domkxfo_ligfopf_msmvkyqls_ihxenuvs_hjlkrtcf_dvymv
mov ecx, 0x1007bbb8
call fcn.1000ee07
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1004a17b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov byte [ebp - 8], dl
push ebx
push esi
push edi
test dl, dl
je 0x1004a1ad
push 0x2338
push 1
push 0x7f52
mov dl, 1
mov byte [ebp - 1], 0
lea ecx, [ebp - 1]
call fcn.10049ecd
add esp, 0xc
jmp 0x1004a23a
mov dword [ebp - 0x14], 0x3d54
cmp dword [ebp - 0x14], 0x3d9a
push 0
pop ebx
jle 0x1004a216
push ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_CheckDlgButton]
mov edi, ebx
mov esi, ebx
mov dword [ebp - 0x10], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0xc], 0x4442
mov eax, esi
mov ecx, 0x1007bbb8
xor eax, edi
cdq
push edx
push eax
call fcn.1000cbc0
add esi, ebx
dec dword [ebp - 0xc]
jne 0x1004a1da
mov esi, dword [ebp - 0x10]
dec ebx
cmp ebx, 0xffff9c81
jg 0x1004a1d0
inc esi
mov dword [ebp - 0x10], esi
push 0
pop ebx
cmp esi, 0x1bfa
jl 0x1004a1d0
inc edi
cmp edi, 0x7215
jl 0x1004a1cb
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.GDI32.dll_GetCharacterPlacementW]
cmp dword [ebp - 0x14], 0x3a09
jge 0x1004a23a
mov edx, str.vfjpctje_lcgnfhqde_mffrgflh_kvtxyyn_xpp
mov ecx, 0x1007bbb8
call fcn.1000ee07
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret