joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10035434
Capabilities:
Encode data using xor
Set thread local storage value

Disassembly:
mov eax, 0x100647e2
call fcn.100630d8
sub esp, 0x30
cmp byte [ebp + 8], 0
mov eax, ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, edx
mov dword [ebp - 0x18], eax
je 0x100354f0
mov dword [ebp - 0x1c], 0x26f1
cmp dword [ebp - 0x1c], 0x2a45
jle 0x100354b0
xor edi, edi
xor ebx, ebx
mov eax, edi
lea ecx, [ebp - 0x38]
cdq
idiv ebx
mov eax, edx
cdq
push edx
push eax
call fcn.10001ab5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10035488
mov eax, dword [eax]
push eax
call fcn.1004c653
pop ecx
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.100050bb
inc ebx
cmp ebx, 0x63ec
jl 0x1003546c
inc edi
cmp edi, 0x816
jl 0x1003546a
mov eax, dword [ebp - 0x18]
push 2
mov dword [esi], 0
pop edx
jmp 0x100354c7
mov ecx, dword [esi]
mov eax, dword [eax]
mov dword [eax + ecx*4], edx
inc dword [esi]
mov eax, dword [ebp - 0x18]
cmp dword [esi], edx
jl 0x100354bb
cmp dword [ebp - 0x1c], 0x2386
jge 0x100354df
push str.lmrabi_zulh_dqwemoxsf
call fcn.1004c653
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x20], 0x7ed1
cmp dword [ebp - 0x20], 0x824d
jle 0x1003554b
xor edi, edi
xor esi, esi
mov dword [ebp - 0x18], esi
mov ebx, esi
mov dword [ebp - 0x1c], 0xae7
xor esi, esi
lea eax, [ebx + esi]
mov ecx, 0x10081078
xor eax, edi
cdq
push edx
push eax
call fcn.10004aca
inc esi
cmp esi, 0x1f78
jl 0x10035512
dec ebx
dec dword [ebp - 0x1c]
jne 0x10035510
mov esi, dword [ebp - 0x18]
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x6b24
jl 0x10035507
inc edi
cmp edi, 0x7f71
jl 0x10035502
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x7be6
jge 0x100354df
mov edx, str.uowewvgt_soxixgdf_dit_qaurqwvob_gkxfyuimc_hsi_gav_rlatbirk_gwhwrrg_fgns_tfmgojx_rijyo_aajw_qmfdyzw
mov ecx, 0x10081078
call fcn.10006f4f
jmp 0x100354df

Function at 0x10035efd
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
push esi
mov esi, ecx
je 0x10035f40
cmp byte [ebp + 0xc], 0
je 0x10035f24
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push 1
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
jmp 0x10035f72
mov dword [esi], 0
jmp 0x10035f39
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0xcd95da22
inc dword [esi]
cmp dword [esi], 3
jl 0x10035f2c
jmp 0x10035f72
cmp byte [ebp + 0x10], 0
je 0x10035f51
mov eax, dword [ebp + 0x18]
mov dword [eax], 0xee76373a
jmp 0x10035f72
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x10035f72
push 0x1928
push 0x1109
xor eax, eax
push eax
push 0x1bfc
push eax
call dword [sym.imp.USER32.dll_GetMenuStringW]
pop esi
pop ebp
ret
Function at 0x1003662b
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10064818
call fcn.100630d8
push ecx
push ecx
cmp byte [ebp + 0x1c], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x10036683
cmp byte [ebp + 0x18], 0
je 0x1003666c
xor esi, esi
mov dword [edx], esi
cmp dword [edx], 4
jge 0x1003674b
mov edi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [edi]
mov dword [eax + ecx*4], esi
inc dword [edx]
cmp dword [edx], 4
jl 0x10036659
jmp 0x1003674b
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
sub eax, dword [ecx]
mov ecx, dword [ebp + 0x14]
sar eax, 1
push eax
call fcn.10004c79
jmp 0x1003674b
cmp byte [ebp + 0xc], 0
je 0x10036734
mov dword [ebp + 0x1c], 0x4c91
xor esi, esi
cmp dword [ebp + 0x1c], 0x4dce
jle 0x100366f3
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x14], esi
mov eax, esi
mov ecx, 0x10081078
and eax, ebx
xor eax, edi
cdq
push edx
push eax
call fcn.10004aca
inc esi
cmp esi, 0x51bc
jl 0x100366b1
inc ebx
push 0
pop esi
cmp ebx, 0x1671
jl 0x100366ae
inc edi
cmp edi, 0x736f
jl 0x100366ac
push esi
push 0x144e
push 0x927
call dword [sym.imp.USER32.dll_SetDlgItemTextA]
mov eax, dword [ebp + 8]
mov dl, byte [eax]
mov eax, dword [ebp + 0x20]
mov dword [ebp - 4], esi
cmp dword [ebp + 0x1c], 0x4a48
mov byte [eax], dl
jge 0x10036718
mov edx, str.gcyx_cfqiu_atgjp_upkvqz_pjdgkgrc_qndky_nhmm
mov ecx, 0x10081078
call fcn.10006f4f
jmp 0x1003674b
push 0x1d81
push 0x1964
push 0
push 0xdc2
call dword [sym.imp.USER32.dll_CreateCaret]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10036bef
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, edx
push edi
test cl, cl
je 0x10036c46
cmp byte [ebp + 0x20], 0
je 0x10036c27
mov esi, dword [ebp + 8]
xor edx, edx
mov dword [esi], 2
cmp dword [esi], edx
jl 0x10036c83
mov edi, dword [ebp + 0x18]
mov ebx, dword [ebp + 0x10]
mov ecx, dword [edi]
mov eax, dword [ebx]
cmp dword [eax + ecx*4], edx
jne 0x10036c83
dec dword [esi]
cmp dword [esi], edx
jge 0x10036c16
jmp 0x10036c83
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
jmp 0x10036c3f
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [edx]
cmp dword [edx], 1
jl 0x10036c32
jmp 0x10036c83
cmp byte [ebp + 0x14], 0
je 0x10036c71
mov edx, dword [ebp + 0x28]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x10036c83
mov esi, dword [ebp + 0x1c]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 1
inc dword [edx]
cmp dword [edx], 3
jl 0x10036c5d
jmp 0x10036c83
mov eax, dword [ebp + 0x24]
cmp byte [eax], 0
je 0x10036c83
xor edx, edx
push edx
push edx
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x10036cac
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10064836
call fcn.100630d8
sub esp, 0x4c
push ebx
push esi
mov byte [ebp - 0x14], cl
xor ebx, ebx
mov dword [ebp - 0x1c], 0x18e3
cmp dword [ebp - 0x1c], 0x1bac
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edx
jle 0x10036cfe
mov esi, ebx
mov edi, ebx
mov eax, edi
mov ecx, 0x10081078
xor eax, esi
cdq
push edx
push eax
call fcn.10004aca
inc edi
cmp edi, 0x37e8
jl 0x10036cdb
inc esi
cmp esi, 0x5d94
jl 0x10036cd9
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1c], 0x162c
jge 0x10036d19
mov edx, str.onblmgzcp_wxnesmvq_qdxrbngv_ssqoooa_ntzrg_izbsmbo_nkgfc_wmi_oxoept_iand_tkhhctzuw_zaksidjkn
mov ecx, 0x10081078
call fcn.10006f4f
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x14], 0
je 0x10036dd6
mov byte [ebp - 0x15], bl
mov dword [ebp - 0x1c], 0xe94
cmp dword [ebp - 0x1c], 0x1247
jle 0x10036d7b
mov esi, ebx
mov edi, ebx
mov eax, edi
lea ecx, [ebp - 0x3c]
xor eax, esi
cdq
push edx
push eax
call fcn.10001ab5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10036d57
mov eax, dword [eax]
push eax
call fcn.1004c653
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.100050bb
inc edi
cmp edi, 0x4fea
jl 0x10036d3e
inc esi
cmp esi, 0x56cd
jl 0x10036d3c
cmp byte [ebp - 0x15], 0
je 0x10036d94
push 0x2197
push 0x71f
push ebx
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
cmp dword [ebp - 0x1c], 0xe7a
jge 0x10036ead
push str.penlazpo_lvlujux_mclvqgw_vafd
call fcn.1004c653
pop ecx
jmp 0x10036ead
mov dword [ebp - 0x20], 0x47a4
cmp dword [ebp - 0x20], 0x4969
jle 0x10036e41
mov esi, ebx
mov edi, ebx
mov eax, ebx
mov dword [ebp - 0x1c], ebx
xor eax, edi
lea ecx, [ebp - 0x54]
or eax, esi
cdq
push edx
push eax
call fcn.10001ab5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10036e08
mov eax, dword [eax]
push eax
call fcn.1004c653
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x54]
call fcn.100050bb
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x787b
jl 0x10036def
inc edi
cmp edi, 0x5c93
jl 0x10036dea
inc esi
cmp esi, 0x6fc
jl 0x10036de8
push ebx
call dword [sym.imp.KERNEL32.dll_UnmapViewOfFile]
cmp dword [ebp - 0x20], 0x4616
jge 0x10036e55
push str.vbx_zyshlzx_jijjl
call fcn.1004c653
pop ecx
mov esi, dword [ebp + 0x14]
xor edx, edx
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [ebp + 8]
mov dword [eax], ebx
mov ecx, dword [eax]
mov eax, dword [esi]
cmp eax, ecx
mov eax, dword [ebp + 0x1c]
setg dl
xor ecx, ecx
cmp edx, 0x707
mov eax, dword [eax]
setne cl
xor edx, edx
mov dword [eax + 4], ecx
mov ecx, dword [esi]
mov eax, dword [esi]
cmp ecx, eax
mov eax, dword [esi]
setge dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x24]
setl cl
xor edx, edx
mov dword [eax], ecx
mov ecx, dword [esi]
mov eax, dword [eax]
cmp eax, ecx
mov eax, dword [ebp + 0x18]
sete dl
mov eax, dword [eax]
mov dword [eax + 4], edx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10038166
Capabilities:
Delete file

Disassembly:
mov eax, 0x10064895
call fcn.100630d8
sub esp, 0xc
push ebx
push esi
mov byte [ebp - 0x14], dl
mov ebx, ecx
mov dword [ebp - 0x18], 0x17b2
cmp dword [ebp - 0x18], 0x181f
push edi
mov dword [ebp - 0x10], esp
jle 0x100381b5
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x10081078
and eax, esi
cdq
push edx
push eax
call fcn.10004aca
inc edi
cmp edi, 0x3fd9
jl 0x10038192
inc esi
cmp esi, 0x293b
jl 0x10038190
cmp byte [ebp + 0x14], 0
je 0x100381d0
cmp byte [ebp + 0xc], 0
je 0x100381c8
mov eax, dword [ebp + 0x18]
dec dword [eax]
jmp 0x100381e7
mov eax, dword [ebp + 8]
mov byte [eax], 1
jmp 0x100381e7
cmp byte [ebp - 0x14], 0
je 0x100381df
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebx]
add dword [eax], ecx
jmp 0x100381e7
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x1797
jge 0x10038203
mov edx, str.txknio_udiyct_sfbhu_qwqtolq_dvofchg_ndzps_ghcxbx_htucr_zfermwvi
mov ecx, 0x10081078
call fcn.10006f4f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10038866
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
cmp byte [ebp + 0x18], 0
push ebx
push esi
mov ebx, edx
mov edx, ecx
push edi
je 0x10038923
mov dword [esp + 0x14], 0x53de
cmp dword [esp + 0x14], 0x57b7
push 0
pop esi
jle 0x100388fc
xor edi, edi
mov ebx, esi
inc edi
mov eax, esi
mov dword [esp + 0xc], esi
mov ecx, esi
mov dword [esp + 0x10], esi
add eax, ecx
lea ecx, [esp + 0x18]
add eax, ebx
cdq
push edx
push eax
call fcn.10001ab5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100388c0
mov eax, dword [eax]
push eax
call fcn.1004c653
pop ecx
push esi
push edi
lea ecx, [esp + 0x20]
call fcn.100050bb
mov ecx, dword [esp + 0x10]
mov eax, dword [esp + 0xc]
inc ecx
mov dword [esp + 0x10], ecx
cmp ecx, 0x5e9e
jl 0x100388a6
inc eax
mov dword [esp + 0xc], eax
cmp eax, 0x37b3
jl 0x100388a0
inc ebx
cmp ebx, 0x2966
jl 0x1003889a
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1003890c
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
cmp dword [esp + 0x14], 0x53d1
jge 0x10038962
push str.ech_amovp_dbakwvf_tgezsqho_ajhfqkn_uuwkjexgu_rdrpkf
call fcn.1004c653
pop ecx
jmp 0x10038962
mov ecx, dword [ebp + 0x10]
xor esi, esi
push 1
pop edi
mov eax, esi
cmp dword [ecx], esi
je 0x10038933
mov eax, edi
and dword [esp + 0x14], esi
add eax, 0x17e58134
imul eax, dword [edx]
cmp dword [esp + 0x14], eax
sbb eax, eax
neg eax
cmp dword [ecx], eax
jne 0x1003894f
cmp dword [ecx], esi
jne 0x10038951
mov edi, esi
mov dword [edx], edi
mov eax, dword [ecx]
xor ecx, ecx
test eax, eax
sete cl
add ecx, edi
neg ecx
mov dword [ebx], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10038969
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
cmp byte [ebp + 0x1c], 0
push ebx
push esi
push edi
je 0x10038996
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x10038a64
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x10038a64
mov dword [esp + 0x14], 0x7c90
cmp dword [esp + 0x14], 0x7e5f
jle 0x10038a46
xor esi, esi
mov dword [esp + 0x10], esi
xor edi, edi
mov dword [esp + 0xc], edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov edi, edx
xor esi, esi
mov eax, edi
lea ecx, [esp + 0x18]
or eax, esi
or eax, ebx
cdq
push edx
push eax
call fcn.10001ab5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100389df
mov eax, dword [eax]
push eax
call fcn.1004c653
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.100050bb
inc esi
cmp esi, 0x7b7d
jl 0x100389c3
inc ebx
cmp ebx, 0x4497
jl 0x100389c1
mov edi, dword [esp + 0xc]
mov esi, dword [esp + 0x10]
inc edi
mov dword [esp + 0xc], edi
cmp edi, 0x7433
jl 0x100389b8
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0x4f27
jl 0x100389b2
push 0x24c
push 0x70e
push 0x4e1
push 0x2222
push 0x82d
call dword [sym.imp.GDI32.dll_Ellipse]
cmp dword [esp + 0x14], 0x7aa5
jge 0x10038a5b
push str.lxhyfks_eyomwjt_wncpfsfa_hwb_hqboppym_gexb_ydookstvj_gavqci_wsb_cldw_wem_pejj_xmjunbt_wlwcf
call fcn.1004c653
pop ecx
mov eax, dword [ebp + 0x14]
mov dword [eax], 0xec2e0cf5
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10038daf
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100648b3
call fcn.100630d8
sub esp, 0x10
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, edx
je 0x10038e7a
mov dword [ebp - 0x1c], 0x76cd
cmp dword [ebp - 0x1c], 0x7a54
jle 0x10038e26
xor esi, esi
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x18], eax
add eax, ebx
lea ecx, [edi + esi]
xor eax, ecx
mov ecx, 0x10081078
cdq
push edx
push eax
call fcn.10004aca
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x1c0e
jl 0x10038de9
inc ebx
cmp ebx, 0x3714
jl 0x10038de4
inc edi
cmp edi, 0x7869
jl 0x10038de2
inc esi
cmp esi, 0x742a
jl 0x10038de0
push 1
push 0x48b2
push ecx
mov byte [ebp - 0x11], 0
lea edx, [ebp - 0x11]
mov ecx, 0x50b1
call fcn.10035bfd
and dword [ebp - 4], 0
add esp, 0xc
cmp dword [ebp - 0x1c], 0x75d8
jge 0x10038e5e
mov edx, str.ybha_lwzij_lwlefvbgm_fuzd
mov ecx, 0x10081078
call fcn.10006f4f
jmp 0x10038e97
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
jmp 0x10038e92
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x5ee3
inc dword [edx]
cmp dword [edx], 2
jl 0x10038e85
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003a0a2
Capabilities:
Get keyboard layout

Disassembly:
mov eax, 0x10064920
call fcn.100630d8
sub esp, 0x34
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edi
je 0x1003a211
mov esi, dword [ebp + 0x18]
xor ebx, ebx
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x28], edi
mov eax, dword [esi]
mov dword [eax], ebx
mov eax, dword [esi]
cmp dword [eax], 7
jl 0x1003a234
mov dword [ebp - 0x30], 7
lea ecx, [ebp - 0x3c]
mov dword [ebp - 0x2c], 1
push 1
call fcn.10004d6b
mov dword [ebp - 4], ebx
mov dword [ebp - 0x1c], 0x64ea
cmp dword [ebp - 0x1c], 0x667c
jle 0x1003a154
push ebx
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov edi, ebx
mov esi, ebx
mov dword [ebp - 0x18], ebx
mov ebx, esi
mov esi, 0x349
mov eax, ebx
mov ecx, 0x10081078
xor eax, edi
cdq
push edx
push eax
call fcn.10004aca
dec ebx
dec esi
jne 0x1003a11e
mov esi, dword [ebp - 0x18]
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x2ed3
jl 0x1003a117
inc edi
push 0
pop ebx
cmp edi, 0x4aa9
jl 0x1003a112
mov esi, dword [ebp + 0x18]
mov edi, dword [ebp - 0x20]
mov byte [ebp - 4], 1
cmp dword [ebp - 0x1c], 0x6174
jge 0x1003a19a
mov edx, str.nqopi_nxbljutv_ytkyztiy_qtrfzto_faivbqrd_jsnvvcx_eqc_alfqwvi_huuazyhr
mov ecx, 0x10081078
call fcn.10006f4f
jmp 0x1003a19a
mov dword [ebp - 4], ebx
mov dword [ebp - 0x18], ebx
jmp 0x1003a1b2
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x3c]
mov dword [eax + ecx*4], 0xffff
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jl 0x1003a1a2
cmp dword [ebp - 0x2c], ebx
je 0x1003a1e3
mov eax, dword [ebp - 0x3c]
xor edx, edx
mov dword [ebp - 0x2c], 0x9552
cmp dword [eax], ebx
mov eax, dword [ebp - 0x30]
setg dl
xor ecx, ecx
dec edx
test edx, edx
setle cl
imul eax, ecx
mov dword [edi], eax
cmp dword [ebp - 0x2c], ebx
jmp 0x1003a1fc
push ecx
push ecx
lea eax, [ebp - 0x11]
mov byte [ebp - 0x11], bl
push eax
push ecx
xor dl, dl
mov ecx, 0x47aa
call fcn.100387af
add esp, 0x10
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x3c]
call fcn.10004dc8
mov eax, dword [esi]
inc dword [eax]
jmp 0x1003a0d3
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x1003a234
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xc64f6b90
inc dword [edx]
cmp dword [edx], 1
jl 0x1003a222
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003ab90
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push esi
mov esi, ecx
test dl, dl
je 0x1003abc4
cmp byte [ebp + 8], 0
je 0x1003abb8
push ecx
mov dl, 1
mov byte [esp + 0xb], 0
lea ecx, [esp + 0xb]
call fcn.1003706b
pop ecx
jmp 0x1003ac0f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x1003ac0f
cmp byte [ebp + 0x14], 0
je 0x1003abef
mov edx, dword [ebp + 0x18]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1003ac0f
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 1
inc dword [edx]
cmp dword [edx], 2
jl 0x1003abdb
jmp 0x1003ac0f
mov dword [esi], 0
cmp dword [esi], 3
jge 0x1003ac0f
mov edx, dword [ebp + 0x10]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 1
inc dword [esi]
cmp dword [esi], 3
jl 0x1003abfd
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1003fb74
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 4], dl
push edi
mov edi, ecx
test dl, dl
je 0x1003fbb7
push ebx
push esi
mov esi, dword [ebp + 0x14]
xor edx, edx
mov eax, dword [esi]
cmp eax, 1
mov eax, dword [esi]
setne dl
xor ebx, ebx
add edx, 0x89a6
cmp edx, eax
mov eax, dword [ebp + 0x10]
pop esi
setge bl
xor ecx, ecx
mov eax, dword [eax]
add eax, 0xb7ce
cmp eax, ebx
pop ebx
setle cl
mov dword [edi], ecx
jmp 0x1003fbc1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop edi
mov esp, ebp
pop ebp
ret
Function at 0x1004195f
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
push ebx
push esi
push edi
test dl, dl
je 0x10041a7d
cmp byte [ebp + 8], 0
je 0x10041a72
mov dword [ebp - 0xc], 0x6bc4
cmp dword [ebp - 0xc], 0x6d59
push 0
pop ebx
jle 0x100419d8
mov esi, ebx
mov edi, ebx
mov eax, esi
lea ecx, [ebp - 0x24]
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001ab5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100419ad
mov eax, dword [eax]
push eax
call fcn.1004c653
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x24]
call fcn.100050bb
inc edi
cmp edi, 0x41e9
jl 0x10041991
inc esi
cmp esi, 0x40d8
jl 0x1004198f
push ebx
call dword [sym.imp.GDI32.dll_CreateBrushIndirect]
mov byte [ebp - 1], bl
cmp byte [ebp - 1], 0
je 0x10041a5c
push ecx
push ebx
push ecx
push 0x2462
call fcn.10041879
mov dword [ebp - 8], 0x5e14
add esp, 0x10
cmp dword [ebp - 8], 0x5f39
jle 0x10041a48
mov esi, ebx
mov edi, ebx
mov eax, edi
lea ecx, [ebp - 0x3c]
xor eax, esi
cdq
push edx
push eax
call fcn.10001ab5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10041a1e
mov eax, dword [eax]
push eax
call fcn.1004c653
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.100050bb
inc edi
cmp edi, 0x4ae4
jl 0x10041a05
inc esi
cmp esi, 0x1368
jl 0x10041a03
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
cmp dword [ebp - 8], 0x5d21
jge 0x10041a5c
push str.bpicrye_rpzt_idfftlg_ggxhd_rktvmeoxr_rpfo_poleqqzv_fxbcxx_kmnt_itwfter_kavdyigil
call fcn.1004c653
pop ecx
cmp dword [ebp - 0xc], 0x69a2
jge 0x10041aa0
push str.bcn_pqxjrmjef_ayfggyha_ekdaxsbp_tpiftsy_davsktngk_rlu_wqxxvehig
call fcn.1004c653
pop ecx
jmp 0x10041aa0
mov eax, dword [ebp + 0xc]
mov dword [eax], 0xec2e0cf5
jmp 0x10041aa0
cmp byte [ebp + 0x10], 0
je 0x10041a8e
mov eax, dword [ebp + 0x14]
push 0xb
pop ecx
mov word [eax], cx
jmp 0x10041aa0
cmp byte [ecx], 0
je 0x10041aa0
push 0
push 0x2393
call dword [sym.imp.USER32.dll_MapDialogRect]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10041ab7
Capabilities:
Encode data using xor
Set thread local storage value

Disassembly:
mov eax, 0x10064c46
call fcn.100630d8
sub esp, 0x38
mov byte [ebp - 0x18], dl
mov dword [ebp - 0x2c], ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10041c48
mov dword [ebp - 0x24], 0x174f
cmp dword [ebp - 0x24], 0x1b22
jle 0x10041b47
xor esi, esi
mov dword [ebp - 0x20], esi
xor edi, edi
mov dword [ebp - 0x1c], edi
mov eax, esi
mov ecx, edi
xor ebx, ebx
sar eax, cl
mov dword [ebp - 0x28], eax
mov esi, eax
xor edi, edi
mov eax, ebx
mov ecx, 0x10081078
cdq
idiv edi
xor edx, esi
mov eax, edx
cdq
push edx
push eax
call fcn.10004aca
inc edi
cmp edi, 0x6ee
jl 0x10041b01
inc ebx
cmp ebx, 0x4ad8
jl 0x10041aff
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x58cc
jl 0x10041af2
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x2cca
jl 0x10041aed
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x142d
jge 0x10041b63
mov edx, str.hhp_mohn_ihqgdzia_vtscwfc_beukyhjo_evr_sdxosm_fzg_mfcu_pxzsov_blxhuurta_rlsjz_unftisl
mov ecx, 0x10081078
call fcn.10006f4f
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x20], 0x3098
cmp dword [ebp - 0x20], 0x32a5
jle 0x10041bf5
push 0x696
push 0
push 0x2683
push 0x17a
call dword [sym.imp.USER32.dll_GetDlgItemTextW]
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x24], ecx
mov eax, ebx
cdq
idiv ecx
lea ecx, [ebp - 0x44]
lea eax, [edi + edx]
xor eax, esi
cdq
push edx
push eax
call fcn.10001ab5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10041bb8
mov eax, dword [eax]
push eax
call fcn.1004c653
pop ecx
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.100050bb
mov ecx, dword [ebp - 0x24]
inc ecx
mov dword [ebp - 0x24], ecx
cmp ecx, 0x28d3
jl 0x10041b99
inc ebx
cmp ebx, 0x72a0
jl 0x10041b94
inc edi
cmp edi, 0x4f76
jl 0x10041b92
inc esi
cmp esi, 0x41af
jl 0x10041b90
mov eax, dword [ebp - 0x2c]
cmp byte [eax], 0
je 0x10041c18
push 0x5db
push ecx
push 0
push ecx
push 0x1bb0
mov ecx, 0x19cf
call fcn.100413ce
add esp, 0x14
cmp dword [ebp - 0x20], 0x2e0a
jge 0x10041c52
push str.tyymwtwme_qtjfhjq_okqj_vofb_eeg_yirswel_jgltavhmw_sjvpiehe_qsqlsbruw
call fcn.1004c653
pop ecx
jmp 0x10041c52
push 0
push 0
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x8e21f0
Capabilities:
Encode data using xor

Disassembly:
pushal
call 0x8e21f6
pop ebp
sub ebp, 6
sub ebp, 0x4e21f0
jmp 0x8e2254
mov dword [0x7e8877e2], eax
invalid
jmp 0x8e225d
mov eax, 0x4e21f0
add eax, ebp
add eax, 0x93
mov ecx, 0x620
mov edx, 0x7d410029
xor byte [eax], dl
inc eax
dec ecx
jne 0x8e2274
test esi, esi
invalid
jmp 0x8e2287
inc ebx
imul eax, dword [ecx + 0x29], 0x41292939
sub ebp, esp
add eax, 0xced9a829
cld
pop ebx
test al, 0xd9
into
cld
pop ebx
sbb ch, cl
jns 0x8e2279
mov esp, 0x296d4815
jns 0x8e224c
in al, 0xa2
mov al, byte [0x29292915]
test al, 0xe8
shr dword [ecx], 1
sub dword [ecx], ebp
sub ah, ah
xchg ecx, eax
das
sub dword [ecx], ebp
sub dword [ebx + 0x29292901], edx
fmulp st(3)
sub ah, cl
mov byte [0x292925a8], al
sub dword [edx], ebp
in al, dx
jns 0x8e2312
pop esi
push ds
and byte [ecx], ch
inc ecx
pop edi
ret
and eax, 0xda5a229
sub eax, 0x41292929
pop esi
push ds
and byte [ecx], ch
inc ecx
pop edi
ret