joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10027348
Capabilities:
Compare security identifiers
Get disk information

Disassembly:
mov eax, 0x1005ea9b
call fcn.1005d884
sub esp, 0x30
push ebx
mov ebx, ecx
mov dword [ebp - 0x24], ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10027461
mov dword [ebp - 0x20], 0x2397
cmp dword [ebp - 0x20], 0x2613
jle 0x100273e3
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov eax, ebx
cdq
idiv ecx
lea ecx, [ebp - 0x3c]
and edx, edi
and edx, esi
mov eax, edx
cdq
push edx
push eax
call fcn.10001a9f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100273a3
mov eax, dword [eax]
push eax
call fcn.10045b49
pop ecx
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.100101ce
mov ecx, dword [ebp - 0x1c]
inc ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x3568
jl 0x10027383
inc ebx
cmp ebx, 0x1222
jl 0x1002737e
inc edi
cmp edi, 0x136e
jl 0x1002737c
inc esi
cmp esi, 0x72be
jl 0x1002737a
mov ebx, dword [ebp - 0x24]
cmp dword [ebp - 0x20], 0x22d2
jge 0x100273f7
push str.llks_shz_tuu_lpcapay_hqewmd_hpk_eqvdro_qpevwxg_yxoqwqh_zno_sdsiwhxcj_mzyym
call fcn.10045b49
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x1c], 0
je 0x1002743c
push 1
push 0x24b1
push 1
push 0x74c9
lea eax, [ebp - 0x15]
mov byte [ebp - 0x15], 0
push 0x4054
push eax
mov edx, 0x6d1f
mov cl, 1
call fcn.10027007
add esp, 0x18
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebx]
mov edx, dword [ebp + 0xc]
mov eax, dword [edx]
mov dword [eax], ecx
mov eax, dword [ebx]
mov eax, dword [ebx]
mov eax, dword [ebp + 8]
mov eax, dword [eax]
mov eax, dword [ebx]
mov eax, dword [ebx]
mov eax, dword [ebx]
mov eax, dword [ebx]
mov eax, dword [edx]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
jmp 0x1002742b
mov dword [ebp - 0x20], 0x5e4
cmp dword [ebp - 0x20], 0x661
jle 0x100274a0
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x10079a18
or eax, esi
cdq
push edx
push eax
call fcn.1000f556
inc edi
cmp edi, 0x3012
jl 0x10027475
inc esi
cmp esi, 0x5627
jl 0x10027473
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
cmp byte [ebp + 0x14], 0
je 0x100274b2
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
jmp 0x100274bf
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0x100274bf
call fcn.10026fdd
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x27c
jge 0x1002742b
mov edx, str.bdldvdvf_yogunqhw_viirx_ltqeajh_ewodxndpu_ekjaj
mov ecx, 0x10079a18
call fcn.10012762
jmp 0x1002742b

Function at 0x100285ed
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov dword [0x100dccf4], ecx
inc edx
mov esi, 0x270
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
mov dword [edx*4 + 0x100dccf4], ecx
inc edx
cmp edx, esi
jl 0x10028602
mov dword [0x100dccf0], esi
pop esi
pop ebp
ret 8
Function at 0x10028628
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x100dccf4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x100dd080
jl 0x10028636
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x100dd324
jl 0x10028676
mov ecx, dword [0x100de070]
xor ecx, dword [0x100dccf4]
and ecx, edi
xor ecx, dword [0x100de070]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x100dccf0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x100dd324]
mov dword [0x100dd6b0], eax
pop esi
ret
Function at 0x10029503
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
cmp byte [ebp + 0x20], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], edx
je 0x10029564
cmp byte [ebp + 8], 0
je 0x10029523
mov byte [ecx], 1
jmp 0x100296bf
xor ebx, ebx
push ebx
push 0x387
push 0x221b
push ebx
push 0x11f
push 0x13a2
push 0x43f
push 0xe69
push 0x2439
push 0xb2f
push 0x1951
push 0x14a6
call dword [sym.imp.GDI32.dll_MaskBlt]
jmp 0x100296bf
cmp byte [ebp + 0x24], 0
je 0x100296b5
mov dword [ebp - 0xc], 0x38f4
cmp dword [ebp - 0xc], 0x3ab9
push 0
pop ebx
jle 0x1002960d
call dword [sym.imp.USER32.dll_CreatePopupMenu]
mov dword [ebp + 0x20], ebx
mov esi, ebx
mov dword [ebp - 8], ebx
mov edi, ebx
mov dword [ebp - 4], ebx
mov eax, esi
mov esi, dword [ebp + 0x20]
cdq
idiv edi
mov edi, ebx
mov eax, edx
mov dword [ebp - 0x18], eax
cdq
lea ecx, [ebp - 0x34]
idiv edi
and edx, esi
mov eax, edx
cdq
push edx
push eax
call fcn.10001a9f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100295c3
mov eax, dword [eax]
push eax
call fcn.10045b49
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x34]
call fcn.100101ce
mov eax, dword [ebp - 0x18]
inc edi
cmp edi, 0xa86
jl 0x100295a7
mov edi, dword [ebp - 4]
mov esi, dword [ebp - 8]
inc edi
mov dword [ebp - 4], edi
cmp edi, 0xe0
jl 0x10029598
inc esi
mov dword [ebp - 8], esi
cmp esi, 0x57a4
jl 0x10029593
mov eax, dword [ebp + 0x20]
inc eax
mov dword [ebp + 0x20], eax
cmp eax, 0x4b35
jl 0x1002958e
cmp dword [ebp - 0xc], 0x35f5
jge 0x10029621
push str.aqyrz_pjvaaop_fcmjufy_qxzp_cdwpdsmb
call fcn.10045b49
pop ecx
mov esi, dword [ebp + 0x14]
mov edi, dword [ebp + 0x18]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [edi]
cmp dword [edi], ebx
jne 0x10029635
mov eax, dword [esi]
mov eax, dword [edi]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [ebp - 0x10]
mov dword [ebp + 0x20], ebx
mov eax, dword [eax]
mov eax, dword [esi]
cmp dword [edi], ebx
je 0x10029652
mov dword [ebp + 0x20], 1
mov eax, dword [ebp + 0x1c]
xor ecx, ecx
mov edx, dword [esi]
mov eax, dword [eax]
cmp dword [ebp + 0x20], eax
mov eax, dword [ebp + 0x10]
setle cl
mov eax, dword [eax]
imul ecx, dword [eax + edx*4]
imul eax, ecx, 0xffffabb1
test eax, eax
je 0x1002968c
mov byte [ebp + 0x23], bl
cmp byte [ebp + 0x23], 0
je 0x100296bf
push 0x1903
mov dl, 1
call fcn.10029d20
pop ecx
jmp 0x100296bf
mov ecx, dword [ebp + 0x1c]
lea eax, [ebp - 0x1c]
push esi
push ebx
push dword [ebp + 0x10]
mov edx, 0x224a
mov dword [ebp - 0x1c], 0x316d
push eax
push edi
push dword [ebp - 0x10]
push dword [ebp + 0xc]
call fcn.10029b30
add esp, 0x1c
jmp 0x100296bf
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_EqualSid]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100297b3
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005ebb6
call fcn.1005d884
sub esp, 0x1c
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], ecx
je 0x100297e2
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, dword [edx]
mov dword [eax + ecx*4], 5
jmp 0x10029897
mov dword [ebp - 0x1c], 0x297
cmp dword [ebp - 0x1c], 0x47a
jle 0x1002985c
push 0
call dword [sym.imp.KERNEL32.dll_TlsFree]
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x14], edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov eax, edx
mov dword [ebp - 0x20], eax
mov esi, eax
mov ecx, ebx
xor edi, edi
shl esi, cl
mov eax, esi
mov ecx, 0x10079a18
xor eax, edi
cdq
push edx
push eax
call fcn.1000f556
inc edi
cmp edi, 0x33bc
jl 0x10029818
mov eax, dword [ebp - 0x20]
inc ebx
cmp ebx, 0x259c
jl 0x10029810
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x5775
jl 0x10029804
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x425c
jl 0x100297ff
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x1c1
jge 0x10029878
mov edx, str.bnlhxwraf_lpuhkwni_naitpewib
mov ecx, 0x10079a18
call fcn.10012762
mov edx, dword [ebp + 0x18]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [edx]
lea eax, [ecx + 2]
mov dword [edx], eax
call fcn.1002886d
mov ecx, dword [ebp - 0x24]
movzx eax, ax
push eax
call fcn.1000f6f3
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10029b56
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
push ebx
mov dword [esp + 0xc], 0x1581
mov ebx, ecx
cmp dword [esp + 0xc], 0x16d1
push esi
push edi
mov dword [esp + 0x1c], ebx
jle 0x10029be3
xor esi, esi
mov dword [esp + 0x10], esi
xor edi, edi
mov ecx, edi
mov dword [esp + 0x18], esi
xor ebx, ebx
shl esi, cl
mov ecx, ebx
mov eax, esi
sar eax, cl
lea ecx, [esp + 0x20]
cdq
push edx
push eax
call fcn.10001a9f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10029ba8
mov eax, dword [eax]
push eax
call fcn.10045b49
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.100101ce
inc ebx
cmp ebx, 0x36bb
jl 0x10029b8c
mov esi, dword [esp + 0x10]
inc edi
cmp edi, 0x1e44
jl 0x10029b82
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0x45a7
jl 0x10029b80
mov ebx, dword [esp + 0x1c]
cmp dword [esp + 0x14], 0x11b8
jge 0x10029bf8
push str.dbghq_qcjd_wtm_sjrpuj_bvjalaucm
call fcn.10045b49
pop ecx
cmp byte [ebp + 0x18], 0
je 0x10029c91
mov dword [esp + 0x14], 0x1686
cmp dword [esp + 0x14], 0x1954
jle 0x10029c6e
xor esi, esi
xor edi, edi
xor ebx, ebx
mov ecx, ebx
mov eax, edi
shl eax, cl
lea ecx, [esp + 0x38]
and eax, esi
cdq
push edx
push eax
call fcn.10001a9f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10029c38
mov eax, dword [eax]
push eax
call fcn.10045b49
pop ecx
push 0
push 1
lea ecx, [esp + 0x40]
call fcn.100101ce
inc ebx
cmp ebx, 0x2e47
jl 0x10029c1a
inc edi
cmp edi, 0x6c
jl 0x10029c18
inc esi
cmp esi, 0x5bfc
jl 0x10029c16
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov eax, dword [ebp + 0x28]
dec dword [eax]
cmp dword [esp + 0x14], 0x14cf
jge 0x10029d19
push str.ogulsq_nltntamm_aqh_xenspjek_yyh_nvzuif_qajzhauv_tst_zdn_ssoe
call fcn.10045b49
pop ecx
jmp 0x10029d19
mov esi, dword [ebp + 0x24]
mov dword [esi], 0
cmp dword [esi], 3
jg 0x10029d19
mov edi, dword [ebp + 0x14]
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x20]
mov dword [esp + 0x1c], 0xfffffff6
mov dword [esp + 0x14], 0xad5889e5
mov eax, dword [eax]
mov eax, dword [ebx]
mov eax, dword [esp + 0x1c]
mov eax, dword [edi]
mov eax, dword [ebx]
cmp dword [edx], 0
je 0x10029ce0
mov eax, dword [ebp + 0xc]
mov ecx, dword [ebx]
mov eax, dword [eax]
cmp dword [eax + ecx*4], 0
je 0x10029ce0
cmp dword [ebx], 0
je 0x10029ce0
xor ecx, ecx
inc ecx
jmp 0x10029ce2
xor ecx, ecx
mov eax, dword [edi]
sub ecx, eax
jne 0x10029cea
mov eax, dword [ebx]
mov eax, dword [edx]
mov eax, dword [edx]
mov eax, dword [edx]
mov eax, dword [ebx]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x14]
mov eax, dword [ebx]
mov eax, dword [esi]
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [ecx]
mov dword [ecx + edx*4], eax
mov ecx, dword [ebp + 0x2c]
mov dword [ecx], eax
inc dword [esi]
cmp dword [esi], 3
jle 0x10029ca2
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002a191
Capabilities:
Compare security identifiers

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
xor eax, eax
push eax
test cl, cl
je 0x1002a1b7
push 0xf74
push eax
push eax
push 0x1e26
push 0x306
call dword [sym.imp.USER32.dll_ToAsciiEx]
jmp 0x1002a1be
push eax
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov esp, ebp
pop ebp
ret

Function at 0x1002a574
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x1005ebfe
call fcn.1005d884
sub esp, 0x20
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], esp
xor esi, esi
mov dword [ebp - 0x28], edi
cmp byte [ebp + 0xc], 0
je 0x1002a5b1
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], 0x4866
cmp dword [ebp - 0x1c], 0x49f0
jle 0x1002a633
push esi
push esi
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
mov ebx, esi
mov dword [ebp - 0x18], esi
mov ecx, esi
mov dword [ebp - 0x14], esi
mov eax, ebx
mov edi, esi
cdq
idiv ecx
mov ebx, edx
mov dword [ebp - 0x24], ebx
mov eax, ebx
mov dword [ebp - 0x20], esi
cdq
idiv edi
mov ebx, edx
mov eax, ebx
mov ecx, 0x10079a18
or eax, esi
cdq
push edx
push eax
call fcn.1000f556
inc esi
cmp esi, 0x197c
jl 0x1002a5e9
mov ebx, dword [ebp - 0x24]
inc edi
push 0
pop esi
cmp edi, 0x3199
jl 0x1002a5df
mov ecx, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x25d1
jl 0x1002a5d3
inc ebx
mov dword [ebp - 0x18], ebx
cmp ebx, 0x75b8
jl 0x1002a5ce
mov edi, dword [ebp - 0x28]
mov dword [edi], esi
cmp dword [edi], 1
jge 0x1002a64b
mov edx, dword [ebp + 8]
mov ecx, dword [edi]
mov eax, dword [edx]
mov dword [eax + ecx*4], esi
inc dword [edi]
cmp dword [edi], 1
jl 0x1002a63d
mov dword [ebp - 4], esi
cmp dword [ebp - 0x1c], 0x461b
jge 0x1002a5a0
mov edx, str.epumybg_xpgfmwb_ktnc_ruyo_jznohtjjz_gms_ulx_qvvto
mov ecx, 0x10079a18
call fcn.10012762
jmp 0x1002a5a0

Function at 0x1002ad6f
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1005ec24
call fcn.1005d884
sub esp, 0xc
mov byte [ebp - 0x14], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x1002adb4
mov esi, dword [ebp + 8]
mov dword [esi], 0
jmp 0x1002ad9e
mov ecx, dword [esi]
mov eax, dword [edx]
and dword [eax + ecx*4], 0
inc dword [esi]
cmp dword [esi], 2
jl 0x1002ad94
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x18], 0x5d00
cmp dword [ebp - 0x18], 0x607d
jle 0x1002adeb
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x10079a18
and eax, esi
cdq
push edx
push eax
call fcn.1000f556
inc edi
cmp edi, 0x274b
jl 0x1002adc8
inc esi
cmp esi, 0x3e9c
jl 0x1002adc6
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x18], 0x5ca6
jge 0x1002ada3
mov edx, str.nieuavfo_lsrio_gegynbbs_xjhatrq_vbmmjdnto_onlvbwg_zvaonpjwi_amokrhx_bvu_oltspt_flvvipzxg_sxse_ihpsw_mopvi
mov ecx, 0x10079a18
call fcn.10012762
jmp 0x1002ada3
Function at 0x1002b06b
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
test dl, dl
je 0x1002b09c
mov esi, dword [ebp + 0xc]
mov eax, dword [esi]
and dword [eax], 0
jmp 0x1002b093
push ecx
push 1
push 0x676b
push ecx
push ecx
call fcn.10029a29
mov eax, dword [esi]
add esp, 0x14
dec dword [eax]
mov eax, dword [esi]
cmp dword [eax], 0xffffffed
jl 0x1002b07d
jmp 0x1002b0a4
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x1002b425
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005ec42
call fcn.1005d884
sub esp, 0xc
push ebx
push esi
mov dword [ebp - 0x14], 0x3c5e
cmp dword [ebp - 0x14], 0x3e74
push edi
mov dword [ebp - 0x10], esp
jle 0x1002b47c
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x10079a18
and eax, edi
xor eax, esi
cdq
push edx
push eax
call fcn.1000f556
inc ebx
cmp ebx, 0x7adb
jl 0x1002b44e
inc edi
cmp edi, 0x216
jl 0x1002b44c
inc esi
cmp esi, 0x7fa3
jl 0x1002b44a
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x3aa9
jge 0x1002b498
mov edx, str.gbvy_bwqz_ngkdt_bwxfoln_ixofmlsuh
mov ecx, 0x10079a18
call fcn.10012762
cmp byte [ebp + 8], 0
je 0x1002b4cb
push 0
push 0x620
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetStringTypeW]
jmp 0x1002b4d6
push 0xccd
call dword [sym.imp.GDI32.dll_DeleteDC]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100359e9
Capabilities:
Compare security identifiers

Disassembly:
mov eax, 0x1005f117
call fcn.1005d884
sub esp, 0x34
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], ebx
je 0x10035a22
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_EqualSid]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x20], 0x1c29
cmp dword [ebp - 0x20], 0x1cf2
jle 0x10035aa3
xor esi, esi
mov dword [ebp - 0x1c], esi
xor eax, eax
mov dword [ebp - 0x18], 0x65e0
mov dword [ebp - 0x14], eax
mov esi, dword [ebp - 0x14]
xor edi, edi
xor ebx, ebx
lea eax, [ebx + edi]
or eax, esi
lea ecx, [ebp - 0x3c]
cdq
push edx
push eax
call fcn.10001a9f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10035a64
mov eax, dword [eax]
push eax
call fcn.10045b49
pop ecx
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.100101ce
inc ebx
cmp ebx, 0x51e4
jl 0x10035a4a
inc edi
cmp edi, 0x6d03
jl 0x10035a48
mov esi, dword [ebp - 0x1c]
add dword [ebp - 0x14], esi
dec dword [ebp - 0x18]
jne 0x10035a43
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x518b
jl 0x10035a37
mov ebx, dword [ebp - 0x24]
cmp dword [ebp - 0x20], 0x19b8
jge 0x10035ab7
push str.vnirizagy_mus_keoe_mnkzbtjn_fzagch_rqozjkmdf_orqa_tvwbs_rcchtg_dat_xbiu
call fcn.10045b49
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebx], 0
je 0x10035a11
mov dword [ebp - 0x20], 0x39fb
cmp dword [ebp - 0x20], 0x3d71
jle 0x10035b07
xor esi, esi
xor edi, edi
xor ebx, ebx
lea eax, [ebx + edi]
mov ecx, 0x10079a18
add eax, esi
cdq
push edx
push eax
call fcn.1000f556
inc ebx
cmp ebx, 0x11a3
jl 0x10035ada
inc edi
cmp edi, 0x420d
jl 0x10035ad8
inc esi
cmp esi, 0x72ca
jl 0x10035ad6
push ecx
push 0x4ea0
push ecx
push ecx
push 0x545c
push ecx
push 0
push ecx
push 0x3d69
push ecx
call fcn.10035d23
add esp, 0x28
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x36d6
jge 0x10035a11
mov edx, str.nrqgsrj_fvfkjh_bsqszx_jjt_ptdaa_nje_snnkr_gafne
mov ecx, 0x10079a18
call fcn.10012762
jmp 0x10035a11
Function at 0x10038c8f
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005f393
call fcn.1005d884
sub esp, 0x38
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, edx
mov byte [ebp - 0x18], cl
je 0x10038dcf
mov dword [ebp - 0x20], 0x7519
cmp dword [ebp - 0x20], 0x75ea
jle 0x10038d18
push 0
call dword [sym.imp.USER32.dll_SetKeyboardState]
xor edi, edi
xor esi, esi
mov dword [ebp - 0x1c], esi
xor ebx, ebx
mov dword [ebp + 0x10], 0x51c9
xor esi, esi
mov ecx, esi
mov eax, ebx
shl eax, cl
mov ecx, 0x10079a18
xor eax, edi
cdq
push edx
push eax
call fcn.1000f556
inc esi
cmp esi, 0x3ddc
jl 0x10038cdb
mov esi, dword [ebp - 0x1c]
add ebx, esi
dec dword [ebp + 0x10]
jne 0x10038cd9
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x6520
jl 0x10038cd0
inc edi
cmp edi, 0x4de3
jl 0x10038ccb
cmp byte [ebp - 0x18], 0
je 0x10038d30
mov eax, dword [ebp + 0x24]
movzx eax, word [eax]
push eax
push ecx
mov ecx, dword [ebp + 8]
call fcn.10025d9b
jmp 0x10038d40
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
mov eax, dword [ebp + 0x14]
sar ecx, 2
mov dword [eax], ecx
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x736f
jge 0x10038db0
mov dword [ebp + 0x10], 0x2057
cmp dword [ebp + 0x10], 0x11f1
jge 0x10038da1
lea eax, [ebp - 0x24]
push eax
push 0x10066a28
call fcn.100454fb
mov esi, dword [ebp - 0x24]
pop ecx
pop ecx
push 0xa
xor ecx, ecx
pop edi
cmp esi, edi
setge cl
jmp 0x10038d8d
mov eax, esi
cdq
idiv edi
push 9
mov esi, eax
pop eax
sub eax, edx
mov dword [ebp - 0x24], esi
add ecx, eax
cmp esi, edi
jge 0x10038d7c
add ecx, 9
push ecx
push str._ld_n
call fcn.10045b49
pop ecx
pop ecx
mov edx, str.agr_yhksf_qezqyxk_ktjad_pouiaoyrv_wkpfwbono_fnuu_lpgzeh
mov ecx, 0x10079a18
call fcn.10012762
jmp 0x10038e6f
mov dword [ebp + 0x10], 0x19f3
cmp dword [ebp + 0x10], 0x1bca
jle 0x10038e20
xor esi, esi
xor edi, edi
lea eax, [edi + esi]
cdq
lea ecx, [ebp - 0x40]
push edx
push eax
call fcn.10001a9f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10038dfb
mov eax, dword [eax]
push eax
call fcn.10045b49
pop ecx
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.100101ce
inc edi
cmp edi, 0x9b1
jl 0x10038de3
inc esi
cmp esi, 0x65ac
jl 0x10038de1
cmp dword [ebp + 0x10], 0x1615
jge 0x10038e34
push str.pjkktanp_tvnvkj_dvdsfyxa_rshmw_rkyqk_itmr_emumd_nvkqsflvf_ecxk_get
call fcn.10045b49
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x1c], 0
je 0x10038e69
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
mov esi, dword [ebp + 0x20]
mov edi, dword [ebp + 0x18]
sar eax, 2
mov dword [esi], eax
jmp 0x10038e63
and dword [ebp - 0x28], 0
lea eax, [ebp - 0x28]
push eax
mov ecx, ebx
call fcn.10039f88
inc dword [esi]
mov eax, dword [esi]
cmp eax, dword [edi]
jl 0x10038e50
jmp 0x10038e6f
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLCID]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003a6d6
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005f47c
call fcn.1005d884
sub esp, 0x20
push ebx
push esi
mov byte [ebp - 0x14], cl
mov dword [ebp - 0x24], 0x3e00
cmp dword [ebp - 0x24], 0x4153
push edi
mov dword [ebp - 0x10], esp
jle 0x1003a76a
xor esi, esi
mov dword [ebp - 0x20], esi
xor edi, edi
mov dword [ebp - 0x1c], edi
mov dword [ebp - 0x18], esi
mov ecx, edi
xor ebx, ebx
shl esi, cl
mov dword [ebp - 0x18], esi
mov ecx, ebx
mov dword [ebp - 0x28], esi
xor edi, edi
sar esi, cl
mov eax, esi
mov ecx, 0x10079a18
xor eax, edi
cdq
push edx
push eax
call fcn.1000f556
inc edi
cmp edi, 0x28cd
jl 0x1003a71b
mov esi, dword [ebp - 0x18]
inc ebx
cmp ebx, 0x5a53
jl 0x1003a712
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x3736
jl 0x1003a706
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x1d4b
jl 0x1003a701
push 0x266f
call dword [sym.imp.GDI32.dll_GetBkColor]
cmp byte [ebp - 0x14], 0
je 0x1003a795
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x1003a79b
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xa32b1cec
inc dword [edx]
cmp dword [edx], 1
jl 0x1003a781
jmp 0x1003a79b
mov eax, dword [ebp + 0x14]
and dword [eax], 0
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x3c11
jge 0x1003a7b7
mov edx, str.fkwkpvjfp_hamljtckg_ktgdaw_dmprn_sxqovgiqn
mov ecx, 0x10079a18
call fcn.10012762
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret