joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008ee8
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
cmp byte [ebp + 0xc], 0
push esi
mov byte [esp + 8], cl
je 0x10008f65
cmp byte [ebp + 0x10], 0
je 0x10008f4a
mov esi, dword [ebp + 0x1c]
mov dword [esi], 1
jmp 0x10008f43
mov edx, dword [ebp + 8]
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0xc], 0xffffffff
mov dword [esp + 0xc], 0xdbf4df7b
push ecx
mov dword [esp + 0x10], 0xffffffff
mov cl, 1
mov dword [esp + 0x10], 0xffffffff
call fcn.10005ed4
dec dword [esi]
pop ecx
cmp dword [esi], 0
jge 0x10008f0d
jmp 0x10008f8b
mov byte [esp + 7], 0
cmp byte [esp + 7], 0
je 0x10008f8b
push 0xf6b
push 0
call dword [sym.imp.KERNEL32.dll_GetWindowsDirectoryW]
jmp 0x10008f8b
test cl, cl
je 0x10008f75
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
jmp 0x10008f8b
cmp byte [edx], 0
je 0x10008f8b
push 1
push 0xe75
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10009925
Capabilities:
Delete file

Disassembly:
mov eax, 0x100642f4
call fcn.10063a98
sub esp, 0x24
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x18], dl
test dl, dl
je 0x10009a81
mov dword [ebp - 0x30], 0xd9b
cmp dword [ebp - 0x30], 0x1143
mov dword [ebp - 0x1c], ebx
jle 0x100099bc
mov edi, ebx
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x24], 0x1d32
mov edi, ebx
mov ebx, dword [ebp - 0x20]
mov ecx, edi
mov eax, ebx
sar eax, cl
mov ecx, 0x100812f8
cdq
push edx
push eax
call fcn.10001ee2
inc edi
cmp edi, 0x78dc
jl 0x1000996f
mov eax, dword [ebp - 0x28]
add ebx, eax
dec dword [ebp - 0x24]
push 0
mov dword [ebp - 0x20], ebx
pop ebx
jne 0x1000996a
mov edi, dword [ebp - 0x2c]
dec eax
mov dword [ebp - 0x28], eax
cmp eax, 0xffffddb2
jg 0x10009960
inc edi
mov dword [ebp - 0x2c], edi
cmp edi, 0x5fb
jl 0x1000995d
push ebx
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x30], 0xad5
jge 0x100099d7
mov edx, str.hdxqm_nejbm_lye_scz_mcmhc_vgtjuskw
mov ecx, 0x100812f8
call fcn.1000395e
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x30], 0x553c
cmp dword [ebp - 0x30], 0x575d
jle 0x10009a14
mov edi, ebx
mov ebx, 0x3048
mov eax, edi
mov ecx, 0x100812f8
cdq
push edx
push eax
call fcn.10001ee2
dec edi
dec ebx
jne 0x100099f2
mov ebx, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 0x1c], ebx
cmp ebx, 0x424e
jl 0x100099eb
mov eax, dword [ebp + 0x10]
mov edx, dword [eax]
mov eax, dword [ebp + 8]
add dword [eax], edx
mov dword [ebp - 4], 2
cmp dword [ebp - 0x30], 0x5463
jge 0x10009a3d
mov edx, str.fspbrrtgu_jez_relx_jgjja_jtjl_cdv_dvm_jbjggbht_bckcbeowq
mov ecx, 0x100812f8
call fcn.1000395e
jmp 0x10009a97
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x10009a97
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_BeginPaint]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001472a
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
je 0x10014802
mov dword [esp + 0x1c], 0x353b
cmp dword [esp + 0x1c], 0x3584
jle 0x100147cb
push 0
call dword [sym.imp.OLEAUT32.dll_SysStringLen]
xor esi, esi
mov dword [esp + 0x18], esi
xor edi, edi
mov eax, esi
mov dword [esp + 0x14], 0x6ea9
cdq
idiv edi
mov esi, edx
xor ebx, ebx
mov eax, esi
lea ecx, [esp + 0x20]
xor eax, ebx
cdq
push edx
push eax
call fcn.10001a31
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001478d
mov eax, dword [eax]
push eax
call fcn.1004b616
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.1000230b
inc ebx
cmp ebx, 0x6b10
jl 0x10014773
inc esi
dec dword [esp + 0x14]
jne 0x10014771
mov esi, dword [esp + 0x18]
inc edi
cmp edi, 0xb40
jl 0x10014762
inc esi
mov dword [esp + 0x18], esi
cmp esi, 0x5c77
jl 0x10014760
mov byte [esp + 0x13], 0
cmp byte [esp + 0x13], 0
je 0x100147eb
push 0x111f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
cmp dword [esp + 0x1c], 0x3337
jge 0x10014811
push str.mqswk_dky_zgirbxb_niotpp_uothzt_pxa_psji_vaskma
call fcn.1004b616
pop ecx
jmp 0x10014811
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100148fc
Capabilities:
Modify service

Disassembly:
mov eax, 0x100647bd
call fcn.10063a98
sub esp, 0x20
push ebx
push esi
mov dword [ebp - 0x1c], 0x5620
xor ebx, ebx
cmp dword [ebp - 0x1c], 0x5886
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], ecx
jle 0x1001497e
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x20], ebx
mov dword [ebp - 0x18], 0xe67
mov ecx, ebx
mov eax, esi
shl eax, cl
mov ecx, 0x100812f8
cdq
push edx
push eax
call fcn.10001ee2
add ebx, edi
dec dword [ebp - 0x18]
jne 0x10014932
inc edi
push 0
pop ebx
cmp edi, 0x1229
jl 0x10014928
inc esi
cmp esi, 0x4f76
jl 0x10014926
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xb4f
push 0x18ee
push 0x26c0
push ebx
call dword [sym.imp.ADVAPI32.dll_ChangeServiceConfigW]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1c], 0x52f4
jge 0x10014999
mov edx, str.gkvlnkz_kazy_zirxe_xlbrznrm_dtqtuxpy
mov ecx, 0x100812f8
call fcn.1000395e
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0xc], 0
je 0x100149e0
push ecx
mov ecx, dword [ebp - 0x24]
call fcn.10013ca0
pop ecx
mov ecx, dword [ebp + 8]
mov dword [ebp - 0x28], eax
lea eax, [ebp - 0x28]
push eax
call fcn.10018448
jmp 0x100149f4
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x100149f4
push ecx
push ebx
push ecx
call fcn.1001472a
add esp, 0xc
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10014d77
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006481f
call fcn.10063a98
sub esp, 0x20
and dword [ebp - 0x1c], 0
lea eax, [ebp - 0x28]
push ebx
push esi
push edi
push 0x1001849b
push fcn.10018173
xor edi, edi
mov ebx, ecx
inc edi
mov dword [ebp - 0x18], ebx
push edi
push 0xc
push eax
mov esi, edx
call fcn.1004bd5a
push 0
lea eax, [ebp - 0x28]
mov dword [ebp - 4], edi
push eax
push esi
push 0x1ee2
mov edx, 0x60d5
mov ecx, 0x5ad6
call fcn.10015bde
mov dword [ebp - 0x14], 0x3939
add esp, 0x10
cmp dword [ebp - 0x14], 0x3c5a
jle 0x10014e2f
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x14], 0x3ae2
mov dword [ebp - 0x10], ecx
mov eax, edi
sar eax, cl
mov ecx, 0x100812f8
xor eax, esi
cdq
push edx
push eax
call fcn.10001ee2
mov ecx, dword [ebp - 0x10]
add ecx, ebx
dec dword [ebp - 0x14]
mov dword [ebp - 0x10], ecx
jne 0x10014dee
inc ebx
cmp ebx, 0x5dfd
jl 0x10014de2
inc edi
cmp edi, 0x1aff
jl 0x10014de0
inc esi
cmp esi, 0x4f52
jl 0x10014dde
mov ebx, dword [ebp - 0x18]
xor edi, edi
inc edi
lea eax, [ebp - 0x28]
mov ecx, ebx
push eax
call fcn.100183ff
push 0x1001849b
push edi
push 0xc
lea eax, [ebp - 0x28]
mov dword [ebp - 0x1c], edi
push eax
mov byte [ebp - 4], 0
call fcn.1004bc74
mov ecx, dword [ebp - 0xc]
mov eax, ebx
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10014ecf
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006484b
call fcn.10063a98
sub esp, 0x20
push ebx
push esi
push edi
mov edi, ecx
xor ebx, ebx
push 0x17fd5
mov dword [ebp - 4], ebx
call fcn.1002a867
pop ecx
movzx esi, ax
lea ecx, [ebp + 8]
mov eax, esi
push 1
mov dword [ebp - 0x18], eax
lea eax, [ebp - 0x18]
push ebx
push eax
call fcn.10013a6d
cmp eax, 0xffffffff
jne 0x10014f11
mov eax, esi
jmp 0x10014f1f
push 0x12523
call fcn.1002a867
pop ecx
movzx eax, ax
push eax
push ecx
lea ecx, [ebp + 8]
call fcn.1001864c
push ecx
push 0x37b0
lea eax, [ebp + 8]
mov dl, 1
push 0x1fc9
push eax
call fcn.10014e65
pop ecx
mov eax, esp
lea edx, [ebp + 8]
lea ecx, [ebp - 0x2c]
mov dword [eax], ebx
mov dword [eax + 4], ebx
mov dword [eax + 8], ebx
call fcn.10044dae
add esp, 0xc
mov esi, eax
cmp edi, esi
je 0x10014f83
mov ecx, edi
call fcn.10018911
mov ecx, dword [esi]
mov dword [edi], ecx
mov eax, dword [esi + 4]
mov dword [edi + 4], eax
mov eax, dword [esi + 8]
mov dword [edi + 8], eax
mov byte [ebp - 0xd], bl
mov byte [ebp - 0xe], bl
mov dword [esi], ebx
mov dword [esi + 4], ebx
mov dword [esi + 8], ebx
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], bl
call fcn.10018911
mov dword [ebp - 0x14], 0x682b
cmp dword [ebp - 0x14], 0x688a
jle 0x10015033
push 0x167d
push 0x1ae8
push ebx
call dword [sym.imp.USER32.dll_DeleteMenu]
mov esi, ebx
mov dword [ebp - 0x18], ebx
mov edi, ebx
mov dword [ebp - 0x14], edi
and dword [ebp - 0x20], 0
mov eax, edi
mov edi, dword [ebp - 0x20]
mov ecx, ebx
sar eax, cl
and eax, esi
mov dword [ebp - 0x1c], eax
mov esi, eax
mov eax, esi
mov ecx, 0x100812f8
xor eax, edi
cdq
push edx
push eax
call fcn.10001ee2
inc edi
cmp edi, 0x765a
jl 0x10014fd1
mov esi, dword [ebp - 0x18]
inc ebx
mov edi, dword [ebp - 0x14]
cmp ebx, 0x400d
jl 0x10014fbd
inc edi
mov dword [ebp - 0x14], edi
push 0
pop ebx
cmp edi, 0x3d52
jl 0x10014fbd
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x3984
jl 0x10014fb8
push 0x5c5
push 0x12b3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
push ebx
push 1
lea ecx, [ebp + 8]
call fcn.1000f1cb
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10015ee4
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100648fd
call fcn.10063a98
sub esp, 0x50
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x28], esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x1001600d
mov dword [ebp - 0x20], 0x4580
cmp dword [ebp - 0x20], 0x4747
jle 0x10015f6f
xor edi, edi
mov dword [ebp - 0x1c], edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
xor esi, esi
and dword [ebp - 0x24], 0
add ebx, esi
add ebx, edi
mov edi, dword [ebp - 0x24]
mov eax, ebx
mov ecx, 0x100812f8
xor eax, edi
cdq
push edx
push eax
call fcn.10001ee2
inc edi
cmp edi, 0x508a
jl 0x10015f2b
mov edi, dword [ebp - 0x1c]
inc esi
mov ebx, dword [ebp - 0x18]
cmp esi, 0x5b3
jl 0x10015f20
inc ebx
mov dword [ebp - 0x18], ebx
cmp ebx, 0x4b27
jl 0x10015f1e
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x88
jl 0x10015f19
mov esi, dword [ebp - 0x28]
cmp byte [ebp + 0x14], 0
je 0x10015f9f
push ecx
mov edx, 0x1a05
lea ecx, [ebp - 0x44]
call fcn.10040cef
and dword [ebp - 4], 0
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.10013c15
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.1000f1cb
jmp 0x10015fcf
mov dword [esi], 0
jmp 0x10015fca
push 0x7d3d
push esi
push dword [ebp + 0x1c]
mov dword [ebp - 0x2c], 7
lea edx, [ebp - 0x2c]
push ecx
mov ecx, 0x42ae
call fcn.10016550
add esp, 0x10
inc dword [esi]
cmp dword [esi], 3
jle 0x10015fa7
mov dword [ebp - 4], 1
cmp dword [ebp - 0x20], 0x4243
jge 0x10015fee
mov edx, str.ftohsvahp_aslx_oezpjz_ataxe
mov ecx, 0x100812f8
call fcn.1000395e
jmp 0x100160d8
cmp byte [ebp + 0xc], 0
je 0x100160bf
mov dword [ebp - 0x18], 0x7a3
cmp dword [ebp - 0x18], 0xa88
jle 0x1001609f
xor edi, edi
xor esi, esi
mov dword [ebp - 0x1c], esi
xor ebx, ebx
mov dword [ebp - 0x20], ebx
and dword [ebp - 0x28], 0
mov eax, esi
cdq
idiv ebx
mov esi, dword [ebp - 0x28]
mov ebx, edx
mov eax, ebx
lea ecx, [ebp - 0x5c]
and eax, esi
and eax, edi
cdq
push edx
push eax
call fcn.10001a31
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001605c
mov eax, dword [eax]
push eax
call fcn.1004b616
pop ecx
push 0
push 1
lea ecx, [ebp - 0x5c]
call fcn.1000230b
inc esi
cmp esi, 0x5c00
jl 0x10016041
mov ebx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 0x20], ebx
cmp ebx, 0x911
jl 0x10016033
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x10af
jl 0x1001602e
inc edi
cmp edi, 0x1129
jl 0x10016029
cmp dword [ebp - 0x18], 0x56d
jge 0x100160b3
push str.kzfjrtly_bnv_fhcclji
call fcn.1004b616
pop ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
jmp 0x100160d8
push ecx
push 0x7c89
mov edx, 0x4ec6
mov byte [ebp - 0x11], 0
lea ecx, [ebp - 0x11]
call fcn.10015b99
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001bbd9
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x10
mov byte [esp + 8], dl
mov dword [esp + 0xc], ecx
test dl, dl
je 0x1001bc10
mov byte [esp + 7], 0
cmp byte [esp + 7], 0
je 0x1001bc15
push 0x111f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x1001bc15
mov eax, dword [ebp + 0x10]
inc dword [eax]
mov esp, ebp
pop ebp
ret

Function at 0x1001be52
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov dword [0x1022b474], ecx
inc edx
mov esi, 0x270
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
mov dword [edx*4 + 0x1022b474], ecx
inc edx
cmp edx, esi
jl 0x1001be67
mov dword [0x1022b470], esi
pop esi
pop ebp
ret 8

Function at 0x1001be8d
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x1022b474
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x1022b800
jl 0x1001be9b
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x1022baa4
jl 0x1001bedb
mov ecx, dword [0x1022c7f0]
xor ecx, dword [0x1022b474]
and ecx, edi
xor ecx, dword [0x1022c7f0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x1022b470], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x1022baa4]
mov dword [0x1022be30], eax
pop esi
ret
Function at 0x10022dd0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10064e88
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10022e0d
push 1
push 0x577d
call fcn.10022f92
pop ecx
pop ecx
jmp 0x10022f81
mov dword [ebp - 0x28], 0x7c5f
mov dword [ebp - 0x30], str.oylgei_louihznl_yqgfuiz_exxqve_gtcnngi_ujryyeghm_pfhdbcar
cmp dword [ebp - 0x28], 0x7d7b
jle 0x10022e8d
and dword [ebp - 0x20], 0
jmp 0x10022e31
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x12e7
jge 0x10022e8d
and dword [ebp - 0x18], 0
jmp 0x10022e47
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xb21
jge 0x10022e8b
and dword [ebp - 0x1c], 0
jmp 0x10022e5d
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x4ade
jge 0x10022e89
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
mov ecx, 0x100812f8
call fcn.10001ee2
jmp 0x10022e56
jmp 0x10022e40
jmp 0x10022e2a
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x7995
jge 0x10022ead
mov edx, dword [ebp - 0x30]
mov ecx, 0x100812f8
call fcn.1000395e
jmp 0x10022ec9
or dword [ebp - 4], 0xffffffff
jmp 0x10022ed3
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x10022f0b
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x10022f09
push 0x111f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x10022f81
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
push 0
mov ecx, dword [ebp - 0x24]
call fcn.10002096
and dword [eax], 0
jmp 0x10022f4a
push 0
mov ecx, dword [ebp - 0x24]
call fcn.10002096
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x2c]
mov dword [ecx], eax
push 0
mov ecx, dword [ebp - 0x24]
call fcn.10002096
cmp dword [eax], 0xffffffea
jg 0x10022f81
mov byte [ebp - 0x12], 0
movzx eax, byte [ebp - 0x12]
test eax, eax
je 0x10022f76
push 1
push 0xe75
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SignalObjectAndWait]
mov eax, dword [ebp - 0x48]
mov dword [eax], 0x6673e7ed
jmp 0x10022f32
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10024e47
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10024e82
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
push dword [ebp - 4]
push 0x7669
push dword [ebp - 8]
push 1
push 0x5219
push 0x2e82
call fcn.10024ec4
add esp, 0x18
jmp 0x10024ec0
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10024eab
push 0
push 0x1e3a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x10024ec0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [eax], 0x204e2db5
mov esp, ebp
pop ebp
ret
Function at 0x100306b2
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10030716
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x100306f2
push 0x111f
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextA]
jmp 0x10030714
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x10030741
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x20], eax
push 0x1d27
push 0x327f
push dword [ebp - 0x20]
push 1
mov edx, dword [ebp - 0x24]
mov ecx, 0x777a
call fcn.1002ba90
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1003f9fb
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006557d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x44
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1003fb14
mov dword [ebp - 0x1c], 0x2878
mov dword [ebp - 0x20], str.fhn_dosljx_gpsdoxla_rkqgu_abzqa_aflhj_mhfvaf_okzeo_hghxnfenl_fudvvahn_mtf_huke_hmeytelgy_qqhaflo
cmp dword [ebp - 0x1c], 0x2c3d
jle 0x1003fa9b
push 0x1be5
push 0
call dword [sym.imp.KERNEL32.dll_WinExec]
and dword [ebp - 0x14], 0
jmp 0x1003fa5a
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x73c5
jge 0x1003fa9b
and dword [ebp - 0x18], 0
jmp 0x1003fa70
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x3978
jge 0x1003fa99
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x54], eax
mov dword [ebp - 0x50], edx
push dword [ebp - 0x50]
push dword [ebp - 0x54]
mov ecx, 0x100812f8
call fcn.10001ee2
jmp 0x1003fa69
jmp 0x1003fa53
lea eax, [ebp + 0x14]
mov dword [ebp - 0x24], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x24c8
jge 0x1003fabb
mov edx, dword [ebp - 0x20]
mov ecx, 0x100812f8
call fcn.1000395e
jmp 0x1003fad7
or dword [ebp - 4], 0xffffffff
jmp 0x1003fae1
lea eax, [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x24]
push dword [eax]
push 1
push 0xf59
push dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
push dword [eax]
push dword [ebp - 0x30]
call fcn.1003fb80
add esp, 0x18
jmp 0x1003fb6f
lea eax, [ebp + 8]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x1003fb54
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov ecx, dword [ebp - 0x4c]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x1003fb6f
push 0x1e8c
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10042796
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006565b
call fcn.10063a98
sub esp, 0x38
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x18], dl
mov dword [ebp - 0x24], edi
je 0x100427ed
cmp byte [ebp + 0x14], 0
je 0x100427d1
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EndPaint]
jmp 0x1004297b
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1004297b
push 0x1c93
call dword [sym.imp.USER32.dll_GetSysColorBrush]
jmp 0x1004297b
test dl, dl
je 0x100428d7
mov dword [ebp - 0x1c], 0xcec
cmp dword [ebp - 0x1c], 0xf98
jle 0x10042854
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
lea ecx, [ebp - 0x44]
or eax, edi
or eax, esi
cdq
push edx
push eax
call fcn.10001a31
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10042826
mov eax, dword [eax]
push eax
call fcn.1004b616
pop ecx
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.1000230b
inc ebx
cmp ebx, 0x197f
jl 0x1004280b
inc edi
cmp edi, 0x7b30
jl 0x10042809
inc esi
cmp esi, 0x6122
jl 0x10042807
push 0x7c4d
push 0x31cf
lea eax, [ebp + 0x13]
mov byte [ebp + 0x13], 0
push eax
push 1
xor dl, dl
xor cl, cl
call fcn.100426b3
mov dword [ebp - 0x20], 0x22d1
add esp, 0x10
cmp dword [ebp - 0x20], 0x710
jge 0x100428ba
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
push str._d_d
call fcn.1004ba5e
mov eax, dword [ebp - 0x28]
add esp, 0xc
cmp dword [ebp - 0x2c], eax
jne 0x100428af
push eax
push 0x1006dd20
call fcn.1004b616
pop ecx
jmp 0x100428b9
push 0x100730ac
call fcn.1004bf06
pop ecx
cmp dword [ebp - 0x1c], 0xaa6
jge 0x1004297b
push str.vdwq_fmqrzigy_argbg
call fcn.1004b616
pop ecx
jmp 0x1004297b
mov dword [ebp - 0x20], 0x2da6
cmp dword [ebp - 0x20], 0x3175
jle 0x10042920
xor esi, esi
mov ebx, esi
mov dword [ebp - 0x1c], 0x8b3
xor edi, edi
mov eax, ebx
mov ecx, 0x100812f8
xor eax, edi
cdq
push edx
push eax
call fcn.10001ee2
inc edi
cmp edi, 0x69e7
jl 0x100428f4
dec ebx
dec dword [ebp - 0x1c]
jne 0x100428f2
inc esi
cmp esi, 0xf63
jl 0x100428e9
mov edi, dword [ebp - 0x24]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x2a11
jge 0x1004295e
mov edx, str.klbqfm_zololshai_uotjcg_zbvvoft_dldn_qqlgj_iiguzpb
mov ecx, 0x100812f8
call fcn.1000395e
jmp 0x1004295e
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
jmp 0x10042976
mov ecx, dword [edx]
mov eax, dword [edi]
mov dword [eax + ecx*4], 0x36432a27
inc dword [edx]
cmp dword [edx], 1
jl 0x10042969
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret