joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10008be1
Capabilities:
Get common file path

Disassembly:
mov eax, 0x100572fe
call fcn.10056a88
sub esp, 0xc
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x10008c8f
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10008c73
mov dword [ebp - 0x14], 0x14d7
cmp dword [ebp - 0x14], 0x1516
jle 0x10008c4a
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x100711f8
or eax, edi
or eax, esi
cdq
push edx
push eax
call fcn.10003fa2
inc ebx
cmp ebx, 0x5e13
jl 0x10008c1c
inc edi
cmp edi, 0x255
jl 0x10008c1a
inc esi
cmp esi, 0x6c98
jl 0x10008c18
push 0xa8d
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x1370
jge 0x10008c73
mov edx, str.exuzs_zwvtsgjf_piltwfi
mov ecx, 0x100711f8
call fcn.1000634f
jmp 0x10008ca1
mov eax, dword [ebp + 0x18]
mov ecx, dword [edx]
sub ecx, dword [eax]
sar ecx, 1
push ecx
mov ecx, dword [ebp + 8]
call fcn.1000ed5c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10008fa5
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10057312
call fcn.10056a88
sub esp, 0x10
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x10008fcb
push 0x1f4b
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x1000904a
mov dword [ebp - 0x1c], 0x37d5
cmp dword [ebp - 0x1c], 0x3818
jle 0x10009016
xor esi, esi
mov dword [ebp - 0x18], esi
mov edi, esi
mov ebx, 0x2621
xor esi, esi
mov eax, edi
mov ecx, 0x100711f8
xor eax, esi
cdq
push edx
push eax
call fcn.10003fa2
inc esi
cmp esi, 0x72d0
jl 0x10008fe9
dec edi
dec ebx
jne 0x10008fe7
mov esi, dword [ebp - 0x18]
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x5410
jl 0x10008fe0
mov byte [ebp - 0x11], 0
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x355f
jge 0x10009036
mov edx, str.oxsff_mih_qvlqgu_tfajrf_hfbojxki_fxgdn_pevomuncn_pmgfal_cjeehrd_ubpzndgni
mov ecx, 0x100711f8
call fcn.1000634f
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x11], 0
je 0x1000904a
push 0
push ecx
call fcn.100089bf
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009910
Capabilities:
Create thread

Disassembly:
mov eax, 0x10057338
call fcn.10056a88
sub esp, 0x24
push ebx
push esi
mov byte [ebp - 0x14], dl
mov dword [ebp - 0x28], 0x1eb0
cmp dword [ebp - 0x28], 0x1f84
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x30], ecx
jle 0x100099c1
call dword [sym.imp.KERNEL32.dll_GetACP]
xor ebx, ebx
mov esi, ebx
mov dword [ebp - 0x24], ebx
mov edi, ebx
mov dword [ebp - 0x20], ebx
mov eax, edi
mov dword [ebp - 0x1c], ebx
xor eax, esi
mov dword [ebp - 0x2c], eax
mov esi, eax
mov edi, ebx
mov ebx, dword [ebp - 0x1c]
mov ecx, edi
mov eax, ebx
sar eax, cl
mov ecx, 0x100711f8
or eax, esi
cdq
push edx
push eax
call fcn.10003fa2
inc edi
cmp edi, 0x4e3b
jl 0x10009960
inc ebx
push 0
mov dword [ebp - 0x1c], ebx
cmp ebx, 0x561a
pop ebx
jl 0x1000995b
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x24]
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x5ebc
jl 0x1000994f
inc esi
mov dword [ebp - 0x24], esi
cmp esi, 0x6532
jl 0x1000994a
push ebx
push 0x10c8
push ebx
push ebx
push 0x1142
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x100099c3
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x28], 0x1cac
jge 0x100099fc
mov edx, str.iafukntcw_bixyzwcob_emsnjnniy_pamncofkt_njaoygpcy_hnjqn_dslfgxhac_ddnlb
mov ecx, 0x100711f8
call fcn.1000634f
jmp 0x100099fc
cmp byte [ebp - 0x14], 0
je 0x10009a23
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ecx]
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
mov eax, dword [ecx]
mov ecx, dword [ebp - 0x30]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x10009a52
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10009a52
push 0x158f
push ebx
push ebx
push 0x9f0
push 0x15a5
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetDIBits]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a8f7
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10057360
call fcn.10056a88
sub esp, 0x18
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], dl
je 0x1000aa07
cmp byte [ebp + 8], 0
je 0x1000a9dd
mov dword [ebp - 0x1c], 0x4d65
cmp dword [ebp - 0x1c], 0x4d74
jle 0x1000a98e
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp + 0x14], edi
and dword [ebp - 0x24], 0
mov ecx, edi
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x20], esi
shl esi, cl
mov eax, esi
mov ecx, 0x100711f8
and eax, edi
xor eax, ebx
cdq
push edx
push eax
call fcn.10003fa2
inc edi
cmp edi, 0x4e61
jl 0x1000a94b
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp + 0x14], edi
cmp edi, 0x68c9
jl 0x1000a93d
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x1e7e
jl 0x1000a938
inc ebx
cmp ebx, 0x2651
jl 0x1000a933
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1000a9a2
mov dl, 1
push 0
mov cl, dl
call fcn.10009b47
pop ecx
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x4bec
jge 0x1000a9be
mov edx, str.wqe_wsiu_hjhcgl_ktkigczhh_agj_xngmbrhau_anpo_qrgo_joddlgqrs_zxganexz
mov ecx, 0x100711f8
call fcn.1000634f
jmp 0x1000aa5e
mov byte [ebp + 0x17], 0
cmp byte [ebp + 0x17], 0
je 0x1000aa5e
push 0x25c5
push 0x1c19
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetPixel]
jmp 0x1000aa5e
test dl, dl
je 0x1000aa2a
cmp byte [ecx], 0
je 0x1000aa5e
push 1
push 1
push 0
mov edx, 0x480f
mov ecx, 0x4d1b
call fcn.10009511
add esp, 0xc
jmp 0x1000aa5e
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1000aa5e
push 0
push 1
push 0x6603
push 0x73ff
push 0xc20
push 0x1290
push 1
mov edx, 0x5bf3
mov ecx, 0x134b
call fcn.10007d8f
add esp, 0x1c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10012744
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100574c6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1001279a
lea eax, [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10012788
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
jmp 0x10012795
push 0x6f8
push 0
call dword [sym.imp.KERNEL32.dll_IsValidLocale]
jmp 0x100128f6
mov dword [ebp - 0x24], 0x6af6
mov dword [ebp - 0x30], str.gnquqbamo_gooxga_zutyzuah_knwpaqrnq
cmp dword [ebp - 0x24], 0x6dcd
jle 0x10012888
push 0x13c0
push 0
push 0xc05
push 0x1204
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_TextOutA]
and dword [ebp - 0x1c], 0
jmp 0x100127e7
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x5caf
jge 0x10012888
and dword [ebp - 0x14], 0
jmp 0x10012801
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x6441
jge 0x10012883
and dword [ebp - 0x18], 0
jmp 0x10012817
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2d9b
jge 0x1001287e
and dword [ebp - 0x20], 0
jmp 0x1001282d
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0xb8b
jge 0x1001287c
mov eax, dword [ebp - 0x14]
cdq
idiv dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov ecx, edx
sar eax, cl
mov ecx, dword [ebp - 0x20]
shl eax, cl
cdq
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
push dword [ebp - 0x44]
push dword [ebp - 0x48]
lea ecx, [ebp - 0x60]
call fcn.10001a55
pop ecx
pop ecx
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
call fcn.10003f82
push eax
call fcn.1003e75c
pop ecx
lea ecx, [ebp - 0x60]
call fcn.10003f78
jmp 0x10012826
jmp 0x10012810
jmp 0x100127fa
jmp 0x100127e0
lea eax, [ebp + 0xc]
mov dword [ebp - 0x40], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x6762
jge 0x100128a4
push dword [ebp - 0x30]
call fcn.1003e75c
pop ecx
jmp 0x100128c0
or dword [ebp - 4], 0xffffffff
jmp 0x100128ca
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
push dword [ebp - 0x34]
push dword [ebp - 0x38]
push 0
mov eax, dword [ebp - 0x3c]
push dword [eax]
mov eax, dword [ebp - 0x40]
push dword [eax]
call fcn.1001297c
add esp, 0x14
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001d524
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
mov byte [esp + 4], cl
mov eax, edx
mov dword [esp + 0x14], 0x330e
cmp dword [esp + 0x14], 0x345f
push esi
push edi
mov dword [esp + 0x24], eax
jle 0x1001d5c2
xor esi, esi
mov dword [esp + 0x18], esi
mov dword [esp + 0x20], esi
mov dword [esp + 0x14], 0x7b36
xor edi, edi
xor ebx, ebx
mov ecx, ebx
mov eax, edi
sar eax, cl
lea ecx, [esp + 0x28]
xor eax, esi
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001d580
mov eax, dword [eax]
push eax
call fcn.1003e75c
pop ecx
push 0
push 1
lea ecx, [esp + 0x30]
call fcn.1000460a
inc ebx
cmp ebx, 0x1c80
jl 0x1001d562
inc edi
cmp edi, 0x7460
jl 0x1001d560
dec esi
dec dword [esp + 0x14]
jne 0x1001d55e
mov esi, dword [esp + 0x18]
inc esi
mov dword [esp + 0x18], esi
cmp esi, 0x5110
jl 0x1001d552
mov eax, dword [esp + 0x24]
cmp byte [ebp + 0x14], 0
je 0x1001d5f1
cmp byte [ebp + 0x10], 0
je 0x1001d5dd
mov eax, dword [ebp + 8]
mov ecx, dword [ebp + 0xc]
push dword [eax]
call fcn.1000ed5c
jmp 0x1001d625
cmp byte [eax], 0
je 0x1001d625
push 0xa8d
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x1001d625
cmp byte [esp + 0xc], 0
je 0x1001d60c
push ecx
lea eax, [esp + 0x17]
mov byte [esp + 0x17], 0
push eax
call fcn.1001c77e
pop ecx
pop ecx
jmp 0x1001d625
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
call esi
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_ReleaseDC]
cmp dword [esp + 0x1c], 0x2f9c
jge 0x1001d63a
push str.ucapu_jobdk_uudqdn_bhs_mrya
call fcn.1003e75c
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001e86c
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov dword [0x10444f14], ecx
inc edx
mov esi, 0x270
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
mov dword [edx*4 + 0x10444f14], ecx
inc edx
cmp edx, esi
jl 0x1001e881
mov dword [0x10444f10], esi
pop esi
pop ebp
ret 8

Function at 0x1001e8a7
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x10444f14
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x104452a0
jl 0x1001e8b5
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x10445544
jl 0x1001e8f5
mov ecx, dword [0x10446290]
xor ecx, dword [0x10444f14]
and ecx, edi
xor ecx, dword [0x10446290]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x10444f10], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10445544]
mov dword [0x104458d0], eax
pop esi
ret
Function at 0x1002161d
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10057858
call fcn.10056a88
sub esp, 0x30
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], edi
je 0x10021654
cmp byte [ebp + 0x1c], 0
mov eax, dword [ebp + 0xc]
jne 0x1002164c
mov eax, dword [ebp + 0x18]
and dword [eax], 0
jmp 0x10021738
mov dword [ebp - 0x1c], 0x3d9e
xor ebx, ebx
cmp dword [ebp - 0x1c], 0x3dc3
jle 0x100216c6
mov esi, ebx
mov edi, ebx
mov ecx, ebx
mov dword [ebp + 8], ebx
mov eax, edi
cdq
idiv ecx
mov eax, esi
lea ecx, [ebp - 0x38]
sub eax, edx
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002168d
mov eax, dword [eax]
push eax
call fcn.1003e75c
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x38]
call fcn.1000460a
mov ecx, dword [ebp + 8]
inc ecx
mov dword [ebp + 8], ecx
cmp ecx, 0x652b
jl 0x1002166f
inc edi
cmp edi, 0x3c26
jl 0x1002166a
inc esi
cmp esi, 0x2add
jl 0x10021668
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x18]
cmp byte [ebp + 0x10], 0
je 0x10021749
mov eax, dword [esi]
mov ecx, 0xedca8fec
cmp ecx, eax
mov eax, dword [edi]
sbb ecx, ecx
xor edx, edx
inc ecx
cmp ecx, eax
mov eax, dword [esi]
sete dl
xor ecx, ecx
cmp eax, edx
mov eax, dword [esi]
setle cl
imul eax, ecx
test eax, eax
jne 0x100216f5
mov eax, dword [edi]
mov eax, dword [esi]
xor ecx, ecx
mov esi, dword [ebp + 0x14]
add eax, 9
mov dword [esi], eax
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
cmp eax, 0xffffffff
mov eax, dword [edi]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [edi]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esi]
sete cl
add eax, ecx
mov dword [edi], eax
cmp dword [ebp - 0x1c], 0x3c2c
jge 0x10021738
push str.mznxjjkt_nkuxvyuo_ipk
call fcn.1003e75c
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [ebp + 0xb], bl
cmp byte [ebp + 0xb], 0
je 0x10021724
mov dword [ebp - 0x18], 0x7ba4
cmp dword [ebp - 0x18], 0x7d5c
jle 0x100217a8
mov esi, ebx
mov dword [ebp + 8], ebx
mov edi, ebx
mov dword [ebp - 0x20], ebx
mov ebx, edi
and ebx, esi
mov esi, dword [ebp - 0x20]
mov eax, ebx
mov ecx, 0x100711f8
xor eax, esi
cdq
push edx
push eax
call fcn.10003fa2
inc esi
cmp esi, 0xa1e
jl 0x10021773
mov esi, dword [ebp + 8]
inc edi
push 0
pop ebx
cmp edi, 0x4318
jl 0x10021769
inc esi
mov dword [ebp + 8], esi
cmp esi, 0x46f6
jl 0x10021767
push ebx
push ebx
call dword [sym.imp.USER32.dll_UnregisterClassA]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x77fe
jge 0x10021724
mov edx, str.rfkmwkybb_jyjte_sjajbpopg
mov ecx, 0x100711f8
call fcn.1000634f
jmp 0x10021724
Function at 0x10022d37
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10057989
call fcn.10056a88
sub esp, 0x4c
push ebx
push esi
mov dword [ebp - 0x24], 0x354c
mov eax, edx
cmp dword [ebp - 0x24], 0x3566
mov ebx, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x1c], ebx
jle 0x10022db7
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_KillTimer]
xor esi, esi
mov edi, 0x100711f8
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
and eax, ebx
mov ecx, edi
xor eax, esi
cdq
push edx
push eax
call fcn.10003fa2
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x24ba
jl 0x10022d81
inc ebx
cmp ebx, 0xaa9
jl 0x10022d7c
inc esi
cmp esi, 0x2a29
jl 0x10022d7a
mov eax, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
jmp 0x10022dbc
mov edi, 0x100711f8
cmp byte [ebp + 8], 0
je 0x10022ef7
mov dword [ebp - 0x20], 0x44de
cmp dword [ebp - 0x20], 0x454d
jle 0x10022e14
xor esi, esi
mov dword [ebp - 0x18], esi
mov ebx, esi
mov dword [ebp - 0x14], 0x6ca8
xor esi, esi
mov ecx, esi
mov eax, ebx
sar eax, cl
mov ecx, edi
cdq
push edx
push eax
call fcn.10003fa2
inc esi
cmp esi, 0x1a09
jl 0x10022de6
dec ebx
dec dword [ebp - 0x14]
jne 0x10022de4
mov esi, dword [ebp - 0x18]
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x1c59
jl 0x10022ddb
mov eax, dword [ebp + 0x18]
mov edx, dword [eax]
mov eax, dword [ebp + 0x1c]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
cmp eax, dword [ecx + edx*4]
jge 0x10022eb8
mov dword [ebp - 0x1c], 0x2ada
cmp dword [ebp - 0x1c], 0x2e6d
jle 0x10022e9e
xor esi, esi
mov dword [ebp - 0x14], esi
xor ebx, ebx
mov dword [ebp - 0x18], 0x5cd5
xor edi, edi
mov esi, 0x23a5
mov eax, edi
lea ecx, [ebp - 0x3c]
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10022e6b
mov eax, dword [eax]
push eax
call fcn.1003e75c
pop ecx
push 0
push 1
lea ecx, [ebp - 0x3c]
call fcn.1000460a
add edi, ebx
dec esi
jne 0x10022e54
mov esi, dword [ebp - 0x14]
add ebx, esi
dec dword [ebp - 0x18]
jne 0x10022e4d
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x4f3b
jl 0x10022e44
mov edi, 0x100711f8
mov eax, dword [ebp + 0x20]
or dword [eax], 0xffffffff
cmp dword [ebp - 0x1c], 0x2912
jge 0x10022eb8
push str.wbimgnt_wkf_upbww
call fcn.1003e75c
pop ecx
mov dword [ebp - 4], 4
cmp dword [ebp - 0x20], 0x434c
jge 0x10022f22
mov edx, str.whyfo_bnl_ksy_oinmki
mov ecx, edi
call fcn.1000634f
jmp 0x10022f22
mov ecx, dword [ebp + 0x28]
push 0xffffffffffffffff
push dword [eax]
lea eax, [ebp - 0x54]
push eax
call fcn.1002421c
push eax
mov ecx, ebx
mov dword [ebp - 4], 6
call fcn.100242ca
push 0
push 1
lea ecx, [ebp - 0x54]
call fcn.100046d6
mov dword [ebp - 4], 7
cmp dword [ebp - 0x24], 0x340e
jge 0x10022f3e
mov edx, str.ugubhyl_ccgd_ivpv
mov ecx, edi
call fcn.1000634f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x431005
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
call 0x43100c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403e6a
nop
sub eax, 0x403e10
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
add ebx, 4
cmp ebx, ecx
nop
nop
nop
nop
jl 0x431030
nop
nop
nop
nop
nop
add eax, 0xc
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
jne 0x43101e
nop
nop
nop
nop
nop
nop
popal
nop
jmp fcn.00401219
Function at 0x40e8fd
Capabilities:
Hash data using sha1

Disassembly:
mov eax, dword [esp + 4]
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret 4

Function at 0x4129f9
Capabilities:
Create shortcut via ishelllink

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
lea eax, [ebp - 4]
push eax
push 0x413b8c
push 1
xor ebx, ebx
push ebx
push 0x413c3c
call dword [sym.imp.ole32.dll_CoCreateInstance]
test eax, eax
jl 0x412aca
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
lea edx, [ebp - 8]
push edx
push 0x413c2c
push eax
call dword [ecx]
test eax, eax
jl 0x412ac1
cmp byte [ebp + 8], bl
je 0x412a4c
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 2
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x14]
mov eax, dword [ebp - 4]
push dword [ebp + 0xc]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x50]
cmp dword [ebp + 0x18], ebx
je 0x412a69
mov eax, dword [ebp - 4]
push dword [ebp + 0x18]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x1c]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push ebx
cmp dword [ebp + 0x1c], ebx
jne 0x412a7b
push 0x413734
jmp 0x412a7e
push dword [ebp + 0x1c]
push eax
call dword [ecx + 0x44]
cmp dword [ebp + 0x20], ebx
je 0x412a93
mov eax, dword [ebp - 4]
push dword [ebp + 0x20]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x2c]
cmp dword [ebp + 0x14], ebx
je 0x412aa4
mov eax, dword [ebp - 4]
push dword [ebp + 0x14]
mov ecx, dword [eax]
push eax
call dword [ecx + 0x24]
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push 1
push dword [ebp + 0x10]
push eax
call dword [ecx + 0x18]
test eax, eax
jl 0x412ab8
mov bl, 1
mov eax, dword [ebp - 8]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov eax, dword [ebp - 4]
mov ecx, dword [eax]
push eax
call dword [ecx + 8]
mov al, bl
pop ebx
leave
ret 0x1c

Function at 0x412ae4
Capabilities:
Get common file path

Disassembly:
push dword [esp + 4]
push dword [esp + 0xc]
call dword [sym.imp.KERNEL32.dll_GetCurrentDirectoryW]
neg eax
sbb eax, eax
neg eax
ret 8

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
nop
nop
nop
nop
pop eax
nop
add eax, 0x40a063
nop
sub eax, 0x40a009
nop
nop
nop
mov ebx, dword [eax]
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x433030
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x43301e
nop
nop
nop
nop
nop
popal
jmp 0x431219
Function at 0x401271
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
push ebx
push esi
mov esi, dword [eax + 0x18]
sub esi, 8
push edi
mov dword [ebp - 8], esi
push dword [esi + 0x30]
call fcn.004033d8
xor ecx, ecx
push 2
inc eax
pop edx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.004037ee
push dword [esi + 0x30]
mov ebx, eax
call fcn.004033d8
xor ecx, ecx
mov word [ebx + eax*2], cx
mov eax, dword [esi + 0x30]
movzx eax, word [eax]
xor edi, edi
add esp, 0xc
mov dword [ebp - 4], edi
cmp ax, di
je 0x4012ee
movzx eax, ax
push eax
call fcn.00403651
inc dword [ebp - 4]
mov word [edi + ebx], ax
mov eax, dword [ebp - 4]
lea edi, [eax + eax]
mov eax, dword [esi + 0x30]
movzx eax, word [edi + eax]
pop ecx
test ax, ax
jne 0x4012cb
cmp dword [esi + 0x18], 0
je 0x401302
mov ecx, dword [ebp + 8]
mov edx, ebx
call fcn.0040124d
test eax, eax
jne 0x401318
mov esi, dword [esi + 0xc]
sub esi, 8
cmp dword [ebp - 8], esi
jne 0x40128b
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
mov eax, dword [esi + 0x18]
jmp 0x401313
Function at 0x402a52
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x40d03c]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, dword [0x40ea9c]
push edi
mov edi, dword [0x40eaa0]
push 5
mov eax, esi
lea ecx, [ebp - 0xc]
add edi, 0xffffffee
call fcn.00402809
push 0xd
lea eax, [esi + 5]
lea ecx, [ebp - 0x1c]
mov byte [ebp - 7], 0
call fcn.00402809
push edi
mov byte [ebp - 0xf], 0
call fcn.00403315
mov ecx, eax
mov eax, dword [0x40eaa0]
add eax, 0xffffffee
push eax
mov eax, dword [0x40ea9c]
add eax, 0x12
mov dword [ebp - 0x20], ecx
call fcn.00402809
add esp, 0x10
xor esi, esi
test edi, edi
je 0x402af3
push ebx
mov eax, dword [ebp - 0x20]
lea ecx, [esi + eax]
mov eax, esi
cdq
push 0xd
pop ebx
idiv ebx
push 5
pop ebx
lea eax, [ebp + edx - 0x1c]
mov dl, byte [eax]
xor byte [ecx], dl
mov dl, byte [ecx]
mov byte [eax], dl
mov eax, esi
cdq
idiv ebx
lea eax, [ebp + edx - 0xc]
mov dl, byte [eax]
xor byte [ecx], dl
mov cl, byte [ecx]
inc esi
mov byte [eax], cl
cmp esi, edi
jb 0x402abf
pop ebx
mov eax, dword [ebp - 0x20]
mov ecx, dword [ebp - 4]
mov dword [0x40eaa0], edi
pop edi
mov dword [0x40ea9c], eax
xor ecx, ebp
xor eax, eax
pop esi
call fcn.00402f38
leave
ret