joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10013392
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f066
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100134b3
mov dword [ebp - 0x24], 0xd1b
mov dword [ebp - 0x2c], str.wbildb_lmkc_gfpb_gnyqhlo_gzygb_blyeh_nfjvfvp_njajk_xhlrrjfqu_zvlo_wbsdso_vbh_ujzfrtz
cmp dword [ebp - 0x24], 0xf62
jle 0x1001346d
push 0
call dword [sym.imp.USER32.dll_CharNextW]
and dword [ebp - 0x18], 0
jmp 0x100133f0
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x41b4
jge 0x10013465
and dword [ebp - 0x1c], 0
jmp 0x10013406
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x5cad
jge 0x10013463
and dword [ebp - 0x20], 0
jmp 0x1001341c
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x7f33
jge 0x10013461
mov eax, dword [ebp - 0x18]
and eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x20]
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x64]
call fcn.10001a99
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
call fcn.10005fc0
push eax
call fcn.100460fd
pop ecx
lea ecx, [ebp - 0x64]
call fcn.10005fb6
jmp 0x10013415
jmp 0x100133ff
jmp 0x100133e9
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
push 0
call fcn.100139ce
pop ecx
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x97a
jge 0x1001348b
push dword [ebp - 0x2c]
call fcn.100460fd
pop ecx
jmp 0x100134a7
or dword [ebp - 4], 0xffffffff
jmp 0x100134b1
jmp 0x10013527
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x100134dc
push 0x2356
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
jmp 0x10013527
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x1001350a
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 1
jge 0x10013527
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x44]
call fcn.1000668f
mov dword [eax], 1
jmp 0x100134ff
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10020e53
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
push esi
push edi
push 0
mov dword [esp + 0x24], 0x794e
mov esi, ecx
cmp dword [esp + 0x24], 0x7981
pop ebx
mov dword [esp + 0x24], esi
mov dword [esp + 0x14], ebx
jle 0x10020f05
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov edi, ebx
mov dword [esp + 0x1c], ebx
mov eax, ebx
mov dword [esp + 0x18], 0x56dd
mov dword [esp + 0x10], eax
mov esi, ebx
mov ecx, esi
shl eax, cl
lea ecx, [esp + 0x28]
or eax, edi
cdq
push edx
push eax
call fcn.10001a99
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10020ebb
mov eax, dword [eax]
push eax
call fcn.100460fd
pop ecx
push ebx
push 1
lea ecx, [esp + 0x30]
call fcn.10006e56
mov eax, dword [esp + 0x10]
inc esi
cmp esi, 0x572e
jl 0x10020e9f
mov esi, dword [esp + 0x1c]
add eax, esi
dec dword [esp + 0x18]
mov dword [esp + 0x10], eax
jne 0x10020e9d
inc esi
mov dword [esp + 0x1c], esi
cmp esi, 0x23ba
jl 0x10020e8f
inc edi
cmp edi, 0x39b2
jl 0x10020e8b
mov esi, dword [esp + 0x24]
cmp dword [esp + 0x20], 0x764a
jge 0x10020f1a
push str.txylfec_zjf_ihlefnygp_touxdv_vqcpd_xcu_dpoetp_khblxusph_kflvgmkjn_akusytlsy_hmedqmv_essrf_yzdbvdf_gnk
call fcn.100460fd
pop ecx
mov edi, dword [esi + 0x10]
mov eax, edi
mov dword [esp + 0x20], eax
test edi, edi
je 0x10020f72
cmp edi, ebx
jbe 0x10020f79
cmp dword [esi + 0x14], 0x10
jb 0x10020f33
mov esi, dword [esi]
mov dl, byte [esp + 0x14]
mov bl, byte [esi + ebx]
sub dl, 0x38
mov cl, bl
call fcn.100328eb
movsx esi, al
xor edx, edx
movsx eax, bl
mov ebx, dword [esp + 0x14]
add eax, ebx
push 0x19
pop ecx
div ecx
mov eax, dword [esp + 0x20]
mov ecx, edx
shl esi, cl
add eax, esi
mov esi, dword [esp + 0x24]
inc ebx
mov dword [esp + 0x20], eax
mov dword [esp + 0x14], ebx
cmp ebx, edi
jb 0x10020f27
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push str.osAsvvthLbsHvOsTLHVPSKz
call fcn.100410b6
int3
Function at 0x10026789
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f6b7
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], 0x774
mov dword [ebp - 0x38], str.mtvfu_wpps_vpndpbv_xmxgex_lncazr_cyv_kndeajhqw
cmp dword [ebp - 0x20], 0x81c
jle 0x1002685d
push 0x10a9
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
and dword [ebp - 0x1c], 0
jmp 0x100267e7
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x5ad8
jge 0x1002685d
and dword [ebp - 0x14], 0
jmp 0x100267fd
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x4f4c
jge 0x1002685b
and dword [ebp - 0x18], 0
jmp 0x10026813
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x223b
jge 0x10026859
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x18]
or eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
lea ecx, [ebp - 0x58]
call fcn.10001a99
pop ecx
pop ecx
mov dword [ebp - 0x24], eax
mov ecx, dword [ebp - 0x24]
call fcn.10005fc0
push eax
call fcn.100460fd
pop ecx
lea ecx, [ebp - 0x58]
call fcn.10005fb6
jmp 0x1002680c
jmp 0x100267f6
jmp 0x100267e0
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100268dd
lea eax, [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x100268a9
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x100268a7
push 0
push 0x29eb
push 1
push 0x290d
call fcn.100239ef
add esp, 0x10
jmp 0x100268db
push 0x22e0
push 0x188b
push 0x1fb
push 0x12b2
push 0x1c18
push 0xb3e
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
jmp 0x100268f6
push 0
push 0x6384
push 0x6b36
push 0x7c75
call fcn.10026c68
add esp, 0x10
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x5b8
jge 0x1002690c
push dword [ebp - 0x38]
call fcn.100460fd
pop ecx
jmp 0x10026928
or dword [ebp - 4], 0xffffffff
jmp 0x10026932
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10026c88
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f6cb
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x6c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x10026e4f
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10026e26
mov dword [ebp - 0x28], 0x5a6d
mov dword [ebp - 0x38], str.yijfnwbol_edlgakfm_tewocww_hatdlhlzg_ovdtlqnr_yntztosy_jlpv_zqerqvyx_tnm_vhmq_scnqiyyd_ssqdxu_gbnevdaid_xzdikka
cmp dword [ebp - 0x28], 0x5c34
jle 0x10026db2
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
and dword [ebp - 0x18], 0
jmp 0x10026d14
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x7eff
jge 0x10026db2
and dword [ebp - 0x1c], 0
jmp 0x10026d2e
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x7a4
jge 0x10026dad
and dword [ebp - 0x20], 0
jmp 0x10026d44
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x3d7d
jge 0x10026da8
and dword [ebp - 0x24], 0
jmp 0x10026d5a
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x22ca
jge 0x10026da6
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
sar eax, cl
mov ecx, dword [ebp - 0x20]
and ecx, dword [ebp - 0x24]
xor eax, ecx
cdq
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], edx
push dword [ebp - 0x60]
push dword [ebp - 0x64]
lea ecx, [ebp - 0x7c]
call fcn.10001a99
pop ecx
pop ecx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
call fcn.10005fc0
push eax
call fcn.100460fd
pop ecx
lea ecx, [ebp - 0x7c]
call fcn.10005fb6
jmp 0x10026d53
jmp 0x10026d3d
jmp 0x10026d27
jmp 0x10026d0d
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x44], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x59fb
jge 0x10026dce
push dword [ebp - 0x38]
call fcn.100460fd
pop ecx
jmp 0x10026dea
or dword [ebp - 4], 0xffffffff
jmp 0x10026df4
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x58], eax
push dword [ebp - 0x50]
mov ecx, dword [ebp - 0x54]
call fcn.1003264f
mov ecx, dword [ebp - 0x58]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x10026e4d
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x10026e4d
push 0x1f46
push 1
push 1
push 0x3530
push 0x33d1
call fcn.100230dd
add esp, 0x14
jmp 0x10026e61
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x5c], eax
push 0
push dword [ebp - 0x5c]
call fcn.10022d93
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10032fe9
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005f992
call fcn.1005e208
sub esp, 0x14
mov byte [ebp - 0x14], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x1003301c
push 0
call dword [sym.imp.USER32.dll_SetCursor]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x10033039
push 0
push 0x17e0
mov edx, 0x7cd6
xor cl, cl
call fcn.10037229
pop ecx
pop ecx
mov dword [ebp - 0x20], 0x27df
cmp dword [ebp - 0x20], 0x2b69
jle 0x100330a1
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x18], edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov edi, edx
xor esi, esi
mov eax, esi
mov ecx, 0x1007d6f8
xor eax, ebx
or eax, edi
cdq
push edx
push eax
call fcn.100062e1
inc esi
cmp esi, 0x5391
jl 0x1003305e
inc ebx
cmp ebx, 0x5e07
jl 0x1003305c
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x4c70
jl 0x10033053
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x2b2d
jl 0x1003304e
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x26a0
jge 0x1003300b
mov edx, str.fjngznrj_gmgb_che_ozniiyi_bfh_bmm_dmi_sbcyy_kfknzkl_ngolpa_deowc_snnlwx_kvelbdf
mov ecx, 0x1007d6f8
call fcn.1000aa27
jmp 0x1003300b
Function at 0x10036fdc
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005fac2
call fcn.1005e208
push ecx
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, ecx
je 0x10037040
cmp byte [ebp + 0xc], 0
je 0x1003701a
cmp byte [edx], 0
je 0x100370e1
push ecx
push 0x29f4
push ecx
xor cl, cl
call fcn.10035bdf
add esp, 0xc
jmp 0x100370e1
mov eax, dword [ebp + 0x10]
xor ecx, ecx
mov edx, dword [ebp + 0x2c]
mov dword [eax], 1
mov eax, dword [edx]
test eax, eax
mov eax, dword [ebp + 0x14]
setne cl
mov dword [eax], ecx
mov eax, dword [ebp + 8]
mov ecx, dword [edx]
mov dword [eax], ecx
jmp 0x100370e1
cmp byte [ebp + 0x24], 0
je 0x1003706b
mov dword [esi], 1
cmp dword [esi], 0
jl 0x100370e1
mov edx, dword [ebp + 0x28]
mov ecx, dword [esi]
mov eax, dword [edx]
cmp dword [eax + ecx*4], 0
jne 0x100370e1
dec dword [esi]
cmp dword [esi], 0
jge 0x10037058
jmp 0x100370e1
mov dword [ebp + 0x18], 0x1a7c
cmp dword [ebp + 0x18], 0x1b2f
jle 0x100370ac
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegUnLoadKeyW]
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x1007d6f8
xor eax, esi
cdq
push edx
push eax
call fcn.100062e1
inc edi
cmp edi, 0xbb7
jl 0x10037089
inc esi
cmp esi, 0x9bc
jl 0x10037087
and dword [ebp - 4], 0
cmp dword [ebp + 0x18], 0x16db
jge 0x100370c8
mov edx, str.xienn_lruxk_wazz_xlreukqvb_wasqgk_etb_soewkyvh_ylxzv_ziob_sbwzdqjbf
mov ecx, 0x1007d6f8
call fcn.1000aa27
mov eax, dword [ebp + 0x20]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [eax]
mov eax, dword [ebp + 0x30]
sub ecx, dword [eax]
sar ecx, 1
push ecx
mov ecx, dword [ebp + 0x1c]
call fcn.1000b885
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100378b6
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005fafb
call fcn.1005e208
sub esp, 0x14
push ebx
push esi
mov dword [ebp - 0x1c], 0x9db
mov esi, edx
cmp dword [ebp - 0x1c], 0xb16
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], esi
jle 0x10037923
xor edi, edi
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov eax, edi
xor esi, esi
cdq
idiv ebx
mov edi, edx
mov eax, edi
mov ecx, 0x1007d6f8
xor eax, esi
cdq
push edx
push eax
call fcn.100062e1
inc esi
cmp esi, 0x6780
jl 0x100378ee
mov edi, dword [ebp - 0x18]
inc ebx
cmp ebx, 0x1a26
jl 0x100378e5
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0xa42
jl 0x100378e3
mov esi, dword [ebp - 0x20]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x5fb
jge 0x1003795e
mov edx, str.cqlllne_jiydm_ayic_zcxhd_fuk_zow_oskn_phlmcpqp_woudj_ntjlhp_ltkoc_qft_mwfqem
mov ecx, 0x1007d6f8
call fcn.1000aa27
jmp 0x1003795e
cmp byte [ebp + 0x10], 0
je 0x10037996
mov edx, dword [ebp + 0x20]
mov ecx, dword [edx]
mov eax, dword [esi]
add ecx, eax
mov eax, dword [ebp + 0xc]
cmp dword [eax], ecx
jl 0x10037986
mov eax, dword [edx]
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax]
mov eax, dword [edx]
mov eax, dword [esi]
mov eax, dword [edx]
mov eax, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [eax]
mov dword [eax + ecx*4], 1
jmp 0x100379aa
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x100379aa
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100379bb
Capabilities:
Get file size

Disassembly:
mov eax, 0x1005fb05
call fcn.1005e208
sub esp, 0x30
mov byte [ebp - 0x1c], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x10037a73
mov dword [ebp - 0x20], 0x639e
cmp dword [ebp - 0x20], 0x6617
jle 0x10037a2b
xor esi, esi
xor edi, edi
mov eax, edi
lea ecx, [ebp - 0x38]
or eax, esi
cdq
push edx
push eax
call fcn.10001a99
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10037a06
mov eax, dword [eax]
push eax
call fcn.100460fd
pop ecx
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.10006e56
inc edi
cmp edi, 0x49c4
jl 0x100379ed
inc esi
cmp esi, 0x4d7
jl 0x100379eb
cmp dword [ebp - 0x20], 0x62ec
jge 0x10037a3f
push str.gim_kfkkoag_ryzcqi_yfnw_gkjticxkr_xhjhrfqs_xlmwcehmx
call fcn.100460fd
pop ecx
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x10037a62
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x7222631
inc dword [edx]
cmp dword [edx], 3
jl 0x10037a50
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [ebp - 0x15], 0
cmp byte [ebp - 0x15], 0
je 0x10037a9b
push 0x1bec
push 0x53f
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateCompatibleBitmap]
mov dword [ebp - 0x20], 0x2695
cmp dword [ebp - 0x20], 0x277a
jle 0x10037aea
xor esi, esi
xor edi, edi
xor ebx, ebx
lea ecx, [ebx + edi]
mov eax, esi
shl eax, cl
mov ecx, 0x1007d6f8
cdq
push edx
push eax
call fcn.100062e1
inc ebx
cmp ebx, 0x24ea
jl 0x10037ab1
inc edi
cmp edi, 0x4480
jl 0x10037aaf
inc esi
cmp esi, 0xa0
jl 0x10037aad
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x2487
jge 0x10037a62
mov edx, str.bvuhkpjgi_zik_zky_zxseu_yzkje_txih_hka_guidrbx_wvqa_xokzavj_qdizl_eqaocyh_xpq
mov ecx, 0x1007d6f8
call fcn.1000aa27
jmp 0x10037a62
Function at 0x10038a2b
Capabilities:
Get file size

Disassembly:
mov eax, 0x1005fb66
call fcn.1005e208
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 0x18], 0xc43
mov ebx, edx
mov edi, ecx
mov dword [ebp - 0x10], esp
xor esi, esi
mov dword [ebp - 0x20], ebx
cmp dword [ebp - 0x18], 0x100f
mov dword [ebp - 0x1c], edi
jle 0x10038ac9
push 1
push esi
push 0x6b1
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetScrollInfo]
mov ebx, esi
mov edi, esi
mov eax, esi
mov dword [ebp - 0x14], esi
and eax, edi
lea ecx, [ebp - 0x38]
or eax, ebx
cdq
push edx
push eax
call fcn.10001a99
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10038a91
mov eax, dword [eax]
push eax
call fcn.100460fd
pop ecx
push esi
push 1
lea ecx, [ebp - 0x38]
call fcn.10006e56
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x5415
jl 0x10038a78
inc edi
cmp edi, 0x4690
jl 0x10038a73
inc ebx
cmp ebx, 0x57ad
jl 0x10038a71
mov edi, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x20]
cmp dword [ebp - 0x18], 0x907
jge 0x10038add
push str.qknav_sfal_zoibq_vlcaczv_bkqw_trajh_jzc_fndoaqbs_sjgzhep_mpoeuexyy_fuv_pjragooo_hggbji
call fcn.100460fd
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 8], 0
je 0x10038b93
mov dword [ebp - 0x14], 0x3d26
cmp dword [ebp - 0x14], 0x3e7b
jle 0x10038b40
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x18], 0x2cce
mov dword [ebp - 0x20], esi
mov ecx, esi
mov eax, ebx
shl eax, cl
mov ecx, 0x1007d6f8
cdq
push edx
push eax
call fcn.100062e1
inc esi
cmp esi, 0x2778
jl 0x10038b09
add ebx, edi
dec dword [ebp - 0x18]
push 0
pop esi
jne 0x10038b06
inc edi
cmp edi, 0x4d28
jl 0x10038afd
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov edx, dword [ebp + 0x14]
push 2
pop ebx
mov dword [edx], esi
cmp dword [edx], ebx
jge 0x10038b5c
mov edi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [edi]
mov dword [eax + ecx*4], esi
inc dword [edx]
cmp dword [edx], ebx
jl 0x10038b4f
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x14], 0x3bb3
jge 0x10038b77
mov edx, str.edhb_wakkecmei_iiugajn
mov ecx, 0x1007d6f8
call fcn.1000aa27
jmp 0x10038ba9
mov dword [edi], esi
jmp 0x10038ba4
mov ecx, dword [edi]
mov eax, dword [ebx]
mov dword [eax + ecx*4], 0xe763
inc dword [edi]
cmp dword [edi], 3
jl 0x10038b97
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x45ca75
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.00464e6e
add esp, 0xc
jb 0x45ca90
mov esp, esp
xchg ecx, ecx
jg 0x45caac
pushf
shl esi, 0
rol ecx, 7
rol ecx, 0x19
popf
jg 0x45caa5
mov edi, edi
xchg ecx, ecx
jle 0x45caac
lcall 0x45c6, 0x53e445c6
bnd jo 0x45ca7b
mov byte [ebp - 0x1c], 0x53
mov byte [ebp - 0xe], 0x70
mov byte [ebp - 0x19], 0x65
inc ebp
out 0x65, eax
mov byte [ebp - 0x13], 0x74
mov byte [ebp - 0x11], 0x4e
mov byte [ebp - 0x17], 0x73
mov byte [ebp - 0xc], 0x7a
mov byte [ebp - 0x16], 0x70
mov byte [ebp - 0x14], 0x66
mov byte [ebp - 0x1b], 0x66
mov byte [ebp - 0x12], 0x74
mov byte [ebp - 0x18], 0x51
mov byte [ebp - 0x15], 0x64
mov byte [ebp - 0x10], 0x66
mov byte [ebp - 0xf], 0x6e
mov byte [ebp - 0x1a], 0x62
mov byte [ebp - 0xd], 0x73
mov byte [ebp - 0xb], 0
mov esp, esp
jmp 0x45caf8
and ecx, ecx
cmc
jbe 0x45cb14
jno 0x45caff
lea ebx, [ebx + 0x5a7e]
lea ebx, [ebx - 0x5a7e]
ja 0x45cb0d
mov edx, edx
ja 0x45cb14
mov edi, 0x4d8aa880
in al, 0x80
jmp 0xe493531e
mov cl, byte [ebp - 0x1c]
sub cl, 1
mov byte [ebp - 0x1c], cl
mov dl, byte [ebp - 0x11]
sub dl, 1
mov byte [ebp - 0x11], dl
mov al, byte [ebp - 0x1a]
sub al, 1
mov byte [ebp - 0x1a], al
mov cl, byte [ebp - 0x18]
sub cl, 1
mov byte [ebp - 0x18], cl
mov dl, byte [ebp - 0x10]
sub dl, 1
mov byte [ebp - 0x10], dl
mov al, byte [ebp - 0xc]
sub al, 1
mov byte [ebp - 0xc], al
mov cl, byte [ebp - 0x14]
sub cl, 1
mov byte [ebp - 0x14], cl
mov dl, byte [ebp - 0x16]
sub dl, 1
mov byte [ebp - 0x16], dl
mov al, byte [ebp - 0x13]
sub al, 1
mov byte [ebp - 0x13], al
mov cl, byte [ebp - 0x12]
sub cl, 1
mov byte [ebp - 0x12], cl
mov dl, byte [ebp - 0x1b]
sub dl, 1
mov byte [ebp - 0x1b], dl
mov al, byte [ebp - 0xf]
sub al, 1
mov byte [ebp - 0xf], al
mov cl, byte [ebp - 0x15]
sub cl, 1
mov byte [ebp - 0x15], cl
mov dl, byte [ebp - 0xe]
sub dl, 1
mov byte [ebp - 0xe], dl
mov al, byte [ebp - 0xd]
sub al, 1
mov byte [ebp - 0xd], al
mov cl, byte [ebp - 0x19]
sub cl, 1
mov byte [ebp - 0x19], cl
mov dl, byte [ebp - 0x17]
sub dl, 1
mov byte [ebp - 0x17], dl
mov al, byte [ebp - 0xb]
sub al, 1
mov byte [ebp - 0xb], al
call fcn.0046a37e
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jne 0x45cbc2
xor eax, eax
jmp 0x45cc36
lea ecx, [ebp - 0x1c]
push ecx
mov edx, dword [ebp - 8]
push edx
call fcn.0046b05f
mov dword [ebp - 4], eax
push 0x12
push 0
lea eax, [ebp - 0x1c]
push eax
call fcn.00464e6e
add esp, 0xc
cmp dword [ebp - 4], 0
je 0x45cc34
xor ebx, 0
jns 0x45cbf8
pushf
ja 0x45cbf1
popf
jbe 0x45cbf5
js 0x45cbf8
call 0x52421987
mov ecx, dword [ebp - 4]
push ecx
call fcn.0046394c
add esp, 4
add esp, 0
nop
shl esp, 0
cmp ebx, 0x642e
jnp 0x45cc1b
jns 0x45cc15
js 0x45cc17
jp 0x45cc1b
mov esi, 0x18558bd8
mov edx, dword [ebp + 0x18]
push edx
mov eax, dword [ebp + 0x14]
push eax
mov ecx, dword [ebp + 0x10]
push ecx
mov edx, dword [ebp + 0xc]
push edx
mov eax, dword [ebp + 8]
push eax
call dword [ebp - 4]
jmp 0x45cc36
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0x14