joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10010536
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100105ad
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10010584
mov byte [ebp - 1], 0
push 0
push 1
lea eax, [ebp - 1]
push eax
push 0xcc0
push 0x507e
push 0x2f9d
push 0x24d0
call fcn.1000fb88
add esp, 0x1c
jmp 0x100105ab
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x100105ab
push 0
push 0xd17
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x100105c5
mov eax, dword [ebp + 8]
mov dword [ebp - 0x18], eax
push 1
push 0x180a
push dword [ebp - 0x18]
call fcn.1000d4c9
add esp, 0xc
mov esp, ebp
pop ebp
ret
Function at 0x1001f49c
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10056823
call fcn.10055910
sub esp, 0x14
mov byte [ebp - 0x18], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x1001f558
mov dword [ebp - 0x20], 0x5457
cmp dword [ebp - 0x20], 0x552c
jle 0x1001f511
xor esi, esi
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
add eax, ebx
mov ecx, 0x10071e38
add eax, edi
xor eax, esi
cdq
push edx
push eax
call fcn.10003dea
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x4e6
jl 0x1001f4d5
inc ebx
cmp ebx, 0x4f65
jl 0x1001f4d0
inc edi
cmp edi, 0x2172
jl 0x1001f4ce
inc esi
cmp esi, 0x70eb
jl 0x1001f4cc
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x5226
jge 0x1001f52d
mov edx, str.mbmcbfewd_dvdrr_wxmnsyk_rwqmatvia_rij_ieswcvue
mov ecx, 0x10071e38
call fcn.10005f73
mov eax, dword [ebp + 8]
or dword [ebp - 4], 0xffffffff
mov eax, dword [eax]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x1001f56d
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x1001f56d
push 0xb2d
call dword [sym.imp.GDI32.dll_CloseEnhMetaFile]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100283a1
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x100283fd
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x100283d5
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
jmp 0x100283fb
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
sub eax, 6
cdq
mov ecx, 0x1c3
idiv ecx
sub eax, 6
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
jmp 0x10028420
jmp 0x10028420
push 0x31b1
push 0x2261
push 0x6928
push 0x7bff
push 0x5ce
push 0
call fcn.1002d3e5
add esp, 0x18
mov esp, ebp
pop ebp
ret

Function at 0x100284c3
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10056c91
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x5c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1002866c
mov dword [ebp - 0x24], 0x1697
mov dword [ebp - 0x2c], str.pbtp_cnwkza_xijps_ugyv_ndg_xnpny_mxmzvwiw_fdilydtpu_pagfy_iznol_rabor_rulc
cmp dword [ebp - 0x24], 0x16b6
jle 0x100285cc
push 0
push 0x998
push 0x1761
push 0x2e8
call dword [sym.imp.KERNEL32.dll_RaiseException]
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x34], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x1524
jge 0x100285e8
push dword [ebp - 0x2c]
call fcn.1003eb1f
pop ecx
jmp 0x10028604
or dword [ebp - 4], 0xffffffff
jmp 0x1002860e
mov eax, dword [ebp + 8]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x10028642
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x10028640
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x1002866a
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
movzx eax, byte [eax]
test eax, eax
je 0x1002866a
push 0x21b0
push 0x5a7
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
jmp 0x10028684
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x4c], eax
push dword [ebp - 0x4c]
push 0x36c6
push 1
call fcn.1002620b
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100286b1
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10056c9b
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x54
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10028735
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x10028708
push 0
push 0x20c8
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x10028730
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x10028730
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
jmp 0x1002888a
lea eax, [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x10028765
push 0x2fb
push 0
push 0
push 0
push 0x4c
push 0
call dword [sym.imp.KERNEL32.dll_GetDateFormatW]
jmp 0x1002888a
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x1002888a
mov dword [ebp - 0x1c], 0x622e
mov dword [ebp - 0x44], str.gcdvz_rbm_brhebl_gqhabzf_rivkfnlo_fuw_jao_jlemcwdvq_xscwzea_hpdjrdadm_nzeime
cmp dword [ebp - 0x1c], 0x6552
jle 0x10028827
and dword [ebp - 0x14], 0
jmp 0x100287a7
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x6a98
jge 0x10028803
and dword [ebp - 0x18], 0
jmp 0x100287bd
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x230c
jge 0x10028801
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sar eax, cl
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
lea ecx, [ebp - 0x64]
call fcn.10002462
pop ecx
pop ecx
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
call fcn.10003dca
push eax
call fcn.1003eb1f
pop ecx
lea ecx, [ebp - 0x64]
call fcn.10003dc0
jmp 0x100287b6
jmp 0x100287a0
push 0x21ac
push 0x2088
push 0x2d0
push 0x1b5f
push 0x988
push 0x2682
call dword [sym.imp.GDI32.dll_PatBlt]
push 1
push 0x6dab
push 0x1a8b
push 0x6df3
push 0
push 0x79c8
push 1
push 0x1f93
call fcn.10027094
add esp, 0x20
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x611c
jge 0x10028864
push dword [ebp - 0x44]
call fcn.1003eb1f
pop ecx
jmp 0x10028880
or dword [ebp - 4], 0xffffffff
jmp 0x1002888a
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10028afb
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10056caf
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x34
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10028c72
lea eax, [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10028c26
mov dword [ebp - 0x24], 0xe50
mov dword [ebp - 0x2c], str.prtphga_vxa_klu
cmp dword [ebp - 0x24], 0x10c1
jle 0x10028bcb
push 0x125
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
and dword [ebp - 0x18], 0
jmp 0x10028b76
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0xe07
jge 0x10028bb9
and dword [ebp - 0x1c], 0
jmp 0x10028b8c
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x1f91
jge 0x10028bb7
mov eax, dword [ebp - 0x18]
cdq
idiv dword [ebp - 0x1c]
mov eax, edx
cdq
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x40], edx
push dword [ebp - 0x40]
push dword [ebp - 0x44]
mov ecx, 0x10071e38
call fcn.10003dea
jmp 0x10028b85
jmp 0x10028b6f
push 0x2706
push 0xb
push 0xdae
call dword [sym.imp.USER32.dll_CheckDlgButton]
mov byte [ebp - 0x11], 0
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0xc91
jge 0x10028be9
mov edx, dword [ebp - 0x2c]
mov ecx, 0x10071e38
call fcn.10005f73
jmp 0x10028c05
or dword [ebp - 4], 0xffffffff
jmp 0x10028c0f
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x10028c24
push 0
push 0x24ef
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x10028c70
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [eax], 1
jmp 0x10028c48
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
mov eax, dword [ebp - 0x20]
cmp dword [eax], 0
jl 0x10028c70
push 0x1348
push 0x2f16
push 0x7f53
push 0x3b2b
push 0
call fcn.1002f163
add esp, 0x14
jmp 0x10028c3d
jmp 0x10028c8e
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3c], eax
push dword [ebp - 0x38]
push 0
push dword [ebp - 0x3c]
call fcn.10026223
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10029059
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10056cc1
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x48
movzx eax, byte [ebp + 8]
test eax, eax
je 0x100291ef
lea eax, [ebp + 0xc]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x100291d1
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0x15
jmp 0x100290c2
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 3
jg 0x100291cf
mov dword [ebp - 0x18], 9
mov dword [ebp - 0x54], 9
mov dword [ebp - 0x50], 9
mov dword [ebp - 0x4c], 9
mov dword [ebp - 0x48], 9
mov dword [ebp - 0x18], 0
jmp 0x10029101
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1d
jg 0x100291ca
push 3
lea ecx, [ebp - 0x44]
call fcn.100018bd
and dword [ebp - 4], 0
mov dword [ebp - 0x1c], 0
jmp 0x10029129
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 3
jge 0x10029142
push dword [ebp - 0x1c]
lea ecx, [ebp - 0x44]
call fcn.1000195c
mov dword [eax], 0x14c90d29
jmp 0x10029122
push 2
lea ecx, [ebp - 0x44]
call fcn.1000195c
and dword [eax], 0
jmp 0x10029169
push 2
lea ecx, [ebp - 0x44]
call fcn.1000195c
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x20]
mov dword [ecx], eax
push 2
lea ecx, [ebp - 0x44]
call fcn.1000195c
cmp dword [eax], 3
jg 0x100291b9
mov dword [ebp - 0x10], 0xffffffff
mov dword [ebp - 0x10], 0
jmp 0x1002918f
mov eax, dword [ebp - 0x10]
inc eax
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 4
jge 0x100291a2
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x54], 0x61eefb6f
jmp 0x10029188
push 2
lea ecx, [ebp - 0x44]
call fcn.1000195c
mov eax, dword [eax]
cmp dword [ebp + eax*4 - 0x54], 0
je 0x100291b7
jmp 0x10029151
jmp 0x10029151
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x44]
call fcn.10001940
jmp 0x100290fa
jmp 0x100290b7
jmp 0x100291ed
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x100291ed
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x100291f7
push 1
call fcn.1002889b
pop ecx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1002b34c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002b3be
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1002b39f
mov byte [ebp - 1], 0
push 0x1a9e
push 1
push 0x1ea8
push 0
push 0x5dab
lea eax, [ebp - 1]
push eax
push 0x151c
push 0x60f8
push 0x66b6
push 1
call fcn.1002d753
add esp, 0x28
jmp 0x1002b3bc
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x1002b3bc
push 0
push 0xd17
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x1002b3c6
push 0
call fcn.10028440
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1002d1f3
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10056dbc
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x68
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1002d3bc
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1002d38f
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x28], 0x7b60
mov dword [ebp - 0x48], str.hvw_hpssbxohc_ltfsl_joi_wxn_thk_knfwzohe_tndazvlw_fqys_aayhbq
cmp dword [ebp - 0x28], 0x7e7d
jle 0x1002d31e
and dword [ebp - 0x20], 0
jmp 0x1002d287
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x400c
jge 0x1002d31e
and dword [ebp - 0x18], 0
jmp 0x1002d2a1
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1a78
jge 0x1002d319
and dword [ebp - 0x1c], 0
jmp 0x1002d2b7
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x567
jge 0x1002d317
and dword [ebp - 0x24], 0
jmp 0x1002d2cd
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x42b1
jge 0x1002d315
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x20]
or eax, dword [ebp - 0x24]
cdq
mov dword [ebp - 0x60], eax
mov dword [ebp - 0x5c], edx
push dword [ebp - 0x5c]
push dword [ebp - 0x60]
lea ecx, [ebp - 0x78]
call fcn.10002462
pop ecx
pop ecx
mov dword [ebp - 0x40], eax
mov ecx, dword [ebp - 0x40]
call fcn.10003dca
push eax
call fcn.1003eb1f
pop ecx
lea ecx, [ebp - 0x78]
call fcn.10003dc0
jmp 0x1002d2c6
jmp 0x1002d2b0
jmp 0x1002d29a
jmp 0x1002d280
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x1002d334
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 2
jge 0x1002d351
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x44]
call fcn.1000195c
mov dword [eax], 0xfffffffe
jmp 0x1002d329
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x7a56
jge 0x1002d367
push dword [ebp - 0x48]
call fcn.1003eb1f
pop ecx
jmp 0x1002d383
or dword [ebp - 4], 0xffffffff
jmp 0x1002d38d
jmp 0x1002d3ba
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x50]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x54]
movzx eax, byte [eax]
test eax, eax
je 0x1002d3ba
push 0
push 0x20c8
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
jmp 0x1002d3d4
mov eax, dword [ebp + 8]
mov dword [ebp - 0x58], eax
push 1
push 0x48e0
push dword [ebp - 0x58]
call fcn.100284a6
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10030a68
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x10056ef4
call fcn.10055910
sub esp, 0x14
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x18], dl
mov byte [ebp - 0x1c], cl
je 0x10030ab2
test cl, cl
je 0x10030a96
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
jmp 0x10030b62
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10030b62
push 0xd57
call dword [sym.imp.USER32.dll_IsIconic]
jmp 0x10030b62
test dl, dl
je 0x10030ac3
push 0
call dword [sym.imp.USER32.dll_DestroyMenu]
jmp 0x10030b62
mov dword [ebp - 0x20], 0x21ad
cmp dword [ebp - 0x20], 0x22e5
jle 0x10030b03
xor esi, esi
mov edi, esi
mov ebx, 0xd5d
mov eax, edi
mov ecx, 0x10071e38
cdq
push edx
push eax
call fcn.10003dea
dec edi
dec ebx
jne 0x10030adc
inc esi
cmp esi, 0x3c9a
jl 0x10030ad5
push 0x209a
call dword [sym.imp.USER32.dll_GetQueueStatus]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x1e77
jge 0x10030b1f
mov edx, str.lukdsfj_qsql_uwo
mov ecx, 0x10071e38
call fcn.10005f73
or dword [ebp - 4], 0xffffffff
lea eax, [ebp + 0xf]
push 0
push ecx
mov dword [ebp - 0x20], 0xcf5
mov ecx, 0x7200
mov byte [ebp + 0xf], 0
push eax
call fcn.100304d4
push 0x12a
push 0
lea eax, [ebp - 0x11]
mov byte [ebp - 0x11], 0
push 1
push eax
mov edx, 0x1200
mov ecx, 0x7a6e
call fcn.1003032e
add esp, 0x1c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10030d6a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10056efe
call fcn.10055910
sub esp, 0x10
mov byte [ebp - 0x18], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x10030e09
mov dword [ebp - 0x1c], 0x37b1
cmp dword [ebp - 0x1c], 0x3839
jle 0x10030dbf
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x10071e38
xor eax, esi
cdq
push edx
push eax
call fcn.10003dea
inc edi
cmp edi, 0x2698
jl 0x10030d9c
inc esi
cmp esi, 0x78be
jl 0x10030d9a
push 0x21b0
push 0x5a7
push 0
call dword [sym.imp.USER32.dll_OffsetRect]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x355d
jge 0x10030ded
mov edx, str.crju_myd_sakbd_vnrbjq_ldkhvhcz_aolhbto_ffoxg_xvnybco_emzs_dpnptiery_wxpcs_owhb
mov ecx, 0x10071e38
call fcn.10005f73
jmp 0x10030e23
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x10030e23
push 0x16fa
push 0x103a
call dword [sym.imp.GDI32.dll_SetMapMode]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10030e75
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10056f08
call fcn.10055910
sub esp, 0x20
mov byte [ebp - 0x14], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
mov dword [ebp - 0x1c], edi
test dl, dl
je 0x10030f75
mov dword [ebp - 0x18], 0x37d3
cmp dword [ebp - 0x18], 0x3b76
jle 0x10030ed7
push 0
call dword [sym.imp.KERNEL32.dll_SetThreadLocale]
xor esi, esi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x10071e38
xor eax, esi
cdq
push edx
push eax
call fcn.10003dea
inc ebx
cmp ebx, 0x94e
jl 0x10030eb4
inc esi
cmp esi, 0x47dd
jl 0x10030eb2
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x344c
jge 0x10030f12
mov edx, str.fkevk_obdgtw_nikxb_xhg_qkyjbg_skaz_rzjsxkl_kbgmv_rwt_qxogxna_kkq_lgdrjbvkm_bsmrgycdm
mov ecx, 0x10071e38
call fcn.10005f73
jmp 0x10030f12
mov eax, dword [ebp + 0x14]
or dword [ebp - 4], 0xffffffff
mov ebx, dword [ebp + 0x18]
push ebx
mov eax, dword [eax]
mov dword [ebp - 0x18], eax
mov eax, dword [edi]
mov edi, dword [ebp + 0xc]
mov ecx, edi
mov dword [ebp - 0x2c], eax
lea eax, [ebp - 0x20]
push eax
call fcn.100385ae
mov esi, dword [ebp - 0x20]
cmp esi, dword [edi]
je 0x10030f43
mov eax, dword [ebx]
cmp eax, dword [esi + 0x10]
jge 0x10030f67
push ecx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], ebx
push eax
push ecx
mov ecx, edi
call fcn.10038715
push eax
add eax, 0x10
mov ecx, edi
push eax
push esi
lea eax, [ebp - 0x28]
push eax
call fcn.10038745
mov esi, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
mov dword [esi + 0x14], eax
mov eax, dword [ebp - 0x2c]
mov dword [esi + 0x18], eax
jmp 0x10030f84
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x10030f84
push ecx
call fcn.1003360c
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100311be
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x10056f12
call fcn.10055910
sub esp, 0x34
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], edi
je 0x10031326
mov dword [ebp - 0x24], 0x4c01
xor esi, esi
cmp dword [ebp - 0x24], 0x4e4e
jle 0x10031258
mov ebx, esi
mov eax, ebx
mov dword [ebp - 0x20], 0x5da2
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0x643b
mov edi, eax
mov esi, 0x2963
mov eax, edi
mov ecx, 0x10071e38
cdq
push edx
push eax
call fcn.10003dea
inc edi
dec esi
jne 0x10031211
mov eax, dword [ebp - 0x14]
dec eax
dec dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
jne 0x1003120a
mov eax, dword [ebp - 0x1c]
dec eax
dec dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
jne 0x10031200
inc ebx
cmp ebx, 0x4b40
jl 0x100311f4
push 0xa1
push 0x82c
call dword [sym.imp.USER32.dll_GetWindow]
mov edi, dword [ebp - 0x28]
mov dword [edi], esi
jmp 0x1003126a
mov edx, 0x7461
xor cl, cl
call fcn.10033e7a
inc dword [edi]
cmp dword [edi], 0xc
jle 0x1003125c
mov dword [ebp - 0x1c], 0x3f7
cmp dword [ebp - 0x1c], 0x4a4
jle 0x100312db
mov edi, esi
mov ebx, esi
mov eax, esi
mov dword [ebp - 0x20], esi
add eax, ebx
lea ecx, [ebp - 0x40]
add eax, edi
cdq
push edx
push eax
call fcn.10002462
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100312a1
mov eax, dword [eax]
push eax
call fcn.1003eb1f
pop ecx
push esi
push 1
lea ecx, [ebp - 0x40]
call fcn.10004229
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp eax, 0x7151
jl 0x10031288
inc ebx
cmp ebx, 0x1fd7
jl 0x10031283
inc edi
cmp edi, 0x623c
jl 0x10031281
push esi
push esi
call dword [sym.imp.USER32.dll_EnumWindows]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x24], 0x4ac4
jge 0x100312f6
mov edx, str.wixftj_mek_eenwp_qfql_giwdxxyk_bgufidej_sumj_aprf
mov ecx, 0x10071e38
call fcn.10005f73
cmp dword [ebp - 0x1c], 0x8c
jge 0x10031334
push str.jkaw_fjyg_bns_rik_zymppzklz_ebs_bfnww_nnjsqvyn_hxosjos
call fcn.1003eb1f
pop ecx
jmp 0x10031334
mov ecx, dword [ebp + 0x10]
mov eax, dword [edx]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret