joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1011eca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 8
push ebx
mov ebx, dword [esp + 0x10]
push ebp
mov ebp, dword [esp + 0x18]
push esi
mov eax, dword [ebx + 0x10]
mov esi, dword [esp + 0x24]
push edi
cmp dword [eax + 4], 0xfffffff5
jne 0x1011ed17
mov eax, dword [eax]
mov edx, dword [ebp]
movzx edi, word [eax + 6]
mov eax, edi
add eax, eax
mov ecx, dword [edx + eax*8]
mov eax, ecx
and eax, 0xf0000000
cmp eax, 0x80000000
jne 0x1011ecf6
nop word [eax + eax]
movzx eax, cx
add eax, eax
mov ecx, dword [edx + eax*8]
mov eax, ecx
and eax, 0xf0000000
cmp eax, 0x80000000
je 0x1011ece0
mov eax, ecx
movzx ecx, cx
and eax, 0xf0000000
cmp eax, 0x20000000
push esi
cmovne ecx, edi
push ecx
push ebp
call fcn.10103100
add esp, 0xc
test eax, eax
jne 0x1011ed7d
mov eax, dword [ebx + 0x10]
lea ecx, [eax + 8]
cmp ecx, dword [ebx + 0x14]
jae 0x1011ed8f
cmp dword [eax + 0xc], 0xfffffff5
jne 0x1011ed8f
mov eax, dword [ecx]
mov edx, dword [ebp]
movzx edi, word [eax + 6]
mov eax, edi
add eax, eax
mov ecx, dword [edx + eax*8]
mov eax, ecx
and eax, 0xf0000000
cmp eax, 0x80000000
jne 0x1011ed5c
movzx eax, cx
add eax, eax
mov ecx, dword [edx + eax*8]
mov eax, ecx
and eax, 0xf0000000
cmp eax, 0x80000000
je 0x1011ed46
mov eax, ecx
movzx ecx, cx
and eax, 0xf0000000
cmp eax, 0x20000000
push esi
cmovne ecx, edi
push ecx
push ebp
call fcn.10103100
add esp, 0xc
test eax, eax
je 0x1011ed8f
push eax
push ebx
call fcn.100ea370
add esp, 8
pop edi
pop esi
pop ebp
pop ebx
add esp, 8
ret
or edx, 0xffffffff
or ebp, edx
cmp esi, 4
jne 0x1011edc4
mov ecx, dword [esp + 0x24]
xor edx, edx
pop edi
mov eax, dword [ecx]
cmp eax, dword [ecx + 4]
mov eax, dword [ebx + 0x14]
setne dl
add edx, 0xfffffffd
mov dword [eax - 4], edx
mov eax, dword [ebx + 8]
mov dword [eax + 0x9c], edx
lea eax, [esi - 3]
pop esi
pop ebp
pop ebx
add esp, 8
ret
mov eax, dword [esp + 0x24]
xor edi, edi
nop word [eax + eax]
mov ecx, dword [eax + edi*4 + 8]
mov dword [esp + 0x1c], edx
test ecx, ecx
je 0x1011ee15
mov eax, dword [ebx + 0x10]
cmp dword [eax + edi*8 + 4], 0xfffffff5
jne 0x1011ee15
mov eax, dword [esp + 0x20]
mov esi, dword [ecx]
push 0
sub ecx, dword [eax]
sar ecx, 4
push ecx
push ebx
call fcn.10103250
and esi, 0xf0000000
add esp, 0xc
add eax, 0x10
mov edx, edi
cmp esi, 0x50000000
cmovne edx, dword [esp + 0x1c]
jmp 0x1011ee3b
mov eax, dword [ebx + 0x10]
mov ecx, dword [eax + edi*8 + 4]
cmp ecx, 0xfffffffb
mov eax, edi
cmovne eax, ebp
mov ebp, eax
cmp ecx, 0xfffffff2
ja 0x1011ee32
mov ecx, 0xd
jmp 0x1011ee34
not ecx
mov eax, dword [ecx*4 + 0x10132c28]
mov dword [esp + edi*4 + 0x10], eax
inc edi
mov eax, dword [esp + 0x24]
cmp edi, 2
jl 0x1011edd0
mov eax, ebp
xor eax, edx
cmp eax, 1
je 0x1011ee8d
mov ecx, dword [esp + 0x28]
cmp ecx, 5
jne 0x1011ee62
mov eax, 0xd5a
jmp 0x1011ee7e
cmp ecx, 8
jne 0x1011ee6e
mov eax, 0xd78
jmp 0x1011ee7e
cmp ecx, 0xa
mov eax, 0xd9d
mov edx, 0xdcc
cmovl eax, edx
push dword [esp + 0x14]
push dword [esp + 0x14]
push eax
push ebx
call fcn.100e3730
push dword [esp + edx*4 + 0x10]
push dword [esp + ebp*4 + 0x14]
push 0xd3e
push ebx
call fcn.100e3730
int3
Function at 0x10122f90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
sub esp, 0x2c
push ebx
mov ebx, ecx
push ebp
movzx ebp, word [ebx + 0x74]
lea edx, [ebx + 0x74]
push esi
mov al, byte [ebx + 0x88]
and al, 0x1f
mov dword [esp + 0x10], ebx
mov dword [esp + 0x14], edx
mov dword [esp + 0x34], ebp
push edi
cmp al, 0xe
jne 0x10122fe8
movzx edx, word [ebx + 0x182]
cmp edx, ebp
jbe 0x10122fe4
movzx ecx, word [ebx + 0x19a]
cmp ecx, ebp
jbe 0x10122fe4
nop
cmp ecx, edx
jb 0x10123164
mov eax, dword [ebx + 0x10]
movzx ecx, word [eax + ecx*8 + 6]
cmp ecx, ebp
ja 0x10122fd0
mov edx, dword [esp + 0x18]
movzx eax, word [ebx + 0x19c]
cmp eax, ebp
jbe 0x1012316e
mov esi, dword [ebx + 0x10]
mov dword [esp + 0x28], esi
mov dword [esp + 0x24], 0x8000
lea eax, [esi + eax*8]
mov dword [esp + 0x34], eax
movzx eax, word [eax]
movzx ecx, word [esi + eax*8 + 2]
lea ebx, [esi + eax*8]
cmp edx, ebx
je 0x10123164
movzx edi, word [edx + 2]
cmp byte [esi + edi*8 + 5], 0x1d
lea edx, [esi + edi*8]
jne 0x10123034
movzx edi, word [edx]
lea edx, [esi + edi*8]
cmp byte [esi + ecx*8 + 5], 0x1d
lea ebp, [esi + ecx*8]
jne 0x10123045
movzx ecx, word [ebp]
lea ebp, [esi + ecx*8]
mov eax, dword [esp + 0x14]
mov al, byte [eax + 0x79]
mov byte [esp + 0x13], al
cmp al, 0x39
je 0x10123062
cmp al, 0x38
je 0x10123062
mov eax, dword [esp + 0x14]
movzx eax, word [eax + 0x74]
jmp 0x1012306e
mov eax, dword [esp + 0x14]
movzx eax, word [eax + 0x74]
movzx eax, word [esi + eax*8]
movzx eax, ax
mov dword [esp + 0x2c], eax
mov al, byte [ebx + 5]
cmp al, 0x39
je 0x10123085
cmp al, 0x38
je 0x10123085
movzx eax, word [ebx]
jmp 0x1012308c
movzx eax, word [ebx]
movzx eax, word [esi + eax*8]
movzx ebx, ax
cmp edi, ecx
je 0x10123133
cmp edi, 0x8000
jae 0x101230ab
cmp ecx, 0x8000
jb 0x1012314d
cmp byte [esp + 0x13], 0x38
jne 0x10123129
xor eax, eax
mov dword [esp + 0x1c], edi
cmp byte [edx + 5], 0x28
mov dword [esp + 0x20], eax
jne 0x101230f3
movzx esi, word [edx + 2]
cmp si, word [esp + 0x24]
mov esi, dword [esp + 0x28]
jae 0x101230ef
movzx eax, word [edx]
mov dword [esp + 0x1c], eax
movzx eax, word [edx + 2]
mov edx, dword [esi + eax*8]
cmp dword [esp + 0x1c], ecx
jne 0x101230e9
test edx, edx
jne 0x1012314d
mov eax, dword [esp + 0x20]
jmp 0x101230f5
mov edx, eax
jmp 0x101230f5
xor edx, edx
cmp byte [ebp + 5], 0x28
jne 0x1012311d
movzx esi, word [ebp + 2]
cmp si, word [esp + 0x24]
mov esi, dword [esp + 0x28]
jae 0x1012311d
movzx eax, word [ebp + 2]
movzx ecx, word [ebp]
mov eax, dword [esi + eax*8]
cmp edi, ecx
jne 0x1012311d
test eax, eax
jne 0x1012314d
cmp dword [esp + 0x1c], ecx
jne 0x10123133
cmp edx, eax
je 0x10123133
jmp 0x1012314d
mov al, byte [ebp + 4]
xor al, byte [edx + 4]
test al, 0x1f
jne 0x1012314d
mov eax, dword [esp + 0x2c]
cmp eax, ebx
je 0x10123164
push ebx
push eax
push dword [esp + 0x1c]
call fcn.101238b0
add esp, 0xc
test eax, eax
jne 0x10123164
mov eax, dword [esp + 0x34]
movzx eax, word [eax + 6]
cmp eax, dword [esp + 0x38]
jbe 0x1012316e
mov edx, dword [esp + 0x18]
jmp 0x10123006
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x2c
ret
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
add esp, 0x2c
ret
Function at 0x10123d40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ecx
movzx eax, word [esp + 0xc]
mov ecx, dword [esp + 0x10]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
mov dword [esp + 8], eax
push esi
push edi
movzx eax, word [ebp + eax*2 + 0x11a]
cmp eax, ecx
jbe 0x10123db4
mov edi, dword [ebp + 0x10]
mov dl, byte [edi + eax*8 + 4]
lea ebx, [edi + eax*8]
movzx eax, word [ebx]
and dl, 0x1f
cmp eax, ecx
je 0x10123de1
test dl, dl
jne 0x10123dac
cmp word [esp + 0x1c], 0x40
movzx edx, word [edi + eax*8 + 2]
movzx esi, word [edi + ecx*8 + 2]
je 0x10123d98
mov al, byte [edi + esi*8 + 4]
xor al, byte [edi + edx*8 + 4]
test al, 0x1f
jne 0x10123dac
cmp edx, esi
je 0x10123dd9
cmp edx, 0x8000
jae 0x10123dd9
cmp esi, 0x8000
jae 0x10123dd9
movzx eax, word [ebx + 6]
cmp eax, ecx
ja 0x10123d65
mov eax, dword [esp + 0x10]
movzx eax, word [ebp + eax*2 + 0x10c]
cmp eax, ecx
jbe 0x10123dd9
mov esi, dword [ebp + 0x10]
lea edx, [esi + eax*8]
movzx eax, word [edx]
cmp eax, ecx
je 0x10123dee
movzx eax, word [edx + 6]
cmp eax, ecx
ja 0x10123dc7
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
pop edi
xor eax, eax
test dl, dl
pop esi
pop ebp
setne al
pop ebx
pop ecx
ret
test byte [edx + 4], 0x1f
mov eax, 0
pop edi
pop esi
pop ebp
setne al
pop ebx
pop ecx
ret
Function at 0x10001c60
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x1005f66b
call fcn.1005f130
sub esp, 0x40
push ebx
push esi
mov byte [ebp - 0x18], cl
mov esi, edx
mov dword [ebp - 0x2c], 0x129d
cmp dword [ebp - 0x2c], 0x12f9
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
jle 0x10001d0a
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor edi, edi
mov dword [ebp - 0x28], edi
xor esi, esi
mov dword [ebp - 0x24], 0x7d96
mov dword [ebp - 0x20], esi
xor ebx, ebx
and dword [ebp - 0x30], 0
mov edi, esi
mov esi, dword [ebp - 0x30]
xor edi, ebx
mov eax, edi
mov ecx, 0x1007bf18
or eax, esi
cdq
push edx
push eax
call fcn.1000448f
inc esi
cmp esi, 0xb4f
jl 0x10001caf
mov esi, dword [ebp - 0x20]
inc ebx
cmp ebx, 0x3316
jl 0x10001ca4
mov edi, dword [ebp - 0x28]
add esi, edi
dec dword [ebp - 0x24]
mov dword [ebp - 0x20], esi
jne 0x10001ca2
inc edi
mov dword [ebp - 0x28], edi
cmp edi, 0x3350
jl 0x10001c96
push 0x1b9f
push 0x75
push 0x457
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_CheckRadioButton]
mov esi, dword [ebp - 0x1c]
and dword [ebp - 4], 0
cmp dword [ebp - 0x2c], 0x125f
jge 0x10001d45
mov edx, str.bjzoi_fckll_bsqqao_xtjezcyhn_moiu_yrgcktob_ocnfyjl
mov ecx, 0x1007bf18
call fcn.10006900
jmp 0x10001d45
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x18], 0
je 0x10001d6f
push 0
push 0
push 0x11b
push 0x21a5
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendDlgItemMessageW]
jmp 0x10001e28
mov dword [ebp - 0x24], 0x71bb
cmp dword [ebp - 0x24], 0x742d
jle 0x10001df4
xor edi, edi
mov dword [ebp - 0x28], edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x2c], eax
add eax, ebx
xor esi, esi
and eax, edi
mov dword [ebp - 0x30], eax
mov edi, eax
mov eax, edi
lea ecx, [ebp - 0x48]
xor eax, esi
cdq
push edx
push eax
call fcn.10001a75
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10001daf
mov eax, dword [eax]
push eax
call fcn.10048743
pop ecx
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.10004a80
inc esi
cmp esi, 0x6155
jl 0x10001d96
mov eax, dword [ebp - 0x2c]
mov edi, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x2c], eax
cmp eax, 0x4c24
jl 0x10001d8b
inc ebx
cmp ebx, 0x443a
jl 0x10001d86
inc edi
mov dword [ebp - 0x28], edi
cmp edi, 0x6a9d
jl 0x10001d84
mov esi, dword [ebp - 0x1c]
cmp dword [ebp - 0x24], 0x70a4
jge 0x10001e08
push str.fofqq_dsucwdghy_knjnrgkcj_cxjnurm_bfupw_ytvusq_ycbawawaf_lgxny_untoohcr_oeus
call fcn.10048743
pop ecx
mov dword [esi], 0
cmp dword [esi], 4
jge 0x10001e28
mov edx, dword [ebp + 8]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0x3342
inc dword [esi]
cmp dword [esi], 4
jl 0x10001e16
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000235b
Capabilities:
Create directory
Read .ini file
Suspend thread

Disassembly:
mov eax, 0x1005f6bf
call fcn.1005f130
sub esp, 0x38
push ebx
xor ebx, ebx
push esi
mov byte [ebp - 0x18], bl
mov dword [ebp - 0x28], 0x4761
cmp dword [ebp - 0x28], 0x47d5
push edi
mov dword [ebp - 0x10], esp
jle 0x100023e7
push ebx
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov esi, ebx
mov dword [ebp - 0x24], ebx
mov edi, ebx
lea eax, [edi + esi]
mov dword [ebp - 0x20], 0xf7c
mov dword [ebp - 0x1c], eax
mov esi, ebx
mov ebx, dword [ebp - 0x1c]
mov eax, ebx
mov ecx, 0x1007bf18
and eax, esi
cdq
push edx
push eax
call fcn.1000448f
inc esi
cmp esi, 0x2d94
jl 0x100023a3
dec ebx
dec dword [ebp - 0x20]
push 0
mov dword [ebp - 0x1c], ebx
pop ebx
jne 0x1000239e
mov esi, dword [ebp - 0x24]
inc edi
cmp edi, 0x4ccc
jl 0x10002391
inc esi
mov dword [ebp - 0x24], esi
cmp esi, 0x8c6
jl 0x1000238f
call dword [sym.imp.USER32.dll_CreateMenu]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x28], 0x464c
jge 0x10002402
mov edx, str.zclrro_gye_xoz_mvsyk_vbh_vklfwcjyd_gwmurnmjp_eltq_qbjoza
mov ecx, 0x1007bf18
call fcn.10006900
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x24], 0x45fa
cmp dword [ebp - 0x24], 0x4638
jle 0x10002486
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
mov esi, ebx
mov edi, ebx
mov ecx, ebx
mov dword [ebp - 0x28], ebx
mov eax, edi
cdq
idiv ecx
lea ecx, [ebp - 0x40]
or edx, esi
mov eax, edx
cdq
push edx
push eax
call fcn.10001a75
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10002445
mov eax, dword [eax]
push eax
call fcn.10048743
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x40]
call fcn.10004a80
mov ecx, dword [ebp - 0x28]
inc ecx
mov dword [ebp - 0x28], ecx
cmp ecx, 0x4f97
jl 0x10002427
inc edi
cmp edi, 0x6eb1
jl 0x10002422
inc esi
cmp esi, 0x52c8
jl 0x10002420
push ebx
push 0x87b
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_RemovePropA]
cmp dword [ebp - 0x24], 0x457e
jge 0x100024a8
push str.nwvjo_tzbhiuto_rgu
call fcn.10048743
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10002534
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005f6c9
call fcn.1005f130
push ecx
push ecx
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov ebx, edx
mov dword [ebp - 0x14], ecx
je 0x100025dd
cmp byte [ebp + 0x18], 0
je 0x100025c5
mov esi, dword [ebp + 0x28]
mov edi, dword [ebp + 8]
push 3
pop ecx
mov eax, dword [esi]
sub eax, dword [edi]
mov dword [ebx], eax
mov eax, dword [esi]
cmp ecx, eax
mov eax, dword [esi]
sbb edx, edx
xor ecx, ecx
neg edx
cmp edx, eax
mov eax, dword [ebp - 0x14]
setle cl
xor edx, edx
mov dword [eax], ecx
mov ecx, dword [ebx]
mov eax, dword [edi]
cmp ecx, eax
mov eax, dword [ebp - 0x14]
setg dl
xor ecx, ecx
mov eax, dword [eax]
cmp edx, eax
mov eax, dword [esi]
setg cl
xor edx, edx
sub ecx, eax
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax]
add ecx, eax
mov eax, dword [esi]
add ecx, eax
mov eax, dword [edi]
cmp ecx, eax
mov eax, dword [ebp + 0x20]
setle dl
mov dword [eax], edx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov byte [ebp + 0x13], 0
cmp byte [ebp + 0x13], 0
je 0x100025b4
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindResourceW]
jmp 0x100025b4
cmp byte [ebp + 0x14], 0
je 0x100025f4
mov byte [ebp + 0x13], 0
cmp byte [ebp + 0x13], 0
je 0x100025b4
call fcn.100032da
jmp 0x100025b4
mov dword [ebp - 0x14], 0x342d
cmp dword [ebp - 0x14], 0x3521
jle 0x1000263b
xor esi, esi
xor ebx, ebx
mov dword [ebp + 0x10], 0x713b
xor edi, edi
mov eax, ebx
mov ecx, 0x1007bf18
xor eax, edi
cdq
push edx
push eax
call fcn.1000448f
inc edi
cmp edi, 0x4d96
jl 0x10002611
add ebx, esi
dec dword [ebp + 0x10]
jne 0x1000260f
inc esi
cmp esi, 0x5bf7
jl 0x10002606
mov edx, dword [ebp + 0x24]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1000265e
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xbbbfefa2
inc dword [edx]
cmp dword [edx], 2
jl 0x1000264c
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x3422
jge 0x100025b4
mov edx, str.ebfx_vkkdotmo_aat_rnj_fnwoyos_tmjeceh_imbbsruw_gjpkkixx_qahxau_hylt_menrykcsu_por_maozzlp_myulyjt
mov ecx, 0x1007bf18
call fcn.10006900
jmp 0x100025b4
Function at 0x10003897
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005f76e
call fcn.1005f130
sub esp, 0x34
cmp byte [ebp + 0xc], 0
mov eax, ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], dl
mov dword [ebp - 0x1c], eax
je 0x10003964
mov dword [ebp + 0xc], 0x30c6
cmp dword [ebp + 0xc], 0x32f5
jle 0x10003910
xor esi, esi
xor edi, edi
mov ecx, edi
mov eax, esi
shl eax, cl
lea ecx, [ebp - 0x40]
cdq
push edx
push eax
call fcn.10001a75
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100038eb
mov eax, dword [eax]
push eax
call fcn.10048743
pop ecx
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.10004a80
inc edi
cmp edi, 0x41d7
jl 0x100038d0
inc esi
cmp esi, 0x299a
jl 0x100038ce
cmp dword [ebp + 0xc], 0x2d46
jge 0x10003924
push str.zhpbv_elghqv_puuwymyc_qnctemxbh_owmqcnr_oqyxtup_mcv_uuw
call fcn.10048743
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 8], 0
je 0x1000394c
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
push dword [eax]
call fcn.100046f9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0
push 0
push 0xbc4
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SendMessageW]
jmp 0x1000393b
mov dword [ebp - 0x20], 0x4664
cmp dword [ebp - 0x20], 0x4691
jle 0x100039e3
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp + 0xc], edi
and dword [ebp - 0x28], 0
mov ecx, edi
mov edi, dword [ebp - 0x28]
mov dword [ebp - 0x24], esi
sar esi, cl
mov eax, esi
mov ecx, 0x1007bf18
xor eax, edi
xor eax, ebx
cdq
push edx
push eax
call fcn.1000448f
inc edi
cmp edi, 0x4e87
jl 0x1000398e
mov edi, dword [ebp + 0xc]
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp + 0xc], edi
cmp edi, 0x4b3b
jl 0x10003980
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x95c
jl 0x1000397b
inc ebx
cmp ebx, 0x74b4
jl 0x10003976
push 0
push 0
push 0xb43
call dword [sym.imp.ADVAPI32.dll_CopySid]
mov eax, dword [ebp - 0x1c]
cmp byte [ebp - 0x14], 0
je 0x10003a18
push 0x600
push 0x26cc
push 0x2587
push 0x8be
push 0x1a0d
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PatBlt]
jmp 0x10003a52
mov esi, dword [ebp + 0x20]
mov dword [esi], 0
jmp 0x10003a4d
mov edx, dword [ebp + 0x2c]
push ecx
push dword [ebp + 0x18]
mov ecx, dword [ebp + 0x28]
push 0x63d4
push 0x5d82
push 0
push eax
push dword [ebp + 0x1c]
push dword [ebp + 0x24]
call fcn.10001aad
mov eax, dword [ebp - 0x1c]
add esp, 0x20
inc dword [esi]
cmp dword [esi], 3
jle 0x10003a23
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x43bb
jge 0x1000393b
mov edx, str.aydo_nek_wisqmm_xfykoya_bhgrbmfjz_xsmb_vlcrunh_esk
mov ecx, 0x1007bf18
call fcn.10006900
jmp 0x1000393b
Function at 0x10004dae
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x10004dc5
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x10004de7
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x100df3d4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x100df760
jl 0x10004df5
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x100dfa04
jl 0x10004e35
mov ecx, dword [0x100e0750]
xor ecx, dword [0x100df3d4]
and ecx, edi
xor ecx, dword [0x100e0750]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x100df3d0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x100dfa04]
mov dword [0x100dfd90], eax
pop esi
ret

Function at 0x10007127
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005f8e5
call fcn.1005f130
sub esp, 0x20
push ebx
push esi
mov dword [ebp - 0x1c], 0x7b71
mov eax, ecx
cmp dword [ebp - 0x1c], 0x7d82
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], eax
jle 0x100071b0
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x14], edi
xor ebx, ebx
mov eax, edi
and dword [ebp - 0x24], 0
cdq
idiv ebx
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x20], esi
sub esi, edx
mov eax, esi
mov ecx, 0x1007bf18
xor eax, edi
cdq
push edx
push eax
call fcn.1000448f
inc edi
cmp edi, 0xd0b
jl 0x1000716c
mov esi, dword [ebp - 0x18]
inc ebx
mov edi, dword [ebp - 0x14]
cmp ebx, 0x24e3
jl 0x1000715b
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x5158
jl 0x10007159
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x34d0
jl 0x10007154
mov eax, dword [ebp - 0x28]
push 0x1f62
push ecx
mov edx, eax
lea ecx, [ebp - 0x2c]
call fcn.10007cba
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x7a3e
pop ecx
pop ecx
jge 0x100071de
mov edx, str.twf_jppngmhl_zsafze_karmeoaep_flzsyqnx_myej_cpuaxicq_ilsg
mov ecx, 0x1007bf18
call fcn.10006900
mov eax, dword [ebp - 0x2c]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007cd0
Capabilities:
Encode data using xor
Get file size

Disassembly:
mov eax, 0x1005f965
call fcn.1005f130
sub esp, 0x20
push ebx
push esi
mov dword [ebp - 0x1c], 0x101c
mov eax, ecx
cmp dword [ebp - 0x1c], 0x12d9
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], eax
jle 0x10007d61
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x14], edi
xor ebx, ebx
and dword [ebp - 0x24], 0
lea ecx, [ebx + edi]
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x20], esi
shl esi, cl
mov eax, esi
mov ecx, 0x1007bf18
xor eax, edi
cdq
push edx
push eax
call fcn.1000448f
inc edi
cmp edi, 0x6bb5
jl 0x10007d1d
mov esi, dword [ebp - 0x18]
inc ebx
mov edi, dword [ebp - 0x14]
cmp ebx, 0x738
jl 0x10007d0e
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x1ad4
jl 0x10007d0c
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x5a03
jl 0x10007d07
mov eax, dword [ebp - 0x28]
mov dl, 1
push eax
mov cl, dl
call fcn.10007db5
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0xcd5
pop ecx
jge 0x10007d88
mov edx, str.wnemj_cqfixn_pqx
mov ecx, 0x1007bf18
call fcn.10006900
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10008502
Capabilities:
Encode data using xor
Get common file path

Disassembly:
mov eax, 0x1005f983
call fcn.1005f130
sub esp, 0x10
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], esp
mov edi, edx
mov dword [ebp - 0x18], ebx
je 0x100085db
mov dword [ebp - 0x14], 0x1036
xor esi, esi
cmp dword [ebp - 0x14], 0x10e9
jle 0x1000856e
push esi
push 0xafa
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, esi
mov ebx, esi
mov eax, ebx
mov ecx, 0x1007bf18
xor eax, edi
cdq
push edx
push eax
call fcn.1000448f
inc ebx
cmp ebx, 0x6a1d
jl 0x10008548
inc edi
cmp edi, 0x7df8
jl 0x10008546
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp + 0x1c]
xor edx, edx
mov eax, dword [ebx]
xor ecx, ecx
inc edx
mov eax, dword [edi]
mov eax, dword [ebx]
cmp eax, edx
setle cl
test ecx, ecx
jg 0x1000858b
cmp dword [ebx], esi
jne 0x1000858b
mov edx, esi
mov eax, dword [edi]
xor ecx, ecx
cmp edx, 0xebda1846
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebp + 8]
setge dl
mov dword [eax], edx
mov dword [ebp - 4], esi
cmp dword [ebp - 0x14], 0xcd5
jge 0x100085bf
mov edx, str.gpzysepz_dnzyatb_rvelulc_dpvnituss_mpcagkul_agduife_nuzehhysy_fnhoimi_ely_jsnty
mov ecx, 0x1007bf18
call fcn.10006900
jmp 0x10008613
mov ebx, dword [ebp + 0x20]
xor edx, edx
mov eax, dword [edi]
xor ecx, ecx
inc edx
mov eax, dword [ebx]
mov eax, dword [edi]
cmp eax, edx
setle cl
test ecx, ecx
jg 0x100085f8
xor esi, esi
cmp dword [edi], esi
je 0x100085fa
mov esi, edx
mov eax, dword [ebx]
xor edx, edx
cmp esi, 0xebda1846
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp + 0x24]
setge cl
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret