joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000b453
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x24], 0
je 0x1000b4b1
mov ecx, dword [ebp + 0x20]
push esi
mov esi, dword [ebp + 0x2c]
mov eax, dword [ecx]
mov eax, dword [edx]
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
mov eax, dword [ecx]
cmp dword [ecx], 2
mov eax, dword [ecx]
mov dword [esi], eax
sbb edx, edx
mov ecx, dword [ecx]
neg edx
mov eax, dword [ebp + 0x28]
sub ecx, edx
mov dword [eax], ecx
xor ecx, ecx
mov eax, dword [eax]
add eax, dword [esi]
cmp eax, 0xcb81
pop esi
setle cl
xor eax, eax
cmp ecx, 0xfffffffd
setge al
xor ecx, ecx
cmp eax, 0x337672a6
mov eax, dword [ebp + 0x1c]
setge cl
mov dword [eax], ecx
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
pop ebp
ret
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1000b4c9
xor eax, eax
push eax
push 0x1b21
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop ebp
ret
Function at 0x1000c5b0
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x30
cmp byte [ebp + 0xc], 0
push ebx
push edi
mov byte [esp + 0xc], dl
mov byte [esp + 0x10], cl
je 0x1000c699
mov dword [esp + 0x1c], 0x71b2
cmp dword [esp + 0x1c], 0x726a
jle 0x1000c649
xor edi, edi
mov dword [esp + 0x18], edi
xor ebx, ebx
mov dword [esp + 0x14], ebx
mov eax, edi
cdq
idiv ebx
mov ebx, 0x5d1a
mov edi, edx
mov eax, edi
lea ecx, [esp + 0x20]
cdq
push edx
push eax
call fcn.10001ac9
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000c60f
mov eax, dword [eax]
push eax
call fcn.10045f6d
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.10007132
dec edi
dec ebx
jne 0x1000c5f7
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
inc ebx
mov dword [esp + 0x14], ebx
cmp ebx, 0x3db3
jl 0x1000c5eb
inc edi
mov dword [esp + 0x18], edi
cmp edi, 0x5bc3
jl 0x1000c5e5
cmp byte [esp + 0xc], 0
je 0x1000c665
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1000c682
sub esp, 0xc
call fcn.1000ce79
add esp, 0xc
jmp 0x1000c682
push 0
push 0x6f6
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetTextExtentPointA]
cmp dword [esp + 0x1c], 0x6e10
jge 0x1000c6ae
push str.bwzoa_lpq_pvbmb_ofr_ittgfwy_eber_waibm_xrndxukew_gikxhwoia_ttsmhsbh_yxthhy_qguicd_asg_bnoniwomu
call fcn.10045f6d
pop ecx
jmp 0x1000c6ae
test cl, cl
je 0x1000c6a4
mov eax, dword [ebp + 8]
inc dword [eax]
jmp 0x1000c6ae
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000d30b
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x1000d322
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8
Function at 0x1000d344
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x102c4164
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x102c44f0
jl 0x1000d352
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x102c4794
jl 0x1000d392
mov ecx, dword [0x102c54e0]
xor ecx, dword [0x102c4164]
and ecx, edi
xor ecx, dword [0x102c54e0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x102c4160], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x102c4794]
mov dword [0x102c4b20], eax
pop esi
ret
Function at 0x1000dba5
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1000dbd9
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x34], eax
push 0x218c
push 1
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call fcn.1000dd22
add esp, 0x10
jmp 0x1000dd1e
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x1000dc04
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x1000dd1e
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1000dc32
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0xffffffed
je 0x1000dd1e
mov dword [ebp - 8], 0
mov dword [ebp - 0x20], 0xd0374c7a
mov dword [ebp - 0x28], 0xa1405524
mov dword [ebp - 0x50], 0
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jne 0x1000dc6b
mov dword [ebp - 0x10], 1
jmp 0x1000dc6f
and dword [ebp - 0x10], 0
cmp dword [ebp - 0x10], 0x4c20
jl 0x1000dc81
mov dword [ebp - 0x14], 1
jmp 0x1000dc85
and dword [ebp - 0x14], 0
mov eax, dword [ebp - 8]
cmp dword [ebp - 0x14], eax
jg 0x1000dc96
mov dword [ebp - 0x18], 1
jmp 0x1000dc9a
and dword [ebp - 0x18], 0
mov eax, dword [ebp - 4]
mov eax, dword [eax]
imul eax, dword [ebp - 0x18]
cmp eax, 0xae7b
je 0x1000dcb3
mov dword [ebp - 0x1c], 1
jmp 0x1000dcb7
and dword [ebp - 0x1c], 0
cmp dword [ebp - 0x1c], 0xffffffff
jl 0x1000dcc6
mov dword [ebp - 0xc], 1
jmp 0x1000dcca
and dword [ebp - 0xc], 0
mov eax, dword [ebp - 0x4c]
mov ecx, dword [ebp - 0xc]
mov dword [eax], ecx
mov eax, dword [ebp - 8]
cmp eax, dword [ebp - 0xc]
jne 0x1000dce3
mov dword [ebp - 0x24], 1
jmp 0x1000dce7
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
add eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
add eax, dword [ebp - 8]
imul eax, eax, 6
cmp eax, 0xc715
jne 0x1000dd0f
mov dword [ebp - 0x2c], 1
jmp 0x1000dd13
and dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x50], eax
jmp 0x1000dc27
mov esp, ebp
pop ebp
ret
Function at 0x10010d83
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10010daf
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
push dword [ebp - 4]
push dword [ebp - 8]
push 1
call fcn.10010df5
add esp, 0xc
jmp 0x10010df1
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10010de0
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov edx, 0x39e9671a
mov ecx, dword [ebp - 0x18]
call fcn.1000d85c
jmp 0x10010df1
push 0
push 0x1b21
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esp, ebp
pop ebp
ret
Function at 0x10020f07
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x1005d670
call fcn.1005c6c0
sub esp, 0x10
mov byte [ebp - 0x18], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x10020fc2
mov dword [ebp - 0x1c], 0x2bf6
cmp dword [ebp - 0x1c], 0x2df2
jle 0x10020f6a
xor esi, esi
xor edi, edi
mov ebx, 0x4ec6
mov eax, edi
mov ecx, 0x10077cb8
cdq
push edx
push eax
call fcn.1000651b
add edi, esi
dec ebx
jne 0x10020f3e
inc esi
cmp esi, 0x318d
jl 0x10020f37
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowRgn]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x283c
jge 0x10020f86
mov edx, str.okzux_uxxpykg_nruy_kclvlnlr_qiydl_qxzjxkwmz_eewszz_jvodraszp_tdclgevxy
mov ecx, 0x10077cb8
call fcn.10009581
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10020fd6
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
or dword [eax + ecx*4], 0xffffffff
inc dword [edx]
cmp dword [edx], 2
jl 0x10020f97
jmp 0x10020fd6
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x10020fd6
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10021160
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
cmp byte [ebp + 8], 0
push esi
mov byte [ebp - 8], dl
je 0x100211bf
cmp byte [ebp + 0xc], 0
je 0x100211b8
mov dword [ebp - 0xc], 0x3342eb9
mov dword [ebp - 0xc], 0x13
jmp 0x100211b0
mov edx, 0x657f
xor cl, cl
call fcn.1002157d
push 0x5e4c
push 0x53d
push 0
mov edx, 0x7400
xor cl, cl
call fcn.10020b57
add esp, 0xc
dec dword [ebp - 0xc]
cmp dword [ebp - 0xc], 0xffffffe8
jge 0x10021186
jmp 0x100211fd
mov eax, dword [ebp + 0x14]
inc dword [eax]
jmp 0x100211fd
test dl, dl
je 0x100211e2
mov edx, dword [ecx]
lea esi, [ebp + 0xb]
mov ecx, dword [ebp + 0x10]
push esi
push edx
mov byte [ebp + 0xb], 0
mov eax, dword [ecx]
push eax
mov dword [ecx + 4], eax
lea eax, [ebp - 0x10]
push eax
call fcn.10023b01
jmp 0x100211fd
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x100211fd
push 0
push 0x1b21
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1002acd7
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x1002ad47
mov eax, dword [ebp + 0x34]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x28]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x30]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x2c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x18], eax
push dword [ebp - 8]
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push dword [ebp - 0x14]
push 1
push dword [ebp - 0x18]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 0x7a80
push dword [ebp - 0x28]
call fcn.1002ad91
add esp, 0x2c
jmp 0x1002ad8d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1002ad83
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
push 0
mov ecx, dword [ebp - 0x38]
call fcn.10006b2f
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x1002ad8d
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov esp, ebp
pop ebp
ret
Function at 0x1003704f
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005de13
call fcn.1005c6c0
sub esp, 0x1c
push ebx
push esi
mov dword [ebp - 0x20], 0x27aa
cmp dword [ebp - 0x20], 0x2a3d
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], edx
jle 0x100370cc
xor edi, edi
mov dword [ebp - 0x1c], edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x14], 0x2d14
xor ebx, ebx
mov ecx, ebx
mov eax, edi
sar eax, cl
mov ecx, 0x10077cb8
cdq
push edx
push eax
call fcn.1000651b
inc ebx
cmp ebx, 0x2e51
jl 0x1003708b
mov ebx, dword [ebp - 0x18]
add edi, ebx
dec dword [ebp - 0x14]
jne 0x10037089
mov edi, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 0x18], ebx
cmp ebx, 0x6db5
jl 0x1003707f
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x380b
jl 0x1003707a
cmp byte [ebp + 0xc], 0
je 0x10037112
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x100370e2
push 0
call dword [sym.imp.KERNEL32.dll_EncodePointer]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x2449
jge 0x10037101
mov edx, str.cspvx_xktr_fctzx_xbfjnvxp_yqdg_qtailjgry_ysabk_azsvughy_tyjhuybmq_hhuigr
mov ecx, 0x10077cb8
call fcn.10009581
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x18], 0x772b
cmp dword [ebp - 0x18], 0x7846
jle 0x1003715c
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x1c], eax
add eax, ebx
mov ecx, 0x10077cb8
xor eax, edi
cdq
push edx
push eax
call fcn.1000651b
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x6c2
jl 0x1003712b
inc ebx
cmp ebx, 0x78bf
jl 0x10037126
inc edi
cmp edi, 0x3e9
jl 0x10037124
mov eax, dword [ebp + 0x10]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x73bc
mov ecx, dword [ebp - 0x28]
mov dword [eax], ecx
jge 0x100370e2
mov edx, str.gqgwvpz_opgfzahr_fsndt_xrcoc_swogiw_uldqnp_urypqk_zdn_bbmpd_wfkzqpaw
mov ecx, 0x10077cb8
call fcn.10009581
jmp 0x100370e2
Function at 0x10039466
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005deb4
call fcn.1005c6c0
sub esp, 0x14
mov byte [ebp - 0x18], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10039524
mov dword [ebp - 0x1c], 0x673f
cmp dword [ebp - 0x1c], 0x67c0
jle 0x100394bb
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x10077cb8
xor eax, esi
cdq
push edx
push eax
call fcn.1000651b
inc edi
cmp edi, 0x6649
jl 0x10039498
inc esi
cmp esi, 0x4540
jl 0x10039496
push 0x6f37
push 0xb8c
push 1
push 0x2182
lea eax, [ebp - 0x11]
mov byte [ebp - 0x11], 0
push eax
push 0x5f82
push ecx
mov edx, 0x17db
mov ecx, 0x4eeb
call fcn.10036a0e
and dword [ebp - 4], 0
add esp, 0x1c
cmp dword [ebp - 0x1c], 0x657e
jge 0x10039508
mov edx, str.byy_zsmmpnz_lnpnkdq_mypbmwve
mov ecx, 0x10077cb8
call fcn.10009581
jmp 0x1003953f
mov byte [ebp - 0x12], 0
cmp byte [ebp - 0x12], 0
je 0x1003953f
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_EnumChildWindows]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003993d
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x1005debe
call fcn.1005c6c0
sub esp, 0x10
push ebx
push esi
mov dword [ebp - 0x18], 0x7cce
mov eax, ecx
cmp dword [ebp - 0x18], 0x7e8b
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], eax
jle 0x100399a3
xor edi, edi
xor esi, esi
mov dword [ebp - 0x14], esi
mov ebx, esi
mov esi, 0x6f42
mov eax, ebx
mov ecx, 0x10077cb8
or eax, edi
cdq
push edx
push eax
call fcn.1000651b
dec ebx
dec esi
jne 0x10039973
mov esi, dword [ebp - 0x14]
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x7ac5
jl 0x1003996c
inc edi
cmp edi, 0xf5d
jl 0x10039967
mov eax, dword [ebp - 0x1c]
cmp byte [ebp + 0xc], 0
je 0x100399b5
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x100399bb
mov dword [eax], 0x87d7a760
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x7bc6
jge 0x100399d7
mov edx, str.bgdkv_ivfmjqgu_kfbyvkcm_ewhqn_jzlhek_tgtk
mov ecx, 0x10077cb8
call fcn.10009581
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10039e03
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x1005dedc
call fcn.1005c6c0
sub esp, 0x24
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, edx
mov dword [ebp - 0x18], ecx
je 0x10039e79
cmp byte [ebp + 0x10], 0
je 0x10039e40
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x10039e2f
push 0x1305
push 0x200f
push 0x4a
push 0x1610
push 0x624
push 0xe70
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_RoundRect]
jmp 0x10039e2f
mov dword [ebp - 0x14], 0x706a
cmp dword [ebp - 0x14], 0x711e
jle 0x10039eb0
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x10077cb8
or eax, edi
cdq
push edx
push eax
call fcn.1000651b
inc ebx
cmp ebx, 0xbd7
jl 0x10039e8d
inc edi
cmp edi, 0x29e0
jl 0x10039e8b
cmp byte [ebp + 0xc], 0
je 0x10039f58
mov dword [ebp + 0x18], 0x22e5
cmp dword [ebp + 0x18], 0x23ff
jle 0x10039f22
xor edi, edi
xor ebx, ebx
mov eax, ebx
lea ecx, [ebp - 0x30]
xor eax, edi
cdq
push edx
push eax
call fcn.10001ac9
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10039ee7
mov eax, dword [eax]
push eax
call fcn.10045f6d
pop ecx
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.10007132
inc ebx
cmp ebx, 0x598
jl 0x10039ece
inc edi
cmp edi, 0x3c3c
jl 0x10039ecc
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
cmp dword [ebp + 0x18], 0x22a6
jge 0x10039f36
push str.hmzppb_xbq_iyz_igxgt_qfoibebqw_jjrmdvrgx_shbafc_frqi_pdbvvutz_tjccw
call fcn.10045f6d
pop ecx
mov dword [esi], 0
cmp dword [esi], 1
jge 0x10039f5d
mov edx, dword [ebp - 0x18]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0xd6a9
inc dword [esi]
cmp dword [esi], 1
jl 0x10039f44
jmp 0x10039f5d
mov eax, dword [ebp + 8]
inc dword [eax]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x14], 0x6cac
jge 0x10039e2f
mov edx, str.rwbs_pjnxgs_xhkc_kpgpihef_rboteisx_yzuqlnppj_bfvp_kdzlao_rrun
mov ecx, 0x10077cb8
call fcn.10009581
jmp 0x10039e2f
Function at 0x1003b011
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x54
push ebx
push esi
push edi
test dl, dl
je 0x1003b050
cmp byte [ebp + 0x14], 0
je 0x1003b02f
add dword [ecx], 0xfffffffe
jmp 0x1003b1cc
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1003b1cc
xor esi, esi
push esi
push 0x1b21
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x1003b1cc
xor esi, esi
cmp byte [ebp + 8], 0
je 0x1003b07e
mov edi, dword [ebp + 0xc]
xor ebx, ebx
inc ebx
mov dword [edi], ebx
jmp 0x1003b075
lea eax, [esp + 0x24]
mov dword [esp + 0x24], ebx
push eax
push ebx
call fcn.1003a5b2
dec dword [edi]
pop ecx
pop ecx
cmp dword [edi], esi
jge 0x1003b062
jmp 0x1003b1cc
lea eax, [esp + 0x2c]
mov dword [esp + 0x30], 0xffffffff
push eax
push esi
lea eax, [esp + 0x38]
mov dword [esp + 0x48], 0x891f782a
push eax
lea eax, [esp + 0x40]
mov dword [esp + 0x44], 0x6968939f
push eax
push esi
lea eax, [esp + 0x28]
mov dword [esp + 0x40], esi
push eax
lea eax, [esp + 0x50]
mov dword [esp + 0x54], 0xfffffff6
push eax
lea eax, [esp + 0x58]
mov dword [esp + 0x60], 6
push eax
mov dword [esp + 0x34], 0xe5809974
lea eax, [esp + 0x60]
mov dword [esp + 0x54], 0x39384257
lea edx, [esp + 0x64]
mov dword [esp + 0x40], 0xe2e4ed
mov ecx, 0x3c17
push eax
call fcn.10037204
add esp, 0x24
lea eax, [esp + 0x20]
lea edx, [esp + 0x14]
push eax
push ecx
push esi
call fcn.10037c06
mov dword [esp + 0x34], 0x1964
add esp, 0xc
cmp dword [esp + 0x28], 0x1abd
jle 0x1003b1b7
xor ebx, ebx
mov dword [esp + 0x10], esi
inc ebx
mov edi, esi
mov dword [esp + 0x24], esi
mov eax, esi
mov dword [esp + 0x20], esi
lea ecx, [eax + edi]
mov dword [esp + 0x1c], 0x3685
mov edi, dword [esp + 0x10]
mov dword [esp + 0x18], ecx
mov eax, edi
sar eax, cl
lea ecx, [esp + 0x48]
cdq
push edx
push eax
call fcn.10001ac9
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003b161
mov eax, dword [eax]
push eax
call fcn.10045f6d
pop ecx
push esi
push ebx
lea ecx, [esp + 0x50]
call fcn.10007132
mov ecx, dword [esp + 0x18]
dec ecx
dec dword [esp + 0x1c]
mov dword [esp + 0x18], ecx
jne 0x1003b147
mov eax, dword [esp + 0x20]
mov edi, dword [esp + 0x24]
inc eax
mov dword [esp + 0x20], eax
cmp eax, 0x3153
jl 0x1003b134
inc edi
mov dword [esp + 0x24], edi
cmp edi, 0x4050
jl 0x1003b12e
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
cmp eax, 0x4c04
jl 0x1003b128
cmp dword [esp + 0x28], 0x15a5
jge 0x1003b1cc
push str.leiw_dlcbzc_plemchvfg_tunehy_vvoaxb_buzmms_nghtlci_ehoek_uvib_fcszdjigk_tvofbox_xcjzpibj
call fcn.10045f6d
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406275
Capabilities:
Create directory

Disassembly:
push ebp
sub esp, 0x4c
mov eax, 0x4b3eba
call fcn.004a2e80
sub esp, 0x38
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp + 0x48], esi
call fcn.004094f6
mov edi, dword [sym.imp.KERNEL32.dll_GetLastError]
xor ebx, ebx
mov ecx, eax
inc ebx
xor eax, eax
mov dword [ebp + 0x4c], ecx
mov dword [ebp + 0x44], eax
cmp ecx, ebx
je 0x4062d4
push eax
push esi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4062bd
mov al, bl
jmp 0x4063b4
call edi
cmp eax, 0xb7
je 0x40636a
cmp dword [ebp + 0x4c], 0
je 0x40636a
lea ecx, [ebp + 0x38]
call fcn.004029b0
mov ecx, dword [ebp + 0x48]
lea edx, [ebp + 0x38]
xor esi, esi
cmp dword [ebp + 0x4c], ebx
mov dword [ebp - 4], esi
setne al
movzx eax, al
push eax
call fcn.00409098
test al, al
je 0x40635a
push esi
push dword [ebp + 0x38]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
jne 0x40634e
call edi
cmp eax, 0xb7
je 0x406315
xor bl, bl
jmp 0x40634e
lea ecx, [ebp]
call fcn.00406f52
lea ecx, [ebp + 0x28]
call fcn.004029b0
push 0
push dword [ebp + 0x38]
lea ecx, [ebp]
mov byte [ebp - 4], bl
call fcn.0040719f
test al, al
jne 0x40633d
xor bl, bl
jmp 0x406345
mov eax, dword [ebp + 0x20]
shr eax, 4
and bl, al
push dword [ebp + 0x28]
call fcn.004a2e6c
pop ecx
push dword [ebp + 0x38]
call fcn.004a2e6c
mov al, bl
jmp 0x4063b3
push dword [ebp + 0x38]
or dword [ebp - 4], 0xffffffff
call fcn.004a2e6c
mov esi, dword [ebp + 0x48]
pop ecx
call edi
cmp eax, 0xb7
je 0x406377
xor al, al
jmp 0x4063b4
lea ecx, [ebp - 0x44]
call fcn.00406f52
lea ecx, [ebp - 0x1c]
call fcn.004029b0
push 0
push esi
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 2
call fcn.0040719f
test al, al
je 0x4063a8
mov eax, dword [ebp - 0x24]
shr eax, 4
and al, bl
mov byte [ebp + 0x44], al
push dword [ebp - 0x1c]
call fcn.004a2e6c
mov al, byte [ebp + 0x44]
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
add ebp, 0x50
leave
ret

Function at 0x4063c6
Capabilities:
Create directory

Disassembly:
mov eax, 0x4b3ccc
call fcn.004a2e80
sub esp, 0xc
push esi
push edi
mov edi, ecx
call fcn.004094f6
mov esi, eax
cmp esi, 1
je 0x406405
push 0
push edi
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
test eax, eax
je 0x4063f4
mov al, 1
jmp 0x406451
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0xb7
je 0x40644f
test esi, esi
je 0x40644f
lea ecx, [ebp - 0x18]
call fcn.004029b0
and dword [ebp - 4], 0
lea edx, [ebp - 0x18]
cmp esi, 1
mov ecx, edi
setne al
movzx eax, al
push eax
call fcn.00409098
test al, al
je 0x406446
push 0
push dword [ebp - 0x18]
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
push dword [ebp - 0x18]
mov esi, eax
call fcn.004a2e6c
test esi, esi
pop ecx
setne al
jmp 0x406451
push dword [ebp - 0x18]
call fcn.004a2e6c
pop ecx
xor al, al
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret