joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000204c
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, 0x10058c2b
call fcn.100586e8
sub esp, 0x40
mov byte [ebp - 0x1c], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x100021c8
xor ebx, ebx
mov dword [ebp - 0x2c], 0xfffb
mov dword [ebp - 0x20], ebx
jmp 0x10002086
mov eax, dword [ebp - 0x20]
mov dword [ebp + eax*4 - 0x34], 0xd59e57ad
inc dword [ebp - 0x20]
cmp dword [ebp - 0x20], 2
jl 0x10002078
mov dword [ebp - 0x28], 0x50fe
cmp dword [ebp - 0x28], 0x51b3
jle 0x100020f6
mov edi, ebx
mov esi, ebx
mov ecx, ebx
mov dword [ebp - 0x24], 0x703f
mov dword [ebp - 0x20], ecx
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0x4c]
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100020c5
mov eax, dword [eax]
push eax
call fcn.100402ac
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x4c]
call fcn.10004889
mov ecx, dword [ebp - 0x20]
add ecx, esi
dec dword [ebp - 0x24]
mov dword [ebp - 0x20], ecx
jne 0x100020ac
inc esi
cmp esi, 0x6d88
jl 0x100020a0
inc edi
cmp edi, 0x420d
jl 0x1000209e
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
cmp dword [ebp - 0x28], 0x4e77
jge 0x10002110
push str.cehuq_rsmgffxpf_pevvxgw_hdkzw_hdejn_obyyfwwq_hdsgvfwe_rlldjasm_jvo_erytku_uxvbr
call fcn.100402ac
pop ecx
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x15]
push ecx
push 1
push ecx
mov byte [ebp - 0x15], bl
mov edx, 0x66dc
push eax
mov ecx, 0x5ad5
call fcn.100021e9
mov dword [ebp - 0x28], 0x3b63
add esp, 0x10
cmp dword [ebp - 0x28], 0x3c8f
jle 0x1000218d
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x2c], ebx
mov eax, edi
mov ecx, 0x10073018
cdq
idiv ebx
or edx, esi
mov eax, edx
cdq
push edx
push eax
call fcn.1000421d
inc ebx
cmp ebx, 0x53d4
jl 0x10002148
inc edi
push 0
pop ebx
cmp edi, 0x2ef1
jl 0x10002145
inc esi
cmp esi, 0x3ff7
jl 0x10002143
push 0x13cb
push 0x1b46
push ebx
call dword [sym.imp.USER32.dll_InflateRect]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x28], 0x396a
jge 0x100021ac
mov edx, str.ixcjwc_jitfuvhgj_zdxoedyem
mov ecx, 0x10073018
call fcn.100065e2
jmp 0x100021d8
mov byte [ebp - 0x16], 0
cmp byte [ebp - 0x16], 0
je 0x100021d8
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10007592
Capabilities:
Allocate thread local storage
Get thread local storage value

Disassembly:
mov eax, 0x10058ea8
call fcn.100586e8
sub esp, 0xc
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], ebx
je 0x10007690
cmp byte [ebp + 0x1c], 0
je 0x1000767c
mov dword [ebp + 8], 0x20d8
cmp dword [ebp + 8], 0x21c9
jle 0x10007610
push 0x1ec5
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x10073018
or eax, edi
or eax, esi
cdq
push edx
push eax
call fcn.1000421d
inc ebx
cmp ebx, 0x2a5d
jl 0x100075df
inc edi
cmp edi, 0x4127
jl 0x100075dd
inc esi
cmp esi, 0x4467
jl 0x100075db
mov ebx, dword [ebp - 0x14]
and dword [ebp - 4], 0
cmp dword [ebp + 8], 0x1f2b
jge 0x1000764b
mov edx, str.mchuq_qpxypwuc_yfcme_rxvldt_uuhoqmyh_oumm_sfdnbbc_ejnsdggeo_cxzuhg_rahhzgp
mov ecx, 0x10073018
call fcn.100065e2
jmp 0x1000764b
mov eax, dword [ebp + 0x10]
or dword [ebp - 4], 0xffffffff
push 0x1a
pop esi
mov ecx, dword [eax]
cmp ecx, esi
jge 0x10007665
mov eax, dword [ebp + 0x20]
movzx edx, word [eax]
add edx, ecx
jmp 0x10007672
mov eax, ecx
cdq
idiv esi
mov eax, dword [ebp + 0x14]
movzx eax, word [eax]
add edx, eax
push edx
mov ecx, ebx
call fcn.100095d1
jmp 0x100076d2
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0x100076d2
push 0
push 0
call dword [sym.imp.GDI32.dll_GetRgnBox]
jmp 0x100076d2
cmp byte [ebp + 0xc], 0
je 0x100076a3
cmp byte [edx], 0
je 0x100076d2
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x100076d2
mov byte [ebp + 0xb], 0
cmp byte [ebp + 0xb], 0
je 0x100076d2
push 0x6087
push 0x5744
push 0x23e8
push 0x751a
push 0x4f00
xor dl, dl
xor cl, cl
call fcn.1000899d
add esp, 0x14
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10009869
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x10009880
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x100098a2
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x100741c4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x10074550
jl 0x100098b0
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x100747f4
jl 0x100098f0
mov ecx, dword [0x10075540]
xor ecx, dword [0x100741c4]
and ecx, edi
xor ecx, dword [0x10075540]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x100741c0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x100747f4]
mov dword [0x10074b80], eax
pop esi
ret
Function at 0x1000df6b
Capabilities:
Create pipe
Encode data using xor

Disassembly:
mov eax, 0x100591e1
call fcn.100586e8
sub esp, 0x2c
push ebx
push esi
mov byte [ebp - 0x14], cl
mov dword [ebp - 0x1c], 0x6f14
cmp dword [ebp - 0x1c], 0x72d1
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edx
jle 0x1000dfd9
xor edi, edi
xor ebx, ebx
mov dword [ebp - 0x18], 0x1bf4
mov eax, ebx
lea ecx, [ebp - 0x38]
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000dfb6
mov eax, dword [eax]
push eax
call fcn.100402ac
pop ecx
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.10004889
add ebx, edi
dec dword [ebp - 0x18]
jne 0x1000df9f
inc edi
cmp edi, 0x6f67
jl 0x1000df96
cmp dword [ebp - 0x1c], 0x6bcb
jge 0x1000dfed
push str.hqxacfl_fmvrgv_qmsi_ocwsvga_torhxy_hos_wupbklvv_acmq_zrsy_zug_refyciyk_tgpbvxo_yafjlgp
call fcn.100402ac
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x14], 0
je 0x1000e00e
mov eax, dword [ebp + 8]
and dword [eax], 0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], 0x7c80
cmp dword [ebp - 0x1c], 0x7d9f
jle 0x1000e06d
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x10073018
xor eax, edi
cdq
push edx
push eax
call fcn.1000421d
inc ebx
cmp ebx, 0x1826
jl 0x1000e022
inc edi
cmp edi, 0x71fa
jl 0x1000e020
push 0
push 0x22e7
push 0x1af5
push 0x1bdc
push 0x16f5
push 0x23b2
push 0x9a1
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov eax, dword [ebp - 0x20]
and dword [eax], 0
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x79dc
jge 0x1000dffd
mov edx, str.gtolege_deaap_ubbocyb_wxwl_sjlv_fnhs_nwsnmws_pqsljbgus_oam
mov ecx, 0x10073018
call fcn.100065e2
jmp 0x1000dffd
Function at 0x1000f1f2
Capabilities:
Delete registry value

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov ebx, ecx
je 0x1000f21e
mov eax, dword [ebp + 0x1c]
push dword [ebp + 0x14]
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
mov edx, dword [eax]
call fcn.1000b5ca
pop ecx
jmp 0x1000f2a9
mov dword [esp + 0xc], 0x32c3
cmp dword [esp + 0xc], 0x347f
jle 0x1000f286
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
xor esi, esi
xor edi, edi
mov eax, edi
lea ecx, [esp + 0x10]
and eax, esi
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000f256
mov eax, dword [eax]
push eax
call fcn.100402ac
pop ecx
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.10004889
inc edi
cmp edi, 0x63d4
jl 0x1000f23c
inc esi
cmp esi, 0xa5b
jl 0x1000f23a
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegDeleteValueA]
cmp dword [esp + 0xc], 0x31f2
jge 0x1000f29b
push str.ygtn_bdc_ujrbzwup_nkjvgj
call fcn.100402ac
pop ecx
push ecx
push dword [ebp + 0x20]
mov ecx, dword [ebp + 0x10]
call fcn.1000fef5
mov dword [ebx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100109c0
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, 0x10059315
call fcn.100586e8
sub esp, 0x14
push ebx
push esi
mov byte [ebp - 0x14], dl
mov dword [ebp - 0x1c], 0x250e
cmp dword [ebp - 0x1c], 0x267f
push edi
mov dword [ebp - 0x10], esp
jle 0x10010a0c
xor esi, esi
xor edi, edi
mov ebx, 0x5b84
mov eax, edi
mov ecx, 0x10073018
cdq
push edx
push eax
call fcn.1000421d
add edi, esi
dec ebx
jne 0x100109ef
inc esi
cmp esi, 0x12ba
jl 0x100109e8
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x217c
jge 0x10010a28
mov edx, str.acsbeqq_ecpny_fsxisiums
mov ecx, 0x10073018
call fcn.100065e2
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x14], 0
je 0x10010a63
lea eax, [ebp - 0x15]
mov byte [ebp - 0x15], 0
push eax
mov edx, 0x6bfc
xor cl, cl
call fcn.10011442
pop ecx
jmp 0x10010a73
mov byte [ebp - 0x16], 0
cmp byte [ebp - 0x16], 0
je 0x10010a73
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100117f3
Capabilities:
Connect pipe

Disassembly:
mov eax, 0x10059347
call fcn.100586e8
sub esp, 0x3c
mov dword [ebp - 0x2c], ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10011847
cmp byte [ebp + 0x10], 0
je 0x10011833
push 0xbaf
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polyline]
jmp 0x100119c8
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_MapDialogRect]
jmp 0x100119c8
mov dword [ebp - 0x24], 0x7069
xor esi, esi
cmp dword [ebp - 0x24], 0x7320
jle 0x100118b3
mov edi, esi
mov ebx, esi
mov ecx, esi
mov dword [ebp - 0x14], esi
mov eax, ebx
cdq
idiv ecx
lea ecx, [ebp - 0x44]
xor edx, edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10011880
mov eax, dword [eax]
push eax
call fcn.100402ac
pop ecx
push esi
push 1
lea ecx, [ebp - 0x44]
call fcn.10004889
mov ecx, dword [ebp - 0x14]
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x75eb
jl 0x10011862
inc ebx
cmp ebx, 0x6db9
jl 0x1001185d
inc edi
cmp edi, 0x7046
jl 0x1001185b
cmp byte [ebp + 0xc], 0
je 0x100119a4
mov dword [ebp - 0x20], 0x1856
cmp dword [ebp - 0x20], 0x1b54
jle 0x1001195d
push 0x1b32
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_Polygon]
mov ebx, esi
mov dword [ebp - 0x1c], esi
mov edi, esi
mov eax, ebx
mov dword [ebp - 0x14], esi
cdq
idiv edi
mov dword [ebp - 0x18], 0x313d
mov dword [ebp - 0x28], edx
mov ebx, esi
mov esi, dword [ebp - 0x14]
mov eax, esi
mov ecx, 0x10073018
or eax, ebx
cdq
push edx
push eax
call fcn.1000421d
inc ebx
cmp ebx, 0x4fae
jl 0x10011909
add esi, dword [ebp - 0x28]
dec dword [ebp - 0x18]
push 0
mov dword [ebp - 0x14], esi
pop esi
jne 0x10011904
mov ebx, dword [ebp - 0x1c]
inc edi
cmp edi, 0x7175
jl 0x100118f2
inc ebx
mov dword [ebp - 0x1c], ebx
cmp ebx, 0xe1e
jl 0x100118f0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_CreateHalftonePalette]
mov eax, dword [ebp - 0x2c]
cmp byte [eax], 0
je 0x1001196d
push esi
push esi
call dword [sym.imp.GDI32.dll_GetRgnBox]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x20], 0x174b
jge 0x10011988
mov edx, str.kslzibmt_nvshbn_zlcgva_iksszk_tnfkppyen
mov ecx, 0x10073018
call fcn.100065e2
jmp 0x100119b4
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x100119b4
push esi
push esi
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
cmp dword [ebp - 0x24], 0x6d36
jge 0x100119c8
push str.tmvw_rqm_ssgabff_ldiuxb_obcmgf_ltpynnm_bwlth_euuynqewl_rfacqy_lugp_huee_omo
call fcn.100402ac
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10011a5c
Capabilities:
Connect pipe

Disassembly:
mov eax, 0x10059351
call fcn.100586e8
sub esp, 0x10
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x10011a84
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
jmp 0x10011b0d
mov dword [ebp - 0x1c], 0x6049
cmp dword [ebp - 0x1c], 0x61c8
jle 0x10011ae1
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov ebx, esi
mov dword [ebp - 0x14], 0x616e
xor esi, esi
mov ecx, esi
mov eax, ebx
shl eax, cl
mov ecx, 0x10073018
cdq
push edx
push eax
call fcn.1000421d
inc esi
cmp esi, 0x36e7
jl 0x10011aa6
add ebx, edi
dec dword [ebp - 0x14]
jne 0x10011aa4
mov esi, dword [ebp - 0x18]
inc edi
cmp edi, 0xe57
jl 0x10011a9b
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x6475
jl 0x10011a99
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x5d7a
jge 0x10011afd
mov edx, str.bmlej_fidfsnjle_dzgaxsqep_tgpshr_aqcw
mov ecx, 0x10073018
call fcn.100065e2
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10011b0d
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10012e71
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
mov dword [ebp - 0x14], 0x1cfc
mov eax, ecx
cmp dword [ebp - 0x14], 0x1e95
push esi
push edi
mov dword [ebp - 0x1c], eax
jle 0x10012f16
xor esi, esi
mov dword [ebp - 0x10], esi
xor edi, edi
mov dword [ebp - 0xc], edi
mov ecx, edi
mov dword [ebp - 8], esi
mov edi, esi
xor ebx, ebx
shl edi, cl
mov dword [ebp - 8], edi
mov ecx, ebx
mov dword [ebp - 0x18], edi
xor esi, esi
sar edi, cl
mov eax, edi
lea ecx, [ebp - 0x34]
and eax, esi
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10012ecd
mov eax, dword [eax]
push eax
call fcn.100402ac
pop ecx
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.10004889
inc esi
cmp esi, 0x51b0
jl 0x10012eb4
mov edi, dword [ebp - 8]
inc ebx
cmp ebx, 0x504e
jl 0x10012eab
mov edi, dword [ebp - 0xc]
mov esi, dword [ebp - 0x10]
inc edi
mov dword [ebp - 0xc], edi
cmp edi, 0xde6
jl 0x10012e9d
inc esi
mov dword [ebp - 0x10], esi
cmp esi, 0x2e5b
jl 0x10012e98
mov eax, dword [ebp - 0x1c]
cmp byte [ebp + 0x10], 0
je 0x10012f2e
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10012f3d
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x10012f3d
cmp byte [eax], 0
je 0x10012f3d
mov ecx, 0x71d4
call fcn.10013130
cmp dword [ebp - 0x14], 0x1c82
jge 0x10012f51
push str.eutubj_smrpiozk_mqvekikmi_webmiji_hyqvt_wkbuomdbv_xhmxkshh_qkliwmi_lig_freuuo_ark
call fcn.100402ac
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001393a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100593a1
call fcn.100586e8
sub esp, 0x14
cmp byte [ebp + 0x20], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x18], ecx
je 0x10013ad1
mov dword [ebp - 0x14], 0x3766
cmp dword [ebp - 0x14], 0x37f7
jle 0x100139ad
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp + 0x20], ecx
mov eax, ebx
cdq
idiv ecx
mov eax, edi
mov ecx, 0x10073018
sub eax, edx
cdq
push edx
push eax
call fcn.1000421d
mov ecx, dword [ebp + 0x20]
inc ecx
mov dword [ebp + 0x20], ecx
cmp ecx, 0x47c7
jl 0x10013976
inc ebx
cmp ebx, 0x167d
jl 0x10013971
inc edi
cmp edi, 0x7fef
jl 0x1001396f
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x34cd
jge 0x100139c9
mov edx, str.unlzoh_wqxdzya_iofrwicmd_xbxl_tcbzh_vxjhl_mcegimk_ljomn
mov ecx, 0x10073018
call fcn.100065e2
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x24], 0
je 0x10013ab0
mov dword [ebp + 0x20], 0x324e
cmp dword [ebp + 0x20], 0x32f3
jle 0x10013a33
push 0xfc6
push 0x4b
push 0xcdb
push 0x1ac2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_IntersectClipRect]
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x10073018
xor eax, edi
cdq
push edx
push eax
call fcn.1000421d
inc ebx
cmp ebx, 0x68ad
jl 0x10013a10
inc edi
cmp edi, 0x16c2
jl 0x10013a0e
mov dword [ebp - 4], 2
cmp dword [ebp + 0x20], 0x3008
jge 0x10013a52
mov edx, str.kcpbf_beuz_igcsvznc_tegasjurt_ftfirhg_wkd_mhyptrn_zlyp_xeasf
mov ecx, 0x10073018
call fcn.100065e2
mov eax, dword [ebp + 8]
mov edx, dword [ebp + 0x28]
mov ecx, dword [ebp + 0xc]
push dword [eax]
mov eax, dword [ebp + 0x18]
mov edx, dword [edx]
mov ecx, dword [ecx]
push dword [eax]
mov eax, dword [ebp + 0x1c]
movzx eax, byte [eax]
push eax
mov eax, dword [ebp - 0x18]
push dword [eax]
call fcn.100110ed
add esp, 0x10
jmp 0x10013ae9
mov eax, dword [ebp - 0x1c]
cmp byte [eax], 0
je 0x10013ae9
push 0x126a
push 0xdc2
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_SetWindowLongA]
jmp 0x10013ae9
cmp byte [ebp + 0x10], 0
je 0x10013ade
mov eax, dword [ebp + 0x14]
dec dword [eax]
jmp 0x10013ae9
push 0x254d
call dword [sym.imp.USER32.dll_GetSysColor]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10013afa
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100593ab
call fcn.100586e8
sub esp, 0x24
push ebx
push esi
mov byte [ebp - 0x14], cl
mov dword [ebp - 0x18], 0x452f
cmp dword [ebp - 0x18], 0x48d9
push edi
mov dword [ebp - 0x10], esp
jle 0x10013b53
xor esi, esi
xor edi, edi
xor ebx, ebx
lea eax, [edi + esi]
mov ecx, 0x10073018
xor eax, ebx
cdq
push edx
push eax
call fcn.1000421d
inc ebx
cmp ebx, 0x5f25
jl 0x10013b26
inc edi
cmp edi, 0x4e87
jl 0x10013b24
inc esi
cmp esi, 0x76e6
jl 0x10013b22
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x431f
jge 0x10013b6f
mov edx, str.qoorn_mptvgdws_crgbx_fsar_tte
mov ecx, 0x10073018
call fcn.100065e2
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x14], 0
je 0x10013c16
mov dword [ebp - 0x18], 0x7330
cmp dword [ebp - 0x18], 0x7367
jle 0x10013bdc
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
lea ecx, [ebp - 0x30]
xor eax, edi
or eax, esi
cdq
push edx
push eax
call fcn.10001a55
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10013bae
mov eax, dword [eax]
push eax
call fcn.100402ac
pop ecx
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.10004889
inc ebx
cmp ebx, 0x805e
jl 0x10013b93
inc edi
cmp edi, 0x145e
jl 0x10013b91
inc esi
cmp esi, 0x7618
jl 0x10013b8f
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
cmp dword [ebp - 0x18], 0x710f
jge 0x10013c1b
push str.yvrztz_gnu_xrin_ztisyq_recll_bttlhsv_boev_npbz_wbbt_mdcxv_anhvpzgc_ezslylt_awhkkpsuo_mgzdx
call fcn.100402ac
pop ecx
jmp 0x10013c1b
mov eax, dword [ebp + 0x18]
dec dword [eax]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100207a7
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x68
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002092e
lea eax, [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x10020918
mov dword [ebp - 0x14], 0x4615
mov dword [ebp - 0x1c], 0xacde9e84
mov dword [ebp - 0x4c], 0xf628
mov dword [ebp - 0x18], 0x78ac
mov dword [ebp - 0x38], 0xfffffffe
mov dword [ebp - 0x44], 0xffffffff
mov dword [ebp - 0x50], 4
mov dword [ebp - 0x34], 0
mov dword [ebp - 0x54], 0x642e40c1
mov dword [ebp - 0xc], 0
mov dword [ebp - 0x40], 0xfffc
mov dword [ebp - 8], 0
jmp 0x1002082a
mov eax, dword [ebp - 8]
inc eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 3
jge 0x1002083d
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x68], 1
jmp 0x10020823
cmp dword [ebp - 0x14], 0
je 0x10020903
mov eax, dword [ebp - 0xc]
dec eax
mov dword [ebp - 0xc], eax
jne 0x1002085f
imul eax, dword [ebp - 0x18], 0xfffffff6
cmp eax, 7
ja 0x1002085f
and dword [ebp - 0x10], 0
jmp 0x10020866
mov dword [ebp - 0x10], 1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
push 4
pop eax
imul eax, eax, 0
mov ecx, dword [ebp - 0x10]
mov dword [ebp + eax - 0x68], ecx
mov eax, dword [ebp - 0x1c]
cmp eax, dword [ebp - 0x10]
je 0x1002088a
mov dword [ebp - 0x20], 1
jmp 0x1002088e
and dword [ebp - 0x20], 0
mov eax, dword [ebp - 0x14]
cmp eax, dword [ebp - 0x20]
jge 0x1002089a
xor eax, eax
je 0x100208a9
cmp dword [ebp - 0x18], 0
je 0x100208a9
mov dword [ebp - 0x24], 1
jmp 0x100208ad
and dword [ebp - 0x24], 0
mov eax, dword [ebp - 0x40]
cmp dword [ebp - 0x24], eax
jge 0x100208be
mov dword [ebp - 0x28], 1
jmp 0x100208c2
and dword [ebp - 0x28], 0
cmp dword [ebp - 0x28], 0x4acc
jge 0x100208d4
mov dword [ebp - 0x2c], 1
jmp 0x100208d8
and dword [ebp - 0x2c], 0
mov eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x2c]
je 0x100208fc
push 4
pop eax
imul eax, eax, 0
cmp dword [ebp + eax - 0x68], 0
je 0x100208fc
cmp dword [ebp - 0x34], 0
je 0x100208fc
mov dword [ebp - 0x30], 1
jmp 0x10020900
and dword [ebp - 0x30], 0
mov eax, dword [ebp - 0x38]
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x58], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x38], 6
jmp 0x1002092c
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1002092c
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x10020940
mov eax, dword [ebp + 8]
mov dword [ebp - 0x48], eax
push dword [ebp - 0x48]
push 0
call fcn.1001da88
pop ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1002599d
Capabilities:
Connect pipe

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x100259ef
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 0x21e9
push 1
push dword [ebp - 8]
push 0x731f
push 0x4a2c
push 0x488d
push dword [ebp - 0xc]
push dword [ebp - 0x10]
call fcn.10025a3d
add esp, 0x24
jmp 0x10025a39
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
movzx eax, byte [eax]
test eax, eax
je 0x10025a2f
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x10025a39
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ConnectNamedPipe]
mov esp, ebp
pop ebp
ret