joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001dab
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
mov byte [esp + 4], dl
push ebx
push esi
push edi
test dl, dl
je 0x10001f71
mov dword [esp + 0x24], 0x14b4
cmp dword [esp + 0x24], 0xb4d
push 0
pop ebx
jge 0x10001f5c
push ebx
push 4
call fcn.10001d3d
push ebx
push 7
call fcn.10001d3d
mov edx, dword [0x1062b98c]
mov eax, edx
mov ecx, dword [0x1062b988]
sub eax, ecx
mov byte [esp + 0x30], bl
push dword [esp + 0x30]
sar eax, 3
push eax
call fcn.100076ae
push 0x10072be8
push 0x10072be0
push str._lld__lld
call fcn.1003fcfb
mov edx, dword [0x10072be4]
add esp, 0x24
xorps xmm0, xmm0
mov esi, dword [0x10072be0]
movlpd qword [esp + 0x18], xmm0
mov dword [esp + 0x24], edx
cmp edx, dword [0x10072bec]
jg 0x10001f43
jl 0x10001e57
cmp esi, dword [0x10072be8]
ja 0x10001f43
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
mov dword [esp + 0x20], edi
mov dword [esp + 0x18], ebx
mov eax, dword [0x1062b988]
mov ecx, dword [0x1062b98c]
sub ecx, eax
mov dword [esp + 0x14], eax
sar ecx, 3
test ecx, ecx
jle 0x10001ec2
mov edi, dword [esp + 0x24]
mov ebx, eax
mov eax, ecx
cdq
sub eax, edx
mov edx, eax
sar edx, 1
lea eax, [ebx + edx*8]
cmp dword [eax + 4], edi
jg 0x10001ea8
jl 0x10001e9c
cmp dword [eax], esi
jae 0x10001ea8
lea ebx, [eax + 8]
or eax, 0xffffffff
sub eax, edx
add ecx, eax
jmp 0x10001eaa
mov ecx, edx
test ecx, ecx
jg 0x10001e85
mov edi, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
mov dword [esp + 0x14], ebx
mov ebx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
mov ecx, dword [0x10072bec]
cmp dword [eax + 4], ecx
jl 0x10001ee9
mov eax, dword [0x10072be8]
jg 0x10001edc
mov ecx, dword [esp + 0x14]
cmp dword [ecx], eax
jbe 0x10001ee5
mov ecx, eax
mov eax, dword [0x10072bec]
jmp 0x10001eee
mov eax, dword [esp + 0x14]
mov ecx, dword [eax]
mov eax, dword [eax + 4]
sub ecx, esi
mov esi, dword [esp + 0x14]
sbb eax, edx
add ecx, 1
push dword [esi + 4]
adc eax, 0
push dword [esi]
push eax
push ecx
call fcn.10045660
mov ecx, dword [esp + 0x14]
add ebx, eax
mov esi, dword [esi]
adc edi, edx
mov dword [esp + 0x18], ebx
add esi, 1
mov dword [esp + 0x20], edi
mov edx, dword [ecx + 4]
adc edx, 0
mov dword [esp + 0x24], edx
cmp edx, dword [0x10072bec]
jl 0x10001e67
jg 0x10001f4b
cmp esi, dword [0x10072be8]
jbe 0x10001e67
jmp 0x10001f4b
mov edi, dword [esp + 0x1c]
mov ebx, dword [esp + 0x18]
push edi
push ebx
push str._lld_n
call fcn.1003fffd
add esp, 0xc
xor ebx, ebx
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10001f76
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x10001f76
mov eax, dword [ecx]
inc dword [eax + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000230f
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
mov dword [esp + 8], 0x3828
mov ebx, ecx
cmp dword [esp + 8], 0x3c08
push esi
push edi
mov dword [esp + 0x14], ebx
jle 0x10002387
xor esi, esi
xor edi, edi
xor ebx, ebx
lea eax, [edi + esi]
or eax, ebx
lea ecx, [esp + 0x18]
cdq
push edx
push eax
call fcn.10001a95
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10002354
mov eax, dword [eax]
push eax
call fcn.1003fffd
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.10004e55
inc ebx
cmp ebx, 0x5365
jl 0x10002339
inc edi
cmp edi, 0x61a8
jl 0x10002337
inc esi
cmp esi, 0x740c
jl 0x10002335
mov ebx, dword [esp + 0x14]
cmp dword [esp + 0x10], 0x3769
jge 0x1000239c
push str.zdarzjx_ohalt_vyjxsder_sehrdnj_eygnmjobb_dwvef_pmaaehxht_txzes
call fcn.1003fffd
pop ecx
cmp byte [ebp + 0x14], 0
je 0x100023cf
mov esi, dword [ebp + 0xc]
mov dword [esi], 0
jmp 0x100023c8
push ecx
lea eax, [esp + 0x13]
mov byte [esp + 0x13], 0
push eax
mov dl, 1
mov ecx, 0x2a70
call fcn.10001dab
dec dword [esi]
pop ecx
pop ecx
cmp dword [esi], 0xffffffe2
jg 0x100023ad
jmp 0x100023de
cmp byte [ebx], 0
je 0x100023de
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000b53f
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005891c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x28
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1000b668
lea eax, [ebp + 8]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov dword [ebp - 0x1c], 0x503a
mov dword [ebp - 0x30], str.scnxwh_zdbht_gesbzkw_khisnb
cmp dword [ebp - 0x1c], 0x5045
jle 0x1000b5dd
and dword [ebp - 0x14], 0
jmp 0x1000b59d
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x2fc4
jge 0x1000b5dd
and dword [ebp - 0x18], 0
jmp 0x1000b5b3
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x105a
jge 0x1000b5db
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
push dword [ebp - 0x34]
push dword [ebp - 0x38]
mov ecx, 0x10071a98
call fcn.100046a4
jmp 0x1000b5ac
jmp 0x1000b596
mov eax, dword [ebp - 0x20]
movzx eax, byte [eax]
test eax, eax
je 0x1000b61a
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1000b618
push 0
push 0x648b
push 1
push 0x3ff4
push 0x72d6
call fcn.1000ab84
add esp, 0x14
jmp 0x1000b626
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x4da1
jge 0x1000b640
mov edx, dword [ebp - 0x30]
mov ecx, 0x10071a98
call fcn.10006c80
jmp 0x1000b65c
or dword [ebp - 4], 0xffffffff
jmp 0x1000b666
jmp 0x1000b681
push 0x102b
push 0
push 0x281b
push 0x1385
call fcn.1000c5a5
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001727f
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10058bd4
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x100173c6
mov eax, dword [ebp + 8]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x24], 0x30d
mov dword [ebp - 0x28], str.vlrfta_tkesysdy_zohnkhsd_aerf_oaytpgv_lcyx_hwszbwko_ctmelqsr_muwuioo_ptjayyq
cmp dword [ebp - 0x24], 0x426
jle 0x10017354
and dword [ebp - 0x1c], 0
jmp 0x100172db
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3fb
jge 0x10017354
and dword [ebp - 0x20], 0
jmp 0x100172f1
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x459f
jge 0x10017352
and dword [ebp - 0x14], 0
jmp 0x10017307
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x6a5
jge 0x10017350
and dword [ebp - 0x18], 0
jmp 0x1001731d
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x4031
jge 0x1001734e
mov eax, dword [ebp - 0x14]
add eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
imul ecx, dword [ebp - 0x20]
and eax, ecx
cdq
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x48], edx
push dword [ebp - 0x48]
push dword [ebp - 0x4c]
mov ecx, 0x10071a98
call fcn.100046a4
jmp 0x10017316
jmp 0x10017300
jmp 0x100172ea
jmp 0x100172d4
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x73
jge 0x10017371
mov edx, dword [ebp - 0x28]
mov ecx, 0x10071a98
call fcn.10006c80
jmp 0x1001738d
or dword [ebp - 4], 0xffffffff
jmp 0x10017397
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x2c]
push 0x1e57
push dword [ebp - 0x30]
push 0x6515
push 0x6c3
push 0x7c83
push dword [ebp - 0x34]
push 0
call fcn.1001740b
add esp, 0x20
jmp 0x100173fa
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x100173f0
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov byte [eax], 1
jmp 0x100173fa
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001c245
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
test cl, cl
je 0x1001c30b
cmp byte [ebp + 0x18], 0
je 0x1001c27b
push 0x1fd
push 0x5b7
push 0
push 0x2191
call dword [sym.imp.USER32.dll_DrawEdge]
jmp 0x1001c348
mov dword [esp + 0x14], 0x6128
cmp dword [esp + 0x14], 0x64ec
push 0
pop ebx
jle 0x1001c2d5
mov esi, ebx
mov edi, ebx
mov ecx, edi
mov eax, esi
shl eax, cl
lea ecx, [esp + 0x18]
cdq
push edx
push eax
call fcn.10001a95
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001c2b0
mov eax, dword [eax]
push eax
call fcn.1003fffd
pop ecx
push ebx
push 1
lea ecx, [esp + 0x20]
call fcn.10004e55
inc edi
cmp edi, 0xc6e
jl 0x1001c294
inc esi
cmp esi, 0x6045
jl 0x1001c292
cmp dword [esp + 0x14], 0x6015
jge 0x1001c2ea
push str.ztxtyajgi_xqh_pnkhuquo_kpj_ekgxrckd_rnomxthk_ils_prxrihbgz
call fcn.1003fffd
pop ecx
mov edx, dword [ebp + 0x10]
mov dword [edx], ebx
cmp dword [edx], 1
jge 0x1001c348
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x46c2e7cc
inc dword [edx]
cmp dword [edx], 1
jl 0x1001c2f7
jmp 0x1001c348
cmp byte [ebp + 0x14], 0
je 0x1001c333
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1001c348
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xcb24ce55
inc dword [edx]
cmp dword [edx], 2
jl 0x1001c31f
jmp 0x1001c348
xor ebx, ebx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x1001c348
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001c73e
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
cmp byte [ebp + 0x1c], 0
push ebx
push esi
push edi
mov byte [esp + 0x14], cl
je 0x1001c844
test cl, cl
je 0x1001c82d
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ecx, dword [ebp + 0x3c]
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x30]
mov dword [eax], 1
mov eax, dword [ecx]
mov eax, dword [ebp + 0x38]
mov eax, dword [eax]
mov eax, dword [ebp + 0x20]
mov dword [eax], 5
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov eax, dword [ecx]
mov eax, dword [edx]
mov eax, dword [ebp + 0x44]
mov ecx, dword [ebx]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ecx], eax
cmp eax, esi
jne 0x1001c7a5
cmp dword [edi], esi
jne 0x1001c7a5
mov edx, esi
jmp 0x1001c7a8
xor edx, edx
inc edx
mov eax, dword [ebp + 0x38]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
sub edx, dword [eax + 8]
imul edx, dword [eax + ecx*4]
xor ecx, ecx
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
cmp edx, eax
mov eax, dword [ebp + 0x34]
setge cl
mov dword [eax], ecx
cmp dword [eax], esi
jne 0x1001c7d4
mov eax, dword [ebx]
cmp dword [eax], esi
je 0x1001c7d7
xor esi, esi
inc esi
mov eax, dword [ebp + 0x44]
xor edx, edx
mov ebx, dword [ebp + 0x38]
cmp esi, 4
setg dl
mov eax, dword [eax]
sub edx, 0xfefe6b3e
neg edx
sbb edx, edx
mov ecx, dword [eax + 4]
inc edx
mov eax, dword [ebp + 0x24]
sub ecx, edx
mov eax, dword [eax]
sub ecx, eax
xor eax, eax
cmp ecx, 0xda77
setl al
xor edx, edx
mov dword [edi], eax
mov ecx, dword [edi]
mov eax, dword [ebx]
cmp eax, ecx
mov eax, dword [ebp + 0x3c]
setne dl
mov dword [eax], edx
xor edx, edx
mov ecx, dword [ebx]
mov eax, dword [eax]
cmp eax, ecx
mov eax, dword [ebp + 0x28]
setle dl
mov dword [eax], edx
jmp 0x1001c86a
mov eax, dword [ebp + 0x40]
cmp byte [eax], 0
je 0x1001c86a
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x1001c86a
cmp byte [ebp + 0x2c], 0
je 0x1001c85c
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_DeviceIoControl]
jmp 0x1001c86a
lea ecx, [esp + 0x13]
mov byte [esp + 0x13], 0
call fcn.1001e735
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001c8cd
Capabilities:
Get file attributes
Query or enumerate registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0x18], 0
je 0x1001c8e1
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x1001c8f1
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
pop ecx
pop ebp
ret

Function at 0x1001d473
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [ebp + 8], 0
je 0x1001d49b
cmp byte [ecx], 0
je 0x1001d4ad
push 0
push ecx
push 0xc3c
push ecx
mov edx, 0x3c22
call fcn.1001e814
add esp, 0x10
jmp 0x1001d4ad
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x1001d4ad
push eax
push eax
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyA]
mov esp, ebp
pop ebp
ret
Function at 0x1001dbe7
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0x10], 0
je 0x1001dc1d
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1001dc28
push 1
push 1
push 0x174c
push 0x5e75
push 0x2123
mov edx, 0x278d
mov cl, 1
call fcn.1001c245
add esp, 0x14
jmp 0x1001dc28
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
pop ecx
pop ebp
ret
Function at 0x1001dff0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10058e6c
call fcn.100580f4
sub esp, 0x1c
mov byte [ebp - 0x18], dl
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x24], esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x1001e0ac
mov dword [ebp - 0x20], 0x4cec
cmp dword [ebp - 0x20], 0x4e81
jle 0x1001e06a
xor edi, edi
mov dword [ebp - 0x1c], edi
xor ebx, ebx
and dword [ebp - 0x28], 0
mov esi, ebx
and esi, edi
mov edi, dword [ebp - 0x28]
mov eax, esi
mov ecx, 0x10071a98
xor eax, edi
cdq
push edx
push eax
call fcn.100046a4
inc edi
cmp edi, 0x19b3
jl 0x1001e035
mov edi, dword [ebp - 0x1c]
inc ebx
cmp ebx, 0xb19
jl 0x1001e02a
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x25b3
jl 0x1001e028
mov esi, dword [ebp - 0x24]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x4a9e
jge 0x1001e0a8
mov edx, str.ozlcevvbl_hsne_npu_cnhspvfbs_gteoxhya_kkjsnkgt_gne_uacqosa_hsrompzz_ljc_majthzog_naoqvma_tbjjw_sduaywa
mov ecx, 0x10071a98
call fcn.10006c80
jmp 0x1001e0a8
inc dword [esi]
jmp 0x1001e0be
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x1001e0be
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001e814
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x14], 0
je 0x1001e83e
mov eax, dword [edx]
xor ecx, ecx
cmp dword [eax + 4], ecx
mov eax, dword [ebp + 0xc]
sete cl
mov dword [eax], ecx
xor ecx, ecx
mov edx, dword [edx]
mov eax, dword [eax]
cmp dword [edx], eax
setge cl
add ecx, dword [edx + 4]
mov dword [edx], ecx
pop ebp
ret
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
pop ebp
ret

Function at 0x1001ea34
Capabilities:
Suspend thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov byte [ebp - 8], dl
test dl, dl
je 0x1001ea59
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x1001ea69
push 1
sub esp, 0x10
call fcn.1001c8cd
add esp, 0x14
jmp 0x1001ea69
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1001ea69
push 0
call dword [sym.imp.KERNEL32.dll_SuspendThread]
mov esp, ebp
pop ebp
ret
Function at 0x1001ea6d
Capabilities:
Start service

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
mov ebx, edx
push esi
push edi
test cl, cl
je 0x1001eb4d
mov dword [ebp - 8], 0x41d8
cmp dword [ebp - 8], 0x454a
push 0
pop edi
jle 0x1001eb02
push edi
push edi
push 0x135d
push 0x19dd
push edi
call dword [sym.imp.USER32.dll_InsertMenuW]
mov esi, edi
lea eax, [edi + esi]
cdq
lea ecx, [ebp - 0x20]
push edx
push eax
call fcn.10001a95
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001eac0
mov eax, dword [eax]
push eax
call fcn.1003fffd
pop ecx
push 0
push 1
lea ecx, [ebp - 0x20]
call fcn.10004e55
inc edi
cmp edi, 0x63fd
jl 0x1001eaa8
inc esi
push 0
pop edi
cmp esi, 0x70c8
jl 0x1001eaa8
push 0xa32
push 0xca5
push 0x1e04
push 0x23a8
call dword [sym.imp.USER32.dll_CheckRadioButton]
cmp dword [ebp - 8], 0x3df1
jge 0x1001eb16
push str.cjk_jmmjm_afacnqom_emgcr_oie_yolnmpdp_dux_dsfvwst_yygzjv
call fcn.1003fffd
pop ecx
cmp byte [ebp + 8], 0
je 0x1001eb3d
mov edx, dword [ebp + 0x14]
mov dword [edx], edi
cmp dword [edx], 1
jge 0x1001eb7e
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [edx]
cmp dword [edx], 1
jl 0x1001eb29
jmp 0x1001eb7e
cmp byte [ebx], 0
je 0x1001eb7e
push edi
push edi
push edi
call dword [sym.imp.ADVAPI32.dll_StartServiceW]
jmp 0x1001eb7e
cmp byte [ebp + 0xc], 0
je 0x1001eb65
push 0xe53
push 0xa0d
call dword [sym.imp.USER32.dll_GetDlgItem]
jmp 0x1001eb7e
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0x1001eb7e
push ecx
push ecx
push 0x55f4
mov dl, 1
call fcn.1001c3e6
add esp, 0xc
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001ecab
Capabilities:
Get common file path

Disassembly:
mov eax, 0x10058e94
call fcn.100580f4
push ecx
push ecx
cmp byte [ebp + 0x1c], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x1001edb0
mov dword [ebp - 0x14], 0x3cf9
xor esi, esi
cmp dword [ebp - 0x14], 0x4003
jle 0x1001ed28
push esi
push 0xa3b
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
mov edi, esi
mov dword [ebp + 0x1c], esi
mov ebx, esi
mov eax, edi
mov edi, 0x740a
cdq
idiv ebx
mov esi, edx
mov eax, esi
mov ecx, 0x10071a98
cdq
push edx
push eax
call fcn.100046a4
dec esi
dec edi
jne 0x1001ecfa
mov edi, dword [ebp + 0x1c]
inc ebx
cmp ebx, 0x3a12
jl 0x1001ecee
inc edi
mov dword [ebp + 0x1c], edi
push 0
pop esi
cmp edi, 0x74d7
jl 0x1001ecec
cmp byte [ebp + 0x18], 0
je 0x1001ed4b
mov edx, dword [ebp + 0xc]
mov dword [edx], esi
cmp dword [edx], 1
jge 0x1001ed79
mov edi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [edi]
mov dword [eax + ecx*4], esi
inc dword [edx]
cmp dword [edx], 1
jl 0x1001ed3b
jmp 0x1001ed79
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x1001ed79
push 1
push 1
push esi
push 0x5634
push 0x7d52
push 0x4f97
mov edx, 0x5199
mov ecx, 0x613
call fcn.1001cd06
add esp, 0x18
mov dword [ebp - 4], esi
cmp dword [ebp - 0x14], 0x39d4
jge 0x1001ed94
mov edx, str.zaklrbje_wqcbfa_alrqi_qiimcx
mov ecx, 0x10071a98
call fcn.10006c80
jmp 0x1001edc8
cmp byte [ebp + 0x10], 0
je 0x1001edbb
add dword [edx], 4
jmp 0x1001edc8
cmp byte [ecx], 0
je 0x1001edc8
push 0
call dword [sym.imp.KERNEL32.dll_GetFileType]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002582e
Capabilities:
Enumerate gui resources

Disassembly:
mov eax, 0x10059192
call fcn.100580f4
sub esp, 0xc
push ebx
push esi
mov dword [ebp - 0x14], 0x3dc4
cmp dword [ebp - 0x14], 0x3e18
push edi
mov dword [ebp - 0x10], esp
jle 0x10025884
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
xor esi, esi
xor edi, edi
mov ecx, edi
mov eax, esi
sar eax, cl
mov ecx, 0x10071a98
cdq
push edx
push eax
call fcn.100046a4
inc edi
cmp edi, 0xa35
jl 0x1002585f
inc esi
cmp esi, 0xe49
jl 0x1002585d
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x3b56
jge 0x100258a0
mov edx, str.ffzddnyt_zhmgky_mcfswwudm_dxehxv_zuju_ndndsl_hbdrpkbh_bvya_jxmoqoy
mov ecx, 0x10071a98
call fcn.10006c80
cmp byte [ebp + 0x10], 0
je 0x100258e5
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x100258ef
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xcb24ce55
inc dword [edx]
cmp dword [edx], 2
jl 0x100258b7
jmp 0x100258ef
push 0
push 0
call dword [sym.imp.USER32.dll_LoadIconA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002593c
Capabilities:
Get file size

Disassembly:
mov eax, 0x1005919c
call fcn.100580f4
sub esp, 0x1c
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], edx
je 0x1002596d
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
mov ecx, dword [ebp + 0x10]
push eax
call fcn.10027832
jmp 0x10025a10
mov dword [ebp - 0x20], 0x3e6c
cmp dword [ebp - 0x20], 0x3f05
jle 0x100259e2
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x14], esi
mov ecx, edi
xor ebx, ebx
sar esi, cl
mov dword [ebp - 0x14], esi
mov ecx, ebx
mov dword [ebp - 0x24], esi
xor edi, edi
shl esi, cl
mov ecx, edi
mov eax, esi
sar eax, cl
mov ecx, 0x10071a98
cdq
push edx
push eax
call fcn.100046a4
inc edi
cmp edi, 0x759b
jl 0x1002599c
mov esi, dword [ebp - 0x14]
inc ebx
cmp ebx, 0x6302
jl 0x10025993
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x30fa
jl 0x10025987
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x2028
jl 0x10025982
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x3cfe
jge 0x100259fe
mov edx, str.wtpyidt_jmihposqs_ptugdhkqf_bqxv_ydsyexaw_zimk_uxisc
mov ecx, 0x10071a98
call fcn.10006c80
mov eax, dword [ebp - 0x28]
cmp byte [eax], 0
je 0x10025a10
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10027832
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x10027849
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x1002786b
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x1062bb14
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x1062bea0
jl 0x10027879
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x1062c144
jl 0x100278b9
mov ecx, dword [0x1062ce90]
xor ecx, dword [0x1062bb14]
and ecx, edi
xor ecx, dword [0x1062ce90]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x1062bb10], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x1062c144]
mov dword [0x1062c4d0], eax
pop esi
ret