joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2e5257
Capabilities:
Create thread

Disassembly:
mov edi, edi
push esi
push edi
xor esi, esi
push esi
xor edi, edi
mov dword [0x2f41d0], eax
call dword [sym.imp.KERNEL32.dll_SetLastError]
push esi
push esi
push 0x2f41c8
push 0x2e52b0
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov ecx, eax
mov dword [0x2f41d4], ecx
cmp ecx, esi
je 0x2ea8be
call fcn.002e35a3
push eax
push ecx
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov dword [0x2f41cc], 1
mov eax, edi
pop edi
pop esi
ret
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, esi
jle 0x2ea8d2
and eax, 0xffff
or eax, 0x80070000
mov edi, eax
cmp edi, esi
jl 0x2ea8dd
mov edi, 0x88980003
push 0x6a
push edi
push 8
push 0x2f4f60
push 5
call fcn.002e8820
jmp 0x2e52a6

Function at 0x2e74c4
Capabilities:
Create thread
Resume thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
push edi
xor edi, edi
push edi
push edi
push edi
push edi
mov esi, eax
mov dword [ebp - 4], edi
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [esi + 0x34], eax
cmp eax, edi
je 0x2e755c
mov eax, esi
call fcn.002e7332
mov eax, dword [esi + 0x38]
cmp eax, edi
je 0x2e74fb
push eax
call dword [sym.imp.KERNEL32.dll_CloseHandle]
push ebx
lea ebx, [esi + 0x3c]
push ebx
push 4
push esi
push 0x2e5d4e
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [esi + 0x38], eax
cmp eax, edi
je 0x2e7563
mov ecx, dword [esi + 0x34]
push 2
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], eax
call fcn.002e5df4
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
push edi
push 0xffffffffffffffff
push edi
lea eax, [ebp - 0x10]
push eax
push 2
call dword [sym.imp.KERNEL32.dll_WaitForMultipleObjectsEx]
sub eax, edi
jne 0x2eb3ed
mov dword [ebp - 4], 1
push dword [esi + 0x34]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x34], edi
pop ebx
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret
mov eax, esi
call fcn.002e5d1d
jmp 0x2e754f
dec eax
je 0x2eb403
sub eax, 0xbf
xor eax, eax
mov ecx, esi
call fcn.002ef7e2
jmp 0x2e754f
push 1
call fcn.002e5df4
lea eax, [ebp - 8]
push eax
push dword [esi + 0x38]
mov dword [ebx], edi
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
test eax, eax
je 0x2eb433
cmp dword [ebp - 8], 5
jne 0x2eb433
push 1
mov eax, esi
call fcn.002e5e4c
push 4
call fcn.002e5df4
push dword [esi + 0x38]
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov dword [esi + 0x38], edi
jmp 0x2e754f
Function at 0x2e790a
Capabilities:
Get system information on windows

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
xor ebx, ebx
push esi
push edi
mov dword [ebp - 4], ebx
cmp byte [ebp + 0xc], bl
jne 0x2e792f
call fcn.002e7aee
cmp eax, ebx
mov dword [ebp - 4], eax
jl 0x2e9c38
mov edi, dword [ebp + 8]
cmp byte [edi + 0xd5], bl
je 0x2e7990
call dword [edi + 0x4c]
mov esi, eax
cmp esi, ebx
jl 0x2e9c4c
cmp dword [ebp - 4], ebx
jl 0x2e7954
cmp esi, ebx
jl 0x2e9c60
call sub.dwmredir.dll_DwmRedirectionManagerShutdown
mov esi, eax
cmp esi, ebx
jl 0x2e9c68
cmp dword [ebp - 4], ebx
jl 0x2e7970
cmp esi, ebx
jl 0x2e9c7c
call dword [edi + 0x50]
mov esi, eax
cmp esi, ebx
jl 0x2e9c84
cmp dword [ebp - 4], ebx
jl 0x2e798a
cmp esi, ebx
jl 0x2e9c98
mov byte [edi + 0xd5], bl
cmp dword [0x2f4ac4], ebx
je 0x2e79be
mov al, byte [0x2f4ac8]
cmp al, 4
jb 0x2e7a0b
mov eax, dword [0x2f4ab0]
mov ecx, dword [0x2f4ab4]
mov esi, 0x80000000
and eax, 1
and ecx, esi
or eax, ecx
jne 0x2e9ca0
push 2
mov byte [edi + 0x44], bl
pop ebx
mov dword [edi], ebx
call fcn.002e262c
test al, al
jne 0x2e7a01
lea eax, [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
mov eax, dword [ebp - 0x24]
mov esi, dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
mov ecx, eax
imul eax, eax, 0x32
imul ecx, ecx, 0x159
push ecx
push eax
call esi
push eax
call dword [sym.imp.KERNEL32.dll_SetProcessWorkingSetSize]
push ebx
call esi
push eax
call sub.GDI32.dll_D3DKMTSetProcessSchedulingPriorityClass
mov eax, dword [ebp - 4]
pop edi
pop esi
pop ebx
leave
ret 8
cmp al, bl
je 0x2e79a1
jmp 0x2e79be

Function at 0x2e853f
Capabilities:
Set registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push ecx
push esi
push edi
xor esi, esi
push esi
lea eax, [ebp - 4]
push eax
push esi
push 2
push esi
push esi
push esi
push 0x2e2918
push 0x80000001
mov dword [ebp - 4], esi
call dword [sym.imp.KERNEL32.dll_RegCreateKeyExW]
mov edi, eax
cmp edi, esi
jne 0x2e8584
push 4
lea eax, [ebp + 0xc]
push eax
push 4
push esi
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.KERNEL32.dll_RegSetValueExW]
mov edi, eax
cmp dword [ebp - 4], esi
je 0x2e8592
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
pop edi
pop esi
leave
ret 8

Function at 0x2ef581
Capabilities:
Get graphical window text

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x404
mov eax, dword [0x2f40d0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp dword [esi + 0xa4], 0
jne 0x2ef60c
push edi
mov edi, 0x100
push edi
lea eax, [ebp - 0x204]
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
test eax, eax
je 0x2ef60b
push edi
lea eax, [ebp - 0x404]
push eax
push 0x2ee
push 0x2ef620
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
push eax
call dword [sym.imp.USER32.dll_LoadStringW]
test eax, eax
je 0x2ef60b
lea eax, [ebp - 0x404]
push eax
mov eax, edi
lea ecx, [ebp - 0x204]
call fcn.002e3c0c
test eax, eax
jl 0x2ef60b
lea eax, [ebp - 0x204]
push eax
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_SetWindowTextW]
mov dword [esi + 0xa4], eax
pop edi
mov ecx, dword [ebp - 4]
mov eax, dword [esi + 0xa4]
xor ecx, ebp
call fcn.002e1b80
leave
ret
Function at 0x2efbdc
Capabilities:
Enumerate gui resources

Disassembly:
mov edi, edi
push edi
lea edi, [esi + 0xc]
push edi
call fcn.002e5bd4
cmp dword [esi + 0x30], 0
jne 0x2efc01
push esi
push 0x2efffd
mov dword [esi + 0x30], 1
call dword [sym.imp.USER32.dll_EnumWindows]
push edi
call fcn.002e5d0c
mov eax, dword [esi + 0x30]
pop edi
ret

Function at 0x2efed4
Capabilities:
Change the wallpaper
Enumerate gui resources

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, eax
xor ebx, ebx
lea edi, [esi + 0xc]
push edi
mov dword [ebp - 8], ebx
mov dword [ebp - 4], ebx
call fcn.002e5bd4
mov eax, dword [esi + 0x5c]
cmp eax, ebx
je 0x2eff0a
push eax
call dword [sym.imp.USER32.dll_IsWindowVisible]
test eax, eax
je 0x2eff0a
mov eax, dword [esi + 0x5c]
mov dword [ebp - 4], eax
push edi
call fcn.002e5d0c
cmp dword [ebp - 4], ebx
je 0x2effa3
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_IsWindowEnabled]
test eax, eax
jne 0x2eff35
lea eax, [ebp - 4]
push eax
push 0x2f007a
call dword [sym.imp.USER32.dll_EnumWindows]
mov ecx, dword [ebp - 4]
cmp ecx, ebx
je 0x2effa3
xor eax, eax
lea edi, [ebp - 0x18]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push 3
pop esi
stosd dword es:[edi], eax
push ebx
lea eax, [ebp - 0x10]
push eax
push ebx
push 0x2004
mov dword [ebp - 0x1c], 0x14
mov dword [ebp - 0x18], ecx
mov dword [ebp - 0x14], esi
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
test eax, eax
jne 0x2eff6d
mov dword [ebp - 0x10], esi
call dword [sym.imp.USER32.dll_GetCaretBlinkTime]
cmp eax, ebx
je 0x2eff7f
shr eax, 3
mov dword [ebp - 0xc], eax
jmp 0x2eff86
mov dword [ebp - 0xc], 0x3e
lea eax, [ebp - 0x1c]
push eax
call dword [sym.imp.USER32.dll_FlashWindowEx]
push ebx
mov dword [ebp - 8], eax
call dword [sym.imp.USER32.dll_MessageBeep]
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SetForegroundWindow]
mov eax, dword [ebp - 8]
pop edi
pop esi
pop ebx
leave
ret
Function at 0x2f033b
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [ebp + 0x10]
push esi
mov esi, dword [ebp + 8]
push esi
mov dword [ebp - 8], eax
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.USER32.dll_GetGuiResources]
mov dword [ebp - 4], eax
cmp esi, 2
jae 0x2f03fd
shl esi, 3
mov eax, dword [esi + 0x2f4fa4]
cmp dword [ebp - 4], eax
jb 0x2f03fd
test eax, eax
jne 0x2f03ec
push edi
lea eax, [ebp + 8]
push eax
push 1
push 0
push 0x2f0408
push 0x80000002
mov edi, 0x2710
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x2f03de
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp + 0x10]
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push dword [esi + 0x2f4fa8]
mov dword [ebp - 0xc], 4
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x2f03d5
cmp dword [ebp - 0x10], 4
jne 0x2f03d5
cmp dword [ebp + 0x10], eax
jbe 0x2f03d5
mov edi, dword [ebp + 0x10]
push dword [ebp + 8]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, edi
shr eax, 3
sub edi, eax
mov dword [esi + 0x2f4fa4], edi
pop edi
mov eax, dword [ebp - 4]
cmp eax, dword [esi + 0x2f4fa4]
jb 0x2f03fd
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
pop esi
leave
ret 0xc

Function at 0x2f09a7
Capabilities:
Check systemkerneldebuggerinformation
Get system information on windows

Disassembly:
cmp byte [0x2f67fa], 0
jne 0x2f09cc
push 0
push 2
push 0x2f67f8
push 0x23
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jl 0x2f09cc
mov byte [0x2f67fa], 1
movzx eax, byte [0x2f67f8]
ret

Function at 0x2f09d9
Capabilities:
Check systemkerneldebuggerinformation
Get system information on windows

Disassembly:
mov edi, edi
push ebx
xor ebx, ebx
cmp byte [0x2f4fdc], bl
je 0x2f0a25
cmp byte [0x2f4fdd], bl
je 0x2f0a10
push ebx
push 2
push 0x2f4fdc
push 0x23
call dword [sym.imp.ntdll.dll_NtQuerySystemInformation]
test eax, eax
jge 0x2f0a10
mov byte [0x2f4fdc], 1
mov byte [0x2f4fdd], 1
cmp byte [0x2f4fdc], bl
je 0x2f0a25
cmp byte [0x2f4fdd], bl
jne 0x2f0a25
xor eax, eax
inc eax
pop ebx
ret
xor eax, eax
pop ebx
ret
Function at 0x2f0a2e
Capabilities:
Terminate process
Terminate thread

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x10
push esi
mov esi, dword [sym.imp.ntdll.dll_DbgPrintEx]
push edi
call fcn.002f09d9
mov dword [ebp - 0x10], eax
mov byte [ebp - 4], 0x3f
mov byte [ebp - 3], 0
test eax, eax
jne 0x2f0a60
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
test eax, eax
je 0x2f0a60
mov byte [ebp - 4], 0x67
mov eax, dword [ebp + 0x10]
mov dword [ebp - 8], 0x2f0d38
test eax, eax
jne 0x2f0af9
mov dword [ebp - 8], 0x2f0d37
mov dword [ebp - 0xc], 0x2ebae8
mov edi, 0x2f0d2c
test eax, eax
jne 0x2f0a8e
mov edi, 0x2f0d37
mov edx, dword [ebp + 0xc]
xor eax, eax
cmp dword [ebp + 0xc], eax
jne 0x2f0a9d
mov edx, 0x2ebae8
cmp dword [ebp + 8], eax
je 0x2f0aac
mov ecx, 0x2f0d1c
cmp dword [ebp + 0xc], eax
jne 0x2f0ab1
mov ecx, 0x2ebae8
cmp dword [ebp + 8], eax
mov eax, dword [ebp + 8]
jne 0x2f0abe
mov eax, 0x2ebae8
push dword [ebp + 0x18]
push dword [ebp + 0x14]
push dword [ebp - 8]
push dword [ebp - 0xc]
push edi
push edx
push ecx
push eax
push 0x2f0cd8
xor edi, edi
push edi
push dword [0x2f4fd8]
call esi
add esp, 0x2c
lea eax, [ebp - 4]
cmp dword [ebp - 0x10], edi
je 0x2f0afe
push 2
push eax
push 0x2f0c90
call dword [sym.imp.ntdll.dll_DbgPrompt]
jmp 0x2f0b15
mov dword [ebp - 0xc], eax
jmp 0x2f0a80
push eax
lea eax, [ebp - 4]
push eax
push 0x2f0bd0
push edi
push dword [0x2f4fd8]
call esi
add esp, 0x14
int3
movsx eax, byte [ebp - 4]
cmp eax, 0x62
jg 0x2f0b4c
je 0x2f0b80
sub eax, 0x42
je 0x2f0b80
sub eax, 5
je 0x2f0b81
dec eax
dec eax
je 0x2f0b6a
sub eax, 7
je 0x2f0b51
sub eax, 4
jne 0x2f0b63
push 0xc0000001
call dword [sym.imp.KERNEL32.dll_GetCurrentThread]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateThread]
jmp 0x2f0b63
sub eax, 0x67
jmp 0x2f0b28
push 0xc0000001
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
push 0x2f0bb4
jmp 0x2f0b6f
push 0x2f0b88
push edi
push dword [0x2f4fd8]
call esi
add esp, 0xc
jmp 0x2f0a3e
int3
pop edi
pop esi
leave
ret 0x14
Function at 0x10002708
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov byte [ebp - 4], cl
test cl, cl
je 0x10002734
mov eax, dword [ebp + 8]
mov dword [eax], 0x17
cmp dword [eax], 0xe
jl 0x1000274a
xor ecx, ecx
inc ecx
mov dword [ebp - 8], ecx
mov dword [ebp - 8], ecx
dec dword [eax]
cmp dword [eax], 0xe
jge 0x10002725
jmp 0x1000274a
xor eax, eax
push eax
push 0x2608
push eax
push eax
push 0x538
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov esp, ebp
pop ebp
ret
Function at 0x10003666
Capabilities:
Create process on windows

Disassembly:
mov eax, 0x10057eab
call fcn.100579d8
sub esp, 0x34
mov byte [ebp - 0x14], dl
mov eax, ecx
mov dword [ebp - 0x18], eax
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x1000374a
mov dword [ebp - 0x24], 0x3cb7
cmp dword [ebp - 0x24], 0x3e7c
jle 0x1000370d
xor esi, esi
mov dword [ebp - 0x20], esi
xor ebx, ebx
mov dword [ebp - 0x1c], 0xc4d
mov dword [ebp - 0x18], ebx
xor edi, edi
xor esi, esi
mov dword [ebp - 0x28], ebx
and ebx, edi
mov eax, ebx
lea ecx, [ebp - 0x40]
or eax, esi
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100036cc
mov eax, dword [eax]
push eax
call fcn.1003f93c
pop ecx
push 0
push 1
lea ecx, [ebp - 0x40]
call fcn.10009a96
inc esi
cmp esi, 0x7ddf
jl 0x100036b3
mov ebx, dword [ebp - 0x18]
inc edi
cmp edi, 0x5dc4
jl 0x100036ac
mov esi, dword [ebp - 0x20]
add ebx, esi
dec dword [ebp - 0x1c]
mov dword [ebp - 0x18], ebx
jne 0x100036aa
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x5221
jl 0x1000369e
cmp dword [ebp - 0x24], 0x3c9b
jge 0x10003721
push str.guygpz_impxg_cxewxboq_frm_mlzxypcro_cayfc_aizunlg_sbqrkg_yyljo_xjfc_lwspcydx_cumurocg_rggwseuq
call fcn.1003f93c
pop ecx
mov eax, dword [ebp + 0xc]
or dword [ebp - 4], 0xffffffff
cmp byte [eax], 0
je 0x10003739
mov edx, 0x2f1a
xor cl, cl
call fcn.10004c55
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], 0x530b
cmp dword [ebp - 0x1c], 0x5613
jle 0x100037d6
push 0x2350
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor esi, esi
mov dword [ebp - 0x20], esi
xor edi, edi
mov dword [ebp - 0x24], edi
xor ebx, ebx
mov eax, edi
and dword [ebp - 0x28], 0
cdq
mov edi, esi
idiv ebx
mov esi, dword [ebp - 0x28]
mov ecx, edx
shl edi, cl
mov eax, edi
mov ecx, 0x1006f958
and eax, esi
cdq
push edx
push eax
call fcn.10009584
inc esi
cmp esi, 0x53e8
jl 0x10003792
mov esi, dword [ebp - 0x20]
inc ebx
mov edi, dword [ebp - 0x24]
cmp ebx, 0x2fca
jl 0x10003780
inc edi
mov dword [ebp - 0x24], edi
cmp edi, 0x49f2
jl 0x1000377e
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x255c
jl 0x10003779
mov eax, dword [ebp - 0x18]
cmp byte [eax], 0
je 0x100037ee
push 0x2f0
push 0
mov ecx, 0x3e71
call fcn.100025a0
pop ecx
pop ecx
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x51b4
jge 0x10003739
mov edx, str.pcubdc_xzhvm_nofqbbv_vznf_qgvcrdbq_ikso_ychykh_tbwmwweo_zbbrahkyy
mov ecx, 0x1006f958
call fcn.1000b719
jmp 0x10003739
Function at 0x10003868
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
push esi
xor esi, esi
mov byte [esp + 4], dl
push edi
test dl, dl
je 0x10003936
xor edi, edi
inc edi
mov dword [esp + 0xc], edi
mov dword [esp + 0x10], 0xfffffff8
mov dword [esp + 0x14], 0x8ed4
mov dword [esp + 0x18], 0x4ffd8143
mov dword [esp + 0x10], esi
mov dword [esp + 0xc], esi
jmp 0x100038b6
mov eax, dword [esp + 0xc]
mov dword [esp + eax*4 + 0x1c], edi
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 3
jl 0x100038aa
mov dword [esp + 0xc], esi
jmp 0x1000392d
mov eax, dword [esp + 0xc]
xor edx, edx
mov ecx, dword [esp + eax*4 + 0x1c]
mov eax, dword [esp + 0xc]
mov eax, dword [esp + eax*4 + 0x1c]
cmp ecx, eax
setg dl
imul edx, dword [esp + 0x24]
test edx, edx
jne 0x100038ef
mov eax, dword [esp + 0xc]
mov edx, esi
cmp dword [esp + eax*4 + 0x1c], esi
je 0x100038f1
mov edx, edi
mov eax, dword [esp + 0x20]
xor ecx, ecx
cmp edx, eax
setle cl
mov dword [esp + 0x10], ecx
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x14], esi
je 0x10003912
mov eax, dword [esp + 0xc]
mov eax, dword [esp + eax*4 + 0x1c]
mov eax, dword [esp + 0xc]
xor edx, edx
mov ecx, dword [esp + eax*4 + 0x1c]
mov eax, dword [esp + 0x18]
cmp eax, ecx
setle dl
mov dword [esp + 0x10], edx
inc dword [esp + 0xc]
cmp dword [esp + 0xc], 2
jle 0x100038c3
jmp 0x10003943
push 0x1c63
push esi
push esi
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10003960
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
je 0x10003979
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1000397e
xor dl, dl
pop ebp
jmp fcn.10002a26
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
pop ebp
ret
Function at 0x10004af8
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 8], dl
test dl, dl
je 0x10004b38
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x10004b4c
push 0x3519
push 1
push 0x5e80
push 0x3b68
push 1
push 0x6756
xor dl, dl
mov ecx, 0x4980
call fcn.10002acc
add esp, 0x18
jmp 0x10004b4c
cmp byte [ecx], 0
je 0x10004b4c
push 0x1c63
push 0
push 0
call dword [sym.imp.KERNEL32.dll_QueryDosDeviceW]
mov esp, ebp
pop ebp
ret

Function at 0x10004c74
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov byte [esp + 0x10], dl
mov byte [esp + 0x14], cl
je 0x10004d2d
test dl, dl
je 0x10004d25
mov dword [esp + 0x1c], 0x3c49
cmp dword [esp + 0x1c], 0x3f2b
jle 0x10004d08
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor edi, edi
xor esi, esi
xor ebx, ebx
mov dword [esp + 0x18], 0x511a
mov eax, ebx
lea ecx, [esp + 0x20]
xor eax, edi
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10004cda
mov eax, dword [eax]
push eax
call fcn.1003f93c
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.10009a96
add ebx, esi
dec dword [esp + 0x18]
jne 0x10004cc0
inc esi
cmp esi, 0x534d
jl 0x10004cb6
inc edi
cmp edi, 0x156c
jl 0x10004cb4
cmp dword [esp + 0x1c], 0x3a88
jge 0x10004d1d
push str.ppm_kuje_ocgqy_jvbdq_fssoup_gmxgqblkn
call fcn.1003f93c
pop ecx
mov eax, dword [ebp + 0x18]
and dword [eax], 0
jmp 0x10004d42
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
jmp 0x10004d42
test cl, cl
je 0x10004d38
mov eax, dword [ebp + 0x10]
dec dword [eax]
jmp 0x10004d42
mov eax, dword [ebp + 0x14]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100050d1
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
push ebx
push esi
push edi
mov dword [esp + 0xc], 0x7d59
cmp dword [esp + 0xc], 0x7f96
push 0
pop ebx
jle 0x1000513c
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov esi, ebx
mov edi, ebx
lea eax, [edi + esi]
cdq
lea ecx, [esp + 0x20]
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10005117
mov eax, dword [eax]
push eax
call fcn.1003f93c
pop ecx
push ebx
push 1
lea ecx, [esp + 0x28]
call fcn.10009a96
inc edi
cmp edi, 0x1d08
jl 0x100050fe
inc esi
cmp esi, 0xa8d
jl 0x100050fc
cmp dword [esp + 0xc], 0x7b41
jge 0x10005151
push str.dpbjljzbe_mvdei_thmmfbkp_taiynow_rqax_ahixqrzgc_donhv_easlkzpal_ivwmwwxd_fxowi_dihiwgvgd_hxstkow
call fcn.1003f93c
pop ecx
cmp byte [ebp + 0x18], 0
je 0x100052b7
mov esi, dword [ebp + 0xc]
mov ecx, dword [esi]
sub ecx, 2
call fcn.10001a9d
mov ecx, dword [ebp + 8]
cmp ax, word [ecx]
jne 0x1000517b
push esi
push ecx
mov cl, 1
call fcn.10002ca7
pop ecx
pop ecx
mov dword [esp + 0x18], 0x1f8c
cmp dword [esp + 0x18], 0x2342
jle 0x100052a0
xor edi, edi
mov dword [esp + 0x14], edi
mov dword [esp + 0xc], 0x2172
cmp dword [esp + 0xc], 0x1106
jge 0x10005216
push 0x10070a90
push 0x10070a94
push str._d__d
call fcn.1003f63b
xor esi, esi
add esp, 0xc
cmp dword [0x10070a90], esi
jle 0x100051f4
lea eax, [esp + 0x10]
push eax
push 0x1005f9c4
call fcn.1003f63b
mov eax, dword [esp + 0x18]
dec eax
pop ecx
pop ecx
mov dword [esp + 0x10], eax
inc dword [eax*4 + 0x10070aa0]
inc esi
cmp esi, dword [0x10070a90]
jl 0x100051ca
xor ecx, ecx
xor esi, esi
inc ecx
call fcn.100050a8
test al, al
cmovne esi, ecx
inc ecx
cmp ecx, 0x31
jle 0x100051f9
push esi
push 0x10060558
call fcn.1003f93c
pop ecx
pop ecx
xor esi, esi
mov dword [esp + 0xc], esi
and dword [esp + 0x1c], 0
mov eax, edi
cdq
idiv esi
mov edi, dword [esp + 0x1c]
mov esi, edx
mov eax, esi
lea ecx, [esp + 0x38]
and eax, edi
and eax, ebx
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10005248
mov eax, dword [eax]
push eax
call fcn.1003f93c
pop ecx
push 0
push 1
lea ecx, [esp + 0x40]
call fcn.10009a96
inc edi
cmp edi, 0x5d2b
jl 0x1000522c
mov esi, dword [esp + 0xc]
mov edi, dword [esp + 0x14]
inc esi
mov dword [esp + 0xc], esi
cmp esi, 0x56df
jl 0x1000521c
inc edi
mov dword [esp + 0x14], edi
cmp edi, 0x4b70
jl 0x10005197
inc ebx
cmp ebx, 0x5b3d
jl 0x10005191
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
cmp dword [esp + 0x18], 0x1cf4
jge 0x100052bc
push str.nzcdffmkt_jxcjabmc_mvngc_nxzplhhs_rirtcsqh_qbe_sbdwonhx_nxxwzrrjb_tbgzx_sscwxu_ednkgywix_zwtq_xiubnou_hzmvm
call fcn.1003f93c
pop ecx
jmp 0x100052bc
mov eax, dword [ebp + 0x10]
dec dword [eax]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000f58a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100581fa
call fcn.100579d8
sub esp, 0xc
push ebx
push esi
push edi
mov dword [ebp - 0x14], 0x52d7
mov edi, ecx
cmp dword [ebp - 0x14], 0x54e1
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], edi
jle 0x1000f5d9
xor esi, esi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x1006f958
xor eax, esi
cdq
push edx
push eax
call fcn.10009584
inc ebx
cmp ebx, 0x64a5
jl 0x1000f5b6
inc esi
cmp esi, 0x623a
jl 0x1000f5b4
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x51a2
jge 0x1000f614
mov edx, str.qjt_mkwuesnbr_wjzm_byrcpfum_rrief_wsn_xwxljg_acgvxuv_upp_xdajikb_zqdoj_wfvow_iodt_vww
mov ecx, 0x1006f958
call fcn.1000b719
jmp 0x1000f614
cmp byte [ebp + 0x1c], 0
je 0x1000f622
mov eax, dword [ebp + 8]
and dword [eax], 0
jmp 0x1000f63f
mov eax, dword [ebp + 0xc]
mov edx, dword [edi]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov eax, dword [eax + edx*4]
cmp eax, dword [ecx + edx*4]
jle 0x1000f63f
mov eax, dword [ebp + 0x24]
mov dword [eax], 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10014943
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x1001495a
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x1001497c
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x10070c24
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x10070fb0
jl 0x1001498a
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x10071254
jl 0x100149ca
mov ecx, dword [0x10071fa0]
xor ecx, dword [0x10070c24]
and ecx, edi
xor ecx, dword [0x10071fa0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x10070c20], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10071254]
mov dword [0x100715e0], eax
pop esi
ret