joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001ca9
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10063f41
call fcn.10063950
sub esp, 0x14
mov byte [ebp - 0x14], dl
push ebx
push esi
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10001ce7
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
jmp 0x10001cdd
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x661fbc9f
inc dword [edx]
cmp dword [edx], 1
jl 0x10001cd0
jmp 0x10001db2
mov dword [ebp - 0x18], 0x4f8d
xor edi, edi
cmp dword [ebp - 0x18], 0x52c0
jle 0x10001d34
mov esi, edi
mov ebx, edi
mov dword [ebp - 0x1c], edi
mov eax, ebx
mov ecx, 0x10080db8
cdq
idiv edi
xor edx, esi
mov eax, edx
cdq
push edx
push eax
call fcn.10004c02
inc edi
cmp edi, 0x1781
jl 0x10001d00
inc ebx
push 0
pop edi
cmp ebx, 0x156
jl 0x10001cfd
inc esi
cmp esi, 0x439d
jl 0x10001cfb
mov dword [ebp - 4], edi
cmp dword [ebp - 0x18], 0x4cfc
jge 0x10001d6d
mov edx, str.pbijstqpj_snxw_lavfn_jyorl_hzxkqhwse_kwecqpwb_uarn_zfyioi_ylayz_fnc_alzhppwui
mov ecx, 0x10080db8
call fcn.10007110
jmp 0x10001d6d
mov esi, dword [ebp + 0x1c]
xor edx, edx
mov ebx, dword [ebp + 0x20]
mov eax, dword [ebx]
mov dword [eax + 4], 0xf3faa32f
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [esi]
cmp eax, 1
mov eax, dword [esi]
setle dl
xor ecx, ecx
cmp eax, edx
setl cl
cmp ecx, dword [esi]
jle 0x10001da5
mov eax, dword [ebx]
cmp dword [eax], edi
je 0x10001da8
xor edi, edi
inc edi
mov eax, dword [ebp + 0x18]
mov dword [eax], edi
mov eax, dword [ebp + 0xc]
mov dword [eax], edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10002316
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp byte [ebp + 0xc], 0
push ebx
push esi
mov ebx, edx
push edi
mov dword [ebp - 0x10], ebx
je 0x10002334
mov eax, dword [ebp + 0x18]
dec dword [eax]
jmp 0x100023d6
mov dword [ebp - 0xc], 0x1e48
cmp dword [ebp - 0xc], 0x1eca
jle 0x100023a5
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
xor edi, edi
xor esi, esi
mov dword [ebp - 8], esi
mov ebx, esi
mov esi, 0x7890
mov eax, ebx
lea ecx, [ebp - 0x28]
xor eax, edi
cdq
push edx
push eax
call fcn.10001a95
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10002373
mov eax, dword [eax]
push eax
call fcn.1004cf6c
pop ecx
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.100052fb
dec ebx
dec esi
jne 0x1000235a
mov esi, dword [ebp - 8]
inc esi
mov dword [ebp - 8], esi
cmp esi, 0x3a21
jl 0x10002353
inc edi
cmp edi, 0x453b
jl 0x1000234e
mov ebx, dword [ebp - 0x10]
cmp dword [ebp - 0xc], 0x1bbd
jge 0x100023b9
push str.zkcsje_auyinco_pfmtwan_cpqxu_mbvgkb_dulma_maliuc_vhzdyx_ptln_hnlrwbni
call fcn.1004cf6c
pop ecx
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
jmp 0x100023d1
mov ecx, dword [edx]
mov eax, dword [ebx]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [edx]
cmp dword [edx], 4
jl 0x100023c4
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000b365
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1000b3ac
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1000b396
mov byte [ebp - 1], 0
push 0
lea eax, [ebp - 1]
push eax
call fcn.1000b695
pop ecx
pop ecx
jmp 0x1000b3aa
push 0x303
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x1000b3f2
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
push 0xb3d
push 0
push 0x42c4
push 0x1679
mov eax, dword [ebp - 0xc]
push dword [eax]
push 0x3a23
push 0x2c6
push 0x5bd2
push dword [ebp - 0x10]
push 0x734a
push 0x685e
call fcn.1000adec
add esp, 0x2c
mov esp, ebp
pop ebp
ret
Function at 0x1001ba2d
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
xor ebx, ebx
cmp byte [ebp + 0xc], bl
push esi
push edi
mov byte [esp + 0xf], bl
je 0x1001ba5e
cmp byte [esp + 0xf], bl
je 0x1001bb3b
push 1
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetOverlappedResult]
jmp 0x1001bb3b
cmp byte [esp + 0xf], bl
je 0x1001bb3b
mov dword [esp + 0x20], 0x6fe4
cmp dword [esp + 0x20], 0x71b0
jle 0x1001bb1c
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
mov esi, ebx
mov dword [esp + 0x1c], ebx
mov edi, ebx
mov dword [esp + 0x18], ebx
mov ecx, edi
mov dword [esp + 0x10], esi
mov edi, esi
mov eax, ebx
sar edi, cl
mov dword [esp + 0x14], eax
mov dword [esp + 0x10], edi
mov dword [esp + 0x24], edi
mov esi, ebx
xor edi, eax
mov eax, edi
lea ecx, [esp + 0x28]
or eax, esi
cdq
push edx
push eax
call fcn.10001a95
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001bac6
mov eax, dword [eax]
push eax
call fcn.1004cf6c
pop ecx
push ebx
push 1
lea ecx, [esp + 0x30]
call fcn.100052fb
inc esi
cmp esi, 0x6afc
jl 0x1001baac
mov eax, dword [esp + 0x14]
mov edi, dword [esp + 0x10]
inc eax
mov dword [esp + 0x14], eax
cmp eax, 0x661f
jl 0x1001baa4
mov edi, dword [esp + 0x18]
mov esi, dword [esp + 0x1c]
inc edi
mov dword [esp + 0x18], edi
cmp edi, 0x51d4
jl 0x1001ba90
inc esi
mov dword [esp + 0x1c], esi
cmp esi, 0x26f6
jl 0x1001ba8a
push 1
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
cmp dword [esp + 0x20], 0x6e8f
jge 0x1001bb3b
push str.eeilxokn_xfyzb_giatc_tgi_cjyej_drltgiegc_wmhlhk_ysar_zhjrgsd_rnhrqt_ggdbhidpe_toacbaz_gbh_wanibpaw
call fcn.1004cf6c
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001cf4b
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006492a
call fcn.10063950
sub esp, 0x24
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], edx
je 0x1001cf79
mov eax, dword [ebp + 0x30]
mov ecx, dword [ebp + 0x28]
push dword [eax]
call fcn.10016e20
jmp 0x1001d144
mov dword [ebp - 0x24], 0x3861
xor esi, esi
cmp dword [ebp - 0x24], 0x3b07
mov edi, 0x10080db8
jle 0x1001cff4
mov ebx, esi
mov dword [ebp - 0x20], ebx
mov eax, esi
mov dword [ebp - 0x1c], esi
and eax, ebx
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], eax
mov ebx, eax
mov eax, esi
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
xor eax, esi
mov ecx, edi
or eax, ebx
cdq
push edx
push eax
call fcn.10004c02
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0xd08
jl 0x1001cfac
inc esi
push 0
mov dword [ebp - 0x18], esi
cmp esi, 0x372e
pop esi
jl 0x1001cfa4
mov eax, dword [ebp - 0x1c]
mov ebx, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x2223
jl 0x1001cf9a
inc ebx
mov dword [ebp - 0x20], ebx
cmp ebx, 0x4af6
jl 0x1001cf95
mov dword [ebp - 4], esi
cmp dword [ebp - 0x24], 0x367b
jge 0x1001d00c
mov edx, str.bhqhlut_qrwtylpx_qiqcwlkq_urde_qwp_ixecdf_cfcsn_gxkw_qdjlj_dlelvkh
mov ecx, edi
call fcn.10007110
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], 0x638a
cmp dword [ebp - 0x1c], 0x63a8
jle 0x1001d08c
mov dword [ebp - 0x14], esi
mov ebx, esi
mov dword [ebp - 0x20], esi
mov ecx, esi
mov dword [ebp - 0x24], esi
mov eax, ebx
mov dword [ebp - 0x18], esi
cdq
idiv ecx
mov esi, dword [ebp - 0x14]
mov ebx, dword [ebp - 0x18]
mov eax, edx
mov dword [ebp - 0x28], eax
cdq
mov ecx, edi
idiv ebx
mov eax, esi
sub eax, edx
cdq
push edx
push eax
call fcn.10004c02
mov eax, dword [ebp - 0x28]
inc ebx
cmp ebx, 0x1d13
jl 0x1001d040
mov ecx, dword [ebp - 0x24]
mov ebx, dword [ebp - 0x20]
inc ecx
mov dword [ebp - 0x24], ecx
push 0
pop esi
cmp ecx, 0x5fca
jl 0x1001d02d
inc ebx
mov dword [ebp - 0x20], ebx
cmp ebx, 0x117a
jl 0x1001d028
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x736b
jl 0x1001d023
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x624b
jge 0x1001d0f0
mov edx, str.nsazbctip_lttxj_zhjyyieqf_oiuqgngum_dquztbdc_txedkepmn_enqj_xsgwnqky_mhhg_dgvaww_bke_ycof
mov ecx, edi
call fcn.10007110
jmp 0x1001d0f0
mov edi, dword [ebp - 0x2c]
mov ebx, dword [ebp + 0x14]
mov ecx, dword [ebp + 0xc]
mov eax, dword [edi]
mov eax, dword [ebx]
cmp dword [ecx], 0xfffffff8
jge 0x1001d109
cmp dword [ebx], esi
je 0x1001d109
xor esi, esi
inc esi
lea eax, [esi - 0x49596113]
sub eax, dword [ecx]
neg eax
sbb eax, eax
xor edx, edx
inc eax
imul ecx, eax, 7
mov eax, dword [ebx]
cmp ecx, eax
mov eax, dword [ebx]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [edi]
sete cl
xor edx, edx
cmp ecx, 0x4acdff90
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp + 8]
setle cl
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001dc71
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x1001dc88
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x1001dcaa
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x106be764
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x106beaf0
jl 0x1001dcb8
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x106bed94
jl 0x1001dcf8
mov ecx, dword [0x106bfae0]
xor ecx, dword [0x106be764]
and ecx, edi
xor ecx, dword [0x106bfae0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x106be760], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x106bed94]
mov dword [0x106bf120], eax
pop esi
ret

Function at 0x1001e5ae
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100649be
call fcn.10063950
sub esp, 0x18
push ebx
push esi
mov dword [ebp - 0x18], 0x55e8
mov eax, ecx
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
cmp dword [ebp - 0x18], 0x5753
mov dword [ebp - 0x20], eax
jle 0x1001e613
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x1c], ebx
mov eax, ebx
mov ecx, 0x10080db8
xor eax, edi
xor eax, esi
cdq
push edx
push eax
call fcn.10004c02
inc ebx
cmp ebx, 0x4e5b
jl 0x1001e5df
inc edi
push 0
pop ebx
cmp edi, 0x14d5
jl 0x1001e5dc
inc esi
cmp esi, 0x20d1
jl 0x1001e5da
mov eax, dword [ebp - 0x20]
cmp byte [ebp + 8], 0
je 0x1001e627
cmp byte [eax], 0
je 0x1001e63a
push ebx
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
jmp 0x1001e63a
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001e63a
push 1
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorOwner]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x54e9
jge 0x1001e655
mov edx, str.arzn_vwtp_cczk
mov ecx, 0x10080db8
call fcn.10007110
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001eb40
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
push esi
push edi
mov dword [esp + 0x18], 0x58f4
cmp dword [esp + 0x18], 0x5c33
push 0
mov dword [esp + 0x28], edx
pop ebx
jle 0x1001ebe9
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultLangID]
mov esi, ebx
mov dword [esp + 0x14], ebx
mov edi, ebx
mov dword [esp + 0x10], ebx
mov ecx, edi
mov dword [esp + 0x1c], esi
mov edi, esi
mov esi, ebx
shl edi, cl
mov ecx, esi
mov eax, edi
sar eax, cl
lea ecx, [esp + 0x28]
cdq
push edx
push eax
call fcn.10001a95
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001eba3
mov eax, dword [eax]
push eax
call fcn.1004cf6c
pop ecx
push ebx
push 1
lea ecx, [esp + 0x30]
call fcn.100052fb
inc esi
cmp esi, 0x4a1
jl 0x1001eb87
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
inc edi
mov dword [esp + 0x10], edi
cmp edi, 0x3a13
jl 0x1001eb7b
inc esi
mov dword [esp + 0x14], esi
cmp esi, 0x3042
jl 0x1001eb75
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
cmp byte [ebp + 0x14], 0
je 0x1001ebfd
push 0x121a
push ebx
call dword [sym.imp.KERNEL32.dll_EnumSystemLocalesW]
jmp 0x1001ec44
mov edx, dword [ebp + 8]
mov eax, dword [edx]
cmp dword [eax + 4], ebx
jne 0x1001ec3c
mov edi, dword [ebp + 0x10]
xor ecx, ecx
mov esi, dword [ebp + 0x18]
mov eax, dword [edi]
cmp eax, 9
setge cl
mov dword [esi], ecx
mov eax, dword [edx]
xor edx, edx
mov ecx, dword [eax + 4]
cmp dword [eax + 0xc], ecx
setge dl
imul edx, ecx
mov ecx, dword [esi]
mov eax, dword [edi]
imul ecx, edx
sub ecx, eax
mov eax, dword [esp + 0x24]
mov dword [eax], ecx
cmp dword [eax], ebx
je 0x1001ec3f
xor ebx, ebx
inc ebx
mov eax, dword [ebp + 0xc]
mov dword [eax], ebx
cmp dword [esp + 0x18], 0x566c
jge 0x1001ec59
push str.hmt_gyuzwvpj_fkmk_sfozn_yce
call fcn.1004cf6c
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001f573
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
je 0x1001f5a4
mov esi, dword [ebp + 8]
mov dword [esi], 0
jmp 0x1001f59a
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0xfffffffe
inc dword [esi]
cmp dword [esi], 2
jl 0x1001f58d
jmp 0x1001f70b
push 0
pop edi
mov dword [ebp - 0x14], 0x6759
cmp dword [ebp - 0x14], 0x69a2
push 1
pop ebx
jle 0x1001f644
mov esi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
mov eax, esi
xor ecx, ecx
cdq
idiv edi
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0xc], edx
mov esi, ecx
mov edi, 0x7e5e
mov eax, esi
lea ecx, [ebp - 0x34]
and eax, edx
cdq
push edx
push eax
call fcn.10001a95
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001f5f3
mov eax, dword [eax]
push eax
call fcn.1004cf6c
pop ecx
push 0
push ebx
lea ecx, [ebp - 0x34]
call fcn.100052fb
mov edx, dword [ebp - 0xc]
dec esi
dec edi
jne 0x1001f5da
mov ecx, dword [ebp - 0x10]
inc ecx
mov dword [ebp - 0x10], ecx
cmp ecx, 0x3294
jl 0x1001f5d3
mov edi, dword [ebp - 8]
mov esi, dword [ebp - 4]
inc edi
mov dword [ebp - 8], edi
cmp edi, 0x3c4b
jl 0x1001f5c6
inc esi
mov dword [ebp - 4], esi
push 0
pop edi
cmp esi, 0x5d8d
jl 0x1001f5c3
push edi
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 8], 0xffffffff
mov dword [ebp - 0xc], 0x40f2
mov dword [ebp - 4], 0x2e889ec
mov dword [ebp - 0x10], edi
push 6
mov dword [ebp - 0x10], 0x8cbd6cd5
mov dword [ebp - 0x10], edi
pop esi
jmp 0x1001f675
mov eax, dword [ebp - 0x10]
mov dword [ebp + eax*4 - 0x1c], esi
inc dword [ebp - 0x10]
cmp dword [ebp - 0x10], 2
jl 0x1001f66b
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 4]
cmp eax, dword [ebp - 0xc]
jne 0x1001f689
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
mov eax, dword [ebp - 4]
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], ebx
cmp dword [ebp - 0x10], edi
je 0x1001f6a2
cmp dword [ebp - 0xc], edi
jne 0x1001f6a4
mov ebx, edi
cmp ebx, dword [ebp - 8]
jg 0x1001f6ae
cmp dword [ebp - 0x10], edi
je 0x1001f6b1
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0xc]
xor ecx, ecx
mov eax, dword [ebp - 8]
mov eax, dword [ebp - 0x10]
test eax, eax
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
sete cl
imul ecx, ecx, 0x952e
xor edx, edx
cmp ecx, eax
setg dl
add edx, 3
mov dword [ebp - 0x10], edx
mov dword [ebp - 4], 9
jmp 0x1001f6f2
mov dword [ebp - 0x10], 0xfffffff9
cmp dword [ebp - 0x10], edi
jne 0x1001f6f7
dec dword [ebp - 4]
cmp dword [ebp - 4], esi
je 0x1001f6e3
cmp dword [ebp - 0x14], 0x63f5
jge 0x1001f70b
push str.gckheesou_xzhkjqi_ochcjyv_grqbf_inkqwl_uqbkpkm_krttl_fhbvnmp_urwtjufw_luygqvrtp_zfewgq_suhbiph_vpxyswbwu
call fcn.1004cf6c
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10022870
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10064ab0
call fcn.10063950
sub esp, 0x14
push ebx
push esi
mov byte [ebp - 0x14], cl
mov dword [ebp - 0x1c], 0x2e3a
cmp dword [ebp - 0x1c], 0x318c
push edi
mov dword [ebp - 0x10], esp
jle 0x100228ca
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x10080db8
and eax, edi
xor eax, esi
cdq
push edx
push eax
call fcn.10004c02
inc ebx
cmp ebx, 0x3819
jl 0x1002289c
inc edi
cmp edi, 0x17e8
jl 0x1002289a
inc esi
cmp esi, 0x5853
jl 0x10022898
cmp byte [ebp - 0x14], 0
je 0x100228e1
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10022901
mov cl, 1
call fcn.10021e0a
jmp 0x10022901
mov byte [ebp - 0x15], 0
cmp byte [ebp - 0x15], 0
je 0x10022901
mov esi, dword [sym.imp.USER32.dll_GetDesktopWindow]
push 0x11
push 0
call esi
push eax
call esi
push eax
call dword [sym.imp.USER32.dll_MapWindowPoints]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x2bab
jge 0x1002291d
mov edx, str.xqxgen_gvuqlim_gbor_cqansxbn_gwwz_nepaydjuh_jxqp_fxbv
mov ecx, 0x10080db8
call fcn.10007110
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003c197
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100652ad
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x64
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1003c1f5
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x28]
push 1
push dword [ebp - 0x2c]
push 0x28fa
push dword [ebp - 0x30]
push 0x54b2
call fcn.1003c38e
add esp, 0x18
jmp 0x1003c37d
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x1003c228
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x40]
and dword [eax], 0
jmp 0x1003c37d
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x24], 0x161f
mov dword [ebp - 0x54], str.otybijefx_sga_qze_qqwpczuh_xulwkrl_ura_hnkyugttl_iacu_dgkkqc_yvtps_hkkopk_kvhoalidu
cmp dword [ebp - 0x24], 0x18b3
jle 0x1003c302
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
and dword [ebp - 0x14], 0
jmp 0x1003c266
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x5277
jge 0x1003c302
and dword [ebp - 0x18], 0
jmp 0x1003c280
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x7555
jge 0x1003c2fd
and dword [ebp - 0x1c], 0
jmp 0x1003c296
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3138
jge 0x1003c2f8
and dword [ebp - 0x20], 0
jmp 0x1003c2ac
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x31c8
jge 0x1003c2f6
mov eax, dword [ebp - 0x14]
and eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
and ecx, dword [ebp - 0x20]
xor eax, ecx
cdq
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edx
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x74]
call fcn.10001a95
pop ecx
pop ecx
mov dword [ebp - 0x4c], eax
mov ecx, dword [ebp - 0x4c]
call fcn.10004ac4
push eax
call fcn.1004cf6c
pop ecx
lea ecx, [ebp - 0x74]
call fcn.10004aba
jmp 0x1003c2a5
jmp 0x1003c28f
jmp 0x1003c279
jmp 0x1003c25f
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
test eax, eax
je 0x1003c341
push 0x6c4
push 0x1f29
push 0x4bd
push 0x1341
push 0x2593
push 0
push 0
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.USER32.dll_DrawStateW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x149d
jge 0x1003c357
push dword [ebp - 0x54]
call fcn.1004cf6c
pop ecx
jmp 0x1003c373
or dword [ebp - 4], 0xffffffff
jmp 0x1003c37d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10041dcc
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov byte [esp + 4], dl
push ebx
mov ebx, ecx
push esi
push edi
test dl, dl
je 0x10041e67
mov dword [esp + 0x14], 0x451e
cmp dword [esp + 0x14], 0x4581
jle 0x10041e42
xor esi, esi
xor edi, edi
mov eax, edi
lea ecx, [esp + 0x18]
and eax, esi
cdq
push edx
push eax
call fcn.10001a95
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10041e16
mov eax, dword [eax]
push eax
call fcn.1004cf6c
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.100052fb
inc edi
cmp edi, 0x411b
jl 0x10041dfc
inc esi
cmp esi, 0x201
jl 0x10041dfa
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
cmp dword [esp + 0x14], 0x4322
jge 0x10041e57
push str.qisuvmmic_gmbu_qcmq_qcfw_amusrb_lapsaybnj_lasn_ohfnwdej_jvt_aniwsrx_xarxwlg_rfoxqsqjt_sai_aml
call fcn.1004cf6c
pop ecx
cmp byte [ebx], 0
je 0x10041e95
push ecx
push ecx
call fcn.1004631f
pop ecx
pop ecx
jmp 0x10041e95
mov esi, dword [ebp + 0x1c]
mov dword [esi], 0
jmp 0x10041e90
push ecx
push 0x572b
push 0
push 0x1a71
push ecx
push dword [ebp + 0xc]
mov ecx, dword [ebp + 0x18]
call fcn.10042008
add esp, 0x18
dec dword [esi]
cmp dword [esi], 0xffffffe7
jl 0x10041e72
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret