joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100342d5
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x100342ec
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x1003430e
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x1076de34
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x1076e1c0
jl 0x1003431c
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x1076e464
jl 0x1003435c
mov ecx, dword [0x1076f1b0]
xor ecx, dword [0x1076de34]
and ecx, edi
xor ecx, dword [0x1076f1b0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x1076de30], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x1076e464]
mov dword [0x1076e7f0], eax
pop esi
ret

Function at 0x100343ce
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, 0x1076de34
mov ecx, dword [esi + 4]
xor ecx, dword [esi]
and ecx, 0x7fffffff
xor ecx, dword [esi]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
add esi, 4
cmp esi, 0x1076e7f4
jl 0x100343d4
pop esi
ret
Function at 0x10034427
Capabilities:
Get file system object information

Disassembly:
mov eax, 0x1005fefa
call fcn.1005e738
sub esp, 0x3c
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x18], edx
xor ebx, ebx
lea ecx, [ebp - 0x34]
push 3
mov dword [ebp - 0x1c], ebx
call fcn.100021db
mov dword [ebp - 4], ebx
mov dword [ebp - 0x14], ebx
jmp 0x10034463
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
mov dword [eax + ecx*4], 0xc3eee2fd
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x10034453
mov edx, dword [ebp - 0x34]
xor ecx, ecx
mov eax, 0x31d26ec1
mov esi, dword [edx + 8]
sub eax, esi
cmp esi, eax
sete cl
xor eax, eax
cmp ecx, esi
setl al
xor ecx, ecx
add eax, dword [edx]
test esi, esi
mov dword [ebp - 0x14], eax
sete cl
xor eax, eax
inc eax
sub eax, ecx
cmp eax, dword [ebp - 0x14]
jne 0x100344bf
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10034543
push 0x1778
push 0x2218
push ebx
push ebx
push ebx
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x10034543
mov dword [ebp - 0x14], 0x5b054dbb
mov dword [ebp - 0x14], 0xffffffff
jmp 0x1003453d
push dword [ebp - 0x18]
movdqa xmm0, xmmword [0x1006cd90]
lea eax, [ebp - 0x34]
push eax
lea eax, [ebp - 0x44]
mov dword [ebp - 0x28], ebx
push eax
push ebx
lea ecx, [ebp - 0x28]
mov dword [ebp - 0x24], ebx
movdqu xmmword [ebp - 0x44], xmm0
mov dword [ebp - 0x20], ebx
call fcn.100022f1
mov ecx, dword [ebp - 0x28]
mov edx, dword [ebp - 0x34]
mov dword [ecx + 8], ebx
mov eax, dword [ecx + 8]
or dword [edx + eax*4], 0xffffffff
inc dword [ecx + 8]
cmp dword [ecx + 8], 3
jl 0x10034502
mov byte [ebp - 0xd], bl
cmp byte [ebp - 0xd], 0
je 0x10034528
push ebx
push 0x1580
push ebx
call dword [sym.imp.GDI32.dll_GetObjectW]
push dword [ebp - 0x28]
call fcn.10046c84
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x20], ebx
dec dword [ebp - 0x14]
pop ecx
cmp dword [ebp - 0x14], 0xffffffec
jl 0x100344cf
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x34]
call fcn.10046c84
mov edx, dword [ebp - 0x18]
mov ecx, edi
call fcn.1003d2f5
pop ecx
mov ecx, dword [ebp - 0xc]
mov eax, edi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003469d
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
cmp byte [ebp + 0x10], 0
push esi
mov esi, ecx
je 0x100346cc
mov edx, dword [ebp + 0x18]
mov dword [edx], 0
jmp 0x100346c5
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xc3eee2fd
inc dword [edx]
cmp dword [edx], 3
jl 0x100346b8
jmp 0x100346e9
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x100346e9
push 0x1778
push 0x2218
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10035247
Capabilities:
Accept command line arguments
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0x18], 0
mov byte [ebp - 4], dl
je 0x1003527d
cmp byte [ebp + 0x14], 0
je 0x1003525e
inc dword [ecx]
jmp 0x100352ae
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x100352ae
push 0x1778
push 0x2218
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
jmp 0x100352ae
test dl, dl
je 0x10035289
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x100352ae
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x100352ae
push esi
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xc095b676
inc dword [edx]
cmp dword [edx], 2
jl 0x1003529b
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10035315
Capabilities:
Get disk size

Disassembly:
mov eax, 0x1005ff56
call fcn.1005e738
sub esp, 0x18
push ebx
push esi
push edi
mov byte [ebp - 0x14], dl
mov edi, ecx
mov dword [ebp - 0x20], 0x74aa
xor ebx, ebx
cmp dword [ebp - 0x20], 0x7660
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edi
jle 0x10035397
push 0x1c84
push ebx
push 0xbca
push 0x2040
call dword [sym.imp.USER32.dll_SystemParametersInfoW]
mov esi, ebx
mov edi, ebx
mov ecx, ebx
mov dword [ebp - 0x1c], ebx
lea eax, [edi + esi]
or eax, ecx
mov ecx, 0x10079c18
cdq
push edx
push eax
call fcn.100048ed
mov ecx, dword [ebp - 0x1c]
inc ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x1ea2
jl 0x10035361
inc edi
cmp edi, 0x4d76
jl 0x1003535c
inc esi
cmp esi, 0x415a
jl 0x1003535a
mov edi, dword [ebp - 0x24]
cmp byte [ebp - 0x14], 0
je 0x10035456
mov esi, dword [ebp + 0xc]
xor edx, edx
mov ecx, dword [esi]
mov eax, dword [esi]
add ecx, 0xee4c20f7
cmp eax, ecx
mov eax, dword [esi]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esi]
sete cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esi]
setle dl
xor ebx, ebx
cmp eax, edx
mov eax, dword [esi]
setne bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [esi]
setne cl
cmp ecx, 0xda2ae7b7
sbb ecx, ecx
xor edx, edx
neg ecx
cmp ecx, eax
mov eax, dword [esi]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esi]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [esi]
sete dl
xor ecx, ecx
cmp edx, eax
setne cl
sub ecx, 0x3b16
neg ecx
sbb ecx, ecx
xor ebx, ebx
inc ecx
cmp ecx, dword [esi]
jg 0x10035420
cmp dword [esi], ebx
jne 0x10035420
mov ecx, ebx
jmp 0x10035423
xor ecx, ecx
inc ecx
mov eax, dword [esi]
mov edx, dword [esi]
imul eax, ecx
add edx, eax
mov eax, dword [ebp + 8]
neg edx
sbb edx, edx
xor ecx, ecx
neg edx
mov dword [eax], edx
mov eax, dword [esi]
cmp edx, eax
setle cl
mov dword [edi], ecx
xor ecx, ecx
mov eax, dword [edi]
mov eax, dword [esi]
mov eax, dword [esi]
test eax, eax
mov eax, dword [ebp + 0x10]
sete cl
mov dword [eax], ecx
jmp 0x1003546a
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x1003546a
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x20], 0x7161
jge 0x10035485
mov edx, str.cdntdg_ujs_womlyq_ogr_fuyt_pllmvq
mov ecx, 0x10079c18
call fcn.10006b05
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100354b0
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x1005ff60
call fcn.1005e738
sub esp, 0xc
cmp byte [ebp + 0x1c], 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x14], edi
je 0x10035529
cmp byte [ebp + 0x18], 0
je 0x100354fd
mov dword [edx], 0
cmp dword [edx], 4
jge 0x100355b2
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [edx]
cmp dword [edx], 4
jl 0x100354e6
jmp 0x100355b2
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x100355b2
mov esi, dword [ebp + 0x20]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xe56a96da
inc dword [edx]
cmp dword [edx], 1
jl 0x10035512
jmp 0x100355b2
mov dword [ebp + 0x1c], 0x6cd0
cmp dword [ebp + 0x1c], 0x6e61
jle 0x10035562
xor esi, esi
xor ebx, ebx
mov ecx, ebx
mov eax, esi
sar eax, cl
mov ecx, 0x10079c18
cdq
push edx
push eax
call fcn.100048ed
inc ebx
cmp ebx, 0xd3c
jl 0x1003553d
inc esi
cmp esi, 0x5448
jl 0x1003553b
and dword [ebp - 4], 0
cmp dword [ebp + 0x1c], 0x6b1f
jge 0x1003559d
mov edx, str.fepijr_njgnceb_ajcverkxs_smnllfl_qvhhzbevt_rucqeklxk_vanunfb
mov ecx, 0x10079c18
call fcn.10006b05
jmp 0x1003559d
cmp byte [ebp + 0xc], 0
je 0x100355ad
push 0
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
jmp 0x100355b2
mov eax, dword [ebp + 0x14]
mov dword [eax], edi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10035e27
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x10], 0
push esi
je 0x10035e56
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10035e64
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xa2c7c8a6
inc dword [edx]
cmp dword [edx], 2
jl 0x10035e42
jmp 0x10035e64
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
pop ebp
ret

Function at 0x10035f4b
Capabilities:
Create thread
Get disk information

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
je 0x10035f5e
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
pop ebp
ret
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop ebp
ret
Function at 0x10036910
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005ffd8
call fcn.1005e738
sub esp, 0x20
push ebx
push esi
mov byte [ebp - 0x14], dl
mov esi, ecx
mov dword [ebp - 0x20], 0x6df5
cmp dword [ebp - 0x20], 0x706b
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], esi
jle 0x10036997
xor edi, edi
mov dword [ebp - 0x1c], edi
xor ebx, ebx
mov dword [ebp - 0x18], ebx
mov eax, ebx
xor esi, esi
and eax, edi
mov dword [ebp - 0x24], eax
mov edi, eax
xor ebx, ebx
lea eax, [ebx + esi]
mov ecx, 0x10079c18
xor eax, edi
cdq
push edx
push eax
call fcn.100048ed
inc ebx
cmp ebx, 0x428c
jl 0x10036952
inc esi
cmp esi, 0x163
jl 0x10036950
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 0x18], ebx
cmp ebx, 0x76f3
jl 0x10036945
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x37e0
jl 0x10036940
mov esi, dword [ebp - 0x28]
cmp byte [ebp - 0x14], 0
je 0x100369c2
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x100369e2
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x197f0a2
inc dword [edx]
cmp dword [edx], 1
jl 0x100369ae
jmp 0x100369e2
mov dword [esi], 0
cmp dword [esi], 1
jge 0x100369e2
mov edx, dword [ebp + 0xc]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0x197f0a2
inc dword [esi]
cmp dword [esi], 1
jl 0x100369d0
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x6d15
jge 0x10036a01
mov edx, str.wtfnegthy_dvrydi_tgte_skdtes_ksaofny_chisot_ltz
mov ecx, 0x10079c18
call fcn.10006b05
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003714e
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 8], 0
je 0x1003717e
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1003717c
push 0x2546
push 0
push 0
push 0x7ab2
mov dl, 1
mov ecx, 0x729f
call fcn.100389d8
add esp, 0x10
pop ebp
ret
cmp byte [edx], 0
je 0x1003717c
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetCommandLineW]
Function at 0x10037ea2
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
mov dword [ebp - 8], edx
mov ebx, ecx
xor edx, edx
push esi
push edi
cmp byte [ebp + 0x1c], dl
je 0x10037f2c
mov edi, dword [ebp + 0x18]
mov esi, dword [ebp + 0xc]
mov dword [edi], 0xfcc58a01
mov eax, dword [esi]
imul eax, dword [ebx]
imul eax, eax, 0xec32
test eax, eax
jne 0x10037ed9
cmp dword [esi], edx
jne 0x10037ed9
mov ecx, edx
jmp 0x10037edc
xor ecx, ecx
inc ecx
xor eax, eax
cmp ecx, 0xfffffff9
mov ecx, 0x7030
setg al
sub ecx, eax
mov eax, dword [ebp + 8]
mov dword [eax], ecx
xor ecx, ecx
mov eax, dword [eax]
cmp eax, 0x6c31
mov eax, dword [ebp + 0x14]
sete cl
mov dword [eax], ecx
mov eax, dword [eax]
mov eax, dword [esi]
cmp dword [ebx], edx
jne 0x10037f0b
mov eax, dword [edi]
mov ecx, dword [ebp + 0x14]
mov eax, dword [esi]
mov ecx, dword [ecx]
sub ecx, eax
jne 0x10037f1a
cmp dword [edi], edx
je 0x10037f1d
xor edx, edx
inc edx
mov ecx, dword [ebp - 8]
xor eax, eax
cmp edx, 0xfffffffd
setge al
mov dword [ecx], eax
jmp 0x10037f40
mov byte [ebp - 1], dl
cmp byte [ebp - 1], dl
je 0x10037f40
push edx
push edx
push edx
push edx
push edx
push edx
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10038b7f
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006005f
call fcn.1005e738
sub esp, 0x2c
push ebx
push esi
mov byte [ebp - 0x14], dl
mov ebx, ecx
mov dword [ebp - 0x20], 0x25be
cmp dword [ebp - 0x20], 0x292f
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ebx
jle 0x10038be1
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x10079c18
xor eax, edi
or eax, esi
cdq
push edx
push eax
call fcn.100048ed
inc ebx
cmp ebx, 0x7476
jl 0x10038bb0
inc edi
cmp edi, 0x478f
jl 0x10038bae
inc esi
cmp esi, 0x2ef1
jl 0x10038bac
mov ebx, dword [ebp - 0x1c]
cmp byte [ebp - 0x14], 0
je 0x10038bee
dec dword [ebx]
jmp 0x10038c73
mov dword [ebp - 0x1c], 0x2e86
cmp dword [ebp - 0x1c], 0x2fdb
jle 0x10038c3f
xor esi, esi
xor edi, edi
lea eax, [edi + esi]
cdq
lea ecx, [ebp - 0x38]
push edx
push eax
call fcn.10002dd6
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10038c1a
mov eax, dword [eax]
push eax
call fcn.100476ff
pop ecx
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.10004d30
inc edi
cmp edi, 0x52ce
jl 0x10038c02
inc esi
cmp esi, 0x6bd1
jl 0x10038c00
mov byte [ebp - 0x15], 0
cmp dword [ebp - 0x1c], 0x2c9f
jge 0x10038c57
push str.nbqekjrt_vagota_mdjeka_lrrk_uxilljghe_mtcgmb_ttrtthpzp_pgmwse_qyxyfw_khorv_kih_yaa
call fcn.100476ff
pop ecx
push 0
push 0x7865
lea eax, [ebp - 0x15]
mov dl, 1
push 0x338d
push eax
xor cl, cl
call fcn.100370f9
add esp, 0x10
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x2313
jge 0x10038c92
mov edx, str.gntbvz_oiglfrrko_llsxfvqkd_ouz_dyoaelptw
mov ecx, 0x10079c18
call fcn.10006b05
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003ddf5
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push ecx
mov byte [ebp - 4], cl
push ebx
mov ebx, edx
push esi
test cl, cl
je 0x1003de80
mov ecx, dword [ebp + 0x24]
xor esi, esi
push edi
mov edi, dword [ebp + 0x20]
mov eax, dword [edi]
mov dword [ecx], eax
cmp dword [ecx], esi
je 0x1003de1d
mov eax, dword [edi]
mov eax, dword [ecx]
mov ecx, esi
jmp 0x1003de20
xor ecx, ecx
inc ecx
mov eax, dword [edi]
mov edx, dword [edi]
imul eax, ecx
xor ecx, ecx
test eax, eax
mov eax, dword [edi]
setg cl
imul edx, ecx
xor ecx, ecx
cmp edx, eax
setl cl
xor eax, eax
cmp ecx, 0xffb9
setl al
mov dword [ebx], eax
imul ecx, dword [ebx], 0x2c36
mov eax, dword [ebp + 0x14]
sub ecx, 0x8d92
neg ecx
sbb ecx, ecx
inc ecx
mov dword [eax], ecx
cmp dword [eax], esi
je 0x1003de63
mov eax, dword [ebx]
mov eax, dword [edi]
xor ecx, ecx
mov edx, dword [edi]
mov eax, dword [ebp + 0xc]
pop edi
mov eax, dword [eax]
mov dword [eax + 4], edx
mov eax, dword [ebx]
cmp edx, eax
mov eax, dword [ebp + 0x18]
setge cl
mov dword [eax], ecx
jmp 0x1003de96
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1003de96
xor esi, esi
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003de9c
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
je 0x1003df38
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1003df42
mov dword [ebp - 4], 0x767e
cmp dword [ebp - 4], 0x7a41
jle 0x1003df1c
xor esi, esi
xor edi, edi
xor ebx, ebx
mov ecx, ebx
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0x1c]
xor eax, esi
cdq
push edx
push eax
call fcn.10002dd6
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003deee
mov eax, dword [eax]
push eax
call fcn.100476ff
pop ecx
push 0
push 1
lea ecx, [ebp - 0x1c]
call fcn.10004d30
inc ebx
cmp ebx, 0x6db7
jl 0x1003ded1
inc edi
cmp edi, 0x58de
jl 0x1003decf
inc esi
cmp esi, 0x4b4a
jl 0x1003decd
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp dword [ebp - 4], 0x746b
jge 0x1003df42
push str.fxsjghp_sqok_frcjhmzzu_eilcyjd_tzx_efmbddmfh_xqeayckti
call fcn.100476ff
pop ecx
jmp 0x1003df42
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CompareFileTime]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003df4b
Capabilities:
Read .ini file

Disassembly:
mov eax, 0x100602dc
call fcn.1005e738
sub esp, 0x24
cmp byte [ebp + 0x18], 0
mov eax, ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], eax
je 0x1003dfe3
mov dword [ebp - 0x14], 0x4e8a
cmp dword [ebp - 0x14], 0x5009
jle 0x1003dfbc
xor esi, esi
mov edi, esi
mov ebx, 0x19b1
mov eax, edi
lea ecx, [ebp - 0x30]
cdq
push edx
push eax
call fcn.10002dd6
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1003df99
mov eax, dword [eax]
push eax
call fcn.100476ff
pop ecx
push 0
push 1
lea ecx, [ebp - 0x30]
call fcn.10004d30
dec edi
dec ebx
jne 0x1003df82
inc esi
cmp esi, 0x612a
jl 0x1003df7b
mov eax, dword [ebp - 0x18]
cmp byte [eax], 0
je 0x1003dfc9
push 0
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
cmp dword [ebp - 0x14], 0x4e26
jge 0x1003e061
push str.pmvyvcf_aozn_safcrjfjv_ute_cbbhjb_lug_jeyciazji_tntnzg_gtqkpp_npr_cazjiqz
call fcn.100476ff
pop ecx
jmp 0x1003e061
mov dword [ebp - 0x14], 0x810
cmp dword [ebp - 0x14], 0x9ee
jle 0x1003e029
xor esi, esi
xor edi, edi
xor ebx, ebx
mov ecx, ebx
mov eax, edi
sar eax, cl
mov ecx, 0x10079c18
and eax, esi
cdq
push edx
push eax
call fcn.100048ed
inc ebx
cmp ebx, 0xd60
jl 0x1003dff9
inc edi
cmp edi, 0x1059
jl 0x1003dff7
inc esi
cmp esi, 0xbc9
jl 0x1003dff5
mov dword [ebp - 4], 2
cmp dword [ebp - 0x14], 0x79b
jge 0x1003e048
mov edx, str.hge_tidpjkvqv_iyjnmqy_udjjxhan_fihhyj_pfvhcq_uxq_qmcdnsusj_nzqjonfu_pjpykfy_thvbzog_mypjcyci
mov ecx, 0x10079c18
call fcn.10006b05
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1003e061
push 0
push 0xdea
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003e0dc
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100602e6
call fcn.1005e738
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x1c], 0x4564
mov edi, ecx
cmp dword [ebp - 0x1c], 0x4917
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edi
jle 0x1003e14b
call dword [sym.imp.KERNEL32.dll_SwitchToThread]
xor ebx, ebx
mov esi, ebx
mov edi, esi
mov dword [ebp - 0x18], 0x868
mov dword [ebp - 0x20], ebx
mov eax, edi
mov ecx, 0x10079c18
xor eax, ebx
cdq
push edx
push eax
call fcn.100048ed
inc ebx
cmp ebx, 0x39ca
jl 0x1003e11a
dec edi
dec dword [ebp - 0x18]
push 0
pop ebx
jne 0x1003e117
inc esi
cmp esi, 0x31cc
jl 0x1003e10e
mov edi, dword [ebp - 0x24]
jmp 0x1003e14d
xor ebx, ebx
cmp byte [ebp + 8], 0
je 0x1003e1ac
mov edx, dword [ebp + 0x14]
mov eax, dword [ebp + 0x10]
mov ecx, dword [edx]
mov dword [eax], ecx
mov eax, dword [edi]
mov eax, dword [edx]
mov eax, dword [edi]
mov eax, dword [edx]
add eax, dword [edi]
cmp eax, 0xfffffff9
jne 0x1003e174
cmp dword [edi], ebx
jne 0x1003e174
mov ecx, ebx
jmp 0x1003e177
xor ecx, ecx
inc ecx
mov eax, dword [ebp + 0x18]
xor edx, edx
cmp ecx, 0x719d
setle dl
xor ecx, ecx
mov eax, dword [eax]
mov esi, dword [eax]
mov eax, dword [edi]
cmp edx, eax
setle cl
lea eax, [esi + 0x4f35204f]
add eax, ecx
mov ecx, dword [ebp + 0x14]
imul eax, esi
mov ecx, dword [ecx]
imul ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
jmp 0x1003e1f2
mov esi, dword [ebp + 0x1c]
mov dword [esi], ebx
jmp 0x1003e1ed
mov dword [ebp - 0x18], 0x94a18885
mov dword [ebp - 0x18], 8
jmp 0x1003e1e5
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1003e1e2
push ebx
push 0x1d7e
push 0xffc
push 0x920
call dword [sym.imp.GDI32.dll_SetViewportExtEx]
dec dword [ebp - 0x18]
cmp dword [ebp - 0x18], 1
jne 0x1003e1c3
inc dword [esi]
cmp dword [esi], 7
jle 0x1003e1b3
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1c], 0x4188
jge 0x1003e20d
mov edx, str.otskkzgds_kqt_srqyhgnte
mov ecx, 0x10079c18
call fcn.10006b05
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003e32c
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
test cl, cl
je 0x1003e36a
mov edi, dword [ebp + 8]
mov eax, dword [edi]
and dword [eax + 8], 0
jmp 0x1003e360
push dword [ebp + 0xc]
mov edx, edi
push ecx
push ecx
push 0
push 0x210d
mov ecx, 0x4298
call fcn.1003e844
mov eax, dword [edi]
add esp, 0x14
inc dword [eax + 8]
mov eax, dword [edi]
cmp dword [eax + 8], 3
jl 0x1003e340
jmp 0x1003e385
cmp byte [edx], 0
je 0x1003e385
push 0x1778
push 0x2218
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
pop edi
pop ecx
pop ebp
ret