joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001c99e
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061bf3
call fcn.10060f20
sub esp, 0x1c
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
xor esi, esi
mov dword [ebp - 0x28], edx
cmp byte [ebp + 0x10], 0
mov dword [ebp - 0x24], edi
je 0x1001ca8a
mov dword [ebp - 0x20], 0x1ddc
cmp dword [ebp - 0x20], 0x2070
jle 0x1001ca38
mov dword [ebp - 0x14], esi
mov edi, dword [ebp - 0x14]
mov ebx, esi
mov dword [ebp - 0x1c], ebx
mov ecx, esi
mov dword [ebp - 0x18], esi
mov eax, ebx
mov ebx, 0x2c34
cdq
idiv ecx
mov esi, edx
mov eax, esi
mov ecx, 0x1007cc18
xor eax, edi
cdq
push edx
push eax
call fcn.10013d0a
inc esi
dec ebx
jne 0x1001c9f1
mov ecx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x836
jl 0x1001c9e5
inc ebx
mov dword [ebp - 0x1c], ebx
push 0
pop esi
cmp ebx, 0x2fa7
jl 0x1001c9e0
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x3dba
jl 0x1001c9d8
mov edi, dword [ebp - 0x24]
mov dword [edi], esi
cmp dword [edi], 1
jge 0x1001ca53
mov esi, dword [ebp - 0x28]
mov ecx, dword [edi]
mov eax, dword [esi]
or dword [eax + ecx*4], 0xffffffff
inc dword [edi]
cmp dword [edi], 1
jl 0x1001ca42
xor esi, esi
mov dword [ebp - 4], esi
cmp dword [ebp - 0x20], 0x1d6a
jge 0x1001ca6e
mov edx, str.arwgh_prn_hjcpdedqk_ogootno_lboaij_oyxedyhq_ltknykz_vspi
mov ecx, 0x1007cc18
call fcn.1001875a
jmp 0x1001cadd
mov edx, dword [ebp + 0x14]
mov ebx, dword [ebp + 0x1c]
mov edi, dword [ebp + 0x20]
cmp dword [edx], esi
jne 0x1001ca9f
mov eax, dword [edx]
mov eax, dword [ebx]
mov eax, dword [edx]
mov eax, dword [edi]
mov ecx, dword [edx]
mov eax, dword [edx]
xor edx, edx
cmp ecx, eax
setne dl
xor eax, eax
cmp edx, 0x23e6
setge al
xor ecx, ecx
cmp eax, 9
mov eax, dword [ebx]
setg cl
xor edx, edx
cmp ecx, 0x294bb489
setl dl
imul eax, edx
test eax, eax
jne 0x1001cad5
cmp dword [edi], esi
je 0x1001cad8
xor esi, esi
inc esi
mov eax, dword [ebp + 0xc]
mov dword [eax], esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001d283
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061c07
call fcn.10060f20
sub esp, 0x1c
cmp byte [ebp + 0x30], 0
mov eax, edx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], eax
mov dword [ebp - 0x24], ecx
je 0x1001d31f
cmp byte [ebp + 0x14], 0
je 0x1001d2d2
mov byte [ebp + 0x33], 0
cmp byte [ebp + 0x33], 0
je 0x1001d2c1
push 1
mov ecx, 0x56d4
call fcn.1001bfb2
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov ebx, dword [ebp + 0x20]
xor edi, edi
mov dword [ebx], edi
jmp 0x1001d319
mov eax, dword [eax]
xor ecx, ecx
mov eax, dword [ebp + 0x38]
mov esi, dword [ebp + 0x1c]
mov eax, dword [eax]
mov esi, dword [esi]
mov eax, dword [ebp + 8]
mov edx, dword [eax]
mov eax, dword [ebx]
neg eax
cmp eax, dword [edx + esi*4]
mov eax, dword [ebp + 0x10]
setge cl
mov dword [eax], ecx
mov eax, dword [ebp + 0x1c]
mov ecx, dword [ebp + 8]
mov edx, dword [eax]
mov eax, dword [eax]
mov ecx, dword [ecx]
mov eax, dword [ecx + eax*4]
add eax, dword [ecx + edx*4]
mov ecx, dword [ebp + 0x2c]
mov dword [ecx], eax
inc dword [ebx]
mov eax, dword [ebp - 0x20]
cmp dword [ebx], edi
jle 0x1001d2db
jmp 0x1001d2c1
mov dword [ebp - 0x20], 0x531e
xor edi, edi
cmp dword [ebp - 0x20], 0x539f
jle 0x1001d3a5
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_EnumResourceNamesW]
mov esi, edi
mov dword [ebp - 0x1c], edi
mov ebx, edi
mov dword [ebp - 0x18], edi
mov eax, esi
mov dword [ebp + 0x30], edi
cdq
idiv ebx
mov ecx, edx
mov dword [ebp - 0x14], ecx
mov esi, edi
mov ebx, 0x3d7b
mov edi, dword [ebp + 0x30]
mov eax, esi
xor eax, ecx
mov ecx, 0x1007cc18
cdq
push edx
push eax
call fcn.10013d0a
mov ecx, dword [ebp - 0x14]
add esi, edi
dec ebx
jne 0x1001d35c
inc edi
push 0
mov dword [ebp + 0x30], edi
cmp edi, 0x3d71
pop edi
jl 0x1001d352
mov ebx, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 0x18], ebx
cmp ebx, 0x4304
jl 0x1001d345
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x6633
jl 0x1001d340
mov ecx, dword [ebp - 0x24]
cmp byte [ebp + 0x18], 0
je 0x1001d3c6
mov esi, dword [ecx]
mov eax, dword [ebp + 0x28]
mov ecx, dword [ecx]
mov edx, dword [eax]
mov eax, dword [eax]
mov ecx, dword [eax + ecx*4]
mov eax, dword [ebp + 0xc]
mov dword [edx + esi*4], ecx
mov eax, dword [eax]
mov dword [eax + 4], ecx
jmp 0x1001d3e5
mov edx, dword [ebp + 0x24]
mov dword [edx], edi
cmp dword [edx], 3
jge 0x1001d3e5
mov esi, dword [ebp + 0x34]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x8470ed99
inc dword [edx]
cmp dword [edx], 3
jl 0x1001d3d3
mov dword [ebp - 4], edi
cmp dword [ebp - 0x20], 0x4f79
jge 0x1001d2c1
mov edx, str.hmfcgyyv_nffux_jet_szenkr_uuntj
mov ecx, 0x1007cc18
call fcn.1001875a
jmp 0x1001d2c1
Function at 0x1001dcc7
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov edi, edx
mov ebx, ecx
je 0x1001dd0f
mov esi, dword [ebp + 0x20]
mov dword [esi], 0
jmp 0x1001dd08
push ecx
push 0x27b3
push dword [ebp + 8]
mov edx, ebx
mov ecx, edi
push 1
push 0x4838
call fcn.1001cbf1
mov eax, dword [ebp + 0x14]
add esp, 0x14
cmp dword [eax], 0
jne 0x1001dd17
inc dword [esi]
cmp dword [esi], 3
jle 0x1001dce2
jmp 0x1001dd17
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x1001e41e
Capabilities:
Get disk information

Disassembly:
mov eax, 0x10061c47
call fcn.10060f20
sub esp, 0x18
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, edx
mov byte [ebp - 0x14], cl
je 0x1001e541
cmp byte [ebp + 0x1c], 0
je 0x1001e507
mov dword [ebp + 0xc], 0x1b1d
cmp dword [ebp + 0xc], 0x65f
jge 0x1001e4de
lea eax, [ebp - 0x20]
push eax
push 0x10069a28
call fcn.1004a46b
mov edx, dword [ebp - 0x20]
pop ecx
pop ecx
or ecx, 0xffffffff
mov byte [ebp + 0xf], 0
push 2
pop eax
mov ebx, ecx
mov dword [ebp - 0x1c], ebx
cmp edx, eax
jl 0x1001e4d3
cmp byte [ebp + 0xf], 0
jne 0x1001e4be
xor edi, edi
inc edi
cmp edx, edi
jle 0x1001e4b9
mov ebx, eax
imul ebx, eax
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], edx
jg 0x1001e4ab
add dword [ebp - 0x18], ebx
inc edi
cmp edi, edx
jl 0x1001e499
mov ebx, dword [ebp - 0x1c]
jmp 0x1001e4b9
mov ecx, edi
mov byte [ebp + 0xf], 1
mov ebx, eax
imul ecx, eax
mov dword [ebp - 0x1c], ebx
inc eax
cmp eax, edx
jle 0x1001e484
test ecx, ecx
jle 0x1001e4d3
push ebx
push ecx
push str._ld__ld_n
call fcn.1004a753
add esp, 0xc
jmp 0x1001e4de
push 0x1006c9d8
call fcn.1004a976
pop ecx
mov dword [esi], 0
cmp dword [esi], 2
jge 0x1001e5f7
mov edx, dword [ebp + 0x14]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0xcc3231a2
inc dword [esi]
cmp dword [esi], 2
jl 0x1001e4f0
jmp 0x1001e5f7
mov esi, dword [ebp + 0x18]
mov dword [esi], 0
jmp 0x1001e537
mov byte [ebp + 0xf], 0
cmp byte [ebp + 0xf], 0
je 0x1001e535
push 0
push 0x188
push 0
push 0x574
push 0x445
call dword [sym.imp.GDI32.dll_ExtCreatePen]
inc dword [esi]
cmp dword [esi], 8
jne 0x1001e512
jmp 0x1001e5f7
test cl, cl
je 0x1001e5e6
mov dword [ebp + 0xc], 0x2fa0
cmp dword [ebp + 0xc], 0x327a
jle 0x1001e58b
xor esi, esi
xor edi, edi
mov eax, esi
mov ecx, 0x1007cc18
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.10013d0a
inc edi
cmp edi, 0x1f33
jl 0x1001e55d
inc esi
cmp esi, 0x7f20
jl 0x1001e55b
push 0
call dword [sym.imp.KERNEL32.dll_GetDriveTypeW]
and dword [ebp - 4], 0
cmp dword [ebp + 0xc], 0x2e86
jge 0x1001e5a7
mov edx, str.gyolzsaw_xmj_vdmfbgcl_hzdu_einkcz_huxsnjlq_tlhffsksj_wxldq_hfikcwwo_vdbvd_njgtmismh_cyui_ggsmblxk_jeoqkhir
mov ecx, 0x1007cc18
call fcn.1001875a
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1001e5f7
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x13dd33a4
inc dword [edx]
cmp dword [edx], 2
jl 0x1001e5b8
jmp 0x1001e5f7
mov byte [ebp + 0xf], 0
cmp byte [ebp + 0xf], 0
je 0x1001e5f7
xor dl, dl
call fcn.1001b117
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001e945
Capabilities:
Accept command line arguments
Get file size

Disassembly:
mov eax, 0x10061c51
call fcn.10060f20
sub esp, 0x28
push ebx
push esi
mov dword [ebp - 0x1c], 0x5b6e
mov eax, edx
cmp dword [ebp - 0x1c], 0x5c24
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], eax
jle 0x1001e9bf
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
lea ecx, [ebp - 0x34]
and eax, edi
and eax, esi
cdq
push edx
push eax
call fcn.10002bac
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001e98e
mov eax, dword [eax]
push eax
call fcn.1004a753
pop ecx
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.10014850
inc ebx
cmp ebx, 0x504b
jl 0x1001e973
inc edi
cmp edi, 0x62bc
jl 0x1001e971
inc esi
cmp esi, 0x782b
jl 0x1001e96f
mov eax, dword [ebp - 0x18]
cmp byte [ebp + 8], 0
je 0x1001e9c9
dec dword [eax]
jmp 0x1001ea35
mov dword [ebp - 0x18], 0xc4d
cmp dword [ebp - 0x18], 0xe1f
jle 0x1001ea12
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
xor esi, esi
xor edi, edi
mov ecx, edi
mov eax, esi
sar eax, cl
mov ecx, 0x1007cc18
cdq
push edx
push eax
call fcn.10013d0a
inc edi
cmp edi, 0x609
jl 0x1001e9e3
inc esi
cmp esi, 0x69aa
jl 0x1001e9e1
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0xbb1
jge 0x1001ea2e
mov edx, str.idyxdszb_imuxatxw_kkb_qxuobbh_jdsgohqr_oaykn_npl_mizmzjhja_exfvvvmo_mmgvyt_psceblonx_fsijss
mov ecx, 0x1007cc18
call fcn.1001875a
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
mov dword [ecx], eax
cmp dword [ebp - 0x1c], 0x5a9c
jge 0x1001ea49
push str.qsbctnl_ajp_hfmkqw_laikgefz_kaf_jytnmcnla_ixv
call fcn.1004a753
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001ea74
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061c5b
call fcn.10060f20
sub esp, 0x24
push ebx
push esi
mov byte [ebp - 0x14], cl
mov esi, edx
mov dword [ebp - 0x24], 0x1edb
cmp dword [ebp - 0x24], 0x205d
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], esi
jle 0x1001eb07
xor edi, edi
mov dword [ebp - 0x20], edi
xor ebx, ebx
xor eax, eax
mov esi, edi
mov ecx, ebx
mov dword [ebp - 0x1c], eax
sar esi, cl
mov dword [ebp - 0x30], esi
and dword [ebp - 0x2c], 0
mov edi, esi
mov esi, dword [ebp - 0x2c]
mov ecx, eax
sar edi, cl
mov eax, edi
mov ecx, 0x1007cc18
xor eax, esi
cdq
push edx
push eax
call fcn.10013d0a
inc esi
cmp esi, 0x4a90
jl 0x1001eac1
mov eax, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x30]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x458
jl 0x1001eab4
mov edi, dword [ebp - 0x20]
inc ebx
cmp ebx, 0x5881
jl 0x1001eaa6
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x6343
jl 0x1001eaa4
mov esi, dword [ebp - 0x28]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x1d28
jge 0x1001eb42
mov edx, str.dvzxxcutv_vzozo_ywrqlq_cbzel_bteivsxj_fjatg_axuqngyk
mov ecx, 0x1007cc18
call fcn.1001875a
jmp 0x1001eb42
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x14], 0
je 0x1001eb6f
mov byte [ebp - 0x15], 0
cmp byte [ebp - 0x15], 0
je 0x1001eb8f
sub esp, 0xc
mov edx, 0x496d
mov cl, 1
push 0x16f3
call fcn.1001dd1c
add esp, 0x10
jmp 0x1001eb8f
mov dword [esi], 0
cmp dword [esi], 3
jge 0x1001eb8f
mov edx, dword [ebp + 8]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0x23afc371
inc dword [esi]
cmp dword [esi], 3
jl 0x1001eb7d
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001ebd2
Capabilities:
Set registry value

Disassembly:
mov eax, 0x10061c65
call fcn.10060f20
sub esp, 0xc
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x1001ec17
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x1001ec06
push ecx
push 1
push ecx
mov edx, 0x272b
call fcn.1001b17e
add esp, 0xc
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ecx], 0
je 0x1001ec37
push 0x2683
push 0
push 0x1073
push 0x2593
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
mov dword [ebp - 0x18], 0x6386
cmp dword [ebp - 0x18], 0x651d
jle 0x1001ec7b
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x1007cc18
and eax, edi
and eax, esi
cdq
push edx
push eax
call fcn.10013d0a
inc ebx
cmp ebx, 0x3bd7
jl 0x1001ec4d
inc edi
cmp edi, 0x515d
jl 0x1001ec4b
inc esi
cmp esi, 0x227
jl 0x1001ec49
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x60f2
jge 0x1001ec06
mov edx, str.urmihlyq_qqcf_dsezc_crwlzhod_qpywnus_vnvr_wkuhzw_btpupgm_qme_has_onbvvui
mov ecx, 0x1007cc18
call fcn.1001875a
jmp 0x1001ec06
Function at 0x100240e0
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
xor edx, edx
push esi
push edi
cmp byte [ebp + 0x14], dl
je 0x10024106
push 0x2683
push edx
push 0x1073
push 0x2593
push edx
push edx
call dword [sym.imp.ADVAPI32.dll_RegSetValueExW]
jmp 0x10024121
mov esi, dword [ebp + 8]
mov dword [esi], edx
cmp dword [esi], 2
jge 0x10024121
mov edi, dword [ebp + 0x10]
mov ecx, dword [esi]
mov eax, dword [edi]
mov dword [eax + ecx*4], edx
inc dword [esi]
cmp dword [esi], 2
jl 0x10024113
pop edi
pop esi
pop ebp
ret

Function at 0x10024234
Capabilities:
Log keystrokes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov byte [ebp - 8], cl
push ebx
push esi
push edi
test cl, cl
je 0x1002432e
mov dword [ebp - 0x1c], 0x4e52
cmp dword [ebp - 0x1c], 0x4fe5
jle 0x10024306
xor esi, esi
push esi
push 0x1901
push esi
push esi
push 0x20e1
push 0x101b
push 0x2305
push 0x2619
call dword [sym.imp.GDI32.dll_ExtTextOutA]
mov edi, esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov eax, edi
mov dword [ebp - 0x10], 0xed9
mov dword [ebp - 0xc], eax
mov edi, eax
mov ebx, 0x2b73
mov eax, edi
lea ecx, [ebp - 0x34]
cdq
push edx
push eax
call fcn.10002bac
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100242b2
mov eax, dword [eax]
push eax
call fcn.1004a753
pop ecx
push esi
push 1
lea ecx, [ebp - 0x34]
call fcn.10014850
inc edi
dec ebx
jne 0x1002429b
mov eax, dword [ebp - 0xc]
mov ebx, dword [ebp - 0x14]
add eax, ebx
dec dword [ebp - 0x10]
mov dword [ebp - 0xc], eax
jne 0x10024294
mov edi, dword [ebp - 0x18]
inc ebx
mov dword [ebp - 0x14], ebx
cmp ebx, 0x74bb
jl 0x10024288
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x2f5a
jl 0x10024285
push 0xf8d
push 0x114f
call fcn.10040adf
pop ecx
pop ecx
call eax
push 1
push 0xf97
push 0x3c8
call dword [sym.imp.USER32.dll_AttachThreadInput]
cmp dword [ebp - 0x1c], 0x4db8
jge 0x10024348
push str.bsv_hjq_nieexpkv_cljemxcy_bwbvxipgm_kfdeir_odsppm_ivozp
call fcn.1004a753
pop ecx
jmp 0x10024348
xor esi, esi
mov dword [edx], esi
cmp dword [edx], 1
jge 0x10024348
mov edi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [edi]
mov dword [eax + ecx*4], esi
inc dword [edx]
cmp dword [edx], 1
jl 0x1002433a
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100246fc
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x10061e87
call fcn.10060f20
sub esp, 0x14
push ebx
push esi
mov byte [ebp - 0x14], dl
mov esi, ecx
mov dword [ebp - 0x18], 0x1ba9
cmp dword [ebp - 0x18], 0x1f69
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
jle 0x10024756
xor edi, edi
xor ebx, ebx
mov ecx, ebx
mov eax, edi
shl eax, cl
mov ecx, 0x1007cc18
cdq
push edx
push eax
call fcn.10013d0a
inc ebx
cmp ebx, 0x4d56
jl 0x1002472b
inc edi
cmp edi, 0x7429
jl 0x10024729
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x1ac9
jge 0x10024791
mov edx, str.lnidqbpb_takdlo_qskz_wydcgf_edw_fuivg_luxxkv_aucyahqoq_coecp_eycib
mov ecx, 0x1007cc18
call fcn.1001875a
jmp 0x10024791
cmp byte [ebp - 0x14], 0
je 0x100247b9
mov dword [esi], 0
cmp dword [esi], 1
jge 0x100247c8
mov edx, dword [ebp + 8]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0xfffffffc
inc dword [esi]
cmp dword [esi], 1
jl 0x100247a5
jmp 0x100247c8
push 0
push 0x1c02
push 0
call dword [sym.imp.GDI32.dll_GetEnhMetaFileHeader]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002480d
Capabilities:
Get file size

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
cmp byte [ebp + 0x18], 0
push esi
mov esi, edx
je 0x10024868
cmp byte [ebp + 0xc], 0
je 0x10024861
mov dword [esi], 0xffffffe8
jmp 0x1002485a
mov dword [ebp - 4], 0xeede0b40
mov dword [ebp - 4], 6
jmp 0x10024852
push ecx
lea eax, [ebp - 8]
mov dword [ebp - 8], 0xf8f0aa6e
push eax
mov edx, esi
call fcn.10024ac2
dec dword [ebp - 4]
pop ecx
pop ecx
cmp dword [ebp - 4], 0xfffffff3
jne 0x1002483a
inc dword [esi]
cmp dword [esi], 0x11
jg 0x1002482a
jmp 0x1002489a
mov eax, dword [ecx]
mov dword [ecx + 4], eax
jmp 0x1002489a
cmp byte [ebp + 0x14], 0
je 0x10024890
mov eax, dword [ebp + 0x10]
lea esi, [ebp + 0x1b]
mov ecx, dword [ebp + 8]
push esi
mov byte [ebp + 0x1b], 0
mov edx, dword [eax]
mov eax, dword [ecx]
push edx
push eax
mov dword [ecx + 4], eax
lea eax, [ebp - 0xc]
push eax
call fcn.1002723e
jmp 0x1002489a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetFileSize]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10024b03
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061e9b
call fcn.10060f20
sub esp, 0xc
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x10024b96
mov dword [ebp - 0x18], 0x3c1d
cmp dword [ebp - 0x18], 0x3fd1
jle 0x10024b53
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x1007cc18
xor eax, esi
cdq
push edx
push eax
call fcn.10013d0a
inc edi
cmp edi, 0x7e7
jl 0x10024b30
inc esi
cmp esi, 0x550d
jl 0x10024b2e
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x3960
jge 0x10024b6f
mov edx, str.xmkcwcn_kpnp_xgsespvsh_fyk_zbi_gdeqayr
mov ecx, 0x1007cc18
call fcn.1001875a
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov dword [ecx], 0
jmp 0x10024baf
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x10024baf
push 0xbd2
push ecx
xor cl, cl
call fcn.10024c03
pop ecx
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10024da3
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061ead
call fcn.10060f20
sub esp, 0x2c
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], cl
je 0x10024eaa
test cl, cl
je 0x10024e87
mov dword [ebp - 0x24], 0x5290
xor esi, esi
cmp dword [ebp - 0x24], 0x53af
jle 0x10024e42
push 0x1a3d
push esi
push esi
call dword [sym.imp.KERNEL32.dll_lstrcpynW]
mov edi, esi
mov dword [ebp - 0x20], esi
mov dword [ebp + 0x14], edi
mov dword [ebp - 0x1c], 0x5a00
mov ebx, esi
mov edi, esi
mov dword [ebp - 0x18], 0x156f
mov esi, dword [ebp + 0x14]
mov eax, esi
mov ecx, 0x1007cc18
xor eax, edi
cdq
push edx
push eax
call fcn.10013d0a
add edi, ebx
dec dword [ebp - 0x18]
jne 0x10024e07
inc ebx
push 0
pop esi
cmp ebx, 0x10c7
jl 0x10024dfb
dec dword [ebp + 0x14]
dec dword [ebp - 0x1c]
jne 0x10024df9
mov edi, dword [ebp - 0x20]
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0xca0
jl 0x10024def
mov eax, dword [ebp + 0x20]
mov eax, dword [eax]
push eax
mov edx, dword [eax]
call dword [edx + 8]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x24], 0x5197
jge 0x10024e68
mov edx, str.dwhfk_fkuapqirz_gocxvbzzg
mov ecx, 0x1007cc18
call fcn.1001875a
jmp 0x10024f60
cmp byte [edx], 0
je 0x10024f60
push 1
push 0x563c
push ecx
push 0x161c
call fcn.100240e0
add esp, 0x10
jmp 0x10024f60
cmp byte [ebp + 0x1c], 0
je 0x10024f3d
mov edi, dword [ebp + 0xc]
xor esi, esi
mov dword [edi], esi
jmp 0x10024f36
push 1
lea ecx, [ebp - 0x34]
call fcn.100021e9
mov dword [ebp - 4], 2
lea eax, [ebp - 0x28]
push esi
mov dword [ebp + 0x14], 0x307b5ca9
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x20], esi
push eax
call fcn.100240a3
pop ecx
pop ecx
mov dword [ebp + 0x14], esi
jmp 0x10024f23
mov edx, dword [ebp + 0x18]
lea eax, [ebp - 0x20]
push eax
push esi
push edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 0x1c], 0x7b80be39
push eax
lea eax, [ebp - 0x18]
mov dword [ebp - 0x18], 0xffffffff
push eax
lea eax, [ebp + 0x14]
mov ecx, 0x3f68
push eax
lea eax, [ebp - 0x34]
push eax
call fcn.100247d9
add esp, 0x1c
inc dword [ebp + 0x14]
cmp dword [ebp + 0x14], esi
jle 0x10024eec
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
call fcn.10002246
inc dword [edi]
cmp dword [edi], 3
jge 0x10024ebd
jmp 0x10024f60
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10024f60
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffff9
inc dword [edx]
cmp dword [edx], 2
jl 0x10024f4e
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002d6e9
Capabilities:
Encode data using xor
Get common file path

Disassembly:
mov eax, 0x100623a4
call fcn.10060f20
sub esp, 0x4c
push ebx
push esi
mov dword [ebp - 0x14], 0x274b
xor esi, esi
cmp dword [ebp - 0x14], 0x2805
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edx
jle 0x1002d749
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x18], esi
mov eax, esi
mov ecx, 0x1007cc18
xor eax, ebx
xor eax, edi
cdq
push edx
push eax
call fcn.10013d0a
inc esi
cmp esi, 0x565d
jl 0x1002d718
inc ebx
push 0
pop esi
cmp ebx, 0x65c
jl 0x1002d715
inc edi
cmp edi, 0x7d7
jl 0x1002d713
mov dword [ebp - 4], esi
cmp dword [ebp - 0x14], 0x269d
jge 0x1002d764
mov edx, str.ldsxjrkw_ylbgojic_bldjdonc
mov ecx, 0x1007cc18
call fcn.1001875a
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0xc], 0
je 0x1002d903
mov dword [ebp - 0x14], 0x681c
cmp dword [ebp - 0x14], 0x6bd3
jle 0x1002d7d9
push esi
push 0x482
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov edi, esi
mov ebx, esi
mov eax, edi
lea ecx, [ebp - 0x40]
cdq
idiv ebx
mov eax, edx
cdq
push edx
push eax
call fcn.10002bac
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002d7ae
mov eax, dword [eax]
push eax
call fcn.1004a753
pop ecx
push esi
push 1
lea ecx, [ebp - 0x40]
call fcn.10014850
inc ebx
cmp ebx, 0x3632
jl 0x1002d792
inc edi
cmp edi, 0x5612
jl 0x1002d790
push esi
call dword [sym.imp.KERNEL32.dll_InitializeSListHead]
cmp dword [ebp - 0x14], 0x66b3
jge 0x1002d7ed
push str.zqs_czeu_edbhhmnc
call fcn.1004a753
pop ecx
mov ecx, dword [ebp + 8]
mov ebx, esi
or dword [ebp - 4], 0xffffffff
push 0x18
pop edi
mov eax, dword [ecx + 4]
sub eax, dword [ecx]
cdq
idiv edi
mov dword [ebp - 0x18], eax
test eax, eax
jle 0x1002d908
mov edi, esi
mov edx, dword [ecx]
mov ecx, dword [ebp + 0x14]
add edx, edi
call fcn.1002c505
test al, al
je 0x1002d85f
mov eax, dword [ebp - 0x1c]
sub esp, 0x18
mov ecx, esp
mov eax, dword [eax]
add eax, edi
push eax
call fcn.10013e1f
lea ecx, [ebp - 0x28]
call fcn.1002b81d
add esp, 0x18
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], 4
call fcn.1002d670
test eax, eax
je 0x1002d896
cmp eax, 2
je 0x1002d896
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.10027199
inc ebx
add edi, 0x18
cmp ebx, dword [ebp - 0x18]
jge 0x1002d908
mov ecx, dword [ebp + 8]
jmp 0x1002d80e
mov dword [ebp - 0x18], 0x3e5f
cmp dword [ebp - 0x18], 0x3ed7
jle 0x1002d8f9
push 0xbb5
push esi
push esi
push 0x1fa5
call dword [sym.imp.USER32.dll_MessageBoxW]
mov edi, esi
mov ebx, esi
mov eax, ebx
lea ecx, [ebp - 0x58]
xor eax, edi
cdq
push edx
push eax
call fcn.10002bac
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002d8d5
mov eax, dword [eax]
push eax
call fcn.1004a753
pop ecx
push esi
push 1
lea ecx, [ebp - 0x58]
call fcn.10014850
inc ebx
cmp ebx, 0x2add
jl 0x1002d8bc
inc edi
cmp edi, 0x38e6
jl 0x1002d8ba
lea ecx, [ebp - 0x28]
call fcn.10027199
jmp 0x1002d908
mov eax, dword [ebp + 0x10]
mov dword [eax], esi
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret