joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100285d1
Capabilities:
Clear file content

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
mov ebx, dword [ebp + 8]
lea ecx, [ebp - 0x2c]
push esi
push edi
push dword [ebp + 0x10]
mov edi, dword [ebp + 0x14]
push dword [ebp + 0xc]
push ebx
call fcn.1002854d
mov eax, dword [ebp - 0x2c]
and eax, dword [ebp - 0x28]
cmp eax, 0xffffffff
je 0x10028740
mov eax, dword [ebp - 0x24]
and eax, dword [ebp - 0x20]
cmp eax, 0xffffffff
je 0x10028740
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 8], ecx
mov dword [ebp - 4], eax
test ecx, ecx
jl 0x100286f5
jg 0x1002862d
test eax, eax
je 0x100286eb
push 1
push 0x1000
call fcn.1001ce63
mov esi, eax
pop ecx
pop ecx
test esi, esi
jne 0x10028650
push 0xc
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x100286e2
push 0x8000
push ebx
call fcn.1002847e
pop ecx
pop ecx
mov ecx, dword [ebp - 0x1c]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x18]
test eax, eax
jl 0x10028679
jg 0x10028674
cmp ecx, 0x1000
jb 0x10028679
mov ecx, 0x1000
push edi
push ecx
push esi
push ebx
call fcn.1001ef0d
add esp, 0x10
cmp eax, 0xffffffff
je 0x100286be
mov ecx, dword [ebp - 4]
cdq
sub ecx, eax
mov eax, dword [ebp - 8]
mov dword [ebp - 4], ecx
sbb eax, edx
mov dword [ebp - 8], eax
test eax, eax
jg 0x10028674
jl 0x100286a5
test ecx, ecx
jne 0x10028666
push dword [ebp - 0xc]
push ebx
call fcn.1002847e
push esi
call fcn.10019292
add esp, 0xc
xor ebx, ebx
jmp 0x1002874e
cmp byte [edi + 0x24], 0
je 0x100286d5
cmp dword [edi + 0x20], 5
jne 0x100286d5
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], 0xd
cmp byte [edi + 0x1c], 0
je 0x100286e0
mov ebx, dword [edi + 0x18]
jmp 0x100286e2
xor ebx, ebx
push esi
call fcn.10019292
pop ecx
jmp 0x1002874e
test ecx, ecx
jg 0x100286b7
jl 0x100286f5
test eax, eax
jae 0x100286b7
push 0
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push ebx
call fcn.1001f44e
and eax, edx
add esp, 0x10
cmp eax, 0xffffffff
jne 0x10028715
cmp byte [edi + 0x1c], 0
je 0x100286b7
jmp 0x10028746
push ebx
call fcn.1002617d
pop ecx
push eax
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
test eax, eax
jne 0x100286b7
call dword [sym.imp.KERNEL32.dll_GetLastError]
push 0xd
mov byte [edi + 0x24], 1
mov dword [edi + 0x20], eax
pop ebx
mov byte [edi + 0x1c], 1
mov dword [edi + 0x18], ebx
jmp 0x1002874e
cmp byte [edi + 0x1c], 0
je 0x1002874b
mov ebx, dword [edi + 0x18]
jmp 0x1002874e
push 0x16
pop ebx
push 0
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push dword [ebp - 0x14]
call fcn.1001f44e
add esp, 0x10
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10029db0
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x10029ddd
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x10029ddd
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret
Function at 0x419a20
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.IaDsgWGk
lea edi, [esi - 0x10000]
push edi
or ebp, 0xffffffff
jmp 0x419a42
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x419a49
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x419a38
mov eax, 1
add ebx, ebx
jne 0x419a5b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x419a50
jne 0x419a6c
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419a50
xor ecx, ecx
sub eax, 3
jb 0x419a80
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x419af2
mov ebp, eax
add ebx, ebx
jne 0x419a8b
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x419a98
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x419abc
inc ecx
add ebx, ebx
jne 0x419aa8
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x419a9d
jne 0x419ab9
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x419a9d
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x419adc
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x419acd
jmp 0x419a3e
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x419adc
add edi, ecx
jmp 0x419a3e
pop esi
lea edi, [esi + 0x17000]
mov eax, dword [edi]
or eax, eax
je 0x419b44
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x199f4]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x19a74]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x419af9
mov ecx, edi
jns 0x419b28
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x19a7c]
or eax, eax
je 0x419b3e
mov dword [ebx], eax
add ebx, 4
jmp 0x419b16
call dword [esi + 0x19a78]
mov ebp, dword [esi + 0x19a80]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1f7]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x419b78
sub esp, 0xffffff80
jmp section.VHqxTUpa

Function at 0x433000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43300c
nop
pop eax
nop
nop
nop
nop
add eax, 0x40a063
nop
nop
sub eax, 0x40a009
mov ebx, dword [eax]
nop
nop
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
nop
mov edx, dword [eax + 8]
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
nop
nop
nop
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
jl 0x433030
nop
nop
add eax, 0xc
nop
nop
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43301e
nop
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x10015b2e
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10064106
call fcn.10063468
sub esp, 0x18
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], ebx
je 0x10015b69
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x10015c22
xor dl, dl
mov ecx, 0x63cb
call fcn.10016950
jmp 0x10015c22
mov dword [ebp - 0x1c], 0x58f6
cmp dword [ebp - 0x1c], 0x5aaf
jle 0x10015be2
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x14], edi
mov ecx, edi
mov dword [ebp - 0x24], esi
xor ebx, ebx
shl esi, cl
xor edi, edi
mov eax, edi
mov ecx, 0x10080838
xor eax, ebx
or eax, esi
cdq
push edx
push eax
call fcn.10010b40
inc edi
cmp edi, 0x29d6
jl 0x10015b8e
inc ebx
cmp ebx, 0x5195
jl 0x10015b8c
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x7acd
jl 0x10015b83
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x6acd
jl 0x10015b7e
push 1
push 0
push 1
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov ebx, dword [ebp - 0x20]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x582e
jge 0x10015c1d
mov edx, str.hrtxp_vporu_frj_doyu_oihaaiwyi_zsmbkud_oxpszlc_nrbij_ojyc
mov ecx, 0x10080838
call fcn.10013913
jmp 0x10015c1d
xor eax, eax
mov word [ebx], ax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100161fd
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006412c
call fcn.10063468
sub esp, 0x30
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x100162bd
mov dword [ebp - 0x1c], 0x338
cmp dword [ebp - 0x1c], 0x3e2
jle 0x1001626e
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
and dword [ebp - 0x20], 0
mov ebx, edi
and ebx, esi
mov esi, dword [ebp - 0x20]
mov eax, ebx
mov ecx, 0x10080838
xor eax, esi
cdq
push edx
push eax
call fcn.10010b40
inc esi
cmp esi, 0x620e
jl 0x1001623c
mov esi, dword [ebp - 0x18]
inc edi
cmp edi, 0x2bae
jl 0x10016231
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x397f
jl 0x1001622f
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x2e6
jge 0x1001628a
mov edx, str.nytbghg_lciaeh_mrdwwzt_mwgjxz_qnzwyxvye_jdwzxmh_hpwo_swvgmldia_rjbqppi_jygjepw_pxu_iye_bjkjw
mov ecx, 0x10080838
call fcn.10013913
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x20]
mov ecx, dword [ebp + 0x10]
and dword [ebp - 0x20], 0
push eax
call fcn.1001936b
jmp 0x1001633d
mov dword [ebp - 0x1c], 0xe5c
cmp dword [ebp - 0x1c], 0x11c7
jle 0x10016321
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, edi
cdq
idiv ebx
mov eax, esi
mov ecx, edx
shl eax, cl
lea ecx, [ebp - 0x38]
cdq
push edx
push eax
call fcn.10002a87
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100162f3
mov eax, dword [eax]
push eax
call fcn.1004e245
pop ecx
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.10011503
inc ebx
cmp ebx, 0x61ff
jl 0x100162d3
inc edi
cmp edi, 0x7040
jl 0x100162d1
inc esi
cmp esi, 0x374d
jl 0x100162cf
cmp dword [ebp - 0x1c], 0xbed
mov ecx, dword [ebp + 8]
mov eax, dword [ecx]
mov dword [ecx + 4], eax
jge 0x1001633d
push str.mkqyqqjw_tkymy_thglxlqd_ncgcsrufy_rhjrcje_akpsxxft_pvz_dveomwepi
call fcn.1004e245
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001634e
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10064136
call fcn.10063468
sub esp, 0x28
cmp byte [ebp + 0x1c], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], edx
mov byte [ebp - 0x14], cl
je 0x10016469
mov dword [ebp - 0x24], 0x8ff
cmp dword [ebp - 0x24], 0xac5
jle 0x100163db
xor esi, esi
mov dword [ebp - 0x20], esi
xor edi, edi
mov dword [ebp - 0x1c], edi
mov ecx, edi
mov dword [ebp - 0x28], esi
xor ebx, ebx
shl esi, cl
xor edi, edi
lea eax, [edi + ebx]
mov ecx, 0x10080838
and eax, esi
cdq
push edx
push eax
call fcn.10010b40
inc edi
cmp edi, 0x68b6
jl 0x10016396
inc ebx
cmp ebx, 0x5457
jl 0x10016394
mov edi, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x3651
jl 0x1001638b
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x5913
jl 0x10016386
mov edx, dword [ebp - 0x2c]
cmp byte [ebp - 0x14], 0
je 0x10016402
mov eax, dword [ebp + 8]
lea esi, [ebp + 0x1f]
push esi
mov byte [ebp + 0x1f], 0
mov ecx, dword [eax]
mov eax, dword [edx]
push ecx
push eax
mov dword [edx + 4], eax
mov ecx, edx
lea eax, [ebp - 0x30]
push eax
call fcn.1001a058
jmp 0x10016422
mov edx, dword [ebp + 0x14]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x10016422
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
or dword [eax + ecx*4], 0xffffffff
inc dword [edx]
cmp dword [edx], 1
jl 0x10016413
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x7e3
jge 0x1001643e
mov edx, str.rvbvmc_lfdqm_yzpm_yowdwsbiq
mov ecx, 0x10080838
call fcn.10013913
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
cmp byte [ebp + 0x10], 0
je 0x100164af
push 0x4b1
push 0x2d3a
push 0x269e
push 0x859
push 0x230d
push 0xa9f
lea eax, [ebp - 0x15]
mov byte [ebp - 0x15], 0
push eax
push 0x1dcf
push 1
push 0x3389
xor dl, dl
xor cl, cl
call fcn.1001516c
add esp, 0x28
jmp 0x1001643e
mov dword [ebp - 0x24], 0x35ff
cmp dword [ebp - 0x24], 0x38a4
jle 0x100164f3
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x10080838
xor eax, edi
or eax, esi
cdq
push edx
push eax
call fcn.10010b40
inc ebx
cmp ebx, 0x4f3a
jl 0x100164c5
inc edi
cmp edi, 0x37f3
jl 0x100164c3
inc esi
cmp esi, 0x1bcf
jl 0x100164c1
mov eax, dword [ebp + 0xc]
and dword [eax], 0
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0x3368
jge 0x1001643e
mov edx, str.bkh_bapnh_qgqbro_gozofe_cvf
mov ecx, 0x10080838
call fcn.10013913
jmp 0x1001643e
Function at 0x1001dcc8
Capabilities:
Clear file content

Disassembly:
mov eax, 0x10064526
call fcn.10063468
sub esp, 0x18
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], esi
je 0x1001dd03
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x1001ddb3
mov edx, 0x3816
call fcn.1001ecde
jmp 0x1001ddb3
mov dword [ebp - 0x1c], 0x283b
cmp dword [ebp - 0x1c], 0x2995
jle 0x1001dd58
xor edi, edi
mov dword [ebp - 0x18], edi
xor ebx, ebx
lea esi, [ebx + edi]
mov edi, 0x323a
mov eax, esi
mov ecx, 0x10080838
cdq
push edx
push eax
call fcn.10010b40
dec esi
dec edi
jne 0x1001dd22
mov edi, dword [ebp - 0x18]
inc ebx
cmp ebx, 0x37e7
jl 0x1001dd1a
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0xfe6
jl 0x1001dd18
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
mov esi, dword [ebp - 0x20]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x2559
jge 0x1001dd93
mov edx, str.jlye_wzljvfdtk_barybvzzh_lori_lfjbqxbgq_ddblmph_dpojh_gwdodog_uwer_pyshscm
mov ecx, 0x10080838
call fcn.10013913
jmp 0x1001dd93
mov dword [esi], 0
cmp dword [esi], 2
jge 0x1001ddb3
mov edx, dword [ebp + 8]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 3
inc dword [esi]
cmp dword [esi], 2
jl 0x1001dda1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10021017
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov dword [0x1009c154], ecx
inc edx
mov esi, 0x270
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
mov dword [edx*4 + 0x1009c154], ecx
inc edx
cmp edx, esi
jl 0x1002102c
mov dword [0x1009c150], esi
pop esi
pop ebp
ret 8

Function at 0x10021052
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x1009c154
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x1009c4e0
jl 0x10021060
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x1009c784
jl 0x100210a0
mov ecx, dword [0x1009d4d0]
xor ecx, dword [0x1009c154]
and ecx, edi
xor ecx, dword [0x1009d4d0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x1009c150], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x1009c784]
mov dword [0x1009cb10], eax
pop esi
ret
Function at 0x10024b0c
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x100649dd
call fcn.10063468
sub esp, 0x38
push ebx
push esi
mov dword [ebp - 0x20], 0x540
xor esi, esi
cmp dword [ebp - 0x20], 0x7a1
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edx
jle 0x10024b96
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], 0x5c2
mov edi, dword [ebp - 0x14]
mov ebx, esi
mov ecx, ebx
mov dword [ebp - 0x28], edi
mov dword [ebp - 0x2c], esi
shl edi, cl
mov eax, edi
mov ecx, 0x10080838
and eax, esi
cdq
push edx
push eax
call fcn.10010b40
inc esi
cmp esi, 0x61b5
jl 0x10024b50
mov edi, dword [ebp - 0x14]
inc ebx
push 0
pop esi
cmp ebx, 0x6b08
jl 0x10024b46
mov edi, dword [ebp - 0x1c]
add dword [ebp - 0x14], edi
dec dword [ebp - 0x18]
jne 0x10024b41
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x741b
jl 0x10024b37
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x20], 0x399
jge 0x10024bb1
mov edx, str.bypgpl_mvdyyydx_mmzan_efemuiyot_wurrombi
mov ecx, 0x10080838
call fcn.10013913
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0xc], 0
je 0x10024c0c
push ecx
mov edx, 0x4096
lea ecx, [ebp - 0x44]
call fcn.1001bfd3
push ecx
mov ecx, dword [ebp + 0x1c]
push eax
mov dword [ebp - 4], 2
call fcn.1001dc3d
push esi
push 1
lea ecx, [ebp - 0x44]
call fcn.10011831
jmp 0x10024c9e
mov edi, dword [ebp + 0x10]
xor ecx, ecx
mov eax, dword [edi]
mov eax, dword [edi]
test eax, eax
setne cl
cmp ecx, 1
mov ecx, dword [edi]
sbb eax, eax
xor edx, edx
neg eax
imul ecx, eax
mov eax, dword [ebp + 0x20]
mov dword [eax], ecx
mov ecx, dword [eax]
mov eax, dword [edi]
cmp ecx, eax
setle dl
cmp edx, dword [edi]
mov edx, dword [ebp - 0x24]
jl 0x10024c47
mov eax, dword [edx]
cmp dword [eax], esi
jne 0x10024c47
cmp dword [edi], esi
je 0x10024c4a
xor esi, esi
inc esi
mov eax, dword [ebp + 0x14]
xor ecx, ecx
mov eax, dword [eax]
mov dword [eax], esi
mov eax, dword [edi]
mov eax, dword [edi]
mov esi, dword [ebp + 0x2c]
mov eax, dword [esi]
mov eax, dword [edx]
cmp dword [eax], 1
sete cl
imul eax, ecx, 0xc6eb
xor ecx, ecx
mov dword [esi], eax
mov eax, dword [edx]
mov edx, dword [eax]
mov eax, dword [esi]
cmp eax, 4
mov eax, dword [edi]
setne cl
xor ebx, ebx
cmp ecx, edx
setl bl
sub ebx, edx
neg ebx
sbb ebx, ebx
add ebx, 3
neg ebx
sbb ebx, ebx
inc ebx
add eax, ebx
imul ecx, eax, 0xf01c
mov eax, dword [ebp + 0x28]
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10025caa
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
cmp byte [ebp + 0x2c], 0
push ebx
push esi
mov ebx, ecx
push edi
mov dword [esp + 0x14], ebx
je 0x10025d12
mov edi, dword [ebp + 0x28]
mov ecx, dword [edi + 4]
cmp dword [edi], ecx
je 0x10025dcf
mov ebx, dword [ebp + 0x24]
push 0x18
pop esi
sub ecx, dword [edi]
mov eax, dword [ebx + 4]
sub eax, dword [ebx]
cdq
idiv esi
push 0x18
mov esi, eax
mov eax, ecx
cdq
pop ecx
idiv ecx
cmp eax, esi
jne 0x10025dcf
push dword [ebp + 0x20]
mov edx, 0x33b3
push 1
push edi
push 0x35a1
push ecx
mov ecx, ebx
call fcn.10025a7b
add esp, 0x14
jmp 0x10025dcf
mov dword [esp + 0x10], 0x7d82
cmp dword [esp + 0x10], 0x7ef6
jle 0x10025d8a
push 0x77e
push 0
push 0x96
call dword [sym.imp.USER32.dll_GetWindowTextW]
xor esi, esi
xor edi, edi
xor ebx, ebx
lea eax, [ebx + edi]
and eax, esi
lea ecx, [esp + 0x18]
cdq
push edx
push eax
call fcn.10002a87
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10025d57
mov eax, dword [eax]
push eax
call fcn.1004e245
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.10011503
inc ebx
cmp ebx, 0x6b23
jl 0x10025d3c
inc edi
cmp edi, 0x16d9
jl 0x10025d3a
inc esi
cmp esi, 0x3d4e
jl 0x10025d38
mov ebx, dword [esp + 0x14]
cmp dword [esp + 0x10], 0x7aab
jge 0x10025d9f
push str.swujgnj_ykocflql_nmkri_tfhrs_sfhwjsk_ewlitx_gsrpl_uhllui_vcqtc_drxmmf
call fcn.1004e245
pop ecx
mov eax, dword [ebp + 0x14]
xor ecx, ecx
mov edx, dword [ebp + 0x18]
mov eax, dword [eax]
mov eax, dword [edx]
cmp eax, 0xaf849fb9
sete cl
mov dword [ebx], ecx
mov eax, dword [ebx]
mov eax, dword [edx]
mov ecx, dword [ebp + 0x1c]
mov eax, dword [edx]
mov eax, dword [ecx]
mov eax, dword [ebx]
mov eax, dword [ecx]
imul ecx, dword [ebx], 0xc5bf
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10025dd6
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x10064aa2
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x84
push ebx
push esi
push ecx
mov edx, 0x40f6
lea ecx, [esp + 0x40]
call fcn.1001bfd3
pop ecx
xor esi, esi
lea ecx, [esp + 0x6c]
push eax
mov dword [esp + 0x98], esi
call fcn.1001c080
xor ebx, ebx
mov byte [esp + 0x94], 2
push esi
inc ebx
lea ecx, [esp + 0x40]
push ebx
call fcn.10011831
push 0x3716
push ebx
lea eax, [esp + 0x74]
mov dl, bl
push eax
push 0x2eab
push ebx
push 0x6fab
mov ecx, 0x36f5
call fcn.100256dc
add esp, 0x14
lea ecx, [esp + 0x28]
mov edx, 0x400e
call fcn.1001bfd3
mov edx, 0x400f
mov byte [esp + 0x98], 3
lea ecx, [esp + 0x40]
call fcn.1001bfd3
pop ecx
mov edx, eax
mov byte [esp + 0x94], 4
lea ecx, [esp + 0x18]
call fcn.1002253b
push esi
push ebx
lea ecx, [esp + 0x44]
mov byte [esp + 0x9c], 6
call fcn.10011831
push ecx
mov edx, 0x4010
lea ecx, [esp + 0x58]
call fcn.1001bfd3
pop ecx
mov edx, eax
mov byte [esp + 0x94], 7
lea ecx, [esp + 0xc]
call fcn.1002253b
push esi
push ebx
lea ecx, [esp + 0x5c]
mov byte [esp + 0x9c], 9
call fcn.10011831
push ebx
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x14]
push eax
lea eax, [esp + 0x30]
push eax
push 0x39a3
push 0x12fe
push 0x2675
push ecx
push 0x259
push ecx
mov ecx, 0x2db9
call fcn.10025caa
add esp, 0x28
lea ecx, [esp + 0xc]
call fcn.1002652c
lea ecx, [esp + 0x18]
call fcn.1002652c
push esi
push ebx
lea ecx, [esp + 0x2c]
call fcn.10011831
or dword [esp + 0x94], 0xffffffff
lea ecx, [esp + 0x6c]
call fcn.1001daa8
mov ecx, dword [esp + 0x8c]
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002825e
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10064b63
call fcn.10063468
sub esp, 0x18
push ebx
push esi
push edi
mov byte [ebp - 0x14], dl
xor edi, edi
mov dword [ebp - 0x24], 0x3ad4
cmp dword [ebp - 0x24], 0x3c46
mov dword [ebp - 0x10], esp
jle 0x100282e6
push edi
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_EnumCalendarInfoW]
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], 0x7c19
mov ebx, edi
mov esi, edi
mov edi, dword [ebp - 0x18]
mov eax, ebx
mov ecx, 0x10080838
cdq
idiv esi
xor edx, edi
mov eax, edx
cdq
push edx
push eax
call fcn.10010b40
inc esi
cmp esi, 0x6263
jl 0x100282a4
inc ebx
push 0
pop edi
cmp ebx, 0x5b66
jl 0x1002829f
mov esi, dword [ebp - 0x20]
add dword [ebp - 0x18], esi
dec dword [ebp - 0x1c]
jne 0x1002829d
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x1d07
jl 0x10028293
cmp byte [ebp - 0x14], 0
je 0x100282f9
push 0x39d
call dword [sym.imp.USER32.dll_DrawMenuBar]
jmp 0x10028354
mov ebx, dword [ebp + 0xc]
xor edx, edx
mov ecx, dword [ebp + 0x18]
mov eax, dword [ebx]
mov eax, dword [ecx]
mov esi, eax
cmp dword [eax], 0xf851
mov eax, dword [ebx]
setg dl
xor ecx, ecx
add eax, edx
cmp dword [esi], eax
setge cl
xor eax, eax
cmp ecx, 0x5f885928
setne al
xor ecx, ecx
cmp eax, 1
setle cl
xor edx, edx
cmp ecx, 0xc74b
setne dl
mov dword [esi], edx
mov eax, dword [ebx]
add eax, 3
add eax, edx
je 0x10028346
mov eax, dword [ebx]
mov eax, dword [ebx]
xor edx, edx
cmp eax, 0x6406
setl dl
mov dword [ebx], edx
mov dword [ebp - 4], edi
cmp dword [ebp - 0x24], 0x3a4a
jge 0x1002836f
mov edx, str.xkmofok_eih_gpo_nhqpbipg_mnzrazano_vehcjl_ketapvz_fde
mov ecx, 0x10080838
call fcn.10013913
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002a9c2
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10064bf1
call fcn.10063468
sub esp, 0x14
push ebx
push esi
mov dword [ebp - 0x1c], 0x6d38
cmp dword [ebp - 0x1c], 0x6e99
push edi
mov dword [ebp - 0x10], esp
jle 0x1002aa40
xor edi, edi
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x14], 0x4a89
mov eax, esi
mov ecx, 0x10080838
and eax, ebx
xor eax, edi
cdq
push edx
push eax
call fcn.10010b40
dec esi
dec dword [ebp - 0x14]
jne 0x1002a9f8
mov esi, dword [ebp - 0x18]
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x5a62
jl 0x1002a9ee
inc ebx
cmp ebx, 0x7782
jl 0x1002a9e9
inc edi
cmp edi, 0x310f
jl 0x1002a9e7
push 1
push 0
push 1
push 0
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x699f
jge 0x1002aa5c
mov edx, str.czic_grrz_nby_pkov_orhojmck_yeg_ieqwtp_jdeic_sarrpgv_vrstx_paysynuo_gtiglgog_ffzgggxwy
mov ecx, 0x10080838
call fcn.10013913
cmp byte [ebp + 0x20], 0
je 0x1002aaf2
mov edi, dword [ebp + 0x10]
xor edx, edx
mov ecx, dword [ebp + 0x30]
mov ebx, 0xc5440874
mov esi, dword [ebp + 0x1c]
mov eax, dword [edi]
mov dword [ecx], eax
mov eax, dword [ebp + 0x2c]
mov dword [eax], ebx
mov eax, dword [edi]
test eax, eax
mov eax, dword [esi]
sete dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esi]
setg cl
xor edx, edx
cmp ecx, ebx
setle dl
xor ebx, ebx
cmp edx, eax
mov eax, dword [edi]
mov edx, dword [esi]
setne bl
xor ecx, ecx
cmp ebx, eax
mov eax, dword [ebp + 0xc]
setge cl
add ecx, 0x3ec58f55
cmp ecx, 5
sbb ecx, ecx
xor ebx, ebx
neg ecx
add edx, ecx
mov ecx, dword [eax]
mov eax, dword [ebp + 0x30]
mov eax, dword [eax]
cmp ecx, eax
mov eax, dword [ebp + 0x24]
setg bl
sub ebx, edx
neg ebx
sbb ebx, ebx
inc ebx
mov dword [eax], ebx
jmp 0x1002ab15
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1002ab15
mov esi, dword [ebp + 0x28]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x653b1dab
inc dword [edx]
cmp dword [edx], 2
jl 0x1002ab03
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret