joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000650f
Capabilities:
Terminate process

Disassembly:
mov eax, 0x1005ae55
call fcn.1005a768
sub esp, 0x30
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], edi
je 0x1000668c
mov dword [ebp - 0x20], 0x1b32
xor esi, esi
cmp dword [ebp - 0x20], 0x1e0b
jle 0x100065af
mov ebx, esi
mov edi, esi
mov eax, esi
mov dword [ebp - 0x1c], esi
add eax, edi
lea ecx, [ebp - 0x38]
or eax, ebx
cdq
push edx
push eax
call fcn.10001a41
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10006565
mov eax, dword [eax]
push eax
call fcn.100425d6
pop ecx
push esi
push 1
lea ecx, [ebp - 0x38]
call fcn.10001f96
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x677
jl 0x1000654c
inc edi
cmp edi, 0x770b
jl 0x10006547
inc ebx
cmp ebx, 0x1493
jl 0x10006545
push esi
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_SetTextColor]
mov edi, dword [ebp - 0x18]
mov dword [ebp - 0x1c], 0x2237
cmp dword [ebp - 0x1c], 0x23bd
jle 0x1000660f
push esi
push 0x18fa
push 0x1e97
push esi
push 0x1263
push 0x25e7
push esi
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov ebx, esi
mov edi, esi
mov ecx, edi
mov eax, ebx
shl eax, cl
mov ecx, 0x10075b18
cdq
push edx
push eax
call fcn.10001b85
inc edi
cmp edi, 0xcf5
jl 0x100065e0
inc ebx
cmp ebx, 0x76e2
jl 0x100065de
push esi
call dword [sym.imp.GDI32.dll_CreateRectRgnIndirect]
mov edi, dword [ebp - 0x18]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x1c], 0x1f3a
jge 0x1000664b
mov edx, str.ftasq_lvkjixpfk_zdgdi_dhfi_qizqax_krs_tvjiip_wgxbuxf_pjbdkcc_yxd_flirodc
mov ecx, 0x10075b18
call fcn.100036dc
jmp 0x1000664b
mov dword [edi], esi
cmp dword [edi], 1
jge 0x10006667
mov edx, dword [ebp + 0x14]
mov ecx, dword [edi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0xd3df75dc
inc dword [edi]
cmp dword [edi], 1
jl 0x10006655
cmp dword [ebp - 0x20], 0x1aa4
jge 0x1000667b
push str.bawnfxc_mhh_ndui_ysw_cduzjvjra_daegbkjbo_jzjotzi_rkdzslt
call fcn.100425d6
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
push 0x1f63
call dword [sym.imp.KERNEL32.dll_ExitProcess]

Function at 0x10006cea
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov dword [0x10076d14], ecx
inc edx
mov esi, 0x270
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
mov dword [edx*4 + 0x10076d14], ecx
inc edx
cmp edx, esi
jl 0x10006cff
mov dword [0x10076d10], esi
pop esi
pop ebp
ret 8
Function at 0x10006d25
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x10076d14
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x100770a0
jl 0x10006d33
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x10077344
jl 0x10006d73
mov ecx, dword [0x10078090]
xor ecx, dword [0x10076d14]
and ecx, edi
xor ecx, dword [0x10078090]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x10076d10], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10077344]
mov dword [0x100776d0], eax
pop esi
ret
Function at 0x10007b3c
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005aec9
call fcn.1005a768
sub esp, 0x14
push ebx
push esi
mov byte [ebp - 0x14], dl
mov esi, ecx
mov dword [ebp - 0x18], 0x472a
cmp dword [ebp - 0x18], 0x48e4
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
jle 0x10007b9d
xor edi, edi
xor ebx, ebx
xor esi, esi
lea eax, [esi + ebx]
mov ecx, 0x10075b18
xor eax, edi
cdq
push edx
push eax
call fcn.10001b85
inc esi
cmp esi, 0x7c81
jl 0x10007b6d
inc ebx
cmp ebx, 0x3a14
jl 0x10007b6b
inc edi
cmp edi, 0x5697
jl 0x10007b69
mov esi, dword [ebp - 0x1c]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x4496
jge 0x10007bd8
mov edx, str.hgixkgel_qrchtax_jhi_ljjqtyo_cpwezt
mov ecx, 0x10075b18
call fcn.100036dc
jmp 0x10007bd8
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x14], 0
je 0x10007c04
mov dword [esi], 0
cmp dword [esi], 4
jge 0x10007c14
mov edx, dword [ebp + 8]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0xffff
inc dword [esi]
cmp dword [esi], 4
jl 0x10007bf0
jmp 0x10007c14
mov ecx, dword [ebp + 0x10]
lea eax, [ebp - 0x20]
and dword [ebp - 0x20], 0
push eax
call fcn.1000a6fe
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10007e65
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005aed3
call fcn.1005a768
sub esp, 0x10
push ebx
push esi
mov dword [ebp - 0x14], 0x34a2
mov ebx, edx
cmp dword [ebp - 0x14], 0x3720
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ebx
jle 0x10007ec7
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, edi
mov ecx, 0x10075b18
cdq
idiv ebx
xor edx, esi
mov eax, edx
cdq
push edx
push eax
call fcn.10001b85
inc ebx
cmp ebx, 0x2573
jl 0x10007e93
inc edi
cmp edi, 0x4923
jl 0x10007e91
inc esi
cmp esi, 0x4ce6
jl 0x10007e8f
mov ebx, dword [ebp - 0x18]
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x3318
jge 0x10007f02
mov edx, str.oxeddlpwy_fvv_aqugpz_mmld_clgkk_ypatj_euhgtglt_eppvgcab_zbmnaq_pkaypyd
mov ecx, 0x10075b18
call fcn.100036dc
jmp 0x10007f02
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x14], 0
je 0x10007f16
mov eax, dword [ebx]
push eax
mov ecx, dword [eax]
call dword [ecx + 8]
jmp 0x10007f39
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10007f39
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x4b79a97a
inc dword [edx]
cmp dword [edx], 2
jl 0x10007f27
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000d8e7
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005b14c
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x24
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1000d9f5
lea eax, [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1000d932
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x1000d9f3
mov dword [ebp - 0x20], 0x4cc5
mov dword [ebp - 0x28], str.ulbuhmka_umstl_odhuhmzh_pexg_pck_vroyrau_yhaipaq_cgwext_omso_tesc
cmp dword [ebp - 0x20], 0x4df9
jle 0x1000d99d
call dword [sym.imp.KERNEL32.dll_GetOEMCP]
and dword [ebp - 0x18], 0
jmp 0x1000d95c
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1807
jge 0x1000d99d
and dword [ebp - 0x1c], 0
jmp 0x1000d972
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x6bf6
jge 0x1000d99b
mov eax, dword [ebp - 0x18]
imul eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
push dword [ebp - 0x30]
push dword [ebp - 0x34]
mov ecx, 0x10075b18
call fcn.10001b85
jmp 0x1000d96b
jmp 0x1000d955
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x1000d9b3
mov ecx, 0x1f63
call fcn.1000b27f
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x499a
jge 0x1000d9cd
mov edx, dword [ebp - 0x28]
mov ecx, 0x10075b18
call fcn.100036dc
jmp 0x1000d9e9
or dword [ebp - 4], 0xffffffff
jmp 0x1000d9f3
jmp 0x1000da0d
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x2c]
push 0x6691
push 0
call fcn.100117a2
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000eb4a
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
cmp dword [ebp + 8], 0xa
jle 0x1000eb5c
jmp 0x1000ed77
mov ecx, 0x10076c8c
call fcn.1001e85e
cmp eax, 4
jne 0x1000ed49
push 0x10076c8c
mov ecx, 0x10076c80
call fcn.1001e783
mov byte [ebp - 1], 1
push 0
mov ecx, 0x10076c80
call fcn.10001cdb
mov esi, eax
push 1
mov ecx, 0x10076c80
call fcn.10001cdb
mov ecx, dword [esi]
add ecx, dword [eax]
cmp ecx, dword [0x10076c60]
je 0x1000ebac
mov byte [ebp - 1], 0
push 2
mov ecx, 0x10076c80
call fcn.10001cdb
mov esi, eax
push 3
mov ecx, 0x10076c80
call fcn.10001cdb
mov ecx, dword [esi]
add ecx, dword [eax]
cmp ecx, dword [0x10076c5c]
je 0x1000ebd6
mov byte [ebp - 1], 0
push 0
mov ecx, 0x10076c80
call fcn.10001cdb
mov esi, eax
push 2
mov ecx, 0x10076c80
call fcn.10001cdb
mov ecx, dword [esi]
add ecx, dword [eax]
cmp ecx, dword [0x10076c6c]
je 0x1000ec00
mov byte [ebp - 1], 0
push 1
mov ecx, 0x10076c80
call fcn.10001cdb
mov esi, eax
push 3
mov ecx, 0x10076c80
call fcn.10001cdb
mov ecx, dword [esi]
add ecx, dword [eax]
cmp ecx, dword [0x10076c70]
je 0x1000ec2a
mov byte [ebp - 1], 0
push 0
mov ecx, 0x10076c80
call fcn.10001cdb
mov esi, eax
push 3
mov ecx, 0x10076c80
call fcn.10001cdb
mov ecx, dword [esi]
add ecx, dword [eax]
cmp ecx, dword [0x10076c68]
je 0x1000ec54
mov byte [ebp - 1], 0
push 1
mov ecx, 0x10076c80
call fcn.10001cdb
mov esi, eax
push 2
mov ecx, 0x10076c80
call fcn.10001cdb
mov ecx, dword [esi]
add ecx, dword [eax]
cmp ecx, dword [0x10076c64]
je 0x1000ec7e
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1000ed15
push 0x10020ce6
push 1
mov ecx, 0x10076c80
call fcn.10001cdb
push dword [eax]
push 0
mov ecx, 0x10076c80
call fcn.10001cdb
push dword [eax]
mov ecx, 0x10075b18
call fcn.1001e5e7
mov dl, 0x20
mov ecx, eax
call fcn.10020b30
mov ecx, eax
call fcn.1001e5e7
mov ecx, eax
call fcn.1001e5db
push 0x10020ce6
push 3
mov ecx, 0x10076c80
call fcn.10001cdb
push dword [eax]
push 2
mov ecx, 0x10076c80
call fcn.10001cdb
push dword [eax]
mov ecx, 0x10075b18
call fcn.1001e5e7
mov dl, 0x20
mov ecx, eax
call fcn.10020b30
mov ecx, eax
call fcn.1001e5e7
mov ecx, eax
call fcn.1001e5db
push 0
call fcn.10044b3f
lea eax, [ebp - 8]
push eax
mov ecx, 0x10076c80
call fcn.10001d34
push dword [eax]
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x10076c80
call fcn.10001d26
push dword [eax]
call fcn.10020d18
pop ecx
pop ecx
movzx eax, al
test eax, eax
jne 0x1000eb7e
jmp 0x1000ed77
mov eax, dword [ebp + 8]
inc eax
push eax
call fcn.1000eb4a
pop ecx
lea eax, [ebp + 8]
push eax
mov ecx, 0x10076c8c
call fcn.1001e867
mov eax, dword [ebp + 8]
inc eax
push eax
call fcn.1000eb4a
pop ecx
mov ecx, 0x10076c8c
call fcn.1001e8ba
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10021cb9
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x14], 0
je 0x10021ccc
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop ebp
ret
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov dword [eax], 0xf890
mov eax, dword [eax]
test eax, eax
mov eax, dword [ebp + 0x10]
setne cl
mov dword [eax], ecx
mov eax, dword [ebp + 0x18]
mov dword [eax], ecx
pop ebp
ret
Function at 0x10027221
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
je 0x1002735e
mov esi, dword [ebp + 8]
mov dword [esi], 0
jmp 0x10027353
mov dword [esp + 0x10], 0x9cd4
mov dword [esp + 0x1c], 0x59229a27
mov dword [esp + 0x18], 0x4202
cmp dword [esp + 0x18], 0x434c
jle 0x100272cd
xor edi, edi
mov dword [esp + 0x14], edi
xor ebx, ebx
mov ecx, ebx
mov dword [esp + 0x1c], edi
xor esi, esi
shl edi, cl
mov eax, edi
lea ecx, [esp + 0x20]
xor eax, esi
cdq
push edx
push eax
call fcn.10001a41
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10027293
mov eax, dword [eax]
push eax
call fcn.100425d6
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.10001f96
inc esi
cmp esi, 0x4e11
jl 0x10027279
mov edi, dword [esp + 0x14]
inc ebx
cmp ebx, 0x6918
jl 0x1002726f
inc edi
mov dword [esp + 0x14], edi
cmp edi, 0xa1
jl 0x1002726d
mov esi, dword [ebp + 8]
mov ecx, dword [esi]
xor edx, edx
mov eax, dword [esi]
cmp ecx, eax
mov eax, dword [esp + 0x10]
setl dl
imul eax, dword [esp + 0x10]
imul eax, edx
imul eax, eax, 0xe75c
test eax, eax
je 0x100272fa
cmp dword [esp + 0x10], 0
je 0x100272fa
xor eax, eax
inc eax
jmp 0x100272fc
xor eax, eax
mov ecx, dword [esi]
dec eax
xor edx, edx
cmp eax, ecx
setle dl
cmp edx, 7
sbb eax, eax
xor ecx, ecx
inc eax
test eax, eax
mov eax, 0xe2f7c629
setg cl
inc ecx
cmp eax, ecx
sbb eax, eax
neg eax
cmp eax, 0xfffffff8
sbb eax, eax
xor edx, edx
inc eax
cmp eax, 0xffffffff
mov eax, dword [esp + 0x10]
setle dl
xor ecx, ecx
cmp edx, eax
setge cl
mov dword [esp + 0x1c], ecx
cmp dword [esp + 0x18], 0x3e93
jge 0x10027351
push str.dojhcuhd_xayowyrf_qwlaqqkwo_cawkg
call fcn.100425d6
pop ecx
inc dword [esi]
cmp dword [esi], 6
je 0x10027245
jmp 0x10027366
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10027d21
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov byte [ebp - 4], cl
push esi
test cl, cl
je 0x10027d53
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x10027d60
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 8
inc dword [edx]
cmp dword [edx], 3
jl 0x10027d3f
jmp 0x10027d60
cmp byte [edx], 0
je 0x10027d60
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x100297bb
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005bc25
call fcn.1005a768
push ecx
push ecx
push ebx
push esi
mov dword [ebp - 0x14], 0x38fd
cmp dword [ebp - 0x14], 0x3b87
push edi
mov dword [ebp - 0x10], esp
jle 0x10029810
xor esi, esi
xor edi, edi
xor ebx, ebx
lea eax, [ebx + edi]
mov ecx, 0x10075b18
xor eax, esi
cdq
push edx
push eax
call fcn.10001b85
inc ebx
cmp ebx, 0x5401
jl 0x100297e3
inc edi
cmp edi, 0x471d
jl 0x100297e1
inc esi
cmp esi, 0x5443
jl 0x100297df
cmp byte [ebp + 0xc], 0
je 0x10029822
mov eax, dword [ebp + 0x24]
mov ecx, dword [eax]
mov eax, dword [ebp + 8]
add dword [eax], ecx
jmp 0x10029845
mov edx, dword [ebp + 0x28]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x10029845
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [edx]
cmp dword [edx], 3
jl 0x10029833
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x364e
jge 0x10029861
mov edx, str.gqnu_rkla_rhlrtzk_gjh_fpynvgu_ecyofra_tdhjptwd_gdu_bkbskn_mtldceyw
mov ecx, 0x10075b18
call fcn.100036dc
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10029dfd
Capabilities:
Get file attributes

Disassembly:
test dl, dl
je 0x10029e24
cmp byte [ecx], 0
je 0x10029e2c
push 0xb8f
push 0
push 0
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_PolyPolyline]
ret
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
ret
Function at 0x1002a2a4
Capabilities:
Log keystrokes via polling

Disassembly:
mov eax, 0x1005bc5d
call fcn.1005a768
sub esp, 0x38
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
je 0x1002a3d7
mov dword [ebp - 0x18], 0x6b3d
cmp dword [ebp - 0x18], 0x6cf4
jle 0x1002a325
push 0
call dword [sym.imp.USER32.dll_GetKeyboardState]
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
lea ecx, [ebp - 0x44]
xor eax, edi
xor eax, esi
cdq
push edx
push eax
call fcn.10001a41
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002a2f7
mov eax, dword [eax]
push eax
call fcn.100425d6
pop ecx
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.10001f96
inc ebx
cmp ebx, 0x4139
jl 0x1002a2dc
inc edi
cmp edi, 0x32be
jl 0x1002a2da
inc esi
cmp esi, 0x10fa
jl 0x1002a2d8
cmp dword [ebp - 0x18], 0x6ab7
jge 0x1002a339
push str.jlrty_jomgj_dpg_shwdd_ulmf_kmzryr_nztrkf_eickalnyp_dfbnzf
call fcn.100425d6
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x14], 5
mov dword [ebp - 0x14], 0
cmp dword [ebp - 0x14], 0xd
je 0x1002a3f3
push 2
pop esi
mov dword [ebp - 0x1c], 8
lea ecx, [ebp - 0x2c]
push esi
call fcn.10001c9a
mov dword [ebp - 4], esi
mov dword [ebp - 0x20], 0xdc6b79df
mov dword [ebp - 0x18], 0
jmp 0x1002a388
mov ecx, dword [ebp - 0x18]
mov eax, dword [ebp - 0x2c]
and dword [eax + ecx*4], 0
inc dword [ebp - 0x18]
cmp dword [ebp - 0x18], esi
jl 0x1002a37b
push 0x2c6
lea eax, [ebp - 0x2c]
push eax
lea eax, [ebp - 0x1c]
push eax
push 1
push ecx
lea eax, [ebp - 0x20]
push eax
push ecx
lea edx, [ebp - 0x14]
call fcn.100276eb
or dword [ebp - 4], 0xffffffff
add esp, 0x1c
cmp dword [ebp - 0x2c], 0
je 0x1002a3cc
push dword [ebp - 0x2c]
call fcn.10042747
and dword [ebp - 0x2c], 0
and dword [ebp - 0x28], 0
and dword [ebp - 0x24], 0
pop ecx
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 0xd
jne 0x1002a358
jmp 0x1002a3f3
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1002a3f3
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_GetDC]
push eax
call dword [sym.imp.GDI32.dll_GetBkColor]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002b3bc
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005bc85
call fcn.1005a768
sub esp, 0x1c
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov ebx, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], ebx
je 0x1002b3e5
mov eax, dword [ebp + 0xc]
add dword [eax], 0xfffffffe
jmp 0x1002b498
mov dword [ebp - 0x1c], 0x2284
cmp dword [ebp - 0x1c], 0x2440
jle 0x1002b44f
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x14], edi
mov ecx, edi
mov dword [ebp - 0x24], esi
xor ebx, ebx
sar esi, cl
xor edi, edi
lea eax, [edi + ebx]
mov ecx, 0x10075b18
xor eax, esi
cdq
push edx
push eax
call fcn.10001b85
inc edi
cmp edi, 0x3e47
jl 0x1002b40a
inc ebx
cmp ebx, 0x1aec
jl 0x1002b408
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x39af
jl 0x1002b3ff
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x4df9
jl 0x1002b3fa
mov ebx, dword [ebp - 0x20]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x222b
jge 0x1002b48a
mov edx, str.rchjuxa_xbs_heyjmyxn_fmzeocc_jgdveywfw_udjbpenor_cxqfwm
mov ecx, 0x10075b18
call fcn.100036dc
jmp 0x1002b48a
mov eax, dword [ebp + 0x14]
mov ecx, 0x295a5277
mov eax, dword [eax]
mov dword [eax], ecx
mov dword [ebx], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003691e
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x48
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x100369f3
mov eax, dword [ebp + 8]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x28], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x100369a6
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [eax], 0
jmp 0x10036974
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0xc]
mov dword [ecx], eax
mov eax, dword [ebp - 0xc]
cmp dword [eax], 0x19
jne 0x100369a4
mov byte [ebp - 1], 0
push 0
lea eax, [ebp - 1]
push eax
push 0x28fd
push 0x5ea2
push 0x3f91
push 0x1330
call fcn.1003a4d7
add esp, 0x18
jmp 0x10036969
jmp 0x100369ee
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x100369d4
mov eax, dword [ebp - 8]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 3
jge 0x100369ee
mov eax, dword [ebp - 8]
push dword [eax]
mov ecx, dword [ebp - 0x34]
call fcn.10001cdb
or dword [eax], 0xffffffff
jmp 0x100369c9
jmp 0x10036a8a
lea eax, [ebp + 0x20]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x10036a7d
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [eax], 0
jmp 0x10036a3d
mov eax, dword [ebp - 0x10]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x10]
mov dword [ecx], eax
mov eax, dword [ebp - 0x10]
cmp dword [eax], 0
jg 0x10036a7b
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x10036a5b
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 0
jl 0x10036a79
mov byte [ebp - 2], 0
movzx eax, byte [ebp - 2]
test eax, eax
je 0x10036a77
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesA]
jmp 0x10036a50
jmp 0x10036a32
jmp 0x10036a8a
call dword [sym.imp.USER32.dll_GetDesktopWindow]
push eax
call dword [sym.imp.USER32.dll_DrawMenuBar]
mov esp, ebp
pop ebp
ret
Function at 0x401180
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
mov esi, edx
mov eax, dword [esi]
mov dword [esi + 4], eax
test ecx, ecx
jne 0x401199
xor al, al
pop esi
mov esp, ebp
pop ebp
ret
push edi
push 0
push 0x80
push 3
push 0
push 5
push 0x120089
push ecx
mov dword [ebp - 4], 0
mov dword [esi + 4], eax
call dword [sym.imp.KERNEL32.dll_CreateFileW]
mov edi, eax
cmp edi, 0xffffffff
je 0x401206
lea eax, [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSizeEx]
test eax, eax
je 0x4011ff
push ebx
mov ebx, dword [ebp - 0xc]
mov ecx, esi
push esi
push ebx
call fcn.00401830
push 0
lea eax, [ebp - 4]
push eax
push ebx
push dword [esi]
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
je 0x4011f9
cmp dword [ebp - 4], ebx
je 0x4011fe
mov eax, dword [esi]
mov dword [esi + 4], eax
pop ebx
push edi
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov eax, dword [esi]
cmp eax, dword [esi + 4]
pop edi
setne al
pop esi
mov esp, ebp
pop ebp
ret