joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4022e0
Capabilities:
Hash data with md5

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x55bb54
mov eax, dword fs:[0]
push eax
sub esp, 0x78
mov eax, dword [0x5b9fe4]
xor eax, ebp
mov dword [ebp - 0x10], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x84], edi
mov dword [ebp - 0x80], 0
mov dword [ebp - 4], 1
lea edx, [ebp + 8]
cmp dword [ebp + 0x1c], 0x10
lea ecx, [ebp - 0x7c]
push dword [ebp + 0x18]
cmovae edx, dword [ebp + 8]
xorps xmm0, xmm0
mov dword [ebp - 0x7c], 0
mov dword [ebp - 0x78], 0
mov dword [ebp - 0x74], 0x67452301
mov dword [ebp - 0x70], 0xefcdab89
mov dword [ebp - 0x6c], 0x98badcfe
mov dword [ebp - 0x68], 0x10325476
mov byte [ebp - 0x20], 0
movq qword [ebp - 0x1f], xmm0
mov dword [ebp - 0x17], 0
mov word [ebp - 0x13], 0
mov byte [ebp - 0x11], 0
call fcn.004035b0
add esp, 4
lea edx, [ebp - 0x20]
lea ecx, [ebp - 0x7c]
call fcn.00403670
mov dword [edi + 0x10], 0
mov dword [edi + 0x14], 0
mov dword [edi + 0x14], 0xf
cmp dword [edi + 0x14], 0x10
mov dword [edi + 0x10], 0
jb 0x4023b4
mov eax, dword [edi]
jmp 0x4023b6
mov eax, edi
mov byte [eax], 0
mov dword [ebp - 0x80], 1
xor esi, esi
xor eax, eax
mov byte [ebp - 0x24], 0
mov word [ebp - 0x23], ax
mov byte [ebp - 0x21], al
movzx eax, byte [ebp + esi - 0x20]
push eax
push str._02X
lea eax, [ebp - 0x24]
push 4
push eax
call fcn.00402ee0
add esp, 0x10
cmp byte [ebp - 0x24], 0
jne 0x4023f2
xor eax, eax
jmp 0x402401
lea eax, [ebp - 0x24]
lea edx, [eax + 1]
mov cl, byte [eax]
inc eax
test cl, cl
jne 0x4023f8
sub eax, edx
push eax
lea eax, [ebp - 0x24]
mov ecx, edi
push eax
call fcn.00402df0
inc esi
cmp esi, 0x10
jl 0x4023c2
mov eax, dword [ebp + 0x1c]
cmp eax, 0x10
jb 0x40245d
mov ecx, dword [ebp + 8]
inc eax
cmp eax, 0x1000
jb 0x402454
test cl, 0x1f
je 0x402430
call fcn.00545956
mov eax, dword [ecx - 4]
cmp eax, ecx
jb 0x40243c
call fcn.00545956
sub ecx, eax
cmp ecx, 4
jae 0x402448
call fcn.00545956
cmp ecx, 0x23
jbe 0x402452
call fcn.00545956
mov ecx, eax
push ecx
call fcn.00404192
add esp, 4
mov eax, edi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x10]
xor ecx, ebp
call fcn.0053d942
mov esp, ebp
pop ebp
ret

Function at 0x402ca0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
movzx eax, word [ebp + 8]
mov dword [ebp + 8], eax
pop ebp
jmp fcn.0041201d
Function at 0x4117ae
Capabilities:
Query or enumerate registry value
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
xor esi, esi
push edi
cmp dword [ecx + 0x58], esi
je 0x411801
push esi
push dword [ebp + 8]
call fcn.004119a1
mov edi, eax
test edi, edi
jne 0x4117d1
mov eax, dword [ebp + 0x10]
jmp 0x411813
lea eax, [ebp - 4]
mov dword [ebp - 4], 4
push eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push eax
push esi
push dword [ebp + 0xc]
push edi
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
push edi
mov esi, eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test esi, esi
jne 0x4117cc
mov eax, dword [ebp - 8]
jmp 0x411813
push dword [ecx + 0x6c]
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret 0xc

Function at 0x412082
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
mov dword [ebp - 4], ecx
xor esi, esi
call fcn.0041964d
push 5
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x4120b9
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
mov ecx, dword [ebp - 4]
push ebx
push dword [ebp + 0xc]
push esi
call fcn.004120da
push edi
mov esi, eax
call dword [sym.imp.KERNEL32.dll_FreeResource]
pop edi
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x41b7b5
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
xor edi, edi
mov dword [ebp - 4], ecx
mov esi, edi
cmp dword [ebp + 8], esi
je 0x41b7fa
call fcn.0041964d
push 0xf0
push dword [ebp + 8]
mov ebx, dword [eax + 0xc]
push ebx
call dword [sym.imp.KERNEL32.dll_FindResourceW]
test eax, eax
je 0x41b7fa
push eax
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov esi, eax
test esi, esi
je 0x41b816
push esi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
mov ecx, dword [ebp - 4]
push edi
call fcn.0048f7d4
mov ebx, eax
test edi, edi
je 0x41b814
test esi, esi
je 0x41b814
push esi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x41c222
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
je 0x41c2e0
cmp dword [esi + 0x20], 0
je 0x41c2e0
push dword [esi + 0x20]
call dword [sym.imp.USER32.dll_IsWindow]
test eax, eax
je 0x41c2e0
cmp dword [ebp + 8], 0
je 0x41c2e0
xor eax, eax
mov ebx, eax
mov dword [ebp - 4], eax
mov dword [ebp - 8], ebx
mov edi, eax
call fcn.0041964d
push 0x56d710
push dword [ebp + 8]
mov eax, dword [eax + 0xc]
push eax
mov dword [ebp - 0xc], eax
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov dword [ebp - 0x10], eax
test eax, eax
je 0x41c2b1
mov edi, dword [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
push dword [ebp - 0x10]
mov dword [ebp - 4], eax
push edi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x41c2e0
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ebx, eax
mov dword [ebp - 8], eax
push dword [ebp - 4]
push ebx
push esi
call fcn.004b0bb3
add esp, 0xc
mov ebx, eax
cmp dword [ebp - 8], 0
je 0x41c2d1
test edi, edi
je 0x41c2d1
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
test ebx, ebx
je 0x41c2dc
mov ecx, esi
call fcn.0041bfc5
mov eax, ebx
jmp 0x41c2e2
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x42073e
Capabilities:
Get graphical window text

Disassembly:
push 4
mov eax, 0x568546
call fcn.0053de7e
mov edi, ecx
xor ebx, ebx
cmp dword [edi + 0x74], ebx
jne 0x420764
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [edi + 0x20]
call dword [sym.imp.USER32.dll_GetWindowTextW]
jmp 0x4207c3
call fcn.00415a31
push eax
lea ecx, [ebp - 0x10]
call fcn.00401d90
mov edi, dword [edi + 0x74]
lea ecx, [ebp - 0x10]
push ecx
mov dword [ebp - 4], ebx
mov eax, dword [edi]
mov esi, dword [eax + 0x8c]
mov ecx, esi
call fcn.0053de41
mov ecx, edi
call esi
mov esi, dword [ebp + 8]
push 0xffffffffffffffff
push dword [ebp - 0x10]
push dword [ebp + 0xc]
push esi
call fcn.00546f90
push eax
call fcn.004047f5
add esp, 0x14
test esi, esi
je 0x4207b6
push esi
call fcn.00545f5a
pop ecx
mov ebx, eax
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffffff0
call fcn.00401ed0
mov eax, ebx
call fcn.0053de47
ret 8
Function at 0x42bfef
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, dword [ebp + 0xc]
mov dword [ebp - 8], ecx
test esi, esi
jne 0x42c008
call fcn.0041964d
mov esi, dword [eax + 0xc]
push 0x56dea4
push dword [ebp + 8]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov ebx, eax
test ebx, ebx
je 0x42c05e
push edi
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
je 0x42c05d
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov dword [ebp - 4], eax
test eax, eax
jne 0x42c03e
xor esi, esi
jmp 0x42c054
push ebx
push esi
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [ebp - 8]
push eax
push dword [ebp - 4]
call fcn.0042c066
mov esi, eax
push edi
call dword [sym.imp.KERNEL32.dll_FreeResource]
mov eax, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8

Function at 0x4b268f
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, dword [ebp + 8]
mov ebx, ecx
push edi
mov dword [ebp - 4], ebx
test byte [esi + 4], 1
je 0x4b26a9
mov edi, dword [esi + 0xc]
jmp 0x4b26e9
push 5
push dword [esi + 0xc]
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_FindResourceW]
mov edi, eax
test edi, edi
jne 0x4b26c2
call fcn.00416486
push edi
push dword [esi + 8]
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov edi, eax
test edi, edi
jne 0x4b26d7
call fcn.00416486
push edi
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
test edi, edi
jne 0x4b26e9
call fcn.00416486
call fcn.0041964d
cmp dword [eax + 0x3c], 0
je 0x4b26fe
push edi
mov ecx, ebx
call fcn.004b1d23
mov edi, eax
push dword [ebp + 0xc]
push edi
call fcn.004b28db
mov ebx, eax
mov eax, dword [ebp - 4]
mov ecx, dword [eax + 0x88]
test ecx, ecx
je 0x4b2727
push ecx
call dword [sym.imp.KERNEL32.dll_GlobalFree]
mov eax, dword [ebp - 4]
and dword [eax + 0x88], 0
test ebx, ebx
je 0x4b2733
mov edi, ebx
mov dword [eax + 0x88], ebx
or dword [esi + 4], 1
mov dword [esi + 0xc], edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x4c422b
Capabilities:
Get file system object information

Disassembly:
push 0x4cc
mov eax, 0x56382b
call fcn.0053deb2
mov ebx, ecx
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00404ae7
pop ecx
lea esi, [eax + 0x10]
mov dword [ebp - 0x4d0], esi
and dword [ebp - 4], 0
lea ecx, [ebp - 0x4d0]
push 0
push 0x56c834
call fcn.00404d5f
cmp eax, 0xffffffff
jne 0x4c42f6
push 0
push 0x56de60
lea ecx, [ebp - 0x4d0]
call fcn.00404d5f
cmp eax, 0xffffffff
jne 0x4c42f6
push 0
push 0x56b18c
lea ecx, [ebp - 0x4d0]
call fcn.00404d5f
cmp eax, 0xffffffff
jne 0x4c42f6
mov eax, dword [ebx + 0x14]
sub eax, 0x10
push eax
call fcn.00404ae7
mov edi, eax
pop ecx
mov dword [ebp - 0x4d4], edi
lea ecx, [edi + 0x10]
mov dword [ebp - 0x4d8], ecx
xor edx, edx
mov byte [ebp - 4], 1
push edx
lea eax, [ebp - 0x218]
push eax
push 0x104
push edx
push ecx
push edx
call dword [sym.imp.KERNEL32.dll_SearchPathW]
test eax, eax
jne 0x4c42d3
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call fcn.0053de41
mov ecx, ebx
call edi
mov ecx, dword [ebp - 0x4d4]
mov edi, eax
call fcn.00401ed0
jmp 0x4c432e
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x4d0]
call fcn.00405618
mov ecx, edi
mov byte [ebp - 4], 0
call fcn.00401ed0
mov esi, dword [ebp - 0x4d0]
push 0x105
push 0x2b4
lea eax, [ebp - 0x4cc]
push eax
push 0
push esi
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
test eax, eax
je 0x4c431c
mov edi, dword [ebp - 0x4cc]
jmp 0x4c432e
mov eax, dword [ebx]
mov edi, dword [eax + 0x14]
mov ecx, edi
call fcn.0053de41
mov ecx, ebx
call edi
mov edi, eax
lea ecx, [esi - 0x10]
call fcn.00401ed0
mov eax, edi
call fcn.0053de5c
ret

Function at 0x503929
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ebp + 8]
lea eax, [ebp - 4]
push eax
push dword [ebp + 0xc]
mov ecx, dword [esi + 4]
call fcn.00420688
push 0xfffffffffffffff0
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowLongW]
push dword [ebp + 0xc]
and eax, 3
mov ecx, esi
cmp al, 3
je 0x503965
call fcn.00503b4b
mov dword [esi + 0xc], 1
jmp 0x50396a
call fcn.00503b4b
cmp dword [esi], 0
je 0x5039b3
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
mov esi, dword [ebp + 0x10]
test eax, eax
jle 0x50398d
lea ecx, [eax + 1]
push ecx
push eax
mov ecx, esi
call fcn.0041b88b
jmp 0x50399e
push 0xff
mov ecx, esi
call fcn.00402020
push 0x100
push eax
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_GetWindowTextW]
push 0xffffffffffffffff
mov ecx, esi
call fcn.00411add
jmp 0x5039d7
mov esi, dword [ebp + 0x10]
push dword [esi]
push 0xffffffffffffffff
push 0x14d
push dword [ebp - 4]
call dword [sym.imp.USER32.dll_SendMessageW]
cmp eax, 0xffffffff
jne 0x5039d7
push dword [esi]
push dword [ebp - 4]
call fcn.00422fe5
pop esi
mov esp, ebp
pop ebp
ret 0xc
Function at 0x503aa0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
mov ecx, esi
push edi
push dword [ebp + 0xc]
call fcn.00503b4b
cmp dword [esi], 0
mov edi, eax
mov dword [esi + 0xc], 1
je 0x503ae8
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthW]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [ebp + 0x10]
push eax
call fcn.0041b88b
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextW]
mov ecx, dword [ebp + 0x10]
push 0xffffffffffffffff
call fcn.00411add
jmp 0x503af3
mov eax, dword [ebp + 0x10]
push dword [eax]
push edi
call fcn.00422fe5
pop edi
pop esi
pop ebp
ret 0xc

Function at 0x557491
Capabilities:
Set environment variable

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
pop ebp
jmp fcn.00557151
Function at 0x401434
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x401443
pop dword [ebp - 0x30]
mov eax, 0x882c0e99
sub eax, 0x87ebfa56
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0xcec71aa2
sub dword [ebp - 0x40], 0x8074d557
mov dword [ebp - 0x3c], 0xab897efe
add dword [ebp - 0x3c], 0x86a9cd47
mov dword [ebp - 0x38], 0x6483fb1b
add dword [ebp - 0x38], 0xe7c84913
mov dword [ebp - 0x34], 0x7c4d08d6
sub dword [ebp - 0x34], 0x7c4d08d6
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x3a3f8e2d
sub dword [ebp - 0x40], 0xc5cd24d7
mov dword [ebp - 0x3c], 0x45500237
sub dword [ebp - 0x3c], 0x3e3a0c2
mov dword [ebp - 0x38], 0xfa6c49d4
add dword [ebp - 0x38], 0x69032298
mov dword [ebp - 0x34], 0x6272d053
sub dword [ebp - 0x34], 0x6272d053
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x3a855
push 0
call eax
mov ecx, 0x8de84f55
sub ecx, 0x8de7fec1
xor edi, edi
add edi, eax
mov esi, 0x459200
add esi, dword [ebp - 0x30]
mov ebx, 0x905f3653
sub ebx, 0xac90c457
xor dword [ebp - 0x18], edx
mov edx, dword [esi]
sub dword [ebp - 0x14], 0x508ed7f6
add edx, ebx
add dword [ebp - 0x24], 0x5a10fafc
mov dword [edi], edx
xor dword [ebp - 0x14], edx
add edi, 0x23ac0442
add edi, 0xdc53fbc2
add esi, 0xa6b52f9c
sub esi, 0xa6b52f98
loop 0x401557
add eax, 0xbc799a6f
add eax, 0x43879ab4
mov ebx, eax
add eax, 5
mov ecx, 0x1f8b7fec
sub ecx, 0x1f4b7fec
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x10001b01
Capabilities:
Query or enumerate registry key

Disassembly:
mov eax, 0x1005e801
call fcn.1005e208
sub esp, 0x10
push ebx
push esi
mov dword [ebp - 0x18], 0x15f6
mov esi, edx
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
cmp dword [ebp - 0x18], 0x16a9
mov dword [ebp - 0x1c], esi
jle 0x10001b66
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push 0xe04
push ebx
call dword [sym.imp.ADVAPI32.dll_RegEnumKeyExW]
mov edi, ebx
mov esi, ebx
lea eax, [esi + edi]
mov ecx, 0x1007d6f8
cdq
push edx
push eax
call fcn.100062e1
inc esi
cmp esi, 0x44d7
jl 0x10001b41
inc edi
cmp edi, 0x6a11
jl 0x10001b3f
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x18], 0x139c
jge 0x10001b85
mov edx, str.proqvmh_gid_sxien_witqbp_yqrs_kbzqfu_vmtwbfza_ncoks_cpsw_dyi_tmswdgw_tskxw_wcdc
mov ecx, 0x1007d6f8
call fcn.1000aa27
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 8], 0
je 0x10001bc1
lea edx, [ebp - 0x11]
mov byte [ebp - 0x11], bl
call fcn.10001d49
jmp 0x10001bdd
mov dword [esi], ebx
cmp dword [esi], 3
jge 0x10001bdd
mov edx, dword [ebp + 0xc]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0x9d786592
inc dword [esi]
cmp dword [esi], 3
jl 0x10001bcb
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004257
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x44
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov byte [esp + 0x10], cl
je 0x100042ac
cmp byte [ebp + 0x18], 0
je 0x1000427b
and dword [edx], 0
jmp 0x10004384
mov eax, dword [ebp + 0x10]
xor esi, esi
mov ecx, dword [ebp + 0x14]
mov eax, dword [eax]
inc eax
push eax
push esi
lea eax, [esp + 0x28]
push eax
call fcn.100065b8
mov ecx, dword [ebp + 0x14]
push eax
call fcn.10006456
push esi
push 1
lea ecx, [esp + 0x28]
call fcn.100072b5
jmp 0x10004384
test cl, cl
je 0x1000437a
mov dword [esp + 0x1c], 0x548f
cmp dword [esp + 0x1c], 0x5863
jle 0x10004350
xor esi, esi
push esi
call dword [sym.imp.USER32.dll_RegisterClassW]
mov edi, esi
mov ebx, esi
mov eax, esi
mov dword [esp + 0x14], esi
mov ecx, esi
mov dword [esp + 0x18], esi
cdq
idiv ecx
lea ecx, [esp + 0x38]
or edx, ebx
or edx, edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001a99
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10004302
mov eax, dword [eax]
push eax
call fcn.100460fd
pop ecx
push esi
push 1
lea ecx, [esp + 0x40]
call fcn.10006e56
mov ecx, dword [esp + 0x18]
mov eax, dword [esp + 0x14]
inc ecx
mov dword [esp + 0x18], ecx
cmp ecx, 0x305f
jl 0x100042e3
inc eax
mov dword [esp + 0x14], eax
cmp eax, 0xe3b
jl 0x100042dd
inc ebx
cmp ebx, 0x1398
jl 0x100042d7
inc edi
cmp edi, 0x2cf5
jl 0x100042d5
push esi
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10004363
push 0x2356
call dword [sym.imp.KERNEL32.dll_SetErrorMode]
cmp dword [esp + 0x1c], 0x5321
jge 0x10004384
push str.lmd_mypnfye_tmzyuz_urojpwunx_nusdecjz_hluswmxas_bnvdux_hqznagmg_jumbef
call fcn.100460fd
pop ecx
jmp 0x10004384
xor esi, esi
push esi
push esi
call dword [sym.imp.USER32.dll_LoadMenuW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10004580
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005ea14
call fcn.1005e208
sub esp, 0x20
push ebx
push esi
mov dword [ebp - 0x1c], 0x5132
mov esi, edx
cmp dword [ebp - 0x1c], 0x5423
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x28], ecx
jle 0x1000460a
xor edi, edi
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov dword [ebp - 0x14], ebx
mov eax, ebx
xor esi, esi
and eax, edi
mov dword [ebp - 0x24], eax
mov edi, eax
xor ebx, ebx
mov ecx, ebx
mov eax, esi
shl eax, cl
mov ecx, 0x1007d6f8
xor eax, edi
cdq
push edx
push eax
call fcn.100062e1
inc ebx
cmp ebx, 0x20db
jl 0x100045c2
inc esi
cmp esi, 0x4de1
jl 0x100045c0
mov ebx, dword [ebp - 0x14]
mov edi, dword [ebp - 0x18]
inc ebx
mov dword [ebp - 0x14], ebx
cmp ebx, 0x650
jl 0x100045b5
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x7fab
jl 0x100045b0
mov esi, dword [ebp - 0x20]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x5083
jge 0x10004645
mov edx, str.tpkdzwwz_cdabb_vptbvrv_gljhe_ixdk_dcdnfoi_icukinss_ptkaeebz_nhtwzdlpw
mov ecx, 0x1007d6f8
call fcn.1000aa27
jmp 0x10004645
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0xc], 0
je 0x1000468a
cmp dword [esi + 0x14], 8
jb 0x10004659
mov ecx, dword [esi]
jmp 0x1000465b
mov ecx, esi
mov eax, dword [esi + 0x10]
mov ax, word [ecx + eax*2 - 2]
mov ecx, dword [ebp - 0x28]
cmp ax, word [ecx]
je 0x100046aa
push esi
push 0x6629
push 1
push ecx
push 0x1e79
mov dl, 1
mov ecx, 0xc53
call fcn.1000406c
add esp, 0x14
jmp 0x100046aa
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 4
jge 0x100046aa
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
or dword [eax + ecx*4], 0xffffffff
inc dword [edx]
cmp dword [edx], 4
jl 0x1000469b
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1000489a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005ea30
call fcn.1005e208
sub esp, 0xc
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], edi
mov esi, ecx
je 0x100048e0
mov dword [esi], 0
cmp dword [esi], 3
jge 0x1000495f
mov edx, dword [ebp + 0x14]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0x6aabecba
inc dword [esi]
cmp dword [esi], 3
jl 0x100048cc
jmp 0x1000495f
mov dword [ebp - 0x14], 0x2da8
cmp dword [ebp - 0x14], 0x30f3
jle 0x10004917
xor esi, esi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x1007d6f8
xor eax, esi
cdq
push edx
push eax
call fcn.100062e1
inc ebx
cmp ebx, 0x2c7d
jl 0x100048f4
inc esi
cmp esi, 0x724e
jl 0x100048f2
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x2d7f
jge 0x10004952
mov edx, str.onglbwrs_lvksnb_pll_lkabmtp_ygvpthkj_gojkil_vanxn
mov ecx, 0x1007d6f8
call fcn.1000aa27
jmp 0x10004952
cmp byte [edi], 0
je 0x1000495f
push 0
call dword [sym.imp.KERNEL32.dll_HeapDestroy]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000e6cf
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x1000e6e6
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x1000e708
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x1069a734
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x1069aac0
jl 0x1000e716
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x1069ad64
jl 0x1000e756
mov ecx, dword [0x1069bab0]
xor ecx, dword [0x1069a734]
and ecx, edi
xor ecx, dword [0x1069bab0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x1069a730], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x1069ad64]
mov dword [0x1069b0f0], eax
pop esi
ret