joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001afd9
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005fb6e
call fcn.1005ebe8
sub esp, 0x24
push ebx
push esi
mov byte [ebp - 0x14], dl
xor esi, esi
push edi
mov dword [ebp - 0x18], 0x60c9
mov edi, 0x1007ad38
cmp dword [ebp - 0x18], 0x6375
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], ecx
jle 0x1001b031
mov ebx, esi
mov dword [ebp - 0x20], esi
mov eax, esi
mov ecx, edi
xor eax, ebx
cdq
push edx
push eax
call fcn.10001b82
inc esi
cmp esi, 0x786a
jl 0x1001b00e
inc ebx
push 0
pop esi
cmp ebx, 0x248d
jl 0x1001b00b
mov dword [ebp - 4], esi
cmp dword [ebp - 0x18], 0x5d77
jge 0x1001b049
mov edx, str.kvwryw_rgvisvlmb_woq_xcym_hocbnn_ffqdo_ivbb_erptc
mov ecx, edi
call fcn.10003a0a
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x14], 0
je 0x1001b084
mov eax, dword [ebp + 0x34]
inc dword [eax]
jmp 0x1001b176
mov dword [ebp - 0x20], 0x2b3b
cmp dword [ebp - 0x20], 0x2d72
jle 0x1001b0e0
mov ebx, esi
mov dword [ebp - 0x1c], esi
mov ecx, esi
mov dword [ebp - 0x18], esi
mov eax, ebx
mov dword [ebp - 0x24], esi
cdq
mov ebx, 0x10a5
idiv ecx
mov dword [ebp - 0x28], edx
mov eax, esi
mov ecx, edi
cdq
push edx
push eax
call fcn.10001b82
add esi, dword [ebp - 0x28]
dec ebx
jne 0x1001b0ae
mov ecx, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x18], ecx
push ebx
mov ebx, dword [ebp - 0x1c]
pop esi
cmp ecx, 0x2938
jl 0x1001b09e
inc ebx
mov dword [ebp - 0x1c], ebx
cmp ebx, 0x6a6e
jl 0x1001b099
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x2912
jge 0x1001b11a
mov edx, str.bcaugr_zpvd_wbhf_glkrhrf_uhcjld
mov ecx, edi
call fcn.10003a0a
jmp 0x1001b11a
mov ebx, dword [ebp + 0xc]
cmp dword [ebx], esi
jne 0x1001b123
mov eax, dword [ebx]
mov eax, dword [ebp + 0x24]
mov ecx, dword [eax]
inc dword [eax]
test ecx, ecx
je 0x1001b135
cmp dword [ebx], esi
je 0x1001b135
xor esi, esi
inc esi
mov edi, dword [ebp + 0x30]
xor edx, edx
mov eax, dword [edi]
mov eax, dword [ebx]
cmp eax, esi
mov esi, dword [ebp + 0x40]
setge dl
xor ecx, ecx
mov eax, dword [esi]
cmp edx, eax
setg cl
mov dword [edi], ecx
mov eax, dword [edi]
mov dword [esi], eax
mov ecx, dword [esi]
mov eax, dword [ebp + 0x44]
mov eax, dword [eax]
mov dword [eax + 4], ecx
mov ecx, dword [ebp + 0x10]
mov eax, dword [ebx]
mov eax, dword [ecx]
mov dword [ecx], eax
mov eax, dword [ecx]
mov ecx, dword [ebp - 0x2c]
add eax, dword [ecx]
neg eax
sbb eax, eax
inc eax
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001b955
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005fb92
call fcn.1005ebe8
sub esp, 0x30
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x18], dl
test dl, dl
je 0x1001ba7f
mov dword [ebp - 0x24], 0x28bd
cmp dword [ebp - 0x24], 0x2c39
jle 0x1001b9f0
mov esi, ebx
mov dword [ebp - 0x1c], ebx
mov edi, ebx
mov ecx, ebx
mov dword [ebp - 0x20], ebx
mov eax, edi
mov dword [ebp - 0x28], esi
cdq
idiv ecx
mov dword [ebp - 0x2c], ebx
mov ecx, edx
sar esi, cl
mov eax, esi
mov ecx, 0x1007ad38
xor eax, ebx
cdq
push edx
push eax
call fcn.10001b82
inc ebx
cmp ebx, 0x281f
jl 0x1001b9a0
mov ecx, dword [ebp - 0x20]
mov esi, dword [ebp - 0x1c]
inc ecx
mov dword [ebp - 0x20], ecx
push 0
pop ebx
cmp ecx, 0x55a3
jl 0x1001b991
inc edi
cmp edi, 0x7f94
jl 0x1001b98c
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x3a11
jl 0x1001b98a
push ebx
push 0x23cb
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
mov dword [ebp - 0x20], 0xffffffff
push 3
mov dword [ebp - 0x2c], ebx
mov dword [ebp - 0x1c], ebx
pop ecx
jmp 0x1001ba10
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x38], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1001ba02
mov dword [ebp - 0x20], 2
cmp dword [ebp - 0x20], ebx
jl 0x1001ba48
mov dword [ebp - 0x1c], 0xefa9d19a
inc dword [ebp - 0x1c]
mov dword [ebp - 0x1c], ebx
jmp 0x1001ba3e
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x38], 0x2c9cc141
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ecx
jl 0x1001ba30
dec dword [ebp - 0x20]
jns 0x1001ba21
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x24], 0x280a
jge 0x1001ba63
mov edx, str.bvdzbykfc_ggsow_oosjl
mov ecx, 0x1007ad38
call fcn.10003a0a
jmp 0x1001ba9b
push ebx
push ecx
push ecx
lea eax, [ebp - 0x11]
mov byte [ebp - 0x11], bl
push 0xd71
push eax
mov ecx, 0x2636
call fcn.1001baac
add esp, 0x14
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001c0c8
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov ebx, edx
je 0x1001c0ec
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x1001c163
call dword [sym.imp.KERNEL32.dll_GetUserDefaultLangID]
jmp 0x1001c163
mov dword [esp + 0xc], 0x5932
cmp dword [esp + 0xc], 0x5a2e
jle 0x1001c142
xor esi, esi
xor edi, edi
mov eax, edi
lea ecx, [esp + 0x10]
and eax, esi
cdq
push edx
push eax
call fcn.10001a75
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001c11c
mov eax, dword [eax]
push eax
call fcn.10046d04
pop ecx
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.1000205c
inc edi
cmp edi, 0x3652
jl 0x1001c102
inc esi
cmp esi, 0x2d8a
jl 0x1001c100
cmp dword [esp + 0xc], 0x5851
jge 0x1001c157
push str.dahf_vjokcf_xtmja_lzovbvit_mxicfv_horqurgu_xlknbs_lndlwakok_gkclrygr_nizqrai
call fcn.10046d04
pop ecx
mov eax, dword [ebp + 0x10]
mov edx, dword [ebx]
mov ecx, dword [eax]
mov eax, dword [edx + 8]
mov dword [ecx], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10034dc7
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x10034dde
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x10034e00
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x10158224
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x101585b0
jl 0x10034e0e
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x10158854
jl 0x10034e4e
mov ecx, dword [0x101595a0]
xor ecx, dword [0x10158224]
and ecx, edi
xor ecx, dword [0x101595a0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x10158220], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10158854]
mov dword [0x10158be0], eax
pop esi
ret
Function at 0x10035aa8
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10060559
call fcn.1005ebe8
sub esp, 0x24
cmp byte [ebp + 0x20], 0
mov eax, edx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], eax
mov byte [ebp - 0x14], cl
je 0x10035b12
cmp byte [ebp + 0x14], 0
je 0x10035b00
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10035aef
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
or dword [eax + ecx*4], 0xffffffff
inc dword [edx]
cmp dword [edx], 2
jl 0x10035ae0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x24]
and dword [ebp - 0x24], 0
push eax
call fcn.10038d48
jmp 0x10035aef
test cl, cl
je 0x10035b21
mov eax, dword [ebp + 0x10]
push 0xb
pop ecx
mov word [eax], cx
jmp 0x10035aef
mov dword [ebp - 0x20], 0xde8
cmp dword [ebp - 0x20], 0xfe9
jle 0x10035b93
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp + 0x20], edi
and dword [ebp - 0x2c], 0
mov ecx, edi
mov edi, dword [ebp - 0x2c]
mov dword [ebp - 0x28], esi
shl esi, cl
mov ecx, edi
mov eax, esi
shl eax, cl
mov ecx, 0x1007ad38
xor eax, ebx
cdq
push edx
push eax
call fcn.10001b82
inc edi
cmp edi, 0x26c9
jl 0x10035b4b
mov edi, dword [ebp + 0x20]
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp + 0x20], edi
cmp edi, 0x2e3a
jl 0x10035b3d
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x10f5
jl 0x10035b38
inc ebx
cmp ebx, 0x608a
jl 0x10035b33
mov eax, dword [ebp - 0x1c]
mov edx, dword [ebp + 0xc]
xor esi, esi
inc esi
mov dword [edx], 0
jmp 0x10035bad
mov ecx, dword [edx]
mov eax, dword [eax]
mov dword [eax + ecx*4], esi
inc dword [edx]
mov eax, dword [ebp - 0x1c]
cmp dword [edx], esi
jl 0x10035ba1
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0xc11
jge 0x10035aef
mov edx, str.abkqc_cvkhx_dypdwwjbb_lqqmls_fze_guklayloq
mov ecx, 0x1007ad38
call fcn.10003a0a
jmp 0x10035aef
Function at 0x10035c94
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10060563
call fcn.1005ebe8
sub esp, 0x24
push ebx
push esi
mov dword [ebp - 0x20], 0x442d
mov eax, edx
cmp dword [ebp - 0x20], 0x45fe
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x2c], ecx
jle 0x10035d21
xor edi, edi
mov dword [ebp - 0x1c], edi
xor esi, esi
mov dword [ebp - 0x18], esi
mov ebx, esi
mov dword [ebp - 0x14], 0x6c40
mov eax, ebx
xor esi, esi
and eax, edi
mov dword [ebp - 0x24], eax
mov edi, eax
mov eax, edi
mov ecx, 0x1007ad38
xor eax, esi
cdq
push edx
push eax
call fcn.10001b82
inc esi
cmp esi, 0x4624
jl 0x10035cdd
mov edi, dword [ebp - 0x1c]
dec ebx
dec dword [ebp - 0x14]
jne 0x10035cd2
mov esi, dword [ebp - 0x18]
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x561b
jl 0x10035cc9
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x703a
jl 0x10035cc4
mov eax, dword [ebp - 0x28]
mov ecx, dword [ebp - 0x2c]
cmp byte [ebp + 0xc], 0
je 0x10035d55
cmp byte [ebp + 0x14], 0
je 0x10035d4b
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10035d72
push 0
push 0x1b05
push 0x208e
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
jmp 0x10035d72
mov ecx, dword [ecx]
mov eax, dword [eax]
or dword [eax + ecx*4], 0xffffffff
jmp 0x10035d72
cmp byte [ebp + 0x18], 0
je 0x10035d65
mov ecx, dword [ebp + 0x10]
mov eax, dword [ecx]
mov dword [ecx + 4], eax
jmp 0x10035d72
push 0
push 0xa99
call dword [sym.imp.USER32.dll_GetWindowInfo]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x43f4
jge 0x10035d8e
mov edx, str.mfnzk_ziohpyh_twyrxbx_nzl_npkbktng
mov ecx, 0x1007ad38
call fcn.10003a0a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10035ef4
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10060587
call fcn.1005ebe8
sub esp, 0x6c
push ebx
push esi
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
cmp byte [ebp + 0xc], 0
je 0x10035fdb
movdqa xmm0, xmmword [0x1006d800]
lea eax, [ebp - 0x58]
mov dword [ebp - 0x2c], esi
lea ecx, [ebp - 0x4c]
mov dword [ebp - 0x20], 0xe55459ee
mov dword [ebp - 0x28], 0x2835357f
mov dword [ebp - 0x30], 8
push dword [ebp - 0x30]
movdqu xmmword [ebp - 0x68], xmm0
push eax
lea eax, [ebp - 0x68]
mov dword [ebp - 0x4c], esi
push eax
push esi
mov dword [ebp - 0x48], esi
mov dword [ebp - 0x44], esi
call fcn.10005101
xor ebx, ebx
mov dword [ebp - 4], esi
inc ebx
mov dword [ebp - 0x1c], 0x246
push ebx
lea ecx, [ebp - 0x58]
mov dword [ebp - 0x24], 0xffffffff
call fcn.10001d0c
lea eax, [ebp - 0x34]
mov byte [ebp - 4], bl
push eax
sub esp, 0x10
lea edx, [ebp - 0x58]
push esi
push ecx
push ecx
call fcn.10035497
add esp, 0x20
lea eax, [ebp - 0x20]
mov edx, 0x3d57
push 0x2a25
push eax
push ecx
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x2c]
push eax
push 0x72e1
push 0x6ea7
push ebx
push 0x22d5
push 0x53d8
push esi
lea eax, [ebp - 0x30]
push eax
push ebx
lea ecx, [ebp - 0x58]
call fcn.10036264
add esp, 0x38
lea ecx, [ebp - 0x58]
call fcn.10001d69
lea ecx, [ebp - 0x4c]
jmp 0x100360dc
mov dword [ebp - 0x1c], 0x64f9
cmp dword [ebp - 0x1c], 0x6613
jle 0x10036048
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x18], esi
mov ecx, esi
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x14], ecx
mov eax, esi
cdq
idiv ecx
mov ecx, 0x1007ad38
and edx, ebx
xor edx, edi
mov eax, edx
cdq
push edx
push eax
call fcn.10001b82
mov ecx, dword [ebp - 0x14]
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x2e7a
jl 0x10035ffa
inc esi
push 0
mov dword [ebp - 0x18], esi
cmp esi, 0x5150
pop esi
jl 0x10035ff2
inc ebx
cmp ebx, 0x7f70
jl 0x10035fef
inc edi
cmp edi, 0x157d
jl 0x10035fed
call dword [sym.imp.USER32.dll_CreateMenu]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x6129
jge 0x10036067
mov edx, str.lxhngxtg_jpbmyucw_vjmuezxq_zaxwdc_eqofd_rdpilbru_obsgkvnm_mfszt_skxnmixg_lvizvikub_fwiygmi_mvsecek_ugx_qvmk
mov ecx, 0x1007ad38
call fcn.10003a0a
or dword [ebp - 4], 0xffffffff
push dword [ebp - 0x34]
movdqa xmm0, xmmword [0x1006d7d0]
lea eax, [ebp - 0x68]
push eax
lea eax, [ebp - 0x78]
mov dword [ebp - 0x40], esi
push eax
push esi
lea ecx, [ebp - 0x40]
mov dword [ebp - 0x3c], esi
movdqu xmmword [ebp - 0x78], xmm0
mov dword [ebp - 0x38], esi
call fcn.10005101
xor ebx, ebx
inc ebx
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x1c], ebx
mov dword [ebp - 0x14], 3
cmp dword [ebp - 0x14], esi
jl 0x100360d9
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x40]
cmp dword [eax + ecx*4], esi
jne 0x100360d9
mov edi, dword [ebp - 0x14]
mov ecx, 0xca9d
mov eax, dword [ebp - 0x14]
mov edx, dword [ebp - 0x40]
sub ecx, dword [edx + eax*4]
imul eax, ecx, 9
xor ecx, ecx
cmp dword [edx + edi*4], eax
setle cl
mov dword [ebp - 0x1c], ecx
dec dword [ebp - 0x14]
jns 0x100360aa
lea ecx, [ebp - 0x40]
call fcn.10001d69
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10039e60
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1006077f
call fcn.1005ebe8
sub esp, 0x30
push ebx
push esi
mov dword [ebp - 0x18], 0x305d
xor esi, esi
cmp dword [ebp - 0x18], 0x3206
push edi
mov dword [ebp - 0x10], esp
jle 0x10039f03
mov edi, esi
mov ebx, esi
mov ecx, esi
mov dword [ebp - 0x1c], esi
lea eax, [ebx + edi]
xor eax, ecx
lea ecx, [ebp - 0x38]
cdq
push edx
push eax
call fcn.10001a75
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10039ea8
mov eax, dword [eax]
push eax
call fcn.10046d04
pop ecx
push esi
push 1
lea ecx, [ebp - 0x38]
call fcn.1000205c
mov ecx, dword [ebp - 0x1c]
inc ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x3373
jl 0x10039e8e
inc ebx
cmp ebx, 0x5e5b
jl 0x10039e89
inc edi
cmp edi, 0x506b
jl 0x10039e87
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push esi
push 0x25b7
push 0x2487
push 0x66a
push 0x996
push 0xeb8
call dword [sym.imp.GDI32.dll_CreateFontA]
cmp dword [ebp - 0x18], 0x2e8e
jge 0x10039f17
push str.hpvnow_xwu_pxc_jzrcedzft_evry_kpxxemy_cuftaz_mxmppov_cympu_jwiqfyz_vcdn_uohhun
call fcn.10046d04
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x20], 0x3e40
cmp dword [ebp - 0x20], 0x41a2
jle 0x10039f82
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x18], esi
mov ecx, esi
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x1c], ecx
mov eax, esi
cdq
idiv ecx
mov eax, ebx
mov ecx, 0x1007ad38
sub eax, edx
xor eax, edi
cdq
push edx
push eax
call fcn.10001b82
mov ecx, dword [ebp - 0x1c]
inc ecx
mov dword [ebp - 0x1c], ecx
cmp ecx, 0x5190
jl 0x10039f3a
inc esi
push 0
mov dword [ebp - 0x18], esi
cmp esi, 0x79cd
pop esi
jl 0x10039f32
inc ebx
cmp ebx, 0x7a3
jl 0x10039f2f
inc edi
cmp edi, 0x47fa
jl 0x10039f2d
cmp byte [ebp + 0xc], 0
je 0x10039f95
push 0x100f
call dword [sym.imp.USER32.dll_DestroyWindow]
jmp 0x10039fea
mov edx, dword [ebp + 8]
push 3
pop ebx
mov dword [edx], esi
cmp dword [edx], ebx
jg 0x10039fea
mov edi, dword [ebp + 0x14]
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x18], ebx
cmp dword [ebp - 0x18], esi
jl 0x10039fdb
mov dword [ebp - 0x1c], 0x86bd085
mov dword [ebp - 0x1c], esi
jmp 0x10039fd1
mov ecx, dword [ebp - 0x18]
mov eax, dword [edi]
cmp dword [eax + ecx*4], esi
jne 0x10039fd6
mov ecx, dword [ebp - 0x18]
mov eax, dword [edi]
or dword [eax + ecx*4], 0xffffffff
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], ebx
jle 0x10039fbb
dec dword [ebp - 0x18]
jns 0x10039faf
mov ecx, dword [edx]
mov eax, dword [edi]
cmp dword [eax + ecx*4], esi
jne 0x10039fea
inc dword [edx]
cmp dword [edx], ebx
jle 0x10039fa4
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x3d30
jge 0x1003a009
mov edx, str.sqaijop_vrgme_slepkv_tokmjq_gxkqvzjaw_avirbkaf_zkui_igpf_hlnl
mov ecx, 0x1007ad38
call fcn.10003a0a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x407bff
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
push esi
push edi
mov ebx, dword [ebp + 8]
mov dword [ebp - 8], 0x29c27be8
add dword [ebp - 8], 0x4196
mov byte [ebp - 1], 1
lea edi, [ebp - 0x1c]
lea esi, [0x42e63e]
mov ecx, 0x11
rep movsb byte es:[edi], byte [esi]
mov eax, dword [ebp - 8]
mov edx, eax
sub edx, eax
mov dword [ebp - 8], edx
lea edi, [ebp - 0x2b]
lea esi, [0x42e64f]
mov ecx, 0xf
rep movsb byte es:[edi], byte [esi]
lea edi, [ebp - 0x32]
lea esi, [0x42e65e]
mov ecx, 7
rep movsb byte es:[edi], byte [esi]
sub dword [ebp - 8], 0x6151
cmp byte [ebx], 0x67
jne 0x407c7a
inc ebx
add byte [ebp - 1], 1
mov eax, dword [ebp - 8]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x3c], eax
mul dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov dword [ebp - 8], eax
mov byte [ebp - 9], 0
jmp 0x407c96
mov al, byte [ebx]
movzx edx, byte [ebp - 9]
cmp al, byte [ebp + edx - 0x1c]
jne 0x407c92
add byte [ebp - 1], 4
jmp 0x407c9c
add byte [ebp - 9], 1
cmp byte [ebp - 9], 0x11
jb 0x407c80
xor dword [ebp - 8], 0x774b
mov byte [ebp - 0xa], 0
jmp 0x407d57
mov al, byte [ebx]
movzx edx, byte [ebp - 0xa]
cmp al, byte [ebp + edx - 0x2b]
jne 0x407d53
add byte [ebp - 1], 1
mov eax, 0x67c6
mul dword [ebp - 8]
mov dword [ebp - 0x38], eax
mov dword [ebp - 8], eax
movzx eax, byte [ebx + 1]
cmp eax, 0xc0
jge 0x407d38
movzx eax, byte [ebx + 1]
and eax, 0xc0
cmp eax, 0x40
jne 0x407ceb
add byte [ebp - 1], 1
movzx eax, byte [ebx + 1]
mov edx, eax
and edx, 7
cmp edx, 4
je 0x407d03
cmp edx, 5
jne 0x407d07
cmp eax, 0x40
jge 0x407d07
add byte [ebp - 1], 1
sub dword [ebp - 8], 0x251a
movzx eax, byte [ebx + 1]
test byte [ebx + 1], 0xc0
jne 0x407d24
and eax, 7
cmp eax, 5
jne 0x407d24
add byte [ebp - 1], 3
movzx eax, byte [ebx + 1]
and eax, 0xc0
cmp eax, 0x80
jne 0x407d38
add byte [ebp - 1], 4
movzx eax, byte [ebx]
cmp eax, 0xf7
jne 0x407d4c
test byte [ebx + 1], 0x38
jne 0x407d4c
add byte [ebp - 1], 4
sub dword [ebp - 8], 0x2d1d
add byte [ebp - 0xa], 1
cmp byte [ebp - 0xa], 0xf
jb 0x407cac
mov byte [ebp - 0xb], 0
jmp 0x407d7d
mov al, byte [ebx]
movzx edx, byte [ebp - 0xb]
cmp al, byte [ebp + edx - 0x32]
jne 0x407d79
add byte [ebp - 1], 1
jmp 0x407d83
add byte [ebp - 0xb], 1
cmp byte [ebp - 0xb], 7
jb 0x407d67
mov eax, 0x7d5b
mul dword [ebp - 8]
mov dword [ebp - 0x38], eax
mov dword [ebp - 8], eax
movzx eax, byte [ebx]
cmp eax, 0x83
jne 0x407d9f
add byte [ebp - 1], 1
movzx eax, byte [ebp - 1]
pop edi
pop esi
pop ebx
leave
ret

Function at 0x40827f
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff0
mov eax, section.sect_0
call 0x40827f
lcall 0x5de5, 0x8b10c483
jmp loc.0078a210
Function at 0x1000aed0
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x24]
test eax, eax
je 0x1000af34
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 0x3d18
push dword [ebp - 8]
push 0x18
push 0x485d
push 0x3b8b
push 0x3e99
push dword [ebp - 0xc]
push 0x43de
push 1
push 0x7043
push 0x5fb2
push 0x35f
push 0x173d
call fcn.1000afa1
add esp, 0x38
jmp 0x1000af9d
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1000af7d
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
mov ecx, dword [ebp - 0x28]
mov ecx, dword [ecx]
mov dword [eax + 8], ecx
jmp 0x1000af9d
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x1000af9d
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov esp, ebp
pop ebp
ret

Function at 0x1000cddf
Capabilities:
Get system information on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1000ce0a
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 1
push 0x5fd8
call fcn.1000ce9b
add esp, 0xc
jmp 0x1000ce97
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1000ce4c
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1000ce4a
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemInfo]
jmp 0x1000ce97
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1000ce7a
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 1
jge 0x1000ce97
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x2c]
call fcn.100208d0
mov dword [eax], 0xdde0
jmp 0x1000ce6f
mov esp, ebp
pop ebp
ret
Function at 0x1000d5da
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1000d606
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 1
push dword [ebp - 8]
call fcn.1000d664
add esp, 0xc
jmp 0x1000d660
lea eax, [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1000d640
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1000d63e
call dword [sym.imp.KERNEL32.dll_IsDebuggerPresent]
jmp 0x1000d660
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1000d660
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
mov esp, ebp
pop ebp
ret