joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100036d8
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
push ebx
push esi
push edi
test dl, dl
je 0x10003815
cmp byte [ebp + 0x2c], 0
je 0x1000372a
mov esi, dword [ebp + 0xc]
mov dword [esi], 0
jmp 0x10003720
mov ecx, dword [ebp + 0x24]
mov dl, 1
push 0x2b46
push 0x2ab2
push 0x5bcd
push dword [ebp + 0x10]
push 1
call fcn.10002920
add esp, 0x14
dec dword [esi]
cmp dword [esi], 0xfffffffb
je 0x100036fd
jmp 0x100038a4
mov dword [esp + 0x14], 0xd22
cmp dword [esp + 0x14], 0xeb1
push 0
pop ebx
jle 0x100037af
push 0x23f
push ebx
push ebx
call dword [sym.imp.GDI32.dll_TranslateCharsetInfo]
mov esi, ebx
mov edi, ebx
mov eax, ebx
mov dword [esp + 0x10], ebx
xor eax, edi
lea ecx, [esp + 0x18]
or eax, esi
cdq
push edx
push eax
call fcn.100025b7
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10003770
mov eax, dword [eax]
push eax
call fcn.1004b05d
pop ecx
push ebx
push 1
lea ecx, [esp + 0x20]
call fcn.10007cc3
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
cmp eax, 0x36e
jl 0x10003756
inc edi
cmp edi, 0x33c4
jl 0x10003750
inc esi
cmp esi, 0x53e5
jl 0x1000374e
push 0x2f
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
cmp dword [esp + 0x14], 0xbd5
jge 0x100037c4
push str.jwba_dlt_bgm_vupaos_bzbdmk_nhvmsxpq_rejdcjp_isp_kbnyso_jqaa_kchnfc
call fcn.1004b05d
pop ecx
mov esi, dword [ebp + 8]
push 0x18
pop ecx
mov eax, dword [esi + 4]
sub eax, dword [esi]
cdq
idiv ecx
mov dword [esp + 0x14], eax
test eax, eax
je 0x100038a4
mov edi, ebx
mov edx, dword [esi]
lea ecx, [esp + 0x30]
push dword [ebp + 0x34]
add edx, edi
call fcn.1000261a
pop ecx
mov ecx, dword [esi]
push eax
add ecx, edi
call fcn.100072c9
push ebx
push 1
lea ecx, [esp + 0x38]
call fcn.10008118
add edi, 0x18
dec dword [esp + 0x14]
jne 0x100037e0
jmp 0x100038a4
xor ebx, ebx
cmp byte [ebp + 0x14], bl
je 0x10003862
mov eax, dword [ebp + 0x28]
mov edx, 0x44cf5927
mov edi, dword [ebp + 0x20]
mov dword [eax], edx
mov eax, dword [ebp + 0x30]
mov dword [ecx], edx
mov eax, dword [eax]
mov eax, dword [ebp + 0x38]
mov eax, dword [eax]
mov eax, dword [edi]
cmp dword [eax], ebx
jne 0x1000383f
cmp dword [ecx], ebx
je 0x10003842
xor ebx, ebx
inc ebx
mov eax, dword [edi]
mov esi, dword [ebp + 0x1c]
mov ecx, dword [eax]
mov eax, dword [esi]
mov edx, dword [eax + ecx*4]
mov eax, dword [ebp + 0x38]
add edx, ebx
mov eax, dword [eax]
sub edx, eax
mov eax, dword [edi]
mov ecx, dword [eax]
mov eax, dword [esi]
mov dword [eax + ecx*4], edx
jmp 0x100038a4
mov esi, dword [ebp + 0x18]
mov dword [esi], ebx
jmp 0x1000389f
mov byte [esp + 0xf], bl
cmp byte [esp + 0xf], bl
je 0x1000389d
push 1
push 0x73f
push 0x702c
push 0x270c
push ebx
push ebx
push 0x55a
mov edx, 0x2359
mov ecx, 0x5c8e
call fcn.100047a3
add esp, 0x1c
inc dword [esi]
cmp dword [esi], 1
jle 0x10003869
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003abb
Capabilities:
Accept command line arguments
Encode data using xor

Disassembly:
mov eax, 0x100606fe
call fcn.10060010
sub esp, 0x40
cmp byte [ebp + 0x1c], 0
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], ebx
je 0x10003b68
cmp byte [ebp + 0xc], 0
je 0x10003b56
mov edi, dword [ebp + 0x10]
mov esi, dword [edi]
mov edi, dword [edi + 4]
jmp 0x10003b41
push esi
lea ecx, [ebp - 0x34]
call fcn.10007269
and dword [ebp - 4], 0
lea eax, [ebp - 0x34]
push 1
push 0x7d47
push 0x4b74
push 0x51a3
push dword [ebp + 8]
mov edx, 0x7dff
push eax
push 0xdf2
push ecx
push ecx
mov ecx, 0x2b8
call fcn.10003986
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x34]
add esp, 0x24
push 0
push 1
call fcn.10008118
add esi, 0x18
cmp esi, edi
jne 0x10003af0
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0x10003b45
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
jmp 0x10003b45
mov dword [ebp + 0x1c], 0x66c1
cmp dword [ebp + 0x1c], 0x697a
jle 0x10003bb2
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x1007bf98
and eax, edi
xor eax, esi
cdq
push edx
push eax
call fcn.10007154
inc ebx
cmp ebx, 0x1d53
jl 0x10003b7e
inc edi
cmp edi, 0x4bad
jl 0x10003b7c
inc esi
cmp esi, 0x7111
jl 0x10003b7a
mov edx, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
cmp byte [ebp + 0x14], 0
je 0x10003bcc
mov eax, dword [ebp + 0x20]
cmp byte [eax], 0
je 0x10003bf9
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x10003bf9
mov eax, dword [ebp + 0x24]
mov ecx, edx
push 0xffffffffffffffff
push dword [eax]
lea eax, [ebp - 0x4c]
push eax
call fcn.1000742b
push eax
mov ecx, ebx
mov dword [ebp - 4], 1
call fcn.100074eb
push 0
push 1
lea ecx, [ebp - 0x4c]
call fcn.10008118
mov dword [ebp - 4], 2
cmp dword [ebp + 0x1c], 0x6546
jge 0x10003b45
mov edx, str.nylcor_efzqyb_bqj_qocw_bndm_wiwegzne_jrco_kyux_amcq_yjrojbblz
mov ecx, 0x1007bf98
call fcn.1000a079
jmp 0x10003b45
Function at 0x100044d9
Capabilities:
Get thread local storage value

Disassembly:
mov eax, 0x100607e8
call fcn.10060010
sub esp, 0x10
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], cl
je 0x10004548
test cl, cl
je 0x1000450b
mov eax, dword [ebp + 0x1c]
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
sar ecx, 2
mov dword [edx], ecx
jmp 0x10004622
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x10004622
push 1
push 0x61b8
push 0x6948
push 0xa37
push 1
push 0
push 0xde2
mov edx, 0x4748
mov ecx, 0x481e
call fcn.100047a3
add esp, 0x1c
jmp 0x10004622
mov dword [ebp - 0x18], 0x227c
cmp dword [ebp - 0x18], 0x22e9
jle 0x100045a7
push 0x4bf
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
xor esi, esi
mov dword [ebp + 0xc], esi
xor edi, edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov esi, edx
mov ecx, ebx
mov eax, esi
shl eax, cl
mov ecx, 0x1007bf98
cdq
push edx
push eax
call fcn.10007154
inc ebx
cmp ebx, 0x27c
jl 0x10004573
mov esi, dword [ebp + 0xc]
inc edi
cmp edi, 0x5004
jl 0x1000456a
inc esi
mov dword [ebp + 0xc], esi
cmp esi, 0x693b
jl 0x10004568
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x20b0
jge 0x100045c3
mov edx, str.mrmd_nyogru_xgl_ywkpy_yacvkmow_uur_hth_udojgartv_lwul_gnzqja_phqp
mov ecx, 0x1007bf98
call fcn.1000a079
cmp byte [ebp + 0x14], 0
je 0x10004608
mov edx, dword [ebp + 0x18]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10004622
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x32e26595
inc dword [edx]
cmp dword [edx], 2
jl 0x100045da
jmp 0x10004622
push 0x24ee
push 0x4b8
push 0x1703
push 0x1111
call dword [sym.imp.USER32.dll_CheckRadioButton]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10010aed
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x18]
test eax, eax
je 0x10010b36
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10010b1d
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
jmp 0x10010b34
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
jmp 0x10010b52
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
push dword [ebp - 0x14]
push 0
push dword [ebp - 0x18]
call fcn.1001058b
add esp, 0xc
mov esp, ebp
pop ebp
ret

Function at 0x10010bb8
Capabilities:
Create directory

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10010c23
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10010bf4
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
jmp 0x10010c21
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [eax], 1
jmp 0x10010c49
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
push 0xf6f
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 0x31d7
push 0
call fcn.100127a1
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x10012a4d
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060d67
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10012ad9
lea eax, [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x10012abd
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov ecx, dword [ebp - 0x3c]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x10012ad4
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x1c]
mov dword [ecx], eax
jmp 0x10012bab
mov dword [ebp - 0x20], 0x7c94
mov dword [ebp - 0x48], str.opunva_alkiac_arjvqsfd_tahaezzk_cpvuns_bhynczkki_ojsg
cmp dword [ebp - 0x20], 0x7df0
jle 0x10012b43
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
and dword [ebp - 0x14], 0
jmp 0x10012b03
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0xcc2
jge 0x10012b43
and dword [ebp - 0x18], 0
jmp 0x10012b19
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x19f3
jge 0x10012b41
mov eax, dword [ebp - 0x14]
xor eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
mov ecx, 0x1007bf98
call fcn.10007154
jmp 0x10012b12
jmp 0x10012afc
push 0x731b
push 0x2121
push 0
push 0x254
push 0x7fc1
push 0x6159
push 0x538c
call fcn.1000f833
add esp, 0x1c
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x79de
jge 0x10012b85
mov edx, dword [ebp - 0x48]
mov ecx, 0x1007bf98
call fcn.1000a079
jmp 0x10012ba1
or dword [ebp - 4], 0xffffffff
jmp 0x10012bab
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100148c5
Capabilities:
Create process on windows

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060dda
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10014a71
lea eax, [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10014a48
mov dword [ebp - 0x24], 0x1260
mov dword [ebp - 0x30], str.zpz_wax_cxxzgefuh_cabiisj_bnjqdwcff_pchckwkts_nlxubfkn_zttigbdh
cmp dword [ebp - 0x24], 0x13ad
jle 0x100149ca
push 0
push 0
push 0
push 0
push 0x2644
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateProcessA]
and dword [ebp - 0x18], 0
jmp 0x1001494c
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x6576
jge 0x100149ca
and dword [ebp - 0x1c], 0
jmp 0x10014962
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x72bd
jge 0x100149c5
and dword [ebp - 0x20], 0
jmp 0x10014978
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x1b7f
jge 0x100149c3
mov eax, dword [ebp - 0x18]
cdq
idiv dword [ebp - 0x1c]
mov eax, edx
cdq
idiv dword [ebp - 0x20]
mov eax, edx
cdq
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x34], edx
push dword [ebp - 0x34]
push dword [ebp - 0x38]
lea ecx, [ebp - 0x50]
call fcn.100025b7
pop ecx
pop ecx
mov dword [ebp - 0x2c], eax
mov ecx, dword [ebp - 0x2c]
call fcn.1000704b
push eax
call fcn.1004b05d
pop ecx
lea ecx, [ebp - 0x50]
call fcn.10007041
jmp 0x10014971
jmp 0x1001495b
jmp 0x10014945
mov byte [ebp - 0x11], 0
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0xec4
jge 0x100149e4
push dword [ebp - 0x30]
call fcn.1004b05d
pop ecx
jmp 0x10014a00
or dword [ebp - 4], 0xffffffff
jmp 0x10014a0a
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x10014a46
push 1
push 0x36f2
push 0
push 0x41c0
push 0x2d81
push 0x320
push 0x3939
push 0x6601
push 0x370
push 0x1a47
call fcn.100126d9
add esp, 0x28
jmp 0x10014a6f
mov byte [ebp - 0x12], 0
movzx eax, byte [ebp - 0x12]
test eax, eax
je 0x10014a6f
push 1
push 0x13f2
push 0x3b83
push 1
push 0x7238
call fcn.10010aed
add esp, 0x14
jmp 0x10014a8a
push 0x4e6b
push 0x3efd
push 0x35e9
push 1
call fcn.10010b93
add esp, 0x10
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10015341
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x54
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100153eb
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x100153dc
mov eax, dword [ebp - 8]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
mov eax, dword [ebp - 0x2c]
push dword [eax]
mov eax, dword [ebp - 0x30]
push dword [eax]
lea eax, [ebp - 0x54]
push eax
call fcn.1000f3c1
add esp, 0x10
mov dword [ebp - 0x34], eax
push dword [ebp - 0x34]
mov ecx, dword [ebp - 0x38]
call fcn.100072c9
lea ecx, [ebp - 0x54]
call fcn.100072ee
jmp 0x100153e9
push 0
push 0x182d
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x10015426
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
push 0x71c1
push 0x6fe4
push 0x1c5e
push 0x7203
push dword [ebp - 0x3c]
push 0x57bb
push 0x5396
push 0x90
push 1
push 0x6134
call fcn.1000f505
add esp, 0x28
mov esp, ebp
pop ebp
ret
Function at 0x1001d8fc
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov byte [ebp - 8], cl
push esi
mov esi, edx
push edi
test cl, cl
je 0x1001d939
mov eax, dword [ebp + 0xc]
push 0x1a
pop edi
mov ecx, dword [eax]
cmp ecx, edi
jge 0x1001d922
mov eax, dword [ebp + 0x14]
movsx edx, byte [eax]
add edx, ecx
jmp 0x1001d92f
mov eax, ecx
cdq
idiv edi
mov eax, dword [ebp + 0x18]
movsx eax, byte [eax]
add edx, eax
push edx
mov ecx, esi
call fcn.10019d8d
jmp 0x1001d94b
xor eax, eax
mov byte [ebp - 1], al
cmp byte [ebp - 1], al
je 0x1001d94b
push eax
push eax
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1001df9d
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x1001dfb4
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x1001dfd6
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x1009f754
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x1009fae0
jl 0x1001dfe4
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x1009fd84
jl 0x1001e024
mov ecx, dword [0x100a0ad0]
xor ecx, dword [0x1009f754]
and ecx, edi
xor ecx, dword [0x100a0ad0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x1009f750], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x1009fd84]
mov dword [0x100a0110], eax
pop esi
ret
Function at 0x1001f00e
Capabilities:
Get memory capacity

Disassembly:
mov eax, 0x10061180
call fcn.10060010
sub esp, 0x14
cmp byte [ebp + 0x20], 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], edi
je 0x1001f045
push 0x6b78
lea edx, [ebp - 0x11]
mov byte [ebp - 0x11], 0
xor cl, cl
call fcn.1001f121
pop ecx
jmp 0x1001f110
mov dword [ebp - 0x18], 0x1300
cmp dword [ebp - 0x18], 0x16a1
jle 0x1001f084
push 0
call dword [sym.imp.KERNEL32.dll_GlobalMemoryStatus]
xor esi, esi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x1007bf98
or eax, esi
cdq
push edx
push eax
call fcn.10007154
inc ebx
cmp ebx, 0x1dd3
jl 0x1001f061
inc esi
cmp esi, 0x76f0
jl 0x1001f05f
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x12d5
jge 0x1001f0bf
mov edx, str.exloon_eih_igz_vmhewgs_pbno_rjemhsea_ebjqjhkv
mov ecx, 0x1007bf98
call fcn.1000a079
jmp 0x1001f0bf
mov eax, dword [ebp + 0xc]
xor esi, esi
mov ecx, dword [ebp + 0x18]
inc esi
mov ebx, dword [ebp + 0x1c]
mov dword [eax], esi
mov eax, dword [ecx]
mov eax, dword [ebx]
mov eax, dword [ecx]
mov eax, dword [ecx]
mov eax, dword [ebp + 8]
cmp dword [eax], esi
je 0x1001f0e4
mov eax, dword [ebp + 0x10]
cmp dword [eax], 0
jne 0x1001f0e6
xor esi, esi
mov edx, dword [ebx]
xor ecx, ecx
mov eax, dword [edi]
mov dword [eax], edx
sub edx, esi
mov eax, dword [ebx]
sub edx, eax
mov eax, dword [ebx]
cmp edx, eax
mov eax, dword [ebx]
setge cl
xor edx, edx
cmp ecx, 0x349124c6
mov ecx, dword [ebp + 8]
setge dl
imul eax, edx
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001f26f
Capabilities:
Get common file path

Disassembly:
mov eax, 0x10061194
call fcn.10060010
sub esp, 0x10
push ebx
push esi
push edi
mov dword [ebp - 0x14], 0x62fe
mov edi, edx
cmp dword [ebp - 0x14], 0x6407
mov ebx, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
jle 0x1001f2d5
xor esi, esi
xor edi, edi
mov ecx, edi
mov eax, esi
shl eax, cl
mov ecx, 0x1007bf98
cdq
push edx
push eax
call fcn.10007154
inc edi
cmp edi, 0x1471
jl 0x1001f2a0
inc esi
cmp esi, 0x6ca9
jl 0x1001f29e
push 0xca1
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
mov edi, dword [ebp - 0x18]
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x60c3
jge 0x1001f313
mov edx, str.qxtfsdjc_bacidefs_rlookbix_igmj_mwfsk_auqya_hzwrejcb_qmnm_cjn_ofszi
mov ecx, 0x1007bf98
call fcn.1000a079
jmp 0x1001f313
cmp byte [ebp + 0xc], 0
je 0x1001f320
xor eax, eax
mov word [ebx], ax
jmp 0x1001f32f
cmp byte [edi], 0
je 0x1001f32f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10027202
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10027262
mov eax, dword [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x14], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10027240
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
and dword [eax], 0
jmp 0x10027260
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x10027260
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x10027287
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x20], eax
push 0
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push dword [ebp - 0x28]
call fcn.10027b04
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10038703
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0xc], 0
je 0x10038724
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x10038737
push 0x22a8
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
jmp 0x10038737
lea eax, [ebp - 2]
mov byte [ebp - 2], 0
push eax
sub esp, 0x10
call fcn.100398f7
add esp, 0x14
mov esp, ebp
pop ebp
ret

Function at 0x10038e21
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061915
call fcn.10060010
sub esp, 0x2c
push ebx
push esi
mov byte [ebp - 0x14], dl
mov dword [ebp - 0x18], 0x5061
cmp dword [ebp - 0x18], 0x5363
push edi
mov dword [ebp - 0x10], esp
jle 0x10038e87
xor esi, esi
mov edi, esi
mov ebx, 0x15d3
mov eax, edi
lea ecx, [ebp - 0x38]
cdq
push edx
push eax
call fcn.100025b7
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10038e67
mov eax, dword [eax]
push eax
call fcn.1004b05d
pop ecx
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.10007cc3
dec edi
dec ebx
jne 0x10038e50
inc esi
cmp esi, 0x4c4f
jl 0x10038e49
cmp dword [ebp - 0x18], 0x4db6
jge 0x10038e9b
push str.zug_thwkvvo_uics_afqm_vhpbsi
call fcn.1004b05d
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x20], 0x77c1
cmp dword [ebp - 0x20], 0x7a40
jle 0x10038f06
push 0
call dword [sym.imp.GDI32.dll_CreatePalette]
xor edi, edi
xor esi, esi
mov dword [ebp - 0x1c], esi
xor ebx, ebx
mov dword [ebp - 0x18], 0x4616
xor esi, esi
mov ecx, esi
mov eax, ebx
shl eax, cl
mov ecx, 0x1007bf98
xor eax, edi
cdq
push edx
push eax
call fcn.10007154
inc esi
cmp esi, 0x6723
jl 0x10038ec9
mov esi, dword [ebp - 0x1c]
add ebx, esi
dec dword [ebp - 0x18]
jne 0x10038ec7
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x7fe9
jl 0x10038ebe
inc edi
cmp edi, 0x611
jl 0x10038eb9
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x751a
jge 0x10038f25
mov edx, str.ihwv_pfqiymb_wdpv_bezvad_qetilwpee_zdr
mov ecx, 0x1007bf98
call fcn.1000a079
cmp byte [ebp - 0x14], 0
je 0x10038f6a
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x10038f75
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 8
inc dword [edx]
cmp dword [edx], 1
jl 0x10038f3c
jmp 0x10038f75
push 0x233c
call dword [sym.imp.GDI32.dll_CreateCompatibleDC]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret