joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000379d
Capabilities:
Identify system language via api

Disassembly:
mov eax, 0x100584d3
call fcn.10057e90
sub esp, 0x38
push ebx
push esi
mov dword [ebp - 0x24], 0x6bcd
cmp dword [ebp - 0x24], 0x6dfb
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], edx
jle 0x1000381e
xor esi, esi
mov dword [ebp - 0x20], esi
mov ebx, esi
mov dword [ebp - 0x1c], 0x48ef
mov dword [ebp - 0x18], ebx
xor edi, edi
lea eax, [ebx + edi]
xor esi, esi
mov dword [ebp - 0x28], eax
mov ebx, eax
mov eax, ebx
mov ecx, 0x10073038
and eax, esi
cdq
push edx
push eax
call fcn.10004272
inc esi
cmp esi, 0x6bec
jl 0x100037e0
mov ebx, dword [ebp - 0x18]
inc edi
cmp edi, 0x855
jl 0x100037d6
dec ebx
dec dword [ebp - 0x1c]
mov dword [ebp - 0x18], ebx
jne 0x100037d4
mov esi, dword [ebp - 0x20]
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x5631
jl 0x100037c8
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x682a
jge 0x1000383a
mov edx, str.qjyxnkvef_qsaddb_zscazvo_nld_lgjuyvugy_fjbbdlc
mov ecx, 0x10073038
call fcn.100062fd
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], 0x7924
cmp dword [ebp - 0x1c], 0x7cfe
jle 0x100038d3
call dword [sym.imp.KERNEL32.dll_GetUserDefaultUILanguage]
xor esi, esi
mov dword [ebp - 0x20], esi
xor edi, edi
mov dword [ebp - 0x24], edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov eax, edx
mov dword [ebp - 0x28], eax
mov edi, eax
xor esi, esi
and edi, ebx
mov eax, edi
lea ecx, [ebp - 0x44]
xor eax, esi
cdq
push edx
push eax
call fcn.10001331
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000388d
mov eax, dword [eax]
push eax
call fcn.10040c20
pop ecx
push 0
push 1
lea ecx, [ebp - 0x44]
call fcn.10001542
inc esi
cmp esi, 0x78c4
jl 0x10003874
mov eax, dword [ebp - 0x28]
inc ebx
cmp ebx, 0x7b3
jl 0x1000386e
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
inc edi
mov dword [ebp - 0x24], edi
cmp edi, 0x575d
jl 0x10003862
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x2193
jl 0x1000385d
cmp byte [ebp + 0x1c], 0
je 0x10003918
mov edx, dword [ebp + 0xc]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x10003940
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xe89c674f
inc dword [edx]
cmp dword [edx], 1
jl 0x100038ea
jmp 0x10003940
mov edx, dword [ebp + 0x18]
mov eax, dword [edx]
and dword [eax], 0
mov eax, dword [edx]
cmp dword [eax], 1
jge 0x10003940
mov esi, dword [ebp - 0x2c]
mov ecx, dword [eax]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x61f6656
mov eax, dword [edx]
inc dword [eax]
mov eax, dword [edx]
cmp dword [eax], 1
jl 0x1000392a
cmp dword [ebp - 0x1c], 0x7540
jge 0x10003954
push str.vetc_iegeg_masz_hnd_rupijofpl_zxmg_gjqdp_gqire_zzfy_flythepvh_ljshlaaz_xcbawhkj
call fcn.10040c20
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100049ef
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x10004a06
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x10004a28
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x100744c4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x10074850
jl 0x10004a36
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x10074af4
jl 0x10004a76
mov ecx, dword [0x10075840]
xor ecx, dword [0x100744c4]
and ecx, edi
xor ecx, dword [0x10075840]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x100744c0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10074af4]
mov dword [0x10074e80], eax
pop esi
ret

Function at 0x100073ac
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x20
mov byte [esp], cl
mov dword [esp + 4], 0x2f6c
cmp dword [esp + 4], 0x324e
push esi
push edi
jle 0x1000740f
xor esi, esi
xor edi, edi
lea eax, [edi + esi]
cdq
lea ecx, [esp + 0x10]
push edx
push eax
call fcn.10001331
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100073e9
mov eax, dword [eax]
push eax
call fcn.10040c20
pop ecx
push 0
push 1
lea ecx, [esp + 0x18]
call fcn.10001542
inc edi
cmp edi, 0x21e4
jl 0x100073d0
inc esi
cmp esi, 0x78e6
jl 0x100073ce
cmp byte [esp + 8], 0
je 0x10007422
mov eax, dword [ebp + 0x10]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
jmp 0x10007432
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10007432
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
cmp dword [esp + 0xc], 0x2cd6
jge 0x10007447
push str.ckzevpbr_aycejrp_wenasx_nxvfhgaeb_uyl_nqsvvomud_ngfuaodyb_ftecf_pyahmbdj
call fcn.10040c20
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10007629
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
mov byte [ebp - 8], cl
test dl, dl
je 0x100076ac
test cl, cl
je 0x1000768e
push esi
mov esi, dword [ebp + 0x18]
xor edx, edx
cmp dword [esi], edx
je 0x10007648
xor ecx, ecx
inc ecx
jmp 0x1000764a
mov ecx, edx
mov eax, dword [esi]
sub ecx, eax
jne 0x10007654
cmp dword [esi], edx
je 0x10007657
xor edx, edx
inc edx
mov ecx, dword [esi]
mov eax, dword [ebp + 0x14]
sub ecx, edx
xor edx, edx
mov eax, dword [eax]
cmp eax, ecx
mov eax, dword [esi]
sete dl
sub edx, 0x2038
neg edx
pop esi
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov eax, dword [ebp + 0x10]
setg cl
xor edx, edx
cmp ecx, 0x1af7f3e7
setne dl
mov dword [eax], edx
jmp 0x100076cd
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x100076cd
xor edx, edx
push edx
push edx
push 0x262d
push 0x2011
call dword [sym.imp.USER32.dll_SetScrollInfo]
jmp 0x100076cd
cmp byte [ebp + 0xc], 0
je 0x100076c5
xor edx, edx
mov byte [ebp - 1], dl
cmp byte [ebp - 1], dl
je 0x100076cd
push edx
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
jmp 0x100076cd
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esp, ebp
pop ebp
ret
Function at 0x10007747
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov esi, edx
mov byte [esp + 0xc], cl
je 0x10007833
cmp byte [ebp + 0xc], 0
je 0x100077fc
mov dword [esp + 0x14], 0x6e44
cmp dword [esp + 0x14], 0x6f2c
jle 0x100077da
xor esi, esi
mov edi, esi
mov ebx, esi
mov eax, esi
mov dword [esp + 0x10], esi
and eax, ebx
lea ecx, [esp + 0x28]
xor eax, edi
cdq
push edx
push eax
call fcn.10001331
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100077a5
mov eax, dword [eax]
push eax
call fcn.10040c20
pop ecx
push esi
push 1
lea ecx, [esp + 0x30]
call fcn.10001542
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
cmp eax, 0x5f4d
jl 0x1000778b
inc ebx
cmp ebx, 0x923
jl 0x10007785
inc edi
cmp edi, 0x45ff
jl 0x10007783
cmp dword [esp + 0x14], 0x6ccb
jge 0x100077ef
push str.hytomxq_sdgasaxk_jrsb_copzca
call fcn.10040c20
pop ecx
mov eax, dword [ebp + 8]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x10]
jmp 0x10007912
mov eax, dword [ebp + 0x14]
xor edx, edx
mov dword [eax], 0x8e5161e3
mov eax, dword [esi]
mov eax, dword [ebp + 0x1c]
mov ecx, dword [eax]
mov eax, dword [esi]
cmp eax, ecx
mov ecx, dword [ebp + 0x24]
setle dl
mov dword [ecx], edx
mov eax, dword [esi]
mov eax, dword [esi]
mov eax, dword [ecx]
mov eax, dword [ebp + 0x20]
mov ecx, dword [esi]
mov eax, dword [eax]
mov dword [eax + ecx*4], 0x93f04518
jmp 0x10007914
mov dword [esp + 0x1c], 0x904
cmp dword [esp + 0x1c], 0xc54
push 0
pop esi
jle 0x100078de
mov dword [esp + 0x10], esi
mov edi, esi
mov dword [esp + 0x18], esi
mov ebx, esi
mov dword [esp + 0x14], esi
mov eax, edi
mov ecx, ebx
mov edi, dword [esp + 0x10]
mov ebx, esi
sar eax, cl
mov dword [esp + 0x24], eax
mov ecx, ebx
shl eax, cl
lea ecx, [esp + 0x40]
or eax, edi
cdq
push edx
push eax
call fcn.10001331
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10007888
mov eax, dword [eax]
push eax
call fcn.10040c20
pop ecx
push esi
push 1
lea ecx, [esp + 0x48]
call fcn.10001542
mov eax, dword [esp + 0x24]
inc ebx
cmp ebx, 0x52aa
jl 0x1000786c
mov ebx, dword [esp + 0x14]
mov edi, dword [esp + 0x18]
inc ebx
mov dword [esp + 0x14], ebx
cmp ebx, 0x2699
jl 0x1000785c
inc edi
mov dword [esp + 0x18], edi
cmp edi, 0x78fd
jl 0x10007856
mov eax, dword [esp + 0x10]
inc eax
mov dword [esp + 0x10], eax
cmp eax, 0x1122
jl 0x10007850
cmp dword [esp + 0x1c], 0x65b
jge 0x100078f3
push str.syihbiwt_pdrsx_zwm_clrrdehd_pliyfqb_wcqcy_ehx_izmwvd_edamdbrzs_rinvsh_pevb_kcl_eot_jdbuvsu
call fcn.10040c20
pop ecx
cmp byte [esp + 0xc], 0
je 0x10007907
push esi
push 0x45
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
jmp 0x10007914
mov eax, dword [ebp + 0x28]
mov eax, dword [eax]
mov ecx, dword [eax + 4]
mov eax, dword [ebp + 0x2c]
mov dword [eax], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008f1e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
push esi
xor esi, esi
cmp byte [ebp + 0x10], 0
je 0x10008fdb
mov dword [ebp - 8], 0xfffffff7
mov dword [ebp - 4], esi
push 2
mov dword [ebp - 4], 0xe5e5349
mov dword [ebp - 4], esi
pop ecx
jmp 0x10008f58
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x10], 0xfffffffe
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x10008f4a
mov dword [ebp - 4], esi
jmp 0x10008f70
mov eax, dword [ebp - 4]
mov dword [ebp + eax*4 - 0x18], 0xfffffffb
inc dword [ebp - 4]
cmp dword [ebp - 4], ecx
jl 0x10008f62
mov edx, dword [ebp - 0x10]
mov eax, dword [ebp - 0xc]
sub edx, 0xfffffff6
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp eax, edx
mov eax, dword [ebp - 0xc]
setle cl
xor edx, edx
cmp eax, ecx
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 8]
setle dl
add ecx, edx
xor edx, edx
cmp ecx, eax
setl dl
mov dword [ebp - 0x18], edx
test edx, edx
je 0x10008fb2
cmp dword [ebp - 0x18], esi
je 0x10008fb2
xor esi, esi
inc esi
mov eax, dword [ebp - 8]
lea ecx, [esi - 0x466604fe]
xor edx, edx
cmp ecx, eax
setg dl
xor ecx, ecx
mov dword [ebp - 4], edx
imul eax, dword [ebp - 4], 0x609f
cmp eax, 0xbcd
setne cl
mov dword [ebp - 4], ecx
jmp 0x10008fe6
push esi
push 0x45
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x1000965d
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, 0x10058792
call fcn.10057e90
sub esp, 0x14
push ebx
push esi
mov esi, ecx
mov dword [ebp - 0x20], esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10009774
mov dword [ebp - 0x1c], 0x6ec6
cmp dword [ebp - 0x1c], 0x711d
jle 0x100096ca
xor edi, edi
mov dword [ebp - 0x18], edi
xor ebx, ebx
mov esi, edi
mov edi, 0x39cf
mov eax, esi
mov ecx, 0x10073038
cdq
push edx
push eax
call fcn.10004272
add esi, ebx
dec edi
jne 0x1000969b
mov edi, dword [ebp - 0x18]
dec ebx
cmp ebx, 0xffff95fd
jg 0x10009694
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x1a1f
jl 0x10009692
mov esi, dword [ebp - 0x20]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x6bbe
jge 0x10009705
mov edx, str.gwvwh_cmqsxoa_mget_ubwowhjyc
mov ecx, 0x10073038
call fcn.100062fd
jmp 0x10009705
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 8], 0
je 0x1000976c
mov dword [esi], 0
jmp 0x10009765
mov dword [ebp - 0x18], 0x91e29ea4
mov dword [ebp - 0x18], 2
cmp dword [ebp - 0x18], 0
jl 0x10009763
mov dword [ebp - 0x14], 0xfffffffa
mov dword [ebp - 0x14], 0
jmp 0x10009755
push ecx
push ecx
push 0
push 0x7322
push dword [ebp + 0xc]
lea ecx, [ebp - 0x14]
call fcn.10007715
add esp, 0x14
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], 3
jl 0x1000973b
mov eax, dword [ebp - 0x18]
dec dword [ebp - 0x18]
jns 0x1000972b
dec dword [esi]
cmp dword [esi], 0xfffffffd
jle 0x10009717
jmp 0x1000978a
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x1000978a
cmp byte [ebp + 0x14], 0
je 0x10009785
mov eax, dword [ebp + 0x10]
mov dword [eax], 0x77dd6887
jmp 0x1000978a
mov eax, dword [ebp + 0x18]
inc dword [eax]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000979b
Capabilities:
Clear file content

Disassembly:
test cl, cl
je 0x100097e0
cmp byte [edx], 0
je 0x100097e8
push 0x3035
push 0x2852
push 0x14ed
push 0x72c4
push 0x62a5
push 0
push 0x3cdc
push 0x18a7
push 1
push 0x49cc
mov edx, 0x1b3b
mov cl, 1
call fcn.10007747
add esp, 0x28
ret
push 0
call dword [sym.imp.KERNEL32.dll_SetEndOfFile]
ret

Function at 0x1000a019
Capabilities:
Query service status

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
push ebx
push esi
mov esi, ecx
mov dword [esp + 0x20], esi
push edi
test dl, dl
je 0x1000a0fd
cmp byte [ebp + 0x10], 0
je 0x1000a0e1
mov dword [esp + 0x14], 0x5b2a
cmp dword [esp + 0x14], 0x5e8e
jle 0x1000a0b5
xor ebx, ebx
push ebx
push 0x2105
push ebx
push ebx
push 0x25bc
push 0x1543
push 0x27c
push 0x1db4
call dword [sym.imp.GDI32.dll_ExtTextOutA]
mov esi, ebx
mov edi, ebx
lea eax, [edi + esi]
cdq
lea ecx, [esp + 0x28]
push edx
push eax
call fcn.10001331
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000a090
mov eax, dword [eax]
push eax
call fcn.10040c20
pop ecx
push ebx
push 1
lea ecx, [esp + 0x30]
call fcn.10001542
inc edi
cmp edi, 0x6662
jl 0x1000a077
inc esi
cmp esi, 0x6162
jl 0x1000a075
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x1000a0c9
mov edx, 0x6449
xor cl, cl
call fcn.1000afd6
cmp dword [esp + 0x14], 0x5894
jge 0x1000a1f0
push str.ryhvzymk_pra_jnm_aao_ncsrmkjl_onwno_iqxz_bwnpadaop_cqqgr_raqhyb_xmu_utpuw
jmp 0x1000a1c5
xor ebx, ebx
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], bl
je 0x1000a1f0
push ebx
call dword [sym.imp.ADVAPI32.dll_GetLengthSid]
jmp 0x1000a1f0
cmp byte [ebp + 8], 0
je 0x1000a1cd
mov dword [esp + 0x20], 0x62b1
cmp dword [esp + 0x20], 0x64bc
push 0
pop ebx
jle 0x1000a1a4
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_QueryServiceStatus]
mov edi, ebx
mov dword [esp + 0x1c], ebx
mov eax, ebx
mov dword [esp + 0x18], 0x7b41
mov dword [esp + 0x14], eax
mov esi, ebx
cdq
lea ecx, [esp + 0x40]
idiv esi
lea eax, [edi + edx]
cdq
push edx
push eax
call fcn.10001331
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000a15a
mov eax, dword [eax]
push eax
call fcn.10040c20
pop ecx
push ebx
push 1
lea ecx, [esp + 0x48]
call fcn.10001542
mov eax, dword [esp + 0x14]
inc esi
cmp esi, 0x4f4d
jl 0x1000a13e
mov esi, dword [esp + 0x1c]
add eax, esi
dec dword [esp + 0x18]
mov dword [esp + 0x14], eax
jne 0x1000a13c
inc esi
mov dword [esp + 0x1c], esi
cmp esi, 0x416d
jl 0x1000a12e
inc edi
cmp edi, 0x490c
jl 0x1000a12a
mov esi, dword [esp + 0x24]
mov edx, dword [ebp + 0xc]
cmp dword [edx], ebx
je 0x1000a1b2
mov ecx, dword [ebp + 0x20]
mov eax, dword [ecx]
mov eax, dword [ecx]
mov eax, dword [edx]
mov dword [esi], eax
cmp dword [esp + 0x20], 0x6277
jge 0x1000a1f0
push str.tjgfnll_mxmbbmh_efyukwz
call fcn.10040c20
pop ecx
jmp 0x1000a1f0
mov edx, dword [ebp + 0x1c]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1000a1f0
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xffff
inc dword [edx]
cmp dword [edx], 2
jl 0x1000a1de
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000a24a
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100587cc
call fcn.10057e90
sub esp, 0x2c
push ebx
push esi
mov dword [ebp - 0x18], 0x350b
cmp dword [ebp - 0x18], 0x36f0
push edi
mov dword [ebp - 0x10], esp
jle 0x1000a2b7
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x14], ecx
mov eax, ebx
shl eax, cl
mov ecx, 0x10073038
xor eax, edi
or eax, esi
cdq
push edx
push eax
call fcn.10004272
mov ecx, dword [ebp - 0x14]
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x5952
jl 0x1000a278
inc ebx
cmp ebx, 0x2c85
jl 0x1000a273
inc edi
cmp edi, 0x4bd5
jl 0x1000a271
inc esi
cmp esi, 0x7e71
jl 0x1000a26f
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x33b3
jge 0x1000a2d3
mov edx, str.finctpkaa_kxwkhbx_nxp_hczx_ror_ertn_gtcn_embimdgee_dxo_uwslpw_gctfzcvm_nmaj
mov ecx, 0x10073038
call fcn.100062fd
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], 0x3636
cmp dword [ebp - 0x1c], 0x39cf
jle 0x1000a35d
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
mov dword [ebp - 0x18], edi
xor ebx, ebx
and dword [ebp - 0x20], 0
lea ecx, [ebx + edi]
mov edi, esi
mov esi, dword [ebp - 0x20]
sar edi, cl
mov eax, edi
lea ecx, [ebp - 0x38]
and eax, esi
cdq
push edx
push eax
call fcn.10001331
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000a31a
mov eax, dword [eax]
push eax
call fcn.10040c20
pop ecx
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.10001542
inc esi
cmp esi, 0x6928
jl 0x1000a301
mov esi, dword [ebp - 0x14]
inc ebx
mov edi, dword [ebp - 0x18]
cmp ebx, 0x5423
jl 0x1000a2f3
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x7ab0
jl 0x1000a2f1
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x3d0d
jl 0x1000a2ec
cmp byte [ebp + 0x14], 0
je 0x1000a395
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0x1000a3ca
push ecx
mov edx, 0x5ad
xor cl, cl
call fcn.1000979b
pop ecx
jmp 0x1000a3ca
mov esi, dword [ebp + 0xc]
mov dword [esi], 0
cmp dword [esi], 0
jl 0x1000a3ca
mov edi, dword [ebp + 0x10]
mov edx, dword [ebp + 8]
mov dword [edx], 0
jmp 0x1000a3be
mov ecx, dword [edx]
mov eax, dword [edi]
mov dword [eax + ecx*4], 0x53d2ae45
inc dword [edx]
cmp dword [edx], 1
jl 0x1000a3b1
dec dword [esi]
cmp dword [esi], 0
jge 0x1000a3a9
cmp dword [ebp - 0x1c], 0x33d8
jge 0x1000a3de
push str.tnvr_nrrcai_viqezu_emopq_jqtenh_efxrrsc_bairkb_wns_gtitqr_jezllzi
call fcn.10040c20
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000b150
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
cmp byte [ebp + 0x14], 0
push esi
mov byte [esp + 4], cl
je 0x1000b1a4
test cl, cl
je 0x1000b18b
mov edx, dword [ebp + 0x20]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x1000b1d8
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x1fc2da8a
inc dword [edx]
cmp dword [edx], 1
jl 0x1000b177
jmp 0x1000b1d8
mov eax, dword [ebp + 0x1c]
cmp byte [eax], 0
je 0x1000b1d8
push 0xcb2
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x1000b1d8
cmp byte [ebp + 0x10], 0
je 0x1000b1c9
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1000b1d8
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
and dword [eax + ecx*4], 0
inc dword [edx]
cmp dword [edx], 2
jl 0x1000b1b8
jmp 0x1000b1d8
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1000b1d8
xor dl, dl
call fcn.10009a85
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10020357
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
test dl, dl
je 0x100203bc
cmp byte [ebp + 8], 0
je 0x1002037b
cmp byte [ecx], 0
je 0x100203c9
push 0x22b7
push 0x1b16
call dword [sym.imp.GDI32.dll_SetROP2]
pop ebp
ret
mov ecx, dword [ebp + 0x1c]
xor edx, edx
mov eax, dword [ecx]
mov eax, dword [ecx]
mov eax, dword [ebp + 0x18]
mov eax, dword [eax]
imul eax, dword [ecx]
mov ecx, dword [ebp + 0x14]
cmp eax, 0xfffffff9
mov eax, dword [ebp + 0x10]
setl dl
sub edx, 4
neg edx
sbb edx, edx
inc edx
neg edx
mov dword [ecx], edx
mov eax, dword [eax]
imul eax, dword [ecx]
xor ecx, ecx
cmp eax, 0x81d2
mov eax, dword [ebp + 0xc]
setle cl
mov eax, dword [eax]
mov dword [eax], ecx
pop ebp
ret
xor eax, eax
push eax
push 0x45
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetTempFileNameW]
pop ebp
ret
Function at 0x10020813
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov byte [ebp - 4], dl
push esi
push edi
mov edi, ecx
test dl, dl
je 0x1002088e
mov esi, dword [ebp + 0x14]
mov dword [esi], 0
jmp 0x10020887
mov dword [ebp - 0xc], 0x90c54408
lea ecx, [ebp - 0x18]
push 1
call fcn.100013ad
mov dword [ebp - 8], 0
jmp 0x10020859
mov ecx, dword [ebp - 8]
mov eax, dword [ebp - 0x18]
mov dword [eax + ecx*4], 0x5714ffd8
inc dword [ebp - 8]
cmp dword [ebp - 8], 1
jl 0x10020849
push edi
lea eax, [ebp - 0xc]
mov dl, 1
push eax
push dword [ebp + 8]
lea eax, [ebp - 0x18]
mov ecx, 0x4aef
push esi
push eax
push 0
call fcn.10020357
add esp, 0x18
lea ecx, [ebp - 0x18]
call fcn.1000140a
dec dword [esi]
cmp dword [esi], 0xfffffff0
jl 0x1002082f
jmp 0x1002089e
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1002089e
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100208f6
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10059009
call fcn.10057e90
sub esp, 0x1c
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x28], ecx
je 0x10020a02
mov dword [ebp - 0x20], 0x4e75
xor esi, esi
cmp dword [ebp - 0x20], 0x4ff9
jle 0x10020987
mov ebx, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], ebx
mov dword [ebp - 0x18], 0x7f71
mov edi, esi
mov ebx, esi
mov esi, dword [ebp - 0x14]
mov ecx, ebx
mov eax, edi
shl eax, cl
mov ecx, 0x10073038
xor eax, esi
cdq
push edx
push eax
call fcn.10004272
inc ebx
cmp ebx, 0x3e2d
jl 0x10020943
inc edi
push 0
pop esi
cmp edi, 0x4bde
jl 0x1002093e
dec dword [ebp - 0x14]
dec dword [ebp - 0x18]
jne 0x1002093c
mov ebx, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 0x1c], ebx
cmp ebx, 0x2292
jl 0x10020932
mov edi, dword [ebp - 0x24]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x20], 0x4cff
jge 0x100209c3
mov edx, str.fgqqijmc_kmp_bwtbtvd_gqzb_panpcyd
mov ecx, 0x10073038
call fcn.100062fd
jmp 0x100209c3
mov eax, dword [edi]
mov eax, dword [edi]
mov dword [edi], eax
cmp dword [edi], 0x836ccb03
jne 0x100209e2
cmp dword [edi], esi
je 0x100209e2
mov eax, dword [edi]
mov eax, dword [edi]
mov eax, dword [edi]
neg eax
je 0x100209e2
xor esi, esi
inc esi
mov eax, dword [ebp + 0x18]
xor ecx, ecx
mov dword [eax], esi
mov edx, dword [eax]
mov esi, dword [ebp - 0x28]
neg edx
mov eax, dword [esi]
cmp edx, eax
sete cl
cmp ecx, 0xffffffff
sbb eax, eax
neg eax
mov dword [esi], eax
jmp 0x10020a07
mov eax, dword [ebp + 0x14]
inc dword [eax]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret