joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100052db
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005daf2
call fcn.1005d528
sub esp, 0x1c
push ebx
mov ebx, ecx
mov dword [ebp - 0x24], ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10005328
cmp byte [ebp + 8], 0
je 0x10005307
mov eax, dword [ebp + 0x18]
dec dword [eax]
jmp 0x1000540d
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x1000540d
push ecx
mov edx, 0x8c6
xor cl, cl
call fcn.10004d5e
pop ecx
jmp 0x1000540d
cmp byte [ebp + 0x1c], 0
je 0x100053e7
mov dword [ebp - 0x20], 0x207d
cmp dword [ebp - 0x20], 0x245d
jle 0x10005392
xor edi, edi
xor esi, esi
mov dword [ebp - 0x1c], esi
xor ebx, ebx
mov dword [ebp - 0x18], 0x7b74
xor esi, esi
mov eax, ebx
mov ecx, 0x100792f8
xor eax, esi
xor eax, edi
cdq
push edx
push eax
call fcn.1000a4ec
inc esi
cmp esi, 0x6f87
jl 0x10005354
mov esi, dword [ebp - 0x1c]
add ebx, esi
dec dword [ebp - 0x18]
jne 0x10005352
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x4871
jl 0x10005349
inc edi
cmp edi, 0x728c
jl 0x10005344
mov ebx, dword [ebp - 0x24]
mov eax, dword [ebx]
mov ecx, dword [ebp + 0x10]
mov eax, dword [eax + 4]
mov dword [ecx], eax
mov ecx, dword [ecx]
mov eax, dword [ebp + 0x20]
mov dword [eax], ecx
mov eax, dword [ebp + 0x14]
mov esi, dword [ebx]
mov edx, dword [eax]
mov eax, dword [esi + 4]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x1e43
mov dword [edx], eax
jge 0x100053cb
mov edx, str.bdig_hqfk_yferrrx_fifp_cjcuruo_jydiywkne_qtvn_kzfrloskr_rrmwu_swsyp_cnai_eoicmh_iapwmblm
mov ecx, 0x100792f8
call fcn.1000c8f5
jmp 0x1000540d
mov ecx, dword [ebp + 0xc]
mov dword [ecx], 0
jmp 0x10005408
mov dword [ebp - 0x24], 3
mov dword [ebp - 0x20], 0x5c7d8169
mov eax, dword [ebp - 0x24]
mov dword [ebp - 0x20], eax
inc dword [ecx]
cmp dword [ecx], 0xa
jne 0x100053f2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100055c6
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1005db06
call fcn.1005d528
sub esp, 0x28
cmp byte [ebp + 0x1c], 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], esp
mov ebx, ecx
mov dword [ebp - 0x18], edi
mov dword [ebp - 0x1c], ebx
je 0x100056fb
mov dword [ebp + 0x1c], 0x1d3a
cmp dword [ebp + 0x1c], 0x1edc
jle 0x10005644
xor esi, esi
xor ebx, ebx
mov edi, 0x2fce
mov eax, ebx
lea ecx, [ebp - 0x34]
cdq
push edx
push eax
call fcn.10001a6a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000561d
mov eax, dword [eax]
push eax
call fcn.10046acc
pop ecx
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.1000aac7
add ebx, esi
dec edi
jne 0x10005606
inc esi
cmp esi, 0x5703
jl 0x100055ff
mov edi, dword [ebp - 0x18]
mov ebx, dword [ebp - 0x1c]
cmp dword [ebp + 0x1c], 0x198e
jge 0x10005658
push str.fzyubpv_yhhrcju_nablts_gyngehpdi_pbn_tqbvpay
call fcn.10046acc
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x18], 0
je 0x100056f5
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x100056d9
push ecx
push ecx
push 0x42d4
push 1
mov edx, 0x429f
call fcn.10002ac8
mov dword [ebp + 0x1c], 0x755e
add esp, 0x10
cmp dword [ebp + 0x1c], 0x77b2
jle 0x100056ba
xor esi, esi
xor edi, edi
lea eax, [edi + esi]
mov ecx, 0x100792f8
cdq
push edx
push eax
call fcn.1000a4ec
inc edi
cmp edi, 0x1a15
jl 0x10005698
inc esi
cmp esi, 0x2e4
jl 0x10005696
mov dword [ebp - 4], 2
cmp dword [ebp + 0x1c], 0x7526
jge 0x100056d9
mov edx, str.bxaneoc_ikjdnk_ajjcmp_lhqy_xpoi_pscfxzx_fjud_vzwacnlv_nyosavs_bpdvemvlb_tbvmttrk_kexirle_doan_eovzayz
mov ecx, 0x100792f8
call fcn.1000c8f5
jmp 0x10005730
mov eax, dword [ebx]
add dword [edi], eax
jmp 0x10005730
cmp byte [ebp + 8], 0
je 0x1000570d
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x10005730
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x10005730
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x6a9b03be
inc dword [edx]
cmp dword [edx], 3
jl 0x1000571e
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10010b64
Capabilities:
Get common file path
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005df74
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10010bab
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
push 1
push 0x35aa
push dword [ebp - 0x2c]
call fcn.10010cfe
add esp, 0xc
jmp 0x10010ced
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
lea eax, [ebp + 0x14]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x10010cd7
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x10010be5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov dword [ebp - 0x28], 0x4f2
mov dword [ebp - 0x40], str.zcpwdrr_sqzgocse_qmng_fkgoe_gmucxmts
cmp dword [ebp - 0x28], 0x7aa
jle 0x10010c95
and dword [ebp - 0x20], 0
jmp 0x10010c0d
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x19cb
jge 0x10010c83
and dword [ebp - 0x18], 0
jmp 0x10010c23
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x2091
jge 0x10010c81
and dword [ebp - 0x1c], 0
jmp 0x10010c39
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x69df
jge 0x10010c7f
and dword [ebp - 0x24], 0
jmp 0x10010c4f
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x1ec9
jge 0x10010c7d
mov eax, dword [ebp - 0x18]
sub eax, dword [ebp - 0x1c]
and eax, dword [ebp - 0x20]
xor eax, dword [ebp - 0x24]
cdq
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
push dword [ebp - 0x44]
push dword [ebp - 0x48]
mov ecx, 0x100792f8
call fcn.1000a4ec
jmp 0x10010c48
jmp 0x10010c32
jmp 0x10010c1c
jmp 0x10010c06
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileStringW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x254
jge 0x10010caf
mov edx, dword [ebp - 0x40]
mov ecx, 0x100792f8
call fcn.1000c8f5
jmp 0x10010ccb
or dword [ebp - 4], 0xffffffff
jmp 0x10010cd5
jmp 0x10010ced
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x10010ced
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10013da7
Capabilities:
Get disk size

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10013e0b
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10013df9
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x10013df7
push 1
push 0x54c5
push 0x2d95
push 0x7e40
push 0x45e4
push 0x18d4
push 0
push 1
call fcn.10017874
add esp, 0x20
jmp 0x10013e09
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
jmp 0x10013e13
push 0
call fcn.10012015
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x1002140a
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x100214a1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10021495
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
mov dword [eax], 3
jmp 0x10021454
mov eax, dword [ebp - 4]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 0
jl 0x10021493
mov dword [ebp - 8], 1
mov dword [ebp - 8], 3
jmp 0x10021473
mov eax, dword [ebp - 8]
dec eax
mov dword [ebp - 8], eax
cmp dword [ebp - 8], 0
jl 0x10021491
push 0xdb5
push 1
push 1
push 0x1616
call fcn.1001f8e2
add esp, 0x10
jmp 0x1002146c
jmp 0x10021449
jmp 0x1002149f
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x100214ba
push 0x5ac6
push 0x375e
push 1
push 0xe49
call fcn.1001efb0
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x10035d6b
Capabilities:
Get common file path

Disassembly:
mov eax, 0x1005e894
call fcn.1005d528
sub esp, 0x48
push ebx
push esi
xor ebx, ebx
mov esi, edx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], esi
cmp byte [ebp + 8], bl
je 0x10035d97
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
jmp 0x10035f3d
mov dword [ebp - 0x1c], 0x7ee4
cmp dword [ebp - 0x1c], 0x807d
jle 0x10035de6
mov edi, ebx
mov esi, edi
mov dword [ebp - 0x20], 0xc31
mov dword [ebp - 0x28], ebx
mov ecx, ebx
mov eax, esi
shl eax, cl
mov ecx, 0x100792f8
cdq
push edx
push eax
call fcn.1000a4ec
inc ebx
cmp ebx, 0x1390
jl 0x10035db5
dec esi
dec dword [ebp - 0x20]
push 0
pop ebx
jne 0x10035db2
inc edi
cmp edi, 0x309e
jl 0x10035da9
mov esi, dword [ebp - 0x24]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1c], 0x7cd6
mov dword [ebp - 0x2c], esi
jge 0x10035e04
mov edx, str.jpuxldoqc_dyzzo_yesjmj_wvekwqtod_voxf_hmwvcqcl_homoy_ssetl_uvgp_mgzlf_ipng
mov ecx, 0x100792f8
call fcn.1000c8f5
or dword [ebp - 4], 0xffffffff
cmp byte [esi], 0
jne 0x10035f3d
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push ecx
mov ecx, dword [ebp + 0xc]
push eax
call fcn.10037a98
mov dword [ebp - 0x20], 0x61928c17
mov dword [ebp - 0x1c], 0xfffffffe
mov byte [ebp - 0x15], bl
cmp byte [ebp - 0x15], 0
je 0x10035e40
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetExitCodeThread]
mov dword [ebp - 0x20], 0xffffffed
cmp dword [ebp - 0x20], 0xfffffffe
jg 0x10035f37
mov dword [ebp - 0x28], 1
mov dword [ebp - 0x1c], 0x7a2
cmp dword [ebp - 0x1c], 0xa18
jle 0x10035ea8
mov esi, ebx
mov edi, ebx
lea eax, [edi + esi]
cdq
lea ecx, [ebp - 0x50]
push edx
push eax
call fcn.10001a6a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10035e84
mov eax, dword [eax]
push eax
call fcn.10046acc
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x50]
call fcn.1000aac7
inc edi
cmp edi, 0x3369
jl 0x10035e6c
inc esi
cmp esi, 0x7df8
jl 0x10035e6a
cmp dword [ebp - 0x1c], 0x3df
jge 0x10035ebc
push str.kwktr_gdc_gyg_viezxn_bklbafuof_qijmid_hsnpsxxe
call fcn.10046acc
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], ebx
jmp 0x10035efb
mov eax, dword [ebp - 0x1c]
mov dword [ebp + eax*4 - 0x38], 0xfffffffc
inc dword [ebp - 0x1c]
cmp dword [ebp - 0x1c], 3
jl 0x10035eed
mov dword [ebp - 0x38], ebx
jmp 0x10035f29
mov eax, dword [ebp - 0x38]
add eax, dword [ebp - 0x28]
mov eax, dword [ebp - 0x20]
push 0
pop edx
setns dl
xor ecx, ecx
cmp edx, eax
setg cl
cmp ecx, 4
sbb eax, eax
neg eax
mov dword [ebp - 0x1c], eax
inc dword [ebp - 0x38]
cmp dword [ebp - 0x38], 0x19
je 0x10035f06
inc dword [ebp - 0x20]
jmp 0x10035e47
mov eax, dword [ebp - 0x2c]
mov byte [eax], 1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100365b0
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister
Terminate process

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
mov byte [esp + 4], dl
push ebx
push esi
push edi
test cl, cl
je 0x1003665a
cmp byte [ebp + 8], 0
je 0x100365ea
push 0
push 0x264b
push 0xe1
push 0x4c1
call dword [sym.imp.GDI32.dll_SetWindowExtEx]
jmp 0x10036718
mov eax, dword [0x1007e98c]
test al, 1
jne 0x10036635
xor esi, esi
mov ecx, 0x1571
inc esi
mov dword [0x1007d5f4], ecx
or eax, esi
mov edx, 0x270
or dword [0x1007e974], 0xffffffff
mov dword [0x1007e98c], eax
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, esi
mov dword [esi*4 + 0x1007d5f4], ecx
inc esi
cmp esi, edx
jl 0x10036614
mov dword [0x1007d5f0], edx
push ecx
push ecx
push 0x1007d5f0
push 0
mov edx, 0x1007d434
call fcn.10035d6b
add esp, 0x10
call fcn.10037a3a
mov ecx, dword [ebp + 0x14]
mov dword [ecx], eax
jmp 0x10036718
test dl, dl
je 0x100366ec
mov dword [esp + 0x14], 0x7571
cmp dword [esp + 0x14], 0x77c5
jle 0x100366bc
xor esi, esi
xor edi, edi
inc esi
xor ebx, ebx
mov ecx, ebx
mov eax, edi
sar eax, cl
lea ecx, [esp + 0x18]
cdq
push edx
push eax
call fcn.10001a6a
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10036697
mov eax, dword [eax]
push eax
call fcn.10046acc
pop ecx
push 0
push esi
lea ecx, [esp + 0x20]
call fcn.1000aac7
inc ebx
cmp ebx, 0x6c97
jl 0x1003667b
inc edi
cmp edi, 0x68b8
jl 0x10036679
mov byte [esp + 0xf], 0
cmp dword [esp + 0x14], 0x72c1
jge 0x100366d6
push str.tkrzuso_tiiakb_jvea_fwtwacvo_fhsxd_cyjxr_mvoyyizd_shvrru_oyurqnhql_rufwji_xesj_wnb
call fcn.10046acc
pop ecx
cmp byte [esp + 0xf], 0
je 0x10036718
push 0x9a6
push 0
call dword [sym.imp.KERNEL32.dll_TerminateProcess]
jmp 0x10036718
mov eax, dword [ebp + 0x1c]
push 0x1a
pop esi
mov ecx, dword [eax]
cmp ecx, esi
jge 0x10036702
mov eax, dword [ebp + 0x18]
movzx edx, word [eax]
add edx, ecx
jmp 0x1003670f
mov eax, ecx
cdq
idiv esi
mov eax, dword [ebp + 0x10]
movzx eax, word [eax]
add edx, eax
mov ecx, dword [ebp + 0xc]
push edx
call fcn.1000a689
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10036c2c
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005e8f0
call fcn.1005d528
sub esp, 0x10
mov byte [ebp - 0x14], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10036d05
mov dword [ebp - 0x1c], 0x2001
cmp dword [ebp - 0x1c], 0x2233
jle 0x10036c9d
push 0
call dword [sym.imp.USER32.dll_ShowCursor]
xor edi, edi
xor esi, esi
mov dword [ebp - 0x18], esi
mov ebx, esi
mov esi, 0x4b5
mov eax, ebx
mov ecx, 0x100792f8
xor eax, edi
cdq
push edx
push eax
call fcn.1000a4ec
dec ebx
dec esi
jne 0x10036c70
mov esi, dword [ebp - 0x18]
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x4986
jl 0x10036c69
inc edi
cmp edi, 0x4bf0
jl 0x10036c64
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x1e4a
jge 0x10036cb9
mov edx, str.wczclyk_sxrzcv_ojubn_efbegndr_szdrt_usefaim_wvocbbzb_cvdzu_dgxk_sabkjn_pqheua
mov ecx, 0x100792f8
call fcn.1000c8f5
mov eax, dword [ebp + 0x20]
or dword [ebp - 4], 0xffffffff
push 0x1a
pop esi
mov ecx, dword [eax]
cmp ecx, esi
jge 0x10036ced
mov eax, dword [ebp + 0x2c]
movsx edx, byte [eax]
add edx, ecx
jmp 0x10036cfa
mov eax, ecx
cdq
idiv esi
mov eax, dword [ebp + 0x30]
movsx eax, byte [eax]
add edx, eax
mov ecx, dword [ebp + 0xc]
push edx
call fcn.1001aede
jmp 0x10036d23
call fcn.100358d6
push 0xa
pop ecx
xor edx, edx
div ecx
mov eax, dword [ebp + 0x18]
mov ecx, dword [ebp + 0x10]
add dx, word [eax]
movzx eax, dx
push eax
call fcn.1000a689
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10037a98
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x10037aaf
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x10037ad1
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x1007d5f4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x1007d980
jl 0x10037adf
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x1007dc24
jl 0x10037b1f
mov ecx, dword [0x1007e970]
xor ecx, dword [0x1007d5f4]
and ecx, edi
xor ecx, dword [0x1007e970]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x1007d5f0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x1007dc24]
mov dword [0x1007dfb0], eax
pop esi
ret
Function at 0x10037b91
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov esi, 0x1007d5f4
mov ecx, dword [esi + 4]
xor ecx, dword [esi]
and ecx, 0x7fffffff
xor ecx, dword [esi]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0x634]
xor eax, ecx
mov dword [esi + 0x9c0], eax
add esi, 4
cmp esi, 0x1007dfb4
jl 0x10037b97
pop esi
ret

Function at 0x10037e73
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005e9b1
call fcn.1005d528
sub esp, 0x10
cmp byte [ebp + 0x2c], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov edi, ecx
je 0x10037f0d
mov esi, dword [edi]
xor ecx, ecx
mov eax, dword [ebp + 0x10]
mov ebx, dword [ebp + 0x18]
mov eax, dword [eax]
mov dword [eax + 4], esi
mov edx, dword [edi]
mov eax, dword [edi]
cmp edx, eax
mov eax, dword [edi]
setne cl
xor edx, edx
cmp ecx, eax
mov eax, dword [ebx]
setne dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebx]
setne cl
add eax, ecx
xor ecx, ecx
cmp esi, eax
mov eax, dword [edi]
setg cl
sub ecx, eax
jne 0x10037ecf
xor esi, esi
cmp dword [ebx], esi
je 0x10037ed2
xor esi, esi
inc esi
xor edx, edx
test esi, esi
sets dl
xor ecx, ecx
imul edx, dword [edi]
mov eax, dword [ebx]
neg edx
cmp edx, eax
mov edx, dword [ebp + 0x1c]
setg cl
cmp ecx, dword [edx]
jl 0x10037ef0
mov eax, dword [edi]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov eax, dword [eax + 4]
mov dword [ebx], eax
mov eax, dword [ebx]
mov eax, dword [ebp + 0x28]
mov eax, dword [eax]
mov eax, dword [ebp + 8]
mov ecx, dword [edx]
mov dword [eax], ecx
jmp 0x10037fa5
mov dword [ebp - 0x18], 0x15f1
xor esi, esi
cmp dword [ebp - 0x18], 0x1705
jle 0x10037f65
mov edi, esi
mov dword [ebp - 0x14], esi
mov ebx, esi
mov dword [ebp - 0x1c], esi
mov esi, ebx
and esi, edi
mov edi, dword [ebp - 0x1c]
mov eax, esi
mov ecx, 0x100792f8
xor eax, edi
cdq
push edx
push eax
call fcn.1000a4ec
inc edi
cmp edi, 0x4f39
jl 0x10037f30
mov edi, dword [ebp - 0x14]
inc ebx
push 0
pop esi
cmp ebx, 0x68eb
jl 0x10037f26
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x488e
jl 0x10037f24
mov dword [ebp - 4], esi
cmp dword [ebp - 0x18], 0x1367
jge 0x10037f80
mov edx, str.rwe_douajizx_rvac
mov ecx, 0x100792f8
call fcn.1000c8f5
mov eax, dword [ebp + 0x20]
or dword [ebp - 4], 0xffffffff
cmp byte [eax], 0
je 0x10037fa5
push 0x7352
push ecx
push ecx
push 1
sub esp, 0xc
mov edx, 0x4ca
call fcn.10037c60
add esp, 0x1c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10039764
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
cmp byte [ebp + 0xc], 0
je 0x10039782
mov eax, dword [ebp + 8]
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
mov eax, dword [ebp + 0x1c]
sar ecx, 2
mov dword [eax], ecx
jmp 0x1003978c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
mov esp, ebp
pop ebp
ret
Function at 0x1003b552
Capabilities:
Get disk size

Disassembly:
mov eax, 0x1005ebb2
call fcn.1005d528
sub esp, 0x10
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], cl
je 0x1003b5b8
cmp byte [ebp + 8], 0
je 0x1003b590
push ecx
push ecx
mov ecx, dword [ebp + 0x14]
push edx
call fcn.1001ebfe
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
xor ebx, ebx
mov byte [ebp + 0x13], bl
cmp byte [ebp + 0x13], bl
je 0x1003b57f
push 0x4655
push ebx
push 0x6626
push 1
mov edx, 0x2977
xor cl, cl
call fcn.1003b552
add esp, 0x10
jmp 0x1003b57f
test cl, cl
je 0x1003b5c4
mov eax, dword [ebp + 0xc]
and dword [eax], 0
jmp 0x1003b57f
mov dword [ebp - 0x1c], 0x21a4
xor ebx, ebx
cmp dword [ebp - 0x1c], 0x2406
jle 0x1003b62f
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x18], ebx
mov ecx, ebx
mov ebx, dword [ebp - 0x18]
mov dword [ebp + 0x10], ecx
mov eax, ebx
cdq
idiv ecx
mov eax, edi
mov ecx, edx
shl eax, cl
mov ecx, 0x100792f8
or eax, esi
cdq
push edx
push eax
call fcn.1000a4ec
mov ecx, dword [ebp + 0x10]
inc ecx
mov dword [ebp + 0x10], ecx
cmp ecx, 0x2330
jl 0x1003b5e5
inc ebx
push 0
mov dword [ebp - 0x18], ebx
cmp ebx, 0x7171
pop ebx
jl 0x1003b5dd
inc edi
cmp edi, 0x4c92
jl 0x1003b5da
inc esi
cmp esi, 0x5ce1
jl 0x1003b5d8
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetDiskFreeSpaceW]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x1c], 0x2195
jge 0x1003b57f
mov edx, str.qmarct_dqkj_enkduy_tybm_ffzh_vkcgurwc_pwqdghg_qfrne_fhwqangr_iuorpbqky_itpllxd
mov ecx, 0x100792f8
call fcn.1000c8f5
jmp 0x1003b57f
Function at 0x1003be95
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x1005ec2e
call fcn.1005d528
sub esp, 0x4c
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov ebx, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], ebx
je 0x1003bf7c
mov dword [ebp - 0x18], 0x5127
cmp dword [ebp - 0x18], 0x51a9
jle 0x1003bf16
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
and dword [ebp - 0x20], 0
mov ebx, esi
mov esi, dword [ebp - 0x20]
mov ecx, edi
shl ebx, cl
mov eax, ebx
mov ecx, 0x100792f8
or eax, esi
cdq
push edx
push eax
call fcn.1000a4ec
inc esi
cmp esi, 0x2e40
jl 0x1003bee1
mov esi, dword [ebp - 0x14]
inc edi
cmp edi, 0x7d1a
jl 0x1003bed4
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x1dce
jl 0x1003bed2
mov ebx, dword [ebp - 0x1c]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x4e1f
jge 0x1003bf51
mov edx, str.ozmaeq_akhah_ikwuuzg_ryt_ywzpf_ohcvtpaw_inad
mov ecx, 0x100792f8
call fcn.1000c8f5
jmp 0x1003bf51
mov esi, dword [ebp + 0x1c]
lea ecx, [ebp - 0x3c]
or dword [ebp - 4], 0xffffffff
push dword [ebp + 0x10]
imul edx, dword [esi], 0x18
add edx, dword [ebx]
call fcn.10037bd1
pop ecx
imul ecx, dword [esi], 0x18
push eax
add ecx, dword [ebx]
call fcn.1001ae6b
lea ecx, [ebp - 0x3c]
jmp 0x1003c02e
mov dword [ebp - 0x20], 0x7288
cmp dword [ebp - 0x20], 0x7517
jle 0x1003bfe5
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
mov dword [ebp - 0x18], edi
mov eax, edi
xor ebx, ebx
and eax, esi
mov dword [ebp - 0x24], eax
mov esi, eax
xor edi, edi
lea eax, [edi + ebx]
mov ecx, 0x100792f8
or eax, esi
cdq
push edx
push eax
call fcn.1000a4ec
inc edi
cmp edi, 0x5cc
jl 0x1003bfa3
inc ebx
cmp ebx, 0x29a4
jl 0x1003bfa1
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x14]
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x3edd
jl 0x1003bf96
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0xf76
jl 0x1003bf91
mov dword [ebp - 4], 2
cmp dword [ebp - 0x20], 0x6f4e
jge 0x1003c004
mov edx, str.fwkd_xgogryp_idqk_qltbk_kfbwtwz_thulzpq_scwd_mlp_ehknuuoi_ppofadxqy_xhm_nnv
mov ecx, 0x100792f8
call fcn.1000c8f5
mov eax, dword [ebp + 0x18]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 0xc]
push 0xffffffffffffffff
push dword [eax]
lea eax, [ebp - 0x54]
push eax
call fcn.1003c66a
mov ecx, dword [ebp + 8]
push eax
mov dword [ebp - 4], 4
call fcn.1003c71d
lea ecx, [ebp - 0x54]
push 0
push 1
call fcn.1000ae2f
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret