joyce8/EMBER2024-capa huggingface dataset:
Function at 0x44daf3
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x8c
mov edi, dword [ebp + 0xc]
mov ebx, dword [ebp + 0x10]
mov esi, dword [ebx + 0x10]
mov dword [esp], 0x44daf0
call sub.cygwin1.dll_chdir
test eax, eax
js 0x44db5f
mov dword [esp], 0
call fcn.00450d90
lea eax, [ebp - 0x78]
mov dword [esp + 4], eax
mov dword [esp], 0x44cf7a
call sub.cygwin1.dll__stat64
test eax, eax
js 0x44db5f
mov eax, dword [ebp - 0x78]
mov edx, dword [ebp + 8]
cmp eax, dword [edx + 4]
jne 0x44db5f
mov ecx, dword [ebp - 0x6c]
xor ecx, dword [edx + 0xc]
mov eax, dword [ebp - 0x70]
xor eax, dword [edx + 8]
mov edx, 0
or eax, ecx
je 0x44dbfa
mov dword [esp], ebx
call fcn.0044da5e
mov edx, 0xffffffff
test eax, eax
js 0x44dbfa
mov eax, dword [esi]
movzx ebx, byte [edi + eax]
mov byte [edi + eax], 0
mov eax, dword [esi]
mov dword [esp], eax
call sub.cygwin1.dll_chdir
test eax, eax
jns 0x44dbab
call fcn.00450d70
cmp eax, 0x5b
jne 0x44dba4
mov eax, dword [esi]
mov dword [esp], eax
call fcn.0044dc07
test eax, eax
jns 0x44dbab
mov eax, dword [esi]
mov byte [edi + eax], bl
jmp 0x44dbf5
mov eax, dword [esi]
mov byte [edi + eax], bl
mov dword [esp], 0
call fcn.00450d90
lea eax, [ebp - 0x78]
mov dword [esp + 4], eax
mov dword [esp], 0x44cf7a
call sub.cygwin1.dll__stat64
test eax, eax
js 0x44dbf5
mov eax, dword [ebp - 0x78]
mov ebx, dword [ebp + 8]
cmp eax, dword [ebx + 4]
jne 0x44dbf5
mov eax, dword [ebp - 0x70]
mov edx, dword [ebp - 0x6c]
mov ecx, dword [ebx + 0xc]
xor ecx, edx
xor eax, dword [ebx + 8]
mov edx, 0
or ecx, eax
je 0x44dbfa
mov edx, 0xffffffff
mov eax, edx
add esp, 0x8c
pop ebx
pop esi
pop edi
pop ebp
ret

Function at 0x44dc07
Capabilities:
Set current directory

Disassembly:
push ebp
mov ebp, esp
push esi
push ebx
sub esp, 0x10
mov esi, dword [ebp + 8]
cmp byte [esi], 0
je 0x44dc51
mov dword [esp + 4], 0x2f
mov dword [esp], esi
call sub.cygwin1.dll_strchr
mov ebx, eax
test eax, eax
je 0x44dc30
mov byte [eax], 0
mov dword [esp], esi
call sub.cygwin1.dll_chdir
mov edx, 0xffffffff
test eax, eax
js 0x44dc56
test ebx, ebx
je 0x44dc51
mov byte [ebx], 0x2f
lea esi, [ebx + 1]
cmp byte [ebx + 1], 0
jne 0x44dc17
mov edx, 0
mov eax, edx
add esp, 0x10
pop ebx
pop esi
pop ebp
ret

Function at 0x44ef3f
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push ebx
sub esp, 0x14
mov ebx, dword [ebp + 8]
cmp dword [0x4a23d0], 0
je 0x44ef75
mov edx, dword [0x4a23d0]
mov eax, dword [edx + 8]
mov dword [esp + 4], eax
mov dword [esp], ebx
call dword [edx + 4]
mov eax, dword [0x4a23d0]
mov eax, dword [eax]
mov dword [0x4a23d0], eax
test eax, eax
jne 0x44ef52
mov dword [esp], ebx
call sub.cygwin1.dll_exit
Function at 0x451b20
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0xc], ebx
mov dword [ebp - 8], esi
mov dword [ebp - 4], edi
mov ebx, dword [ebp + 8]
mov edi, dword [ebp + 0x10]
mov esi, dword [ebp + 0xc]
mov dword [esp], ebx
call fcn.00455805
test al, 2
je 0x451b5e
mov dword [esp], ebx
call sub.cygwin1.dll_fileno
mov dword [esp + 8], edi
mov dword [esp + 4], esi
mov dword [esp], eax
call fcn.00455910
jmp 0x451baa
mov dword [esp + 0xc], ebx
mov dword [esp + 8], edi
mov dword [esp + 4], 1
mov dword [esp], esi
call sub.cygwin1.dll_fwrite
test byte [ebx + 0xc], 0x40
je 0x451baa
mov dword [esp], ebx
call fcn.00455805
test al, 1
jne 0x451ba5
test byte [0x4a34a0], 1
jne 0x451ba5
mov dword [esp + 4], 0
mov dword [esp], str.file_write_err
call fcn.004514fa
mov eax, 0xffffffff
mov ebx, dword [ebp - 0xc]
mov esi, dword [ebp - 8]
mov edi, dword [ebp - 4]
mov esp, ebp
pop ebp
ret
Function at 0x451dab
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0x9c
mov ebx, dword [ebp + 0x14]
mov dword [ebp - 0x80], 0
mov eax, 0
cmp dword [ebp + 8], 0
je 0x451fae
mov dword [esp + 4], 0x2f
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_strchr
test eax, eax
jne 0x451e32
mov dword [ebp - 0x7c], ebx
test ebx, ebx
jne 0x451e08
mov dword [esp], 0x451d9f
call sub.cygwin1.dll_getenv
mov dword [ebp - 0x7c], eax
test eax, eax
jne 0x451e08
mov dword [ebp - 0x7c], 0x451da4
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
call sub.cygwin1.dll_strdup
mov dword [ebp - 0x7c], eax
mov esi, eax
mov eax, 0
test esi, esi
je 0x451fae
jmp 0x451e54
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
call sub.cygwin1.dll_free
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_strdup
jmp 0x451fae
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
call sub.cygwin1.dll_free
mov eax, edi
jmp 0x451fae
mov ebx, esi
mov dword [esp + 4], 0x3a
mov dword [esp], esi
call sub.cygwin1.dll_strchr
mov esi, eax
test eax, eax
je 0x451e70
mov byte [eax], 0
inc esi
cmp byte [ebx], 0
jne 0x451e96
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sub.cygwin1.dll_strdup
mov edi, eax
test eax, eax
jne 0x451ee9
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
call sub.cygwin1.dll_free
jmp 0x451fa9
mov edi, ebx
mov al, 0
cld
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
mov edx, ecx
not edx
mov edi, dword [ebp + 8]
mov ecx, 0xffffffff
repne scasb al, byte es:[edi]
not ecx
add ecx, edx
mov dword [esp], ecx
call sub.cygwin1.dll_malloc
mov edi, eax
test eax, eax
je 0x451e27
mov dword [esp + 0x10], 0
mov eax, dword [ebp + 8]
mov dword [esp + 0xc], eax
mov dword [esp + 8], 0x451da9
mov dword [esp + 4], ebx
mov dword [esp], edi
call fcn.00453b30
mov dword [esp], 0
call fcn.00450d90
lea eax, [ebp - 0x78]
mov dword [esp + 4], eax
mov dword [esp], edi
call sub.cygwin1.dll__stat64
test eax, eax
js 0x451f46
cmp dword [ebp + 0x10], 0
je 0x451f1d
mov eax, dword [ebp - 0x68]
and eax, 0xf000
cmp eax, 0x8000
jne 0x451f34
mov eax, dword [ebp + 0xc]
mov dword [esp + 4], eax
mov dword [esp], edi
call fcn.004556ec
test eax, eax
jns 0x451e42
call fcn.00450d70
mov ebx, eax
test eax, eax
jne 0x451f4d
mov ebx, 8
jmp 0x451f4d
call fcn.00450d70
mov ebx, eax
mov dword [esp], edi
call sub.cygwin1.dll_free
cmp dword [ebp - 0x80], 0
jne 0x451f72
cmp ebx, 2
je 0x451f8b
cmp ebx, 0x14
je 0x451f72
cmp ebx, 0x15
je 0x451f72
cmp ebx, 5
je 0x451f72
mov dword [ebp - 0x80], ebx
cmp ebx, 2
je 0x451f8b
cmp ebx, 0x14
je 0x451f8b
cmp ebx, 0x15
je 0x451f8b
cmp ebx, 5
je 0x451f8b
cmp ebx, 0xd
jne 0x451f93
test esi, esi
jne 0x451e54
mov eax, dword [ebp - 0x7c]
mov dword [esp], eax
call sub.cygwin1.dll_free
mov eax, dword [ebp - 0x80]
mov dword [esp], eax
call fcn.00450d90
mov eax, 0
add esp, 0x9c
pop ebx
pop esi
pop edi
pop ebp
ret
Function at 0x10001695
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
test dl, dl
je 0x100016a9
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
shr eax, 2
inc eax
mov dword [ecx], eax
pop ebp
ret
push 0xb19
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
pop ebp
ret
Function at 0x100095b3
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060390
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x50
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], 0x53ad
mov dword [ebp - 0x40], str.jhaekx_fgnccxrts_nsewe_zbqo_igygzz_nio_udmbhf_slai_ztrf_iohj_dizwyxx_ylwonta
cmp dword [ebp - 0x24], 0x55f7
jle 0x100096a3
push 0
call dword [sym.imp.USER32.dll_SetKeyboardState]
and dword [ebp - 0x14], 0
jmp 0x10009605
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x58b5
jge 0x100096a3
and dword [ebp - 0x18], 0
jmp 0x1000961f
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x1b5c
jge 0x1000969e
and dword [ebp - 0x1c], 0
jmp 0x10009635
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x7300
jge 0x10009699
and dword [ebp - 0x20], 0
jmp 0x1000964b
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x367c
jge 0x10009697
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
sar eax, cl
mov ecx, dword [ebp - 0x1c]
sub ecx, dword [ebp - 0x20]
xor eax, ecx
cdq
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
push dword [ebp - 0x44]
push dword [ebp - 0x48]
lea ecx, [ebp - 0x60]
call fcn.10004d43
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
call fcn.10002db1
push eax
call fcn.10047823
pop ecx
lea ecx, [ebp - 0x60]
call fcn.10002da7
jmp 0x10009644
jmp 0x1000962e
jmp 0x10009618
jmp 0x100095fe
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100096f9
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x100096d2
push 0
push 0
push 0x678
call dword [sym.imp.USER32.dll_SetPropA]
jmp 0x100096f7
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
movzx eax, byte [eax]
test eax, eax
je 0x100096f7
push 0xb19
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
jmp 0x10009711
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
push 0x2c21
push dword [ebp - 0x3c]
push 0
call fcn.1000bd9e
add esp, 0xc
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x5125
jge 0x10009727
push dword [ebp - 0x40]
call fcn.10047823
pop ecx
jmp 0x10009743
or dword [ebp - 4], 0xffffffff
jmp 0x1000974d
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10014f8a
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x10060757
call fcn.1005fa90
sub esp, 0x14
mov byte [ebp - 0x14], cl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test cl, cl
je 0x10014fc4
push 0xb19
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x1c], 0x5777
cmp dword [ebp - 0x1c], 0x57a2
jle 0x10015023
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov eax, ebx
cdq
idiv ecx
mov ecx, edi
mov eax, esi
sub ecx, edx
shl eax, cl
mov ecx, 0x1007fc58
cdq
push edx
push eax
call fcn.10002dd1
mov ecx, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x4a78
jl 0x10014fdf
inc ebx
cmp ebx, 0xef0
jl 0x10014fda
inc edi
cmp edi, 0x7833
jl 0x10014fd8
inc esi
cmp esi, 0x4e42
jl 0x10014fd6
mov eax, dword [ebp + 8]
mov esi, dword [eax]
mov edi, dword [eax]
mov eax, dword [ebp + 0x10]
mov edx, dword [eax]
mov eax, dword [edx + esi*4]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x574a
mov dword [edx + edi*4], eax
jge 0x10014fb3
mov edx, str.fzu_qhodsqro_kqzzykgij_fwkpvhy_cmhopnbo_xibaimwq_vndcofb_zgxj_mypxhajbm
mov ecx, 0x1007fc58
call fcn.10004788
jmp 0x10014fb3
Function at 0x10015253
Capabilities:
Delete directory

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
je 0x1001527b
cmp byte [ecx], 0
je 0x1001543b
push 0
call dword [sym.imp.KERNEL32.dll_RemoveDirectoryW]
jmp 0x1001543b
mov dword [esp + 0x10], 0x1bf2
mov dword [esp + 0x20], 0xfffffffd
mov dword [esp + 0x14], 0xffffffff
mov dword [esp + 0x20], 0x66f5
cmp dword [esp + 0x20], 0x6887
push 1
pop ebx
jle 0x10015315
xor esi, esi
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [esp + 0x24], eax
lea ecx, [eax + ebx]
mov eax, esi
add ecx, edi
sar eax, cl
lea ecx, [esp + 0x30]
cdq
push edx
push eax
call fcn.10004d43
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x100152d3
mov eax, dword [eax]
push eax
call fcn.10047823
pop ecx
push 0
push 1
lea ecx, [esp + 0x38]
call fcn.100031ae
mov eax, dword [esp + 0x24]
inc eax
mov dword [esp + 0x24], eax
cmp eax, 0x60c9
jl 0x100152b4
inc ebx
cmp ebx, 0x26d1
jl 0x100152ae
inc edi
cmp edi, 0x5723
jl 0x100152ac
inc esi
cmp esi, 0x5851
jl 0x100152aa
xor ebx, ebx
inc ebx
mov dword [esp + 0x24], 0xfffffffc
cmp dword [esp + 0x20], 0x65a5
jge 0x10015332
push str.wtzd_fux_vkk_eaycvy_dbrsmhmnx_ztqpdzpep_iilf_epvywr_vkmdqij_akcdqlcfr
call fcn.10047823
pop ecx
mov dword [esp + 0x1c], 7
mov dword [esp + 0x28], 0xec7e318b
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x28], 0xaaf75d59
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x10]
mov dword [esp + 0x24], 0xffffffff
mov eax, dword [esp + 0x14]
add eax, dword [esp + 0x10]
neg eax
sbb eax, eax
inc eax
cmp eax, dword [esp + 0x14]
jl 0x10015388
cmp dword [esp + 0x24], 0
jne 0x1001538a
xor ebx, ebx
mov eax, dword [esp + 0x10]
xor edx, edx
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x20]
cmp eax, 3
push 4
setl dl
xor eax, eax
cmp ebx, 0x7790
setg al
xor ecx, ecx
add edx, eax
mov eax, dword [esp + 0x18]
cmp edx, eax
pop eax
setg cl
cmp eax, ecx
sbb eax, eax
neg eax
mov dword [esp + 0x1c], eax
je 0x100153c9
mov eax, dword [esp + 0x10]
cmp dword [esp + 0x1c], 0
je 0x100153da
mov eax, dword [esp + 0x14]
mov dword [esp + 0x28], eax
jmp 0x1001543b
mov dword [esp + 0x18], 0x24380d33
mov dword [esp + 0x28], 0x231966ba
cmp dword [esp + 0x18], 0
jne 0x10015405
mov eax, dword [esp + 0x10]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x2c]
mov eax, dword [esp + 0x20]
mov eax, dword [esp + 0x14]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x18]
mov eax, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
mov eax, dword [esp + 0x24]
mov edx, dword [esp + 0x1c]
mov eax, dword [esp + 0x14]
sub edx, 0x6409
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
setl cl
sub ecx, dword [esp + 0x28]
mov dword [esp + 0x28], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10016be3
Capabilities:
Create thread

Disassembly:
mov eax, 0x100607d3
call fcn.1005fa90
sub esp, 0x1c
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], cl
je 0x10016c47
test cl, cl
je 0x10016c25
push 1
xor dl, dl
mov byte [ebp + 0x13], 0
lea ecx, [ebp + 0x13]
call fcn.10015253
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [edx], 0
cmp dword [edx], 4
jge 0x10016c14
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 1
inc dword [edx]
cmp dword [edx], 4
jl 0x10016c33
jmp 0x10016c14
mov dword [ebp - 0x28], 0x1cc5
xor esi, esi
cmp dword [ebp - 0x28], 0x1d7b
jle 0x10016ca1
mov ebx, esi
mov dword [ebp - 0x20], esi
mov eax, esi
mov dword [ebp - 0x1c], 0x2e6f
mov esi, dword [ebp - 0x20]
mov dword [ebp - 0x18], eax
or eax, ebx
mov ecx, 0x1007fc58
cdq
push edx
push eax
call fcn.10002dd1
mov eax, dword [ebp - 0x18]
add eax, esi
dec dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
jne 0x10016c6d
inc esi
push 0
mov dword [ebp - 0x20], esi
cmp esi, 0x6a59
pop esi
jl 0x10016c5e
inc ebx
cmp ebx, 0x41b6
jl 0x10016c5b
cmp byte [ebp + 0x18], 0
je 0x10016cda
push 0x22cd
call dword [sym.imp.GDI32.dll_GetStockObject]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x28], 0x193c
jge 0x10016c14
mov edx, str.xueescbi_hdhrvnmq_kxlo_yiu_hsdnfrtiw_yawekn_muowlmt_yayjfhqeu_vobms_lxaolmd_nckdx_iozvk_osrnoyhxe_ssc
mov ecx, 0x1007fc58
call fcn.10004788
jmp 0x10016c14
mov dword [ebp - 0x24], 0x35c1
cmp dword [ebp - 0x24], 0x37d9
jle 0x10016d48
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x20], esi
mov dword [ebp - 0x1c], 0x7707
mov ebx, esi
mov esi, dword [ebp - 0x20]
mov ecx, ebx
mov eax, esi
sar eax, cl
mov ecx, 0x1007fc58
cdq
push edx
push eax
call fcn.10002dd1
inc ebx
cmp ebx, 0x17d8
jl 0x10016cfc
mov ebx, dword [ebp - 0x18]
add esi, ebx
dec dword [ebp - 0x1c]
push 0
mov dword [ebp - 0x20], esi
pop esi
jne 0x10016cf7
inc ebx
mov dword [ebp - 0x18], ebx
cmp ebx, 0x4146
jl 0x10016ced
push esi
push 0xc2e
push esi
push esi
push 0x22f3
push esi
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov edx, dword [ebp + 0xc]
mov dword [edx], esi
cmp dword [edx], 1
jge 0x10016d67
mov ebx, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [ebx]
mov dword [eax + ecx*4], 0xd4ea6801
inc dword [edx]
cmp dword [edx], 1
jl 0x10016d55
mov dword [ebp - 4], esi
cmp dword [ebp - 0x24], 0x339f
jge 0x10016cb2
mov edx, str.bvag_mir_isupap_bwot_nyds_cyhmq_rqzcqe_paueqdthk
mov ecx, 0x1007fc58
call fcn.10004788
jmp 0x10016cb2
Function at 0x10016f9d
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100607e7
call fcn.1005fa90
sub esp, 0x40
mov byte [ebp - 0x1c], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x10016fe9
mov byte [ebp - 0x15], 0
cmp byte [ebp - 0x15], 0
je 0x10016fd8
push 1
sub esp, 0xc
mov ecx, 0x50a1
push 0x4ee5
call fcn.10017539
add esp, 0x14
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x24], 0x3641
cmp dword [ebp - 0x24], 0x38ef
jle 0x1001704b
xor edi, edi
xor esi, esi
xor ebx, ebx
mov dword [ebp - 0x20], 0x3584
mov eax, ebx
lea ecx, [ebp - 0x48]
and eax, edi
cdq
push edx
push eax
call fcn.10004d43
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001701f
mov eax, dword [eax]
push eax
call fcn.10047823
pop ecx
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.100031ae
add ebx, esi
dec dword [ebp - 0x20]
jne 0x10017006
inc esi
cmp esi, 0x20ac
jl 0x10016ffd
inc edi
cmp edi, 0x21a5
jl 0x10016ffb
mov byte [ebp - 0x15], 0
cmp dword [ebp - 0x24], 0x34c4
jge 0x10017063
push str.rttxvtzw_ipuim_hijeucf_dvpne_wyrimciq
call fcn.10047823
pop ecx
or dword [ebp - 4], 0xffffffff
cmp byte [ebp - 0x15], 0
je 0x10016fd8
mov dword [ebp - 0x28], 0x2326
cmp dword [ebp - 0x28], 0x2391
jle 0x100170de
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x20], esi
xor edi, edi
mov dword [ebp - 0x24], edi
and dword [ebp - 0x30], 0
mov ecx, edi
mov edi, dword [ebp - 0x30]
mov dword [ebp - 0x2c], esi
shl esi, cl
mov eax, esi
mov ecx, 0x1007fc58
xor eax, edi
or eax, ebx
cdq
push edx
push eax
call fcn.10002dd1
inc edi
cmp edi, 0x6e5e
jl 0x1001709b
mov edi, dword [ebp - 0x24]
mov esi, dword [ebp - 0x20]
inc edi
mov dword [ebp - 0x24], edi
cmp edi, 0x5a57
jl 0x1001708d
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x4d85
jl 0x10017088
inc ebx
cmp ebx, 0x788d
jl 0x10017083
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x28], 0x208b
jge 0x10016fd8
mov edx, str.uuxayegld_ljmt_msxjds_ijs_xswpfk_yzlgkf_nzl_golupp_kbja_ogdtedcst_tssjawyy_gksnl_bqptzrt
mov ecx, 0x1007fc58
call fcn.10004788
jmp 0x10016fd8
Function at 0x100175e8
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x100607f1
call fcn.1005fa90
sub esp, 0x40
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], esp
mov esi, ecx
mov dword [ebp - 0x30], edi
mov dword [ebp - 0x20], esi
je 0x100176f7
mov dword [ebp - 0x1c], 0x3c4e
cmp dword [ebp - 0x1c], 0x3f24
jle 0x10017668
xor edi, edi
mov dword [ebp - 0x18], edi
xor ebx, ebx
and dword [ebp - 0x24], 0
mov esi, edi
mov edi, dword [ebp - 0x24]
mov ecx, ebx
shl esi, cl
mov eax, esi
mov ecx, 0x1007fc58
xor eax, edi
cdq
push edx
push eax
call fcn.10002dd1
inc edi
cmp edi, 0x602
jl 0x10017633
mov edi, dword [ebp - 0x18]
inc ebx
cmp ebx, 0x46ac
jl 0x10017626
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x58de
jl 0x10017624
mov esi, dword [ebp - 0x20]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x3932
jge 0x100176a3
mov edx, str.khz_xuovdtz_nxdyogbdm_qmnaiu_kmbm_yrzur_kfpyhk_npg_mdo_tczeris
mov ecx, 0x1007fc58
call fcn.10004788
jmp 0x100176a3
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x1c], 0
je 0x100176d1
push 0x4c7d
push 0
push 1
push 0
mov edx, 0x1732
mov byte [ebp + 0x17], 0
lea ecx, [ebp + 0x17]
call fcn.10018064
add esp, 0x10
jmp 0x100177c9
mov dword [esi], 0
cmp dword [esi], 3
jge 0x100177c9
mov edx, dword [ebp + 0xc]
mov ecx, dword [esi]
mov eax, dword [edx]
and dword [eax + ecx*4], 0
inc dword [esi]
cmp dword [esi], 3
jl 0x100176e3
jmp 0x100177c9
cmp byte [ebp + 8], 0
je 0x10017708
mov eax, dword [ebp + 0x18]
add dword [eax], 0xfffffffe
jmp 0x100177c9
mov dword [ebp - 0x24], 0x68ff
cmp dword [ebp - 0x24], 0x6ae2
jle 0x10017795
xor edi, edi
xor esi, esi
mov dword [ebp - 0x18], esi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
and dword [ebp - 0x2c], 0
mov ecx, ebx
mov ebx, esi
mov dword [ebp - 0x28], esi
mov esi, dword [ebp - 0x2c]
sar ebx, cl
mov eax, ebx
lea ecx, [ebp - 0x48]
or eax, esi
or eax, edi
cdq
push edx
push eax
call fcn.10004d43
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001774f
mov eax, dword [eax]
push eax
call fcn.10047823
pop ecx
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.100031ae
inc esi
cmp esi, 0x2a09
jl 0x10017734
mov ebx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x18]
inc ebx
mov dword [ebp - 0x1c], ebx
cmp ebx, 0x71a9
jl 0x10017724
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x317d
jl 0x1001771f
inc edi
cmp edi, 0x37c
jl 0x1001771a
mov edi, dword [ebp - 0x30]
cmp dword [ebp - 0x24], 0x65b0
jge 0x100177a9
push str.vwv_loe_nutfdhm_qozpnwhqt_fcrm_ncewllh_sjfpz_vbn_muyf
call fcn.10047823
pop ecx
mov dword [edi], 0
cmp dword [edi], 3
jge 0x100177c9
mov edx, dword [ebp + 0x10]
mov ecx, dword [edi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0xb6f9b691
inc dword [edi]
cmp dword [edi], 3
jl 0x100177b7
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10017a5d
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov byte [ebp - 8], dl
push esi
mov esi, ecx
test dl, dl
je 0x10017aa5
mov dword [esi], 0
jmp 0x10017a9e
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x10017a9c
push 1
push 0x4e84
push 1
push 0x2ca6
mov edx, 0x7f04
mov cl, 1
call fcn.1001436c
add esp, 0x10
inc dword [esi]
cmp dword [esi], 3
jle 0x10017a75
jmp 0x10017abc
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x10017abc
push 0xb19
push 0
push 0
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsW]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x100189fa
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 8], 0
push ebx
push esi
mov esi, ecx
je 0x10018a49
xor ebx, ebx
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10018a77
push 0x10ea
push 0x3fb
push 0x2022
push 0x17a4
push 1
push 0x21a
push ebx
push 0x6d4b
push 0x5183
mov dl, 1
mov ecx, 0x6806
call fcn.10018a7d
add esp, 0x24
jmp 0x10018a77
mov dword [esi], 0x1a
cmp dword [esi], 0xffffffef
je 0x10018a77
xor ebx, ebx
mov byte [ebp - 1], bl
cmp byte [ebp - 1], bl
je 0x10018a6c
push ebx
push 0xe47
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
cmp dword [esi], ebx
jne 0x10018a77
dec dword [esi]
cmp dword [esi], 0xffffffef
jne 0x10018a56
pop esi
pop ebx
mov esp, ebp
pop ebp
ret