joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4266b0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 0xc]
test ecx, ecx
jne 0x4266be
xor eax, eax
pop ebp
ret
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 8]
push esi
not eax
cmp edx, 8
jb 0x42679d
mov esi, edx
shr esi, 3
push edi
jmp 0x4266e0
movzx edi, byte [ecx]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4483d8]
movzx edi, byte [ecx + 1]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4483d8]
movzx edi, byte [ecx + 2]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4483d8]
movzx edi, byte [ecx + 3]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4483d8]
movzx edi, byte [ecx + 4]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4483d8]
movzx edi, byte [ecx + 5]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4483d8]
movzx edi, byte [ecx + 6]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4483d8]
movzx edi, byte [ecx + 7]
xor edi, eax
and edi, 0xff
shr eax, 8
xor eax, dword [edi*4 + 0x4483d8]
add ecx, 8
sub edx, 8
dec esi
jne 0x4266e0
pop edi
test edx, edx
je 0x4267ba
movzx esi, byte [ecx]
xor esi, eax
and esi, 0xff
shr eax, 8
xor eax, dword [esi*4 + 0x4483d8]
inc ecx
dec edx
jne 0x4267a1
not eax
pop esi
pop ebp
ret

Function at 0x4267c0
Capabilities:
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
mov eax, dword [edx]
movsx ecx, byte [ebp + 0xc]
xor ecx, eax
shr eax, 8
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4483d8]
xor ecx, eax
movzx eax, cl
add eax, dword [edx + 4]
mov dword [edx], ecx
mov ecx, dword [edx + 8]
imul eax, eax, 0x8088405
inc eax
mov dword [edx + 4], eax
shr eax, 0x18
xor eax, ecx
and eax, 0xff
shr ecx, 8
xor ecx, dword [eax*4 + 0x4483d8]
mov dword [edx + 8], ecx
pop ebp
ret
Function at 0x426d50
Capabilities:
Encode data using xor
Generate random numbers using the delphi lcg
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp byte [esi + 0x2d], 0
push edi
mov edi, dword [ebp + 0xc]
mov eax, ebx
je 0x426e3b
mov eax, dword [esi + 0x3c]
test eax, eax
je 0x426d87
cmp dword [esi + 0x40], edi
jae 0x426d87
push eax
call fcn.0042a129
add esp, 4
mov dword [esi + 0x3c], 0
cmp dword [esi + 0x3c], 0
jne 0x426d9f
lea eax, [edi + edi]
push eax
call fcn.0042ae91
add esp, 4
mov dword [esi + 0x3c], eax
mov dword [esi + 0x40], edi
mov ecx, dword [esi + 0x3c]
push edi
push ebx
push ecx
call fcn.0042a420
add esp, 0xc
xor ebx, ebx
test edi, edi
je 0x426e38
mov edx, dword [esi + 0x3c]
mov cl, byte [ebx + edx]
mov edi, dword [esi + 0x30]
mov byte [ebp + 8], cl
movsx ecx, cl
xor ecx, edi
and ecx, 0xff
mov ecx, dword [ecx*4 + 0x4483d8]
mov dword [ebp - 4], ecx
mov eax, dword [esi + 0x38]
shr edi, 8
xor dword [ebp - 4], edi
mov ecx, dword [ebp - 4]
mov dword [esi + 0x30], ecx
movzx ecx, cl
add ecx, dword [esi + 0x34]
mov edx, eax
imul ecx, ecx, 0x8088405
inc ecx
mov dword [esi + 0x34], ecx
shr ecx, 0x18
xor ecx, eax
shr eax, 8
and ecx, 0xff
xor eax, dword [ecx*4 + 0x4483d8]
and edx, 0xfffd
mov dword [esi + 0x38], eax
mov ecx, dword [esi + 0x3c]
or edx, 2
mov eax, edx
xor eax, 1
imul eax, edx
shr eax, 8
xor al, byte [ebp + 8]
inc ebx
mov byte [ebx + ecx - 1], al
cmp ebx, dword [ebp + 0xc]
jb 0x426db7
mov edi, dword [ebp + 0xc]
mov eax, dword [esi + 0x3c]
mov edx, dword [esi + 0x20]
test edx, edx
je 0x426e7a
mov ecx, dword [esi + 0x24]
lea ebx, [ecx + edi]
cmp ebx, dword [esi + 0x28]
jb 0x426e5f
pop edi
mov dword [esi + 0x14], 0x30000
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
push edi
push eax
add ecx, edx
push ecx
call fcn.0042a420
add esp, 0xc
add dword [esi + 0x24], edi
mov eax, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
mov ecx, dword [esi + 4]
test ecx, ecx
je 0x426e9c
push 0
lea edx, [ebp + 0xc]
push edx
push edi
push eax
push ecx
call dword [0x469158]
mov eax, dword [ebp + 0xc]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 8
pop edi
mov dword [esi + 0x14], 0x1000000
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret 8
Function at 0x428430
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
push esi
mov esi, dword [ebp + 8]
push edi
xor ebx, ebx
xor edi, edi
mov dword [esi + 0x6af80], 2
cmp dword [esi + 0x6af90], ebx
je 0x428645
cmp dword [esi + 0x6af90], 3
jb 0x4284a7
mov ecx, dword [esi + 0x6af84]
movzx eax, byte [ecx + esi + 0x1af72]
mov edx, dword [esi + 0x6af7c]
shl edx, 5
xor eax, edx
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
mov ebx, dword [esi + eax*4 + 0x4af70]
and ecx, 0x7fff
mov dword [esi + ecx*4 + 0x2af70], ebx
mov eax, dword [esi + 0x6af7c]
mov ecx, dword [esi + 0x6af84]
mov dword [esi + eax*4 + 0x4af70], ecx
test ebx, ebx
je 0x4284e7
mov edx, dword [esi + 0x6af84]
sub edx, ebx
cmp edx, 0x7efa
ja 0x4284e7
mov eax, dword [esi + 0x6af90]
cmp dword [esi + 0x6afa0], eax
jbe 0x4284cf
mov dword [esi + 0x6afa0], eax
push ebx
push esi
call fcn.00425bb0
mov edi, eax
mov eax, dword [esi + 0x6af90]
add esp, 8
cmp edi, eax
jbe 0x4284e7
mov edi, eax
mov ecx, dword [esi + 0x6af84]
cmp edi, 3
jb 0x4285c4
sub ecx, dword [esi + 0x6af88]
lea eax, [edi - 3]
push eax
push ecx
push esi
call fcn.00425680
sub dword [esi + 0x6af90], edi
add esp, 0xc
mov dword [ebp + 8], eax
mov eax, dword [esi + 0x6af90]
cmp edi, dword [esi + 0x6af98]
ja 0x42858e
cmp eax, 3
jb 0x42858e
mov eax, 1
sub edi, eax
lea ecx, [ecx]
add dword [esi + 0x6af84], eax
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [esi + edx + 0x1af72]
mov ebx, dword [esi + 0x6af7c]
shl ebx, 5
xor ecx, ebx
and ecx, 0x7fff
mov dword [esi + 0x6af7c], ecx
mov ebx, dword [esi + ecx*4 + 0x4af70]
and edx, 0x7fff
sub edi, eax
mov dword [esi + edx*4 + 0x2af70], ebx
mov edx, dword [esi + 0x6af7c]
mov ecx, dword [esi + 0x6af84]
mov dword [esi + edx*4 + 0x4af70], ecx
jne 0x428530
add dword [esi + 0x6af84], eax
jmp 0x4285e7
add dword [esi + 0x6af84], edi
mov edx, dword [esi + 0x6af84]
movzx ecx, byte [edx + esi + 0x1af70]
mov dword [esi + 0x6af7c], ecx
movzx eax, byte [edx + esi + 0x1af71]
shl ecx, 5
xor eax, ecx
xor edi, edi
and eax, 0x7fff
mov dword [esi + 0x6af7c], eax
jmp 0x4285e7
movzx edx, byte [ecx + esi + 0x1af70]
push edx
push 0
push esi
call fcn.00425680
dec dword [esi + 0x6af90]
add esp, 0xc
inc dword [esi + 0x6af84]
mov dword [ebp + 8], eax
cmp dword [ebp + 8], 0
je 0x428623
mov eax, dword [esi + 0x6af74]
test eax, eax
js 0x428600
lea ecx, [eax + esi + 0x1af70]
jmp 0x428602
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 0
sub edx, eax
push edx
push ecx
push esi
call fcn.004282a0
mov eax, dword [esi + 0x6af84]
add esp, 0x10
mov dword [esi + 0x6af74], eax
cmp dword [esi + 0x6af90], 0x106
jae 0x428638
push esi
call fcn.00425d10
add esp, 4
cmp dword [esi + 0x6af90], 0
jne 0x428453
mov eax, dword [esi + 0x6af74]
test eax, eax
js 0x428658
lea ecx, [eax + esi + 0x1af70]
jmp 0x42865a
xor ecx, ecx
mov edx, dword [esi + 0x6af84]
push 1
sub edx, eax
push edx
push ecx
push esi
call fcn.004282a0
add esp, 0x10
pop edi
pop esi
pop ebx
pop ebp
ret
Function at 0x42a20a
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x456900]
jne 0x42a214
repz ret
jmp fcn.00430ad8

Function at 0x43905c
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x24
mov eax, dword [0x456900]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0xc]
push esi
push edi
mov dword [ebp - 0x1c], eax
call fcn.004321a4
and dword [ebp - 0x14], 0
cmp dword [0x46a308], 0
mov dword [ebp - 0x18], eax
jne 0x43910f
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ebx, eax
test ebx, ebx
je 0x4391b7
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxW
push ebx
call edi
test eax, eax
je 0x4391b7
mov esi, dword [sym.imp.KERNEL32.dll_EncodePointer]
push eax
call esi
push str.GetActiveWindow
push ebx
mov dword [0x46a308], eax
call edi
push eax
call esi
push str.GetLastActivePopup
push ebx
mov dword [0x46a30c], eax
call edi
push eax
call esi
push str.GetUserObjectInformationW
push ebx
mov dword [0x46a310], eax
call edi
push eax
call esi
mov dword [0x46a318], eax
test eax, eax
je 0x43910f
push str.GetProcessWindowStation
push ebx
call edi
push eax
call esi
mov dword [0x46a314], eax
mov eax, dword [0x46a314]
mov ecx, dword [ebp - 0x18]
mov esi, dword [sym.imp.KERNEL32.dll_DecodePointer]
cmp eax, ecx
je 0x439168
cmp dword [0x46a318], ecx
je 0x439168
push eax
call esi
push dword [0x46a318]
mov edi, eax
call esi
mov ebx, eax
test edi, edi
je 0x439168
test ebx, ebx
je 0x439168
call edi
test eax, eax
je 0x43915f
lea ecx, [ebp - 0x24]
push ecx
push 0xc
lea ecx, [ebp - 0x10]
push ecx
push 1
push eax
call ebx
test eax, eax
je 0x43915f
test byte [ebp - 8], 1
jne 0x439168
or dword [ebp + 0x10], 0x200000
jmp 0x43919b
mov eax, dword [0x46a30c]
cmp eax, dword [ebp - 0x18]
je 0x43919b
push eax
call esi
test eax, eax
je 0x43919b
call eax
mov dword [ebp - 0x14], eax
test eax, eax
je 0x43919b
mov eax, dword [0x46a310]
cmp eax, dword [ebp - 0x18]
je 0x43919b
push eax
call esi
test eax, eax
je 0x43919b
push dword [ebp - 0x14]
call eax
mov dword [ebp - 0x14], eax
push dword [0x46a308]
call esi
test eax, eax
je 0x4391b7
push dword [ebp + 0x10]
push dword [ebp - 0x1c]
push dword [ebp - 0x20]
push dword [ebp - 0x14]
call eax
jmp 0x4391b9
xor eax, eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.0042a20a
leave
ret
Function at 0x10006290
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10060e59
call fcn.100605f8
sub esp, 0x14
push ebx
xor ebx, ebx
mov dword [ebp - 0x20], edx
push esi
mov byte [ebp - 0x14], bl
mov esi, ecx
mov dword [ebp - 0x18], 0x7aa6
cmp dword [ebp - 0x18], 0x7ca4
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
jle 0x100062ea
mov edi, ebx
mov esi, ebx
mov eax, esi
mov ecx, 0x1007be38
xor eax, edi
cdq
push edx
push eax
call fcn.10003364
inc esi
cmp esi, 0x2fda
jl 0x100062c4
inc edi
cmp edi, 0x16d9
jl 0x100062c2
mov esi, dword [ebp - 0x1c]
mov dword [esi], ebx
cmp dword [esi], 3
jge 0x10006308
mov ebx, dword [ebp - 0x20]
mov ecx, dword [esi]
mov eax, dword [ebx]
mov dword [eax + ecx*4], 1
inc dword [esi]
cmp dword [esi], 3
jl 0x100062f4
xor ebx, ebx
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x77c3
jge 0x10006323
mov edx, str.mtxymuuxi_ssylzupj_nqtty_twelr_qljpbk_duxcqkw_avlz
mov ecx, 0x1007be38
call fcn.100055b2
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100088d2
Capabilities:
Set thread local storage value

Disassembly:
mov eax, 0x10060fd3
call fcn.100605f8
sub esp, 0x48
push ebx
push esi
push edi
mov dword [ebp - 0x1c], edx
mov dword [ebp - 0x20], 0x698e
cmp dword [ebp - 0x20], 0x69e2
push 0
pop ebx
jle 0x1000896b
push ebx
push 0x1f09
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
mov esi, ebx
mov edi, ebx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
mov eax, ebx
sar eax, cl
lea ecx, [edi + esi]
or eax, ecx
lea ecx, [ebp - 0x54]
cdq
push edx
push eax
call fcn.10001a94
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000892b
mov eax, dword [eax]
push eax
call fcn.1004840f
pop ecx
push 0
push 1
lea ecx, [ebp - 0x54]
call fcn.10003868
mov ecx, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x4abd
jl 0x1000890d
inc ebx
cmp ebx, 0x2724
jl 0x10008908
inc edi
push 0
pop ebx
cmp edi, 0x5428
jl 0x10008908
inc esi
cmp esi, 0x2ef8
jl 0x10008906
cmp byte [ebp + 0xc], 0
je 0x10008a83
mov dword [ebp - 0x28], 0xf
mov dword [ebp - 0x2c], ebx
mov byte [ebp - 0x3c], bl
push 0x7bfd
lea eax, [ebp - 0x3c]
mov dword [ebp - 4], ebx
push eax
push 1
lea eax, [ebp - 0x1c]
mov edx, 0x108c
push eax
push 1
push 0x2722
push 1
push 0x46ad
mov ecx, 0x1ae0
call fcn.100085ff
mov eax, dword [0x102f9018]
add esp, 0x20
test al, 1
jne 0x100089e1
or eax, 1
mov dword [0x102f9018], eax
push 0x123ae
mov byte [ebp - 4], 1
call fcn.10037af1
mov byte [0x102f9034], al
mov byte [ebp - 4], bl
mov eax, dword [0x102f9018]
pop ecx
test al, 2
jne 0x10008a04
or eax, 2
mov dword [0x102f9018], eax
push 0x1750e
mov byte [ebp - 4], 2
call fcn.10037af1
pop ecx
mov byte [0x102f9035], al
mov byte [ebp - 4], bl
mov esi, dword [ebp - 0x1c]
test esi, esi
je 0x10008a63
call fcn.10005efc
push 0x34
pop ecx
xor edx, edx
div ecx
push 0x536f
push 0x7b13
push 0x54f6
push ecx
lea eax, [ebp - 0x24]
mov dword [ebp - 0x24], edx
push eax
push 0x2414
push 0x102f9035
push 0x7f79
push 0x3a22
push ecx
push 0x102f9034
lea eax, [ebp - 0x3c]
mov edx, 0xd19
push eax
push 1
mov ecx, 0x23f7
call fcn.10008752
add esp, 0x34
dec esi
jne 0x10008a0b
mov ecx, dword [ebp + 8]
lea eax, [ebp - 0x3c]
cmp ecx, eax
je 0x10008a76
push 0xffffffffffffffff
push ebx
push eax
call fcn.10008c16
push ebx
push 1
lea ecx, [ebp - 0x3c]
call fcn.10008d3d
jmp 0x10008ac8
push 0x6dc4
lea eax, [ebp - 0x11]
mov byte [ebp - 0x11], bl
push eax
push 1
push ebx
push 0x462b
push 0x327c
push 0x123d
push ebx
mov edx, 0x6fa2
mov ecx, 0x60f9
call fcn.10008280
add esp, 0x20
cmp dword [ebp - 0x20], 0x66c7
jge 0x10008ac8
push str.gdinjcqo_bqtl_qrp_ijplaj
call fcn.1004840f
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10008d85
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x10008d9c
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8
Function at 0x10008dbe
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x102f7c94
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x102f8020
jl 0x10008dcc
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x102f82c4
jl 0x10008e0c
mov ecx, dword [0x102f9010]
xor ecx, dword [0x102f7c94]
and ecx, edi
xor ecx, dword [0x102f9010]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x102f7c90], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x102f82c4]
mov dword [0x102f8650], eax
pop esi
ret
Function at 0x1002315b
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061803
call fcn.100605f8
sub esp, 0x2c
mov byte [ebp - 0x14], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x1002324d
mov dword [ebp - 0x1c], 0x27b6
cmp dword [ebp - 0x1c], 0x2b9c
jle 0x100231cf
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
and dword [ebp - 0x20], 0
mov ebx, esi
mov esi, dword [ebp - 0x20]
mov ecx, edi
shl ebx, cl
mov eax, ebx
mov ecx, 0x1007be38
xor eax, esi
cdq
push edx
push eax
call fcn.10003364
inc esi
cmp esi, 0x7bf5
jl 0x1002319d
mov esi, dword [ebp - 0x18]
inc edi
cmp edi, 0x5375
jl 0x10023190
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x7047
jl 0x1002318e
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x2423
jge 0x100231eb
mov edx, str.cyfugmlwt_vexgsmj_rgaubtqq_dxlizzj_dby_vobd_yhcmfithr_kwhaliyoi_drb_pzzsz_yinlb
mov ecx, 0x1007be38
call fcn.100055b2
mov esi, dword [ebp + 0x14]
or dword [ebp - 4], 0xffffffff
push 0x18
pop ecx
mov eax, dword [esi + 4]
sub eax, dword [esi]
cdq
idiv ecx
mov ebx, eax
test ebx, ebx
je 0x10023262
xor edi, edi
mov edx, dword [esi]
lea ecx, [ebp - 0x38]
push dword [ebp + 0x18]
add edx, edi
call fcn.100229af
pop ecx
mov ecx, dword [esi]
push eax
add ecx, edi
call fcn.1002298a
push 0
push 1
lea ecx, [ebp - 0x38]
call fcn.10003d73
add edi, 0x18
dec ebx
jne 0x10023205
jmp 0x10023262
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10023262
push 0
push 0x80
call dword [sym.imp.USER32.dll_FlashWindow]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002aba7
Capabilities:
Set environment variable

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, edx
test cl, cl
je 0x1002abe8
cmp byte [ebp + 0x1c], 0
je 0x1002abd2
mov eax, dword [ebp + 0x2c]
cmp byte [eax], 0
je 0x1002ac8e
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetEnvironmentVariableW]
jmp 0x1002ac8e
mov eax, dword [ebp + 0x34]
mov ecx, dword [ebp + 0x28]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x1002ac8e
cmp byte [ebp + 0x10], 0
push esi
je 0x1002ac58
mov eax, dword [edi]
mov esi, dword [ebp + 0x18]
push ebx
mov ebx, dword [ebp + 0x38]
mov ecx, dword [eax]
mov dword [eax], ecx
mov dword [esi], ecx
xor ecx, ecx
mov eax, dword [ebx]
mov edx, dword [eax]
mov eax, dword [esi]
cmp eax, edx
sete cl
xor eax, eax
cmp ecx, edx
mov ecx, 0xb14151c8
setl al
sub eax, 0xfffe
cmp eax, 0xfffffffa
sbb eax, eax
neg eax
sub eax, 0xfdbd0176
neg eax
sbb eax, eax
inc eax
cmp ecx, eax
sbb eax, eax
neg eax
cmp eax, 0xe0b2
jle 0x1002ac3c
mov eax, dword [esi]
mov eax, dword [edi]
mov ecx, dword [ebp + 0x20]
mov eax, dword [eax]
mov dword [ecx], eax
mov eax, dword [ecx]
xor ecx, ecx
mov eax, dword [ebx]
pop ebx
cmp dword [eax], ecx
mov eax, dword [ebp + 0xc]
setg cl
mov dword [eax], ecx
jmp 0x1002ac8d
mov edx, dword [ebp + 0x14]
mov dword [edx], 0xffffffeb
cmp dword [edx], 0xb
jne 0x1002ac8d
mov esi, dword [ebp + 0x30]
mov edi, dword [ebp + 0x24]
mov dword [esi], 0
jmp 0x1002ac81
mov ecx, dword [esi]
mov eax, dword [edi]
mov dword [eax + ecx*4], 0xd976d993
inc dword [esi]
cmp dword [esi], 3
jl 0x1002ac74
inc dword [edx]
cmp dword [edx], 0xb
je 0x1002ac6c
pop esi
pop edi
pop ebp
ret
Function at 0x1002ec44
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x14], 0
je 0x1002ec5c
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x1002ec70
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
push 0
push 0x3d0
push 0xe43
push 0
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
pop ebp
ret

Function at 0x1002ee15
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061dfc
call fcn.100605f8
sub esp, 0x2c
mov byte [ebp - 0x14], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x1002ef78
cmp byte [ecx], 0
je 0x1002eee4
mov dword [ebp - 0x18], 0x235d
cmp dword [ebp - 0x18], 0x245f
jle 0x1002ee9b
xor esi, esi
xor edi, edi
xor ebx, ebx
mov eax, ebx
lea ecx, [ebp - 0x34]
or eax, edi
or eax, esi
cdq
push edx
push eax
call fcn.10001a94
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002ee6d
mov eax, dword [eax]
push eax
call fcn.1004840f
pop ecx
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.10003868
inc ebx
cmp ebx, 0x3718
jl 0x1002ee52
inc edi
cmp edi, 0x7149
jl 0x1002ee50
inc esi
cmp esi, 0x4c0f
jl 0x1002ee4e
push 0x5f65
push 0x7122
push 1
push ecx
push 0x3d7
push 0x4a6a
push ecx
push 0x5c56
push ecx
push 0x7daf
push ecx
mov ecx, 0x36da
call fcn.1002c9d0
add esp, 0x2c
cmp dword [ebp - 0x18], 0x2317
jge 0x1002eee0
push str.magv_ggxabbr_mkpigpvgy_rhjjszjoo_mqk_pliayszn_iqoeb_wycuyd_giwzg_lvoqw_asf
call fcn.1004840f
pop ecx
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x1c], 0x4b42
cmp dword [ebp - 0x1c], 0x4bb2
jle 0x1002ef3d
xor esi, esi
xor edi, edi
xor ebx, ebx
xor ecx, ecx
mov dword [ebp - 0x18], ecx
lea eax, [edi + esi]
xor eax, ecx
mov ecx, 0x1007be38
xor eax, ebx
cdq
push edx
push eax
call fcn.10003364
mov ecx, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x18], ecx
cmp ecx, 0x4f14
jl 0x1002eeff
inc ebx
cmp ebx, 0x7b5d
jl 0x1002eefa
inc edi
cmp edi, 0x634d
jl 0x1002eef8
inc esi
cmp esi, 0x542e
jl 0x1002eef6
mov dword [ebp - 4], 2
cmp dword [ebp - 0x1c], 0x485d
jge 0x1002ef5c
mov edx, str.rpxs_uwmh_bcmycxno_qbaotivgd_xxqnrk_zknhmsn_zmkcmymhv_djlikfu_phalahb_qvdokuiaj_opcjmw
mov ecx, 0x1007be38
call fcn.100055b2
jmp 0x1002ef97
push 0x632
push 0xe9f
push 0x16dc
push 0xf79
push 0x2165
call dword [sym.imp.GDI32.dll_ExcludeClipRect]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002f3d5
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x18], 0
je 0x1002f417
cmp byte [ebp + 8], 0
je 0x1002f408
mov dword [edx], 0
cmp dword [edx], 1
jge 0x1002f406
push esi
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0x5b3847d2
inc dword [edx]
cmp dword [edx], 1
jl 0x1002f3f3
pop esi
pop ebp
ret
mov eax, dword [ebp + 0xc]
push 0xfffffffffffffffb
pop edx
mov dword [ecx], edx
mov eax, dword [eax]
mov dword [eax + 0xc], edx
pop ebp
ret
cmp byte [ebp + 0x10], 0
je 0x1002f43b
mov byte [ebp + 0x1b], 0
cmp byte [ebp + 0x1b], 0
je 0x1002f406
push 0x13f3
push 0x1ff5
push 0
call dword [sym.imp.USER32.dll_CheckMenuItem]
pop ebp
ret
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
Function at 0x1003e28a
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10062421
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x58
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1003e2d1
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x28]
push 0x6a55
push 1
call fcn.1003e41e
add esp, 0xc
jmp 0x1003e40d
mov eax, dword [ebp + 8]
mov dword [ebp - 0x3c], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x2c]
movzx eax, byte [eax]
test eax, eax
je 0x1003e3c5
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x1003e3c3
mov dword [ebp - 0x24], 0x2f94
mov dword [ebp - 0x34], str.sfow_ydl_nbt
cmp dword [ebp - 0x24], 0x314f
jle 0x1003e381
and dword [ebp - 0x1c], 0
jmp 0x1003e325
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x455c
jge 0x1003e381
and dword [ebp - 0x20], 0
jmp 0x1003e33b
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x29d6
jge 0x1003e37f
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0x20]
sar eax, cl
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
lea ecx, [ebp - 0x68]
call fcn.10001a94
pop ecx
pop ecx
mov dword [ebp - 0x30], eax
mov ecx, dword [ebp - 0x30]
call fcn.10003344
push eax
call fcn.1004840f
pop ecx
lea ecx, [ebp - 0x68]
call fcn.1000333a
jmp 0x1003e334
jmp 0x1003e31e
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x2bcc
jge 0x1003e39d
push dword [ebp - 0x34]
call fcn.1004840f
pop ecx
jmp 0x1003e3b9
or dword [ebp - 4], 0xffffffff
jmp 0x1003e3c3
jmp 0x1003e40d
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
jmp 0x1003e3f3
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax], 2
jge 0x1003e40d
mov eax, dword [ebp - 0x18]
push dword [eax]
mov ecx, dword [ebp - 0x48]
call fcn.1000357a
and dword [eax], 0
jmp 0x1003e3e8
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret