joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10012d72
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100577d6
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x10012dde
mov eax, dword [ebp + 8]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x30], eax
push dword [ebp - 0x24]
push dword [ebp - 0x28]
push 1
push dword [ebp - 0x2c]
push dword [ebp - 0x30]
push 0x64b4
push 0x3ff1
push 0x4f49
call fcn.10012edb
add esp, 0x20
jmp 0x10012eca
lea eax, [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x20], 0x21d9
mov dword [ebp - 0x38], str.dqapbrymf_kmjon_ltlhi_muvvdmu_oolvjqgq_dfefgj_ytkhuj_dnavlcyp_rhowrijim_egetnu_dxgyty_pveb
cmp dword [ebp - 0x20], 0x2491
jle 0x10012e63
and dword [ebp - 0x14], 0
jmp 0x10012e08
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x5211
jge 0x10012e63
and dword [ebp - 0x18], 0
jmp 0x10012e1e
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x4370
jge 0x10012e61
and dword [ebp - 0x1c], 0
jmp 0x10012e34
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x3c4e
jge 0x10012e5f
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x18]
add eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
mov ecx, 0x10070c18
call fcn.1000bb2c
jmp 0x10012e2d
jmp 0x10012e17
jmp 0x10012e01
mov eax, dword [ebp - 0x34]
movzx eax, byte [eax]
test eax, eax
je 0x10012e75
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x10012e8a
push 0x1705
push 0x1792
push 0x312
call dword [sym.imp.KERNEL32.dll_MulDiv]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x1e2b
jge 0x10012ea4
mov edx, dword [ebp - 0x38]
mov ecx, 0x10070c18
call fcn.1000e878
jmp 0x10012ec0
or dword [ebp - 4], 0xffffffff
jmp 0x10012eca
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10025a8a
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
test dl, dl
je 0x10025a9e
mov ecx, dword [ebp + 0xc]
mov eax, dword [ecx]
shr eax, 2
inc eax
mov dword [ecx], eax
pop ebp
ret
cmp byte [ecx], 0
je 0x10025a9c
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetCommandLineA]
Function at 0x10026c94
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x10057d64
call fcn.10056dd0
sub esp, 0x14
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ecx
je 0x10026ce0
cmp byte [ebp + 0xc], 0
je 0x10026cc4
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x10026e7a
push 0x5b8
push 0x16ba
push 0
push 0x1b1b
call dword [sym.imp.USER32.dll_DrawFrameControl]
jmp 0x10026e7a
mov dword [ebp - 0x18], 0x52e
cmp dword [ebp - 0x18], 0x63f
jle 0x10026d5d
push 0
push 0x647
push 0xbcb
push 0x213c
call dword [sym.imp.GDI32.dll_GetCharABCWidthsFloatA]
xor edi, edi
mov esi, 0x10070c18
xor ebx, ebx
xor eax, eax
mov dword [ebp + 0x18], eax
xor ecx, ecx
mov dword [ebp - 0x14], ecx
cdq
idiv ecx
mov ecx, esi
lea eax, [ebx + edx]
or eax, edi
cdq
push edx
push eax
call fcn.1000bb2c
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp + 0x18]
inc ecx
mov dword [ebp - 0x14], ecx
cmp ecx, 0x11e6
jl 0x10026d1a
inc eax
mov dword [ebp + 0x18], eax
cmp eax, 0x5757
jl 0x10026d15
inc ebx
cmp ebx, 0x3038
jl 0x10026d10
inc edi
cmp edi, 0x4750
jl 0x10026d0e
jmp 0x10026d62
mov esi, 0x10070c18
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x3aa
jge 0x10026d9c
mov edx, str.wwkl_bseezdcj_lnssebu_inwegzt_bqezo_rkmgi_sdjs
mov ecx, esi
call fcn.1000e878
jmp 0x10026d9c
or dword [ebp - 4], 0xffffffff
mov dword [ebp + 0x18], 0x7b9
cmp dword [ebp + 0x18], 0x8a6
jle 0x10026dd6
xor edi, edi
xor ebx, ebx
mov ecx, ebx
mov eax, edi
shl eax, cl
mov ecx, esi
cdq
push edx
push eax
call fcn.1000bb2c
inc ebx
cmp ebx, 0x2263
jl 0x10026db4
inc edi
cmp edi, 0x6d72
jl 0x10026db2
mov dword [ebp - 4], 2
cmp dword [ebp + 0x18], 0x794
jge 0x10026df2
mov edx, str.dhanqb_sqhdtkwv_jqhtmqm_usn_xqjgywa_cgu_geoxn_yikvrzgzf_npkweu_reqtcw
mov ecx, esi
call fcn.1000e878
cmp byte [ebp + 0x14], 0
je 0x10026e21
push 0
push 0x50a
call dword [sym.imp.USER32.dll_EndDialog]
jmp 0x10026e7a
mov edi, dword [ebp - 0x20]
mov ebx, dword [ebp - 0x1c]
mov ecx, dword [edi]
mov eax, dword [ebx]
mov eax, dword [eax + ecx*4]
mov ecx, dword [ebp + 8]
mov dword [ecx], eax
mov eax, dword [ecx]
xor ecx, ecx
mov esi, dword [edi]
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
mov dword [eax], esi
mov eax, dword [ebx]
cmp dword [eax + 4], ecx
mov eax, dword [ebp + 0x1c]
setne cl
xor edx, edx
cmp esi, ecx
setge dl
mov dword [eax], edx
mov edx, dword [edi]
mov ecx, dword [ebx]
xor ebx, ebx
mov eax, dword [edi]
cmp dword [ecx + edx*4], eax
mov ecx, dword [edi]
mov eax, dword [ebp - 0x1c]
setle bl
mov eax, dword [eax]
mov dword [eax + ecx*4], ebx
xor ecx, ecx
mov eax, dword [edi]
cmp ebx, eax
mov eax, dword [ebp + 0x20]
setge cl
mov dword [eax], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100273d0
Capabilities:
Accept command line arguments
Set thread local storage value

Disassembly:
mov eax, 0x10057d8c
call fcn.10056dd0
sub esp, 0x24
cmp byte [ebp + 0xc], 0
mov eax, edx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x30], eax
mov byte [ebp - 0x18], cl
je 0x100274c9
test cl, cl
je 0x1002740b
push 0
push 0x1cc7
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
jmp 0x100274f2
mov dword [ebp - 0x28], 0x73c9
cmp dword [ebp - 0x28], 0x7777
jle 0x1002747f
xor esi, esi
mov dword [ebp - 0x24], esi
xor edi, edi
mov dword [ebp - 0x20], edi
xor ebx, ebx
mov dword [ebp - 0x2c], esi
mov ecx, edi
mov dword [ebp - 0x1c], ebx
shl esi, cl
mov edi, ebx
mov ebx, 0x60ba
mov ecx, edi
mov eax, esi
sar eax, cl
mov ecx, 0x10070c18
cdq
push edx
push eax
call fcn.1000bb2c
dec edi
dec ebx
jne 0x10027438
mov ebx, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 0x1c], ebx
cmp ebx, 0xb4f
jl 0x10027431
mov edi, dword [ebp - 0x20]
mov esi, dword [ebp - 0x24]
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x65b9
jl 0x10027425
inc esi
mov dword [ebp - 0x24], esi
cmp esi, 0x5ec0
jl 0x10027420
mov eax, dword [ebp - 0x30]
cmp byte [eax], 0
je 0x1002748a
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x71ff
jge 0x10027406
mov edx, str.pvxckohcb_nhyoypqat_midgaatgf_meyd_cyyna_sqmruqrgb_qkosv
mov ecx, 0x10070c18
call fcn.1000e878
jmp 0x10027406
cmp byte [ebp + 8], 0
je 0x100274dd
lea edx, [ebp + 0xf]
mov byte [ebp + 0xf], 0
call fcn.100273c2
jmp 0x100274f2
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x100274f2
push 0x367
call dword [sym.imp.USER32.dll_DrawMenuBar]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10028d7b
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x10028d92
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x10028db4
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x10071f24
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x100722b0
jl 0x10028dc2
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x10072554
jl 0x10028e02
mov ecx, dword [0x100732a0]
xor ecx, dword [0x10071f24]
and ecx, edi
xor ecx, dword [0x100732a0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x10071f20], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10072554]
mov dword [0x100728e0], eax
pop esi
ret
Function at 0x10028eaf
Capabilities:
Query environment variable

Disassembly:
mov eax, 0x10057e7a
call fcn.10056dd0
sub esp, 0x68
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
je 0x10028eeb
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10029093
push 0x1705
push 0x1792
push 0x312
call dword [sym.imp.KERNEL32.dll_MulDiv]
jmp 0x10029093
mov dword [ebp - 0x1c], 0x6182eac4
lea ecx, [ebp - 0x34]
mov dword [ebp - 0x20], 0x9565e08c
mov dword [ebp - 0x44], 0
mov dword [ebp - 0x40], 0
mov dword [ebp - 0x3c], 0
mov dword [ebp - 0x38], 0
push 1
call fcn.1000be0e
and dword [ebp - 4], 0
mov dword [ebp - 0x24], 0xf29acd40
mov dword [ebp - 0x18], 0x331c587c
mov dword [ebp - 0x14], 0x16c
cmp dword [ebp - 0x14], 0x2f5
jle 0x10028fb0
push 0
push 0x384
call dword [sym.imp.GDI32.dll_GetWindowOrgEx]
xor esi, esi
xor edi, edi
xor ebx, ebx
mov ecx, ebx
mov eax, edi
shl eax, cl
lea ecx, [ebp - 0x5c]
or eax, esi
cdq
push edx
push eax
call fcn.10001a7f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10028f71
mov eax, dword [eax]
push eax
call fcn.10040493
pop ecx
push 0
push 1
lea ecx, [ebp - 0x5c]
call fcn.1000c5c5
inc ebx
cmp ebx, 0x61f4
jl 0x10028f54
inc edi
cmp edi, 0x7d7d
jl 0x10028f52
inc esi
cmp esi, 0x446a
jl 0x10028f50
push 0
push 0
push 0x99e
push 0
call dword [sym.imp.USER32.dll_GetMenuItemInfoW]
cmp dword [ebp - 0x14], 0xfffffe1e
jge 0x10028fc4
push str.zyczg_vxtx_evrrq_bpxbdupe_icdkfklm_cvcp_btkcgvx_vxf_yvxfn_lpr_ahlxsq
call fcn.10040493
pop ecx
and dword [ebp - 4], 0
lea edx, [ebp - 0x28]
push 0
push 0x7bd0
lea ecx, [ebp - 0x34]
call fcn.100299de
mov dword [ebp - 0x24], 0x1ff7
cmp dword [ebp - 0x24], 0x2297
pop ecx
pop ecx
jle 0x1002904f
call dword [sym.imp.KERNEL32.dll_GetEnvironmentStringsW]
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov esi, edx
mov eax, esi
lea ecx, [ebp - 0x74]
or eax, ebx
cdq
push edx
push eax
call fcn.10001a7f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002901b
mov eax, dword [eax]
push eax
call fcn.10040493
pop ecx
push 0
push 1
lea ecx, [ebp - 0x74]
call fcn.1000c5c5
inc ebx
cmp ebx, 0x7989
jl 0x10029002
mov esi, dword [ebp - 0x14]
inc edi
cmp edi, 0x6fc4
jl 0x10028ff9
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x66c6
jl 0x10028ff7
mov eax, dword [ebp - 0x1c]
mov ecx, 0xd777
inc dword [ebp - 0x18]
mov eax, dword [ebp - 0x34]
mov dword [eax], ecx
mov dword [ebp - 0x44], ecx
mov edx, dword [ebp - 0x20]
mov eax, dword [ebp - 0x34]
mov ecx, dword [ebp - 0x3c]
sub ecx, edx
mov dword [eax], edx
mov eax, dword [ebp - 0x1c]
add eax, ecx
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x24], 0x1e85
jge 0x1002908b
push str.yzwatrwu_lipuq_bfj_aylljjwdo_dvci_tixyu_yigge_evmgdpubu_qerzqx_rgukrx_wnyre_qmed
call fcn.10040493
pop ecx
lea ecx, [ebp - 0x34]
call fcn.1000be91
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002a169
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov byte [ebp - 4], cl
push esi
test cl, cl
je 0x1002a18e
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0x1002a1c6
push 0x241d
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
jmp 0x1002a1c6
mov ecx, dword [ebp + 0x10]
xor esi, esi
mov dword [ecx], esi
jmp 0x1002a1c2
mov dword [ebp - 8], 0xfffffffb
mov dword [ebp - 8], 2
mov dword [ebp - 8], esi
jmp 0x1002a1b8
mov eax, dword [ebp - 8]
mov dword [ebp + eax*4 - 0x18], 0x54165132
inc dword [ebp - 8]
cmp dword [ebp - 8], 4
jl 0x1002a1aa
dec dword [edx]
inc dword [ecx]
cmp dword [ecx], esi
jg 0x1002a197
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1002a8c1
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10057eee
call fcn.10056dd0
sub esp, 0x38
push ebx
push esi
mov dword [ebp - 0x28], 0x1067
mov esi, edx
cmp dword [ebp - 0x28], 0x1370
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], esi
jle 0x1002a946
xor edi, edi
mov dword [ebp - 0x24], edi
xor eax, eax
mov dword [ebp - 0x20], 0xe05
mov dword [ebp - 0x14], eax
mov edi, dword [ebp - 0x14]
xor esi, esi
xor eax, eax
mov dword [ebp - 0x1c], eax
add eax, esi
mov ecx, 0x10070c18
xor eax, edi
cdq
push edx
push eax
call fcn.1000bb2c
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp eax, 0x615d
jl 0x1002a904
inc esi
cmp esi, 0xcb5
jl 0x1002a8ff
mov edi, dword [ebp - 0x24]
add dword [ebp - 0x14], edi
dec dword [ebp - 0x20]
jne 0x1002a8fa
inc edi
mov dword [ebp - 0x24], edi
cmp edi, 0x1be4
jl 0x1002a8ee
mov esi, dword [ebp - 0x18]
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0xf94
jge 0x1002a981
mov edx, str.qudxxhb_ktqwvhkc_saxdl_kzvztj_ylkea_kiidkg_gfdps_zvye_eqg
mov ecx, 0x10070c18
call fcn.1000e878
jmp 0x1002a981
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0xc], 0
je 0x1002aa5e
mov dword [ebp - 0x14], 0x36f9
cmp dword [ebp - 0x14], 0x370d
jle 0x1002a9fd
xor edi, edi
mov dword [ebp - 0x1c], edi
xor esi, esi
mov dword [ebp - 0x20], 0x55a
mov dword [ebp - 0x24], esi
xor eax, eax
mov dword [ebp - 0x28], eax
lea edi, [esi + eax]
mov esi, 0x556f
mov eax, edi
mov ecx, 0x10070c18
cdq
push edx
push eax
call fcn.1000bb2c
inc edi
dec esi
jne 0x1002a9bd
mov eax, dword [ebp - 0x28]
mov esi, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x28], eax
cmp eax, 0x4ccf
jl 0x1002a9b5
mov edi, dword [ebp - 0x1c]
add esi, edi
dec dword [ebp - 0x20]
mov dword [ebp - 0x24], esi
jne 0x1002a9b0
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x545f
jl 0x1002a9a4
mov esi, dword [ebp - 0x18]
mov dword [ebp - 4], 2
cmp dword [ebp - 0x14], 0x35b0
jge 0x1002aa3b
mov edx, str.gir_tyo_uhbpq_nisvp_pwcwjqqe_rizmgtp_gffyauhd_axnzwa_bzb
mov ecx, 0x10070c18
call fcn.1000e878
jmp 0x1002aa3b
mov dword [esi], 0
cmp dword [esi], 3
jge 0x1002aacf
mov edx, dword [ebp + 8]
mov ecx, dword [esi]
mov eax, dword [edx]
and dword [eax + ecx*4], 0
inc dword [esi]
cmp dword [esi], 3
jl 0x1002aa4d
jmp 0x1002aacf
push 4
pop esi
push esi
lea ecx, [ebp - 0x34]
call fcn.1000be0e
mov dword [ebp - 0x14], 0
jmp 0x1002aa83
mov ecx, dword [ebp - 0x14]
mov eax, dword [ebp - 0x34]
mov dword [eax + ecx*4], 3
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002aa73
mov dword [ebp - 0x14], 0
jmp 0x1002aa9f
mov eax, dword [ebp - 0x14]
mov dword [ebp + eax*4 - 0x44], 0x32fe2236
inc dword [ebp - 0x14]
cmp dword [ebp - 0x14], esi
jl 0x1002aa91
mov dword [ebp - 0x3c], 3
cmp dword [ebp - 0x3c], 0
jl 0x1002aac7
mov dword [ebp - 0x28], 0x3d2d
mov dword [ebp - 0x28], 0xffffffff
mov eax, dword [ebp - 0x3c]
dec dword [ebp - 0x3c]
jns 0x1002aab1
lea ecx, [ebp - 0x34]
call fcn.1000be91
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002ae75
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
push ebx
mov dword [ebp - 0x10], 0x32a7
cmp dword [ebp - 0x10], 0x3432
push esi
push edi
jle 0x1002af15
xor esi, esi
mov dword [ebp - 0xc], esi
xor edi, edi
mov dword [ebp - 8], edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov edi, edx
xor esi, esi
mov eax, edi
lea ecx, [ebp - 0x28]
xor eax, esi
xor eax, ebx
cdq
push edx
push eax
call fcn.10001a7f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002aec2
mov eax, dword [eax]
push eax
call fcn.10040493
pop ecx
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.1000c5c5
inc esi
cmp esi, 0x8053
jl 0x1002aea7
inc ebx
cmp ebx, 0x355e
jl 0x1002aea5
mov edi, dword [ebp - 8]
mov esi, dword [ebp - 0xc]
inc edi
mov dword [ebp - 8], edi
cmp edi, 0x10fc
jl 0x1002ae9c
inc esi
mov dword [ebp - 0xc], esi
cmp esi, 0x47db
jl 0x1002ae97
push 0x211f
push 0x171b
call dword [sym.imp.USER32.dll_SetParent]
cmp byte [ebp + 0x1c], 0
je 0x1002af31
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0x1002af37
push 1
mov dl, 1
xor cl, cl
call fcn.1002c534
pop ecx
jmp 0x1002af37
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
cmp dword [ebp - 0x10], 0x3161
jge 0x1002af4b
push str.anbjipg_hypkjuut_vqjp
call fcn.10040493
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002ba07
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
test dl, dl
je 0x1002ba16
mov eax, dword [ebp + 0xc]
add dword [eax], 4
pop ebp
ret
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1002ba14
pop ebp
jmp dword [sym.imp.KERNEL32.dll_GetCommandLineA]
Function at 0x10030d31
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x1005811a
call fcn.10056dd0
sub esp, 0x18
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x10030d6c
mov esi, dword [ebp + 0x10]
mov dword [esi], 0
jmp 0x10030d62
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [esi]
cmp dword [esi], 2
jl 0x10030d55
jmp 0x10030e08
mov dword [ebp - 0x1c], 0x372d
cmp dword [ebp - 0x1c], 0x387f
jle 0x10030dde
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x14], edi
xor ebx, ebx
mov eax, edi
and dword [ebp - 0x24], 0
cdq
idiv ebx
mov edi, dword [ebp - 0x24]
mov ecx, edx
mov dword [ebp - 0x20], esi
shl esi, cl
mov ecx, edi
mov eax, esi
shl eax, cl
mov ecx, 0x10070c18
cdq
push edx
push eax
call fcn.1000bb2c
inc edi
cmp edi, 0x7e26
jl 0x10030d9b
mov esi, dword [ebp - 0x18]
inc ebx
mov edi, dword [ebp - 0x14]
cmp ebx, 0x948
jl 0x10030d88
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x5d8b
jl 0x10030d86
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x538e
jl 0x10030d81
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x342c
jge 0x10030dfa
mov edx, str.exqmfyifn_gvmkjyeo_mxz_wce_qjfrc_qadicjd_fyqj_swgvzcd_dngfgiz
mov ecx, 0x10070c18
call fcn.1000e878
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10030e08
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10030f46
Capabilities:
Accept command line arguments
Encode data using xor

Disassembly:
mov eax, 0x10058124
call fcn.10056dd0
sub esp, 0x18
mov byte [ebp - 0x18], dl
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x1003101d
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x10031001
push 0x7c0e
xor dl, dl
mov cl, 1
call fcn.10030f46
mov dword [ebp - 0x24], 0x2d3
cmp dword [ebp - 0x24], 0x5c0
pop ecx
jle 0x10030fe5
xor edi, edi
xor esi, esi
mov dword [ebp - 0x20], esi
xor ebx, ebx
mov dword [ebp - 0x1c], ebx
mov eax, esi
cdq
idiv ebx
mov ebx, 0x1dd9
mov esi, edx
mov eax, esi
mov ecx, 0x10070c18
xor eax, edi
cdq
push edx
push eax
call fcn.1000bb2c
dec esi
dec ebx
jne 0x10030fa9
mov ebx, dword [ebp - 0x1c]
mov esi, dword [ebp - 0x20]
inc ebx
mov dword [ebp - 0x1c], ebx
cmp ebx, 0x8052
jl 0x10030f9d
inc esi
mov dword [ebp - 0x20], esi
cmp esi, 0x3edb
jl 0x10030f98
inc edi
cmp edi, 0x6f50
jl 0x10030f93
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0xf5
jge 0x10031001
mov edx, str.hmb_aksogqwfb_bupl_jmypysb_jsviv_bygeeq
mov ecx, 0x10070c18
call fcn.1000e878
jmp 0x10031023
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100349d0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005839d
call fcn.10056dd0
sub esp, 0x3c
cmp byte [ebp + 8], 0
mov eax, edx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], eax
je 0x10034a25
push 0x21
pop edx
lea ecx, [ebp - 0x48]
call fcn.10026c17
and dword [ebp - 4], 0
push ecx
push ecx
mov ecx, dword [ebp + 0xc]
push eax
call fcn.100387b1
push 0
push 1
lea ecx, [ebp - 0x48]
call fcn.1000c799
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x28], 0x4e89
cmp dword [ebp - 0x28], 0x50e5
jle 0x10034a5f
xor edi, edi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x10070c18
xor eax, edi
cdq
push edx
push eax
call fcn.1000bb2c
inc ebx
cmp ebx, 0x6286
jl 0x10034a39
inc edi
cmp edi, 0x2f3c
jl 0x10034a37
mov eax, dword [ebp - 0x24]
cmp byte [eax], 0
je 0x10034b0b
mov dword [ebp - 0x24], 0x484b
cmp dword [ebp - 0x24], 0x48f8
jle 0x10034ae1
xor edi, edi
mov dword [ebp - 0x20], edi
mov dword [ebp - 0x14], edi
mov dword [ebp - 0x1c], 0x42b1
xor ebx, ebx
mov dword [ebp - 0x18], ebx
and dword [ebp - 0x2c], 0
lea eax, [edi + ebx]
mov edi, dword [ebp - 0x2c]
mov ebx, eax
mov dword [ebp - 0x30], eax
mov ecx, edi
mov eax, ebx
shl eax, cl
mov ecx, 0x10070c18
cdq
push edx
push eax
call fcn.1000bb2c
inc edi
cmp edi, 0x3595
jl 0x10034a9b
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x14]
inc ebx
mov dword [ebp - 0x18], ebx
cmp ebx, 0x6992
jl 0x10034a8c
dec edi
dec dword [ebp - 0x1c]
mov dword [ebp - 0x14], edi
jne 0x10034a87
mov edi, dword [ebp - 0x20]
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x2197
jl 0x10034a7d
push 0x367
call dword [sym.imp.USER32.dll_DrawMenuBar]
mov dword [ebp - 4], 1
cmp dword [ebp - 0x24], 0x4498
jge 0x10034b0b
mov edx, str.zgj_lgpzntnkp_lwfj_vfpq_sbwlgb_ahbkt_uwtdwqbow_ikfgjly
mov ecx, 0x10070c18
call fcn.1000e878
mov dword [ebp - 4], 3
cmp dword [ebp - 0x28], 0x4e3d
jge 0x10034a14
mov edx, str.azpzu_bzvvobp_giyky_hixoimk
mov ecx, 0x10070c18
call fcn.1000e878
jmp 0x10034a14
Function at 0x10036c8e
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
cmp byte [ebp + 8], 0
je 0x10036ca7
push ecx
push ecx
push edx
call fcn.100387b1
jmp 0x10036d35
push ebx
xor ebx, ebx
mov byte [ebp - 1], bl
mov dword [ebp - 8], 0x4b66
cmp dword [ebp - 8], 0x4e3a
jle 0x10036d14
push esi
push edi
push ebx
push 0x183f
push 0x2246
push ebx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
mov esi, ebx
mov edi, ebx
mov eax, edi
lea ecx, [ebp - 0x20]
or eax, esi
cdq
push edx
push eax
call fcn.10001a7f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10036cee
mov eax, dword [eax]
push eax
call fcn.10040493
pop ecx
push ebx
push 1
lea ecx, [ebp - 0x20]
call fcn.1000c5c5
inc edi
cmp edi, 0x2253
jl 0x10036cd5
inc esi
cmp esi, 0x7c13
jl 0x10036cd3
pop edi
pop esi
cmp byte [ebp - 1], 0
pop ebx
je 0x10036d21
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
cmp dword [ebp - 8], 0x49ca
jge 0x10036d35
push str.brj_atzyx_tuvgps_ozs_hqpnybhsh_adir_tlblivu_odx_pansvqr_uixcbsyl_lmy_axfylmcn
call fcn.10040493
pop ecx
mov esp, ebp
pop ebp
ret