joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001ce72
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov eax, ecx
xor esi, esi
cmp byte [ebp + 8], 0
mov ebx, edx
push edi
mov dword [esp + 0x14], eax
je 0x1001cec6
mov edi, dword [ebp + 0x10]
mov dword [edi], esi
jmp 0x1001cec0
mov edx, dword [ebp + 0x18]
lea ecx, [esp + 0x10]
push ecx
mov ecx, dword [ebp + 0xc]
push edi
push esi
push ebx
push dword [ebp + 0x14]
mov dword [esp + 0x24], 5
push dword [ebp + 0x1c]
push eax
call fcn.1002021b
mov eax, dword [esp + 0x30]
add esp, 0x1c
inc dword [edi]
cmp dword [edi], esi
jle 0x1001ce95
jmp 0x1001cece
push esi
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001d98c
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x4c
push ebx
mov dword [esp + 0x10], 0xff6
mov ebx, edx
cmp dword [esp + 0x10], 0x12d3
push esi
push edi
mov dword [esp + 0x24], ebx
jle 0x1001da3d
xor esi, esi
mov dword [esp + 0x14], esi
xor edi, edi
mov dword [esp + 0x10], edi
xor ebx, ebx
and dword [esp + 0x20], 0
mov eax, ebx
and eax, edi
mov edi, dword [esp + 0x20]
xor eax, esi
mov dword [esp + 0x1c], eax
mov esi, eax
mov eax, esi
lea ecx, [esp + 0x28]
or eax, edi
cdq
push edx
push eax
call fcn.10001ace
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001d9f1
mov eax, dword [eax]
push eax
call fcn.1004699c
pop ecx
push 0
push 1
lea ecx, [esp + 0x30]
call fcn.10005d35
inc edi
cmp edi, 0x3acd
jl 0x1001d9d7
mov esi, dword [esp + 0x14]
inc ebx
mov edi, dword [esp + 0x10]
cmp ebx, 0x6f60
jl 0x1001d9c2
inc edi
mov dword [esp + 0x10], edi
cmp edi, 0x49ef
jl 0x1001d9c0
inc esi
mov dword [esp + 0x14], esi
cmp esi, 0x68d0
jl 0x1001d9ba
mov ebx, dword [esp + 0x24]
cmp dword [esp + 0x18], 0xe95
jge 0x1001da52
push str.inzbodf_cczx_iui_cpvmvg_tszbay_liqqbkjuw_rdjbl_uml_rouksxry
call fcn.1004699c
pop ecx
cmp byte [ebp + 8], 0
je 0x1001db17
mov dword [esp + 0x14], 0x7cfd
cmp dword [esp + 0x14], 0x7f10
jle 0x1001dadf
xor esi, esi
mov dword [esp + 0x18], esi
xor edi, edi
mov ecx, edi
mov dword [esp + 0x24], esi
xor ebx, ebx
sar esi, cl
mov ecx, ebx
mov eax, esi
shl eax, cl
lea ecx, [esp + 0x40]
cdq
push edx
push eax
call fcn.10001ace
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001da9c
mov eax, dword [eax]
push eax
call fcn.1004699c
pop ecx
push 0
push 1
lea ecx, [esp + 0x48]
call fcn.10005d35
inc ebx
cmp ebx, 0x25a1
jl 0x1001da80
mov esi, dword [esp + 0x18]
inc edi
cmp edi, 0x1049
jl 0x1001da76
inc esi
mov dword [esp + 0x18], esi
cmp esi, 0xf14
jl 0x1001da74
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
mov eax, dword [ebp + 0xc]
mov dword [eax], 0
jmp 0x1001dafb
mov dword [esp + 0x24], 3
cmp dword [esp + 0x24], 0
jne 0x1001db00
dec dword [eax]
cmp dword [eax], 0xffffffe3
jg 0x1001daea
cmp dword [esp + 0x14], 0x7cc2
jge 0x1001db22
push str.jnqu_wdmjdy_yvhud_kvkkfkgr_bmxi_ittwbjzdh_gmbnkj_qobxol_hgill_aifwhei_iamrst
call fcn.1004699c
pop ecx
jmp 0x1001db22
cmp byte [ebx], 0
je 0x1001db22
call dword [sym.imp.GDI32.dll_GdiFlush]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001dcad
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x2c
cmp byte [ebp + 0xc], 0
push ebx
push esi
mov ebx, edx
push edi
mov dword [esp + 0x1c], ebx
je 0x1001dcd2
push 0
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x1001dd9d
mov dword [esp + 0x18], 0x4114
cmp dword [esp + 0x18], 0x4350
jle 0x1001dd75
xor esi, esi
mov dword [esp + 0x14], esi
xor edi, edi
mov dword [esp + 0x10], edi
mov ecx, edi
mov dword [esp + 0xc], esi
xor ebx, ebx
shl esi, cl
xor edi, edi
mov dword [esp + 0xc], 0xb20
mov eax, edi
lea ecx, [esp + 0x20]
xor eax, esi
cdq
push edx
push eax
call fcn.10001ace
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001dd22
mov eax, dword [eax]
push eax
call fcn.1004699c
pop ecx
push 0
push 1
lea ecx, [esp + 0x28]
call fcn.10005d35
add edi, ebx
dec dword [esp + 0xc]
jne 0x1001dd08
inc ebx
cmp ebx, 0x3029
jl 0x1001dcfe
mov edi, dword [esp + 0x10]
mov esi, dword [esp + 0x14]
inc edi
mov dword [esp + 0x10], edi
cmp edi, 0x7a1d
jl 0x1001dcf4
inc esi
mov dword [esp + 0x14], esi
cmp esi, 0x2e49
jl 0x1001dcee
push 0
call dword [sym.imp.USER32.dll_CharNextW]
mov ebx, dword [esp + 0x1c]
cmp dword [esp + 0x18], 0x3dcb
jge 0x1001dd8a
push str.jle_xfuv_scym_pfcipe_zmlt_bivqxo_wca_hyilxg_xbiex_pqxqxh
call fcn.1004699c
pop ecx
cmp byte [ebx], 0
je 0x1001dd9d
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001dde9
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
cmp byte [ebp + 0x14], 0
push ebx
push esi
mov esi, edx
mov byte [ebp - 8], cl
push edi
mov dword [ebp - 0x10], esi
je 0x1001dec2
mov dword [ebp - 0xc], 0xe96
cmp dword [ebp - 0xc], 0xec8
jle 0x1001de6b
xor edi, edi
xor esi, esi
mov dword [ebp + 0x14], 0x4a89
xor ebx, ebx
mov ecx, ebx
mov eax, esi
shl eax, cl
lea ecx, [ebp - 0x28]
cdq
push edx
push eax
call fcn.10001ace
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001de3c
mov eax, dword [eax]
push eax
call fcn.1004699c
pop ecx
push 0
push 1
lea ecx, [ebp - 0x28]
call fcn.10005d35
inc ebx
cmp ebx, 0x1ae6
jl 0x1001de21
add esi, edi
dec dword [ebp + 0x14]
jne 0x1001de1f
inc edi
cmp edi, 0x26ce
jl 0x1001de16
mov esi, dword [ebp - 0x10]
cmp byte [ebp + 8], 0
je 0x1001de8c
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1001deac
push 0
push 0x585
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x1001deac
mov dword [esi], 0
cmp dword [esi], 2
jge 0x1001deac
mov edx, dword [ebp + 0x10]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0xfffffffa
inc dword [esi]
cmp dword [esi], 2
jl 0x1001de9a
cmp dword [ebp - 0xc], 0xb26
jge 0x1001ded5
push str.ijbq_uvpnwyweq_aquq_ymhwg_bjzjvnh_vhzk_yvwjpzrq_snsg
call fcn.1004699c
pop ecx
jmp 0x1001ded5
test cl, cl
je 0x1001ded0
push 0
call dword [sym.imp.KERNEL32.dll_EnterCriticalSection]
jmp 0x1001ded5
mov eax, dword [ebp + 0x18]
inc dword [eax]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001f90b
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1005e414
push eax
mov dword fs:[0], esp
sub esp, 0x1c
cmp byte [ebp + 8], 0
je 0x1001f99a
mov dword [esp + 4], 0xea5d6c05
mov dword [esp + 4], 0xffffffec
jmp 0x1001f98a
push 1
lea ecx, [esp + 0x10]
call fcn.1000580e
and dword [esp + 0x24], 0
lea eax, [esp + 0xc]
push 0x7585
push 1
push eax
push ecx
mov edx, 0x69bc
lea ecx, [esp + 0x18]
call fcn.1001fd3f
mov eax, dword [esp + 0x1c]
lea ecx, [esp + 0x1c]
add esp, 0x10
cmp dword [eax], 0
jne 0x1001f993
or dword [esp + 0x24], 0xffffffff
call fcn.1000586b
dec dword [esp + 4]
cmp dword [esp + 4], 0xffffffe9
jl 0x1001f941
jmp 0x1001f9aa
call fcn.1000586b
jmp 0x1001f9aa
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1001f9aa
push 0
call dword [sym.imp.KERNEL32.dll_LockResource]
mov ecx, dword [esp + 0x1c]
mov dword fs:[0], ecx
mov esp, ebp
pop ebp
ret

Function at 0x100212ef
Capabilities:
Create pipe
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ecx
test dl, dl
je 0x1002133a
cmp byte [ebp + 0xc], 0
je 0x10021321
mov byte [esp + 7], 0
cmp byte [esp + 7], 0
je 0x10021362
push 1
push 0x149a
sub esp, 0xc
call fcn.1001e43e
add esp, 0x14
jmp 0x10021362
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x10021362
xor eax, eax
push eax
push 0x225d
push eax
call dword [sym.imp.GDI32.dll_GetBitmapBits]
jmp 0x10021362
cmp byte [ebp + 8], 0
je 0x10021352
cmp byte [ecx], 0
je 0x10021362
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x10021362
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov esp, ebp
pop ebp
ret

Function at 0x10021366
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005e474
call fcn.1005d360
sub esp, 0x14
push ebx
push esi
push edi
mov dword [ebp - 0x14], 0x742b
mov ebx, edx
cmp dword [ebp - 0x14], 0x755e
mov edi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], ebx
mov dword [ebp - 0x1c], edi
jle 0x100213bd
xor esi, esi
xor ebx, ebx
mov eax, ebx
mov ecx, 0x10078bb8
xor eax, esi
cdq
push edx
push eax
call fcn.100055e4
inc ebx
cmp ebx, 0x26a6
jl 0x10021397
inc esi
cmp esi, 0x543c
jl 0x10021395
mov ebx, dword [ebp - 0x18]
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x71db
jge 0x100213fb
mov edx, str.okfgzgzyt_rgh_ygkltjt_hjxezrqd_ffwjrb_lxjc_vdvgmbhx_mhliobzg_wgkjufzek_egueo_jiqg
mov ecx, 0x10078bb8
call fcn.10009472
jmp 0x100213fb
cmp byte [ebp + 0xc], 0
je 0x1002141d
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
jmp 0x10021416
mov ecx, dword [edx]
mov eax, dword [ebx]
and dword [eax + ecx*4], 0
inc dword [edx]
cmp dword [edx], 3
jl 0x1002140c
jmp 0x1002142a
cmp byte [edi], 0
je 0x1002142a
push 0
call dword [sym.imp.KERNEL32.dll_SetCommBreak]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100215c0
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005e47e
call fcn.1005d360
sub esp, 0x20
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], ecx
je 0x100216b5
mov dword [ebp - 0x1c], 0x2ff3
cmp dword [ebp - 0x1c], 0x30a4
jle 0x1002165a
xor ebx, ebx
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x14], edi
and dword [ebp - 0x24], 0
mov ecx, edi
mov edi, dword [ebp - 0x24]
mov dword [ebp - 0x20], esi
shl esi, cl
mov ecx, edi
mov eax, esi
sar eax, cl
mov ecx, 0x10078bb8
or eax, ebx
cdq
push edx
push eax
call fcn.100055e4
inc edi
cmp edi, 0x1b4b
jl 0x1002160a
mov edi, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0xbd9
jl 0x100215fc
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x7d63
jl 0x100215f7
inc ebx
cmp ebx, 0x238e
jl 0x100215f2
push 0x2083
call dword [sym.imp.USER32.dll_HideCaret]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x2f75
jge 0x10021676
mov edx, str.ntvc_mmvnldi_vtnbhkoj_xhjjoebho_ygxv_uvtt_jsaui_mtbz_oia_ykzsfdudb_lrwkhx
mov ecx, 0x10078bb8
call fcn.10009472
mov esi, dword [ebp + 0xc]
or dword [ebp - 4], 0xffffffff
mov ecx, dword [esi]
sub ecx, 2
call fcn.1001cb4d
mov ecx, dword [ebp - 0x28]
cmp ax, word [ecx]
jne 0x1002174a
add dword [esi], 0xfffffffe
jmp 0x1002174a
mov dword [ebp - 0x14], 0x5982
cmp dword [ebp - 0x14], 0x5bb8
jle 0x10021726
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x1c], edi
xor ebx, ebx
and dword [ebp - 0x20], 0
mov eax, edi
mov edi, dword [ebp - 0x20]
mov ecx, ebx
shl eax, cl
and eax, esi
mov dword [ebp - 0x24], eax
mov esi, eax
mov eax, esi
mov ecx, 0x10078bb8
xor eax, edi
cdq
push edx
push eax
call fcn.100055e4
inc edi
cmp edi, 0x1d16
jl 0x100216e5
mov esi, dword [ebp - 0x18]
inc ebx
mov edi, dword [ebp - 0x1c]
cmp ebx, 0x2532
jl 0x100216d1
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x4a5b
jl 0x100216cf
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x2ce2
jl 0x100216ca
mov dword [ebp - 4], 2
cmp dword [ebp - 0x14], 0x57dc
jge 0x10021745
mov edx, str.yjmnn_fincdlrhy_yxkicojkh_erglazvkw_dpa_nijaucvy_wqh_gcn
mov ecx, 0x10078bb8
call fcn.10009472
mov eax, dword [ebp + 8]
inc dword [eax]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10026823
Capabilities:
Accept command line arguments
Create pipe

Disassembly:
mov eax, 0x1005e6da
call fcn.1005d360
sub esp, 0x1c
push ebx
push esi
mov dword [ebp - 0x20], 0x5810
mov eax, ecx
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
cmp dword [ebp - 0x20], 0x5b74
mov dword [ebp - 0x28], eax
jle 0x100268a6
mov edi, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x24], esi
mov dword [ebp - 0x14], 0x3f1b
mov dword [ebp - 0x24], edi
mov ebx, 0x2acc
mov eax, edi
mov ecx, 0x10078bb8
cdq
push edx
push eax
call fcn.100055e4
add edi, esi
dec ebx
jne 0x10026867
mov ebx, dword [ebp - 0x18]
add esi, ebx
dec dword [ebp - 0x14]
mov edi, dword [ebp - 0x1c]
jne 0x1002685f
inc ebx
mov dword [ebp - 0x18], ebx
push 0
pop esi
cmp ebx, 0x410a
jl 0x10026855
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x6d0e
jl 0x10026852
mov eax, dword [ebp - 0x28]
cmp byte [ebp + 0xc], 0
je 0x100268bd
cmp byte [eax], 0
je 0x100268cd
push esi
push esi
push esi
push esi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x100268cd
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x100268cd
push esi
push esi
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x20], 0x5524
jge 0x100268e8
mov edx, str.hpyao_xehtbpd_tsihgkrb_cqrig_qudymznb_ptl
mov ecx, 0x10078bb8
call fcn.10009472
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10028437
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
mov byte [esp + 4], cl
push esi
mov esi, edx
test cl, cl
je 0x10028467
push ecx
mov ecx, dword [ebp + 8]
call fcn.1000a8c3
pop ecx
mov dword [esp + 0xc], eax
mov ecx, esi
lea eax, [esp + 0xc]
push eax
call fcn.1002aeec
jmp 0x1002847c
xor eax, eax
mov byte [esp + 7], al
cmp byte [esp + 7], al
je 0x1002847c
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10028b35
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005e877
call fcn.1005d360
sub esp, 0xc
push ebx
push esi
mov dword [ebp - 0x18], 0x261
cmp dword [ebp - 0x18], 0x5c7
push edi
mov dword [ebp - 0x10], esp
jle 0x10028baa
push 0x1795
call dword [sym.imp.USER32.dll_ShowCaret]
xor esi, esi
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp - 0x14], eax
and eax, ebx
mov ecx, 0x10078bb8
xor eax, edi
xor eax, esi
cdq
push edx
push eax
call fcn.100055e4
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0xa82
jl 0x10028b6e
inc ebx
cmp ebx, 0x31bf
jl 0x10028b69
inc edi
cmp edi, 0x7f4e
jl 0x10028b67
inc esi
cmp esi, 0x7471
jl 0x10028b65
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0xfffffe80
jge 0x10028bc6
mov edx, str.wxlkprblx_iacsou_jadjidysx_unhb_dymyglws_eux_ditasnl_jis_erkqcl_wnby_xrwujixaf
mov ecx, 0x10078bb8
call fcn.10009472
cmp byte [ebp + 0xc], 0
je 0x10028c0b
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
cmp dword [edx], 3
jge 0x10028c1d
mov esi, dword [ebp + 8]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 6
inc dword [edx]
cmp dword [edx], 3
jl 0x10028bdd
jmp 0x10028c1d
push 0x1ea
push 0xa25
push 0
call dword [sym.imp.USER32.dll_RemoveMenu]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002a76e
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005e994
call fcn.1005d360
sub esp, 0x24
mov byte [ebp - 0x14], dl
mov dword [ebp - 0x24], ecx
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
test dl, dl
je 0x1002a8ba
mov dword [ebp - 0x20], 0x37e7
xor esi, esi
cmp dword [ebp - 0x20], 0x3a9a
jle 0x1002a7f2
mov edi, esi
mov ebx, esi
mov dword [ebp - 0x1c], esi
mov eax, esi
mov esi, dword [ebp - 0x1c]
mov dword [ebp - 0x18], eax
add eax, esi
mov ecx, 0x10078bb8
xor eax, ebx
or eax, edi
cdq
push edx
push eax
call fcn.100055e4
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x4de6
jl 0x1002a7b0
inc esi
push 0
mov dword [ebp - 0x1c], esi
cmp esi, 0x115e
pop esi
jl 0x1002a7a8
inc ebx
cmp ebx, 0xe8e
jl 0x1002a7a5
inc edi
cmp edi, 0x68bf
jl 0x1002a7a3
mov dword [ebp - 4], esi
cmp dword [ebp - 0x20], 0x36db
jge 0x1002a80d
mov edx, str.qdencca_omjfvc_qwxrtf_sjome_cqvojqdfd_siptgs_gdpp_whfg_noebhe_dtve
mov ecx, 0x10078bb8
call fcn.10009472
or dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp + 8]
push 0x18
pop ebx
mov eax, dword [ecx + 4]
sub eax, dword [ecx]
cdq
idiv ebx
mov dword [ebp - 0x20], eax
test eax, eax
jle 0x1002a8c0
mov ebx, dword [ebp - 0x24]
mov edi, esi
mov edx, dword [ecx]
mov ecx, dword [ebp + 0xc]
add edx, edi
call fcn.100291f6
test al, al
je 0x1002a87d
mov eax, dword [ebx]
sub esp, 0x18
add eax, edi
mov ecx, esp
push eax
call fcn.1000a7c7
lea ecx, [ebp - 0x30]
call fcn.1002863b
add esp, 0x18
lea ecx, [ebp - 0x30]
mov dword [ebp - 4], 2
call fcn.1002a333
test eax, eax
je 0x1002a8b0
cmp eax, 2
je 0x1002a8b0
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x30]
call fcn.100060d7
inc esi
add edi, 0x18
cmp esi, dword [ebp - 0x20]
jge 0x1002a8c0
mov ecx, dword [ebp + 8]
jmp 0x1002a82f
lea ecx, [ebp - 0x30]
call fcn.100060d7
jmp 0x1002a8c0
call dword [sym.imp.GDI32.dll_GdiFlush]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002c8bd
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005ea66
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x18
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], 0x426e
mov dword [ebp - 0x20], str.urebwegi_bbu_nblaqpn_mbbcf_oyaaf_bptshy_agnlvzkr
cmp dword [ebp - 0x1c], 0x4485
jle 0x1002c96a
push 0
push 0
push 0x26aa
push 0x23dd
push 0
call dword [sym.imp.USER32.dll_InsertMenuW]
and dword [ebp - 0x14], 0
jmp 0x1002c919
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x2042
jge 0x1002c959
and dword [ebp - 0x18], 0
jmp 0x1002c92f
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x163f
jge 0x1002c957
mov eax, dword [ebp - 0x14]
sub eax, dword [ebp - 0x18]
cdq
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x24], edx
push dword [ebp - 0x24]
push dword [ebp - 0x28]
mov ecx, 0x10078bb8
call fcn.100055e4
jmp 0x1002c928
jmp 0x1002c912
push 0x252
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetLocaleInfoA]
push dword [ebp + 0xc]
push dword [ebp + 8]
push 0x758c
push 0
call fcn.100332ba
add esp, 0x10
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x41cc
jge 0x1002c999
mov edx, dword [ebp - 0x20]
mov ecx, 0x10078bb8
call fcn.10009472
jmp 0x1002c9b5
or dword [ebp - 4], 0xffffffff
jmp 0x1002c9bf
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002cbc7
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
movzx eax, byte [ebp + 0x10]
test eax, eax
je 0x1002cc26
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1002cc1a
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x1002cc18
push 1
push 0x16d6
push 0x17f7
push 0x2482
call dword [sym.imp.USER32.dll_SetScrollPos]
jmp 0x1002cc24
push 0
push 0
call dword [sym.imp.SHELL32.dll_CommandLineToArgvW]
jmp 0x1002cc51
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x14], eax
push 0x55c6
push 0x6520
push dword [ebp - 0x14]
push 0
push 0x2f74
push dword [ebp - 0x18]
call fcn.100330b0
add esp, 0x18
mov esp, ebp
pop ebp
ret
Function at 0x1002cc55
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005ea7a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002ccc3
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1002cca5
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x1002ccbe
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov edx, 0xc82ac04c
mov ecx, dword [ebp - 0x34]
call fcn.1002b86b
jmp 0x1002cde3
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov dword [ebp - 0x24], 0x256e
mov dword [ebp - 0x40], str.llmukhy_fzpstu_phl_vnbr_qumhup_aimnblp_rcqakyue
cmp dword [ebp - 0x24], 0x25cb
jle 0x1002cd89
and dword [ebp - 0x1c], 0
jmp 0x1002ccf7
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x56c2
jge 0x1002cd75
and dword [ebp - 0x20], 0
jmp 0x1002cd0d
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x2853
jge 0x1002cd70
and dword [ebp - 0x14], 0
jmp 0x1002cd23
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x11da
jge 0x1002cd6e
and dword [ebp - 0x18], 0
jmp 0x1002cd39
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x3784
jge 0x1002cd6c
mov eax, dword [ebp - 0x14]
mov ecx, dword [ebp - 0x18]
shl eax, cl
mov ecx, dword [ebp - 0x1c]
imul ecx, dword [ebp - 0x20]
and eax, ecx
cdq
mov dword [ebp - 0x48], eax
mov dword [ebp - 0x44], edx
push dword [ebp - 0x44]
push dword [ebp - 0x48]
mov ecx, 0x10078bb8
call fcn.100055e4
jmp 0x1002cd32
jmp 0x1002cd1c
jmp 0x1002cd06
jmp 0x1002ccf0
push 0
push 0x453
push 0x768
push 0
call dword [sym.imp.GDI32.dll_SetPaletteEntries]
push dword [ebp - 0x38]
push dword [ebp - 0x3c]
push 0x63c9
push 0
push 0x526a
call fcn.1002e6e4
add esp, 0x14
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x23d0
jge 0x1002cdbd
mov edx, dword [ebp - 0x40]
mov ecx, 0x10078bb8
call fcn.10009472
jmp 0x1002cdd9
or dword [ebp - 4], 0xffffffff
jmp 0x1002cde3
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002e0ba
Capabilities:
Query environment variable

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1002e160
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x1c], eax
lea eax, [ebp + 0x18]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1002e13c
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
mov dword [eax], 0
jmp 0x1002e10a
mov eax, dword [ebp - 8]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 8]
mov dword [ecx], eax
mov eax, dword [ebp - 8]
cmp dword [eax], 0
jl 0x1002e13a
mov dword [ebp - 0x18], 0x786f
push 0x412d
push 0x4060
push 0x2511
push 1
push 1
lea eax, [ebp - 0x18]
push eax
call fcn.1002c5ea
add esp, 0x18
jmp 0x1002e0ff
jmp 0x1002e15e
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1002e15e
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
jmp 0x1002e1d8
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x30], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x1002e1c9
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x34]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 4]
mov dword [eax], 0
jmp 0x1002e1aa
mov eax, dword [ebp - 4]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 4]
mov dword [ecx], eax
mov eax, dword [ebp - 4]
cmp dword [eax], 3
jge 0x1002e1c7
mov eax, dword [ebp - 4]
push dword [eax]
mov ecx, dword [ebp - 0x3c]
call fcn.10005887
mov dword [eax], 6
jmp 0x1002e19f
jmp 0x1002e1d8
push 0
push 0x225d
push 0
call dword [sym.imp.GDI32.dll_GetBitmapBits]
mov esp, ebp
pop ebp
ret