joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000e8d9
Capabilities:
Accept command line arguments
Get file system object information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1000e90f
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 4], eax
push dword [ebp - 4]
push 0x2b81
push 1
push 0x5b6f
push dword [ebp - 8]
call fcn.1000e979
add esp, 0x14
jmp 0x1000e975
mov eax, dword [ebp + 0x1c]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x1000e949
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x1000e947
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x1000e975
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x1000e975
push 0x1778
push 0x2218
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov esp, ebp
pop ebp
ret
Function at 0x10017c24
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 0x10]
mov dword [esp + 0x14], eax
xor eax, eax
jmp 0x10017c77
cmp dword [ebx + 0x14], 8
jb 0x10017c47
mov ecx, dword [ebx]
jmp 0x10017c49
mov ecx, ebx
movzx esi, word [ecx + eax*2]
lea edx, [eax - 0xb5e]
mov ecx, esi
call fcn.1002ba88
movzx edi, ax
xor edx, edx
mov eax, esi
add eax, dword [esp + 0x10]
push 0x19
pop ecx
div ecx
mov eax, dword [esp + 0x10]
mov ecx, edx
shl edi, cl
add dword [esp + 0x14], edi
inc eax
mov dword [esp + 0x10], eax
cmp dword [ebx + 0x10], eax
ja 0x10017c3d
mov dword [esp + 0x1c], 0x2a0d
mov dword [esp + 0x10], 0x17d3
cmp dword [esp + 0x10], 0x604
jge 0x10017d4a
push 0x10152638
push 0x1013e768
push str._lld__lld
call fcn.10047aed
mov eax, dword [0x1013e768]
add esp, 0xc
mov edx, dword [0x1013e76c]
mov ecx, eax
mov edi, dword [0x1015263c]
xor ebx, ebx
mov dword [esp + 0x10], ecx
mov dword [esp + 0x18], edx
cmp edx, edi
jg 0x10017d3f
mov esi, dword [0x10152638]
jge 0x10017d3b
cmp eax, esi
jne 0x10017d19
cmp edx, edi
jne 0x10017d19
push 0x10068f58
call fcn.10047cbc
pop ecx
push ebx
push 0x10068f5c
call fcn.100476ff
mov edi, dword [0x1015263c]
mov esi, dword [0x10152638]
mov edx, dword [0x1013e76c]
mov eax, dword [0x1013e768]
pop ecx
pop ecx
mov ecx, dword [esp + 0x10]
push dword [esp + 0x18]
push ecx
push edx
push eax
call fcn.1004b6d0
mov ecx, dword [esp + 0x10]
inc ebx
mov dword [0x1013e768], eax
mov dword [0x1013e76c], edx
cmp edx, edi
jl 0x10017cde
jg 0x10017d3f
cmp eax, esi
jbe 0x10017ce0
push 0x10068f60
call fcn.10047cbc
pop ecx
cmp dword [esp + 0x1c], 0x2b79
jle 0x10017d7b
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x10079c18
xor eax, esi
cdq
push edx
push eax
call fcn.100048ed
inc edi
cmp edi, 0xbd1
jl 0x10017d58
inc esi
cmp esi, 0x4cef
jl 0x10017d56
mov eax, dword [esp + 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x100184a1
Capabilities:
Read .ini file

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x100184c8
mov eax, dword [ebp + 8]
mov dword [ebp - 8], eax
push dword [ebp - 8]
push 0x21f3
push 0
call fcn.1001ce55
add esp, 0xc
jmp 0x100184e5
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x100184e5
push 0
push 0xdea
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
mov esp, ebp
pop ebp
ret
Function at 0x10018a26
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10018a4f
push 0
push 0x7328
push 0x66da
push 0x61e4
call fcn.1001cd14
add esp, 0x10
jmp 0x10018ac5
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x18], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10018a9b
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
movzx eax, byte [eax]
test eax, eax
je 0x10018a99
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x10018ac5
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
mov dword [eax], 8
mov eax, dword [ebp - 0x28]
mov dword [eax], 8
mov esp, ebp
pop ebp
ret
Function at 0x10018af9
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1005f56d
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x40
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10018ba7
lea eax, [ebp + 0x10]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x10018b90
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x18]
mov dword [eax], 0
jmp 0x10018b71
mov eax, dword [ebp - 0x18]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x18]
mov dword [ecx], eax
mov eax, dword [ebp - 0x18]
cmp dword [eax], 2
jge 0x10018b8e
mov eax, dword [ebp - 0x18]
push dword [eax]
mov ecx, dword [ebp - 0x44]
call fcn.10002242
mov dword [eax], 0xa2c7c8a6
jmp 0x10018b66
jmp 0x10018ba2
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x10018ba2
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x10018c9e
mov dword [ebp - 0x2c], 0x79d1
mov dword [ebp - 0x48], str.vpzh_nszmlgyq_vpwgum_ctxci_yswrrd_xuujwkfj_inaois_jkftu_vbnqpa_kcuvpna_ztrvvvk_qwa
cmp dword [ebp - 0x2c], 0x7c6d
jle 0x10018c56
push 0
push 0
call dword [sym.imp.KERNEL32.dll_SetCommTimeouts]
and dword [ebp - 0x28], 0
jmp 0x10018bd9
mov eax, dword [ebp - 0x28]
inc eax
mov dword [ebp - 0x28], eax
cmp dword [ebp - 0x28], 0x780b
jge 0x10018c56
and dword [ebp - 0x1c], 0
jmp 0x10018bef
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x76c0
jge 0x10018c51
and dword [ebp - 0x20], 0
jmp 0x10018c05
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x6945
jge 0x10018c4f
and dword [ebp - 0x24], 0
jmp 0x10018c1b
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x1c75
jge 0x10018c4d
mov ecx, dword [ebp - 0x1c]
imul ecx, dword [ebp - 0x20]
imul ecx, dword [ebp - 0x24]
mov eax, dword [ebp - 0x28]
sar eax, cl
cdq
mov dword [ebp - 0x50], eax
mov dword [ebp - 0x4c], edx
push dword [ebp - 0x4c]
push dword [ebp - 0x50]
mov ecx, 0x10079c18
call fcn.100048ed
jmp 0x10018c14
jmp 0x10018bfe
jmp 0x10018be8
jmp 0x10018bd2
push 0
call fcn.100192b6
pop ecx
and dword [ebp - 4], 0
cmp dword [ebp - 0x2c], 0x7787
jge 0x10018c78
mov edx, dword [ebp - 0x48]
mov ecx, 0x10079c18
call fcn.10006b05
jmp 0x10018c94
or dword [ebp - 4], 0xffffffff
jmp 0x10018c9e
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10018df9
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push ecx
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x10018e15
push 0
push 0x4a6e
call fcn.10019b69
pop ecx
pop ecx
jmp 0x10018e45
lea eax, [ebp + 8]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10018e2f
push 0
call dword [sym.imp.KERNEL32.dll_LeaveCriticalSection]
jmp 0x10018e45
push 0x1778
push 0x2218
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov esp, ebp
pop ebp
ret
Function at 0x1001ce77
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1001ced3
lea eax, [ebp + 0x1c]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1001ceb5
mov eax, dword [ebp - 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x10]
mov byte [eax], 1
jmp 0x1001ced1
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x1c]
movzx eax, byte [eax]
test eax, eax
je 0x1001ced1
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
jmp 0x1001cef4
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x24], eax
push 0x3d8c
push dword [ebp - 0x20]
push dword [ebp - 0x24]
push 1
call fcn.10017e00
add esp, 0x10
mov esp, ebp
pop ebp
ret
Function at 0x1002e57b
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
push esi
push edi
mov dword [esp + 0xc], 0x443c
mov edi, edx
cmp dword [esp + 0xc], 0x4607
push 0
mov dword [esp + 0x14], edi
mov dword [esp + 0x18], ecx
pop ebx
jle 0x1002e5ed
mov esi, ebx
mov edi, ebx
mov eax, edi
lea ecx, [esp + 0x18]
or eax, esi
cdq
push edx
push eax
call fcn.10002dd6
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002e5c4
mov eax, dword [eax]
push eax
call fcn.100476ff
pop ecx
push ebx
push 1
lea ecx, [esp + 0x20]
call fcn.10004d30
inc edi
cmp edi, 0x77e9
jl 0x1002e5aa
inc esi
cmp esi, 0x5a71
jl 0x1002e5a8
mov edi, dword [esp + 0x10]
cmp dword [esp + 0xc], 0x4060
jge 0x1002e602
push str.widaf_iavhvx_xfardypv_tfuwtdk_rzwhgbfc_iudyp_aakohzt_uonijtsm_sjup_zxzsdrfbz_lem_smaaldhh
call fcn.100476ff
pop ecx
cmp byte [ebp + 0x1c], 0
je 0x1002e64f
mov ecx, dword [ebp + 0x20]
mov esi, dword [ebp + 0xc]
mov eax, dword [ecx]
mov eax, dword [esi]
cmp dword [edi], ebx
jne 0x1002e618
mov eax, dword [ecx]
mov edx, dword [ebp + 0x14]
xor ebx, ebx
mov ecx, dword [ebp + 0x18]
mov eax, dword [edx]
imul eax, dword [eax], 0xf20b
mov dword [ecx], eax
mov eax, dword [ecx]
mov ecx, dword [edx]
mov eax, dword [esi]
cmp dword [ecx], eax
mov ecx, dword [edi]
mov eax, dword [esi]
setl bl
xor edx, edx
cmp ecx, eax
mov ecx, dword [esp + 0x14]
setne dl
xor eax, eax
cmp edx, ebx
setne al
mov dword [ecx], eax
jmp 0x1002e663
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x1002e663
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateThread]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1002e68a
Capabilities:
Accept command line arguments
Get file system object information

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x28
cmp byte [ebp + 0x10], 0
push esi
push edi
je 0x1002e725
cmp byte [edx], 0
je 0x1002e747
mov dword [esp + 0x14], 0x7188
cmp dword [esp + 0x14], 0x73d2
jle 0x1002e708
xor esi, esi
mov dword [esp + 0x10], esi
mov edi, esi
mov esi, 0x664b
mov eax, edi
lea ecx, [esp + 0x18]
cdq
push edx
push eax
call fcn.10002dd6
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002e6df
mov eax, dword [eax]
push eax
call fcn.100476ff
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.10004d30
dec edi
dec esi
jne 0x1002e6c7
mov esi, dword [esp + 0x10]
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0x238c
jl 0x1002e6c0
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp dword [esp + 0x14], 0x6ef1
jge 0x1002e747
push str.pavvdbvgv_nygngotl_ctaijplh_aibkvp_mww_afn
call fcn.100476ff
pop ecx
jmp 0x1002e747
mov byte [esp + 0xf], 0
cmp byte [esp + 0xf], 0
je 0x1002e747
push 0x1778
push 0x2218
push 0
push 0
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
pop edi
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x1002e74d
Capabilities:
Identify system language via api

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
push ebx
push esi
mov dword [ebp - 0xc], 0x31a6
mov ebx, edx
cmp dword [ebp - 0xc], 0x34c6
mov esi, ecx
push edi
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x14], esi
jle 0x1002e7d1
xor esi, esi
mov dword [ebp - 8], esi
xor edi, edi
mov ebx, esi
mov esi, 0x7ced
mov eax, ebx
lea ecx, [ebp - 0x2c]
cdq
push edx
push eax
call fcn.10002dd6
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1002e795
mov eax, dword [eax]
push eax
call fcn.100476ff
pop ecx
push 0
push 1
lea ecx, [ebp - 0x2c]
call fcn.10004d30
add ebx, edi
dec esi
jne 0x1002e77e
mov esi, dword [ebp - 8]
inc edi
cmp edi, 0x3ab0
jl 0x1002e777
inc esi
mov dword [ebp - 8], esi
cmp esi, 0x3597
jl 0x1002e775
call dword [sym.imp.KERNEL32.dll_GetSystemDefaultUILanguage]
mov ebx, dword [ebp - 0x10]
mov esi, dword [ebp - 0x14]
cmp dword [ebp - 0xc], 0x2dfc
jge 0x1002e7e5
push str.ahj_wyepufuk_fbszukraz_ryapsfaa_ewlvdjk
call fcn.100476ff
pop ecx
cmp byte [ebp + 8], 0
je 0x1002e816
mov edi, dword [ebp + 0x14]
mov esi, dword [ebp + 0x10]
mov eax, dword [edi + 4]
sub eax, dword [edi]
sar eax, 2
mov dword [esi], eax
jmp 0x1002e810
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push eax
mov ecx, edi
call fcn.100312ea
inc dword [esi]
mov eax, dword [esi]
cmp eax, dword [ebx]
jl 0x1002e7fd
jmp 0x1002e823
mov eax, dword [ebp + 0x20]
mov ecx, dword [eax + 4]
sub ecx, dword [eax]
sar ecx, 2
mov dword [esi], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002ebc5
Capabilities:
Allocate thread local storage

Disassembly:
mov eax, 0x1005fc08
call fcn.1005e738
sub esp, 0x14
push ebx
push esi
mov dword [ebp - 0x1c], 0x29cc
cmp dword [ebp - 0x1c], 0x2d3b
push edi
mov dword [ebp - 0x10], esp
jle 0x1002ec43
xor esi, esi
mov dword [ebp - 0x18], esi
xor edi, edi
mov dword [ebp - 0x14], edi
xor ebx, ebx
mov eax, edi
mov dword [ebp - 0x20], esi
cdq
mov edi, 0x5f28
idiv ebx
sub esi, edx
mov eax, esi
mov ecx, 0x10079c18
cdq
push edx
push eax
call fcn.100048ed
inc esi
dec edi
jne 0x1002ec03
mov esi, dword [ebp - 0x18]
inc ebx
mov edi, dword [ebp - 0x14]
cmp ebx, 0x67c7
jl 0x1002ebf4
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x1fc4
jl 0x1002ebf2
inc esi
mov dword [ebp - 0x18], esi
cmp esi, 0x18e8
jl 0x1002ebed
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
and dword [ebp - 4], 0
cmp dword [ebp - 0x1c], 0x29b7
jge 0x1002ec5f
mov edx, str.vbcvix_zjmxvznqq_yho_cwsepfk_gvq_mkyyogzaq_hutkkjd_qtr_tyf_jbiughd_rabhrhbol
mov ecx, 0x10079c18
call fcn.10006b05
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x14], 0
je 0x1002ecb1
mov edi, dword [ebp + 8]
mov esi, dword [ebp + 0x20]
mov ebx, dword [ebp + 0x10]
mov eax, dword [edi + 4]
sub eax, dword [edi]
sar eax, 2
mov dword [esi], eax
jmp 0x1002ecab
and dword [ebp - 0x20], 0
lea eax, [ebp - 0x20]
push eax
mov ecx, edi
call fcn.100312ea
inc dword [esi]
mov eax, dword [esi]
cmp eax, dword [ebx]
jl 0x1002ec98
jmp 0x1002ece3
mov esi, dword [ebp + 0x1c]
mov eax, dword [esi]
and dword [eax], 0
jmp 0x1002ecdc
push 1
push 1
push 0xfa0
push 0x5ebe
mov edx, 0x2bec
xor cl, cl
call fcn.10030182
mov eax, dword [esi]
add esp, 0x10
inc dword [eax]
mov eax, dword [esi]
cmp dword [eax], 0x15
je 0x1002ecbb
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002edd7
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005fc22
call fcn.1005e738
sub esp, 0x48
push ebx
push esi
mov dword [ebp - 0x30], 0x65ed
mov ebx, edx
cmp dword [ebp - 0x30], 0x6638
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x34], ebx
jle 0x1002ee61
xor edi, edi
mov dword [ebp - 0x2c], edi
xor esi, esi
xor eax, eax
mov dword [ebp - 0x28], 0x7c83
mov dword [ebp - 0x24], eax
and dword [ebp - 0x38], 0
mov ebx, edi
mov edi, dword [ebp - 0x38]
mov ecx, eax
sar ebx, cl
mov eax, ebx
mov ecx, 0x10079c18
xor eax, edi
cdq
push edx
push eax
call fcn.100048ed
inc edi
cmp edi, 0x6ab9
jl 0x1002ee1f
mov eax, dword [ebp - 0x24]
mov edi, dword [ebp - 0x2c]
add eax, esi
dec dword [ebp - 0x28]
mov dword [ebp - 0x24], eax
jne 0x1002ee12
inc esi
cmp esi, 0x6d9e
jl 0x1002ee06
inc edi
mov dword [ebp - 0x2c], edi
cmp edi, 0x6e62
jl 0x1002ee04
mov ebx, dword [ebp - 0x34]
and dword [ebp - 4], 0
cmp dword [ebp - 0x30], 0x64ec
jge 0x1002ee9c
mov edx, str.mqplasw_dwdhup_pkb_vghf_phtcwyedr_qsntogflv
mov ecx, 0x10079c18
call fcn.10006b05
jmp 0x1002ee9c
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x10], 0
je 0x1002ef87
and dword [ebp - 0x1c], 0
lea ecx, [ebp - 0x50]
mov edx, ebx
call fcn.1002e154
mov edx, dword [ebp + 0x14]
lea ecx, [ebp - 0x44]
mov dword [ebp - 4], 2
call fcn.1002e154
push 0x5a54
lea eax, [ebp - 0x44]
mov byte [ebp - 4], 3
and dword [ebp - 0x20], 0
xor ebx, ebx
push eax
inc ebx
lea eax, [ebp - 0x50]
push ebx
push eax
lea eax, [ebp - 0x20]
mov dl, bl
push eax
lea eax, [ebp - 0x18]
mov ecx, 0x6128
push eax
call fcn.1002ea7f
and dword [ebp - 0x18], 0
add esp, 0x18
cmp dword [ebp - 0x20], 0
jle 0x1002ef6d
mov ecx, dword [ebp - 0x1c]
test ecx, ecx
jne 0x1002ef70
push 0x3f8f
push 0x410d
lea eax, [ebp - 0x44]
mov edx, 0x22ba
push eax
push ecx
lea eax, [ebp - 0x1c]
push eax
lea eax, [ebp - 0x50]
push eax
push 0x2ea3
push ecx
push ebx
push ecx
lea ecx, [ebp - 0x18]
call fcn.100301f7
push 0x1d6
push ebx
push ebx
lea eax, [ebp - 0x44]
mov edx, 0x75cc
push eax
push ebx
lea eax, [ebp - 0x18]
mov ecx, 0x69d2
push eax
lea eax, [ebp - 0x50]
push eax
lea eax, [ebp - 0x1c]
push eax
call fcn.1002ed20
mov eax, dword [ebp - 0x18]
add esp, 0x48
inc eax
mov dword [ebp - 0x18], eax
cmp eax, dword [ebp - 0x20]
jl 0x1002ef04
mov ecx, dword [ebp - 0x1c]
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
lea ecx, [ebp - 0x44]
call fcn.10031628
lea ecx, [ebp - 0x50]
call fcn.10031628
jmp 0x1002ef9b
push ecx
push 1
push ecx
push ecx
lea edx, [ebp - 0x11]
mov byte [ebp - 0x11], 0
call fcn.1002e68a
add esp, 0x10
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10031a25
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 8], 0
je 0x10031a4a
push ecx
push ecx
lea eax, [ebp - 1]
mov byte [ebp - 1], 0
push 0x193
push eax
xor cl, cl
call fcn.10031a68
add esp, 0x10
jmp 0x10031a64
cmp byte [ecx], 0
je 0x10031a64
push 0x1778
push 0x2218
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
mov esp, ebp
pop ebp
ret
Function at 0x10031a68
Capabilities:
Accept command line arguments
Read .ini file

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x24
push ebx
mov byte [esp + 8], cl
mov dword [esp + 0xc], 0xe6f
cmp dword [esp + 0xc], 0x1250
push esi
push edi
jle 0x10031add
xor esi, esi
xor edi, edi
xor ebx, ebx
mov ecx, ebx
mov eax, edi
sar eax, cl
lea ecx, [esp + 0x18]
xor eax, esi
cdq
push edx
push eax
call fcn.10002dd6
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10031aae
mov eax, dword [eax]
push eax
call fcn.100476ff
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.10004d30
inc ebx
cmp ebx, 0x775d
jl 0x10031a90
inc edi
cmp edi, 0x7712
jl 0x10031a8e
inc esi
cmp esi, 0x43de
jl 0x10031a8c
cmp byte [esp + 0x10], 0
je 0x10031aff
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x10031b0d
push 0
push 0xdea
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetPrivateProfileIntW]
jmp 0x10031b0d
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10031b0d
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
cmp dword [esp + 0x14], 0xd2a
jge 0x10031b22
push str.omntkdt_hvn_dtwa_revn_eatksctd_yispr_evimx_ceduh_ixctsfjrr
call fcn.100476ff
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10031b29
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
test dl, dl
je 0x10031b43
xor eax, eax
push eax
push eax
push eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_CreateThread]
jmp 0x10031b55
push 0
push 0x2057
push 0x2118
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
mov esp, ebp
pop ebp
ret
Function at 0x10032570
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1005fe29
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x40
mov byte [esp + 8], dl
push ebx
push esi
push edi
mov edi, ecx
test dl, dl
je 0x1003274e
push 3
lea ecx, [esp + 0x30]
call fcn.100021db
sub esp, 0xc
mov dword [esp + 0x60], 2
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x3c]
push eax
call fcn.100339d5
mov esi, dword [esp + 0x40]
xor ecx, ecx
add esp, 0x14
mov eax, 0x31d26ec1
mov edx, dword [esi + 8]
sub eax, edx
cmp edx, eax
sete cl
xor eax, eax
cmp ecx, edx
setl al
xor ecx, ecx
add eax, dword [esi]
test edx, edx
mov dword [esp + 0x18], eax
sete cl
xor edi, edi
inc edi
xor ebx, ebx
mov eax, edi
sub eax, ecx
cmp eax, dword [esp + 0x18]
jne 0x10032611
lea ecx, [esp + 0x12]
mov byte [esp + 0x12], bl
call fcn.10031a1a
jmp 0x100326cb
mov dword [esp + 0x18], 0x5b054dbb
mov dword [esp + 0x18], 0xffffffff
cmp dword [esp + 0x18], 0xffffffec
jge 0x100326c7
push dword [esp + 0x1c]
movdqa xmm0, xmmword [0x1006cd90]
lea eax, [esp + 0x4c]
push eax
lea eax, [esp + 0x40]
mov dword [esp + 0x28], ebx
push eax
push ebx
lea ecx, [esp + 0x30]
mov dword [esp + 0x34], ebx
movdqu xmmword [esp + 0x48], xmm0
mov dword [esp + 0x38], ebx
call fcn.100022f1
mov byte [esp + 0x54], 3
mov eax, dword [esp + 0x20]
mov dword [eax + 8], ebx
push ecx
lea edx, [esp + 0x24]
lea ecx, [esp + 0x30]
call fcn.100327f1
mov eax, dword [esp + 0x24]
pop ecx
inc dword [eax + 8]
cmp dword [eax + 8], 3
jl 0x1003266a
mov byte [esp + 0x13], bl
cmp byte [esp + 0x13], 0
je 0x100326a3
push 0x15d3
xor dl, dl
mov ecx, 0x2fee
call fcn.10033119
pop ecx
mov byte [esp + 0x54], 2
push dword [esp + 0x20]
call fcn.10046c84
mov dword [esp + 0x24], ebx
mov dword [esp + 0x28], ebx
mov dword [esp + 0x2c], ebx
dec dword [esp + 0x1c]
pop ecx
jmp 0x10032621
mov esi, dword [esp + 0x2c]
or dword [esp + 0x54], 0xffffffff
test esi, esi
je 0x100326db
push esi
call fcn.10046c84
pop ecx
mov eax, dword [0x1076f1c4]
test al, 1
jne 0x10032723
or eax, edi
mov ecx, 0x1571
or dword [0x1076f1b4], 0xffffffff
mov edx, 0x270
mov dword [0x1076f1c4], eax
mov dword [0x1076de34], ecx
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edi
mov dword [edi*4 + 0x1076de34], ecx
inc edi
cmp edi, edx
jl 0x10032702
mov dword [0x1076de30], edx
push 0x261f
push ebx
push 0x3463
push 0x1076dca0
xor dl, dl
mov ecx, 0x1076de30
call fcn.10032570
add esp, 0x10
call fcn.10034277
mov ecx, dword [ebp + 0xc]
mov dword [ecx], eax
jmp 0x10032768
mov esi, dword [ebp + 8]
cmp byte [esi], 0
jne 0x10032768
push ecx
call dword [sym.imp.KERNEL32.dll_GetTickCount]
push eax
mov ecx, edi
call fcn.100342d5
mov byte [esi], 1
mov ecx, dword [esp + 0x4c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret