joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100048cf
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0x18], 0
push esi
mov byte [ebp - 4], cl
je 0x1000491a
test cl, cl
je 0x10004903
mov dword [edx], 0
cmp dword [edx], 3
jge 0x10004955
mov esi, dword [ebp + 0x1c]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 1
inc dword [edx]
cmp dword [edx], 3
jl 0x100048ef
jmp 0x10004955
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x10004955
push 0
push 0x26c9
call dword [sym.imp.USER32.dll_GetWindowThreadProcessId]
jmp 0x10004955
cmp byte [ebp + 0xc], 0
je 0x10004945
mov edx, dword [ebp + 8]
mov dword [edx], 0
cmp dword [edx], 2
jge 0x10004955
mov esi, dword [ebp + 0x20]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfe93046a
inc dword [edx]
cmp dword [edx], 2
jl 0x10004931
jmp 0x10004955
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x10004955
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10004dfb
Capabilities:
Extract resource via kernel32 functions

Disassembly:
mov eax, 0x10063d22
call fcn.10063758
sub esp, 0x18
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], edx
mov byte [ebp - 0x14], cl
je 0x10004ea0
cmp byte [ebp + 0x18], 0
je 0x10004e8c
mov edi, dword [ebp + 0x28]
push 2
pop edx
mov dword [edi], 0
cmp dword [edi], edx
jg 0x10004f8a
mov ebx, dword [ebp + 0x44]
mov esi, dword [ebp + 0x38]
mov dword [esi], 0
cmp dword [esi], edx
jg 0x10004e81
mov edi, dword [ebp + 0x24]
mov ecx, dword [esi]
mov eax, dword [edi]
cmp dword [eax + ecx*4], 0
jne 0x10004e7e
mov dword [ebx], edx
cmp dword [ebx], 0
jl 0x10004e78
push 0x1e7b
mov edx, 0x5f04
xor cl, cl
call fcn.100056f2
dec dword [ebx]
cmp dword [ebx], 0
pop ecx
jge 0x10004e5c
push 2
pop edx
inc dword [esi]
cmp dword [esi], edx
jle 0x10004e4b
mov edi, dword [ebp + 0x28]
inc dword [edi]
cmp dword [edi], edx
jle 0x10004e3e
jmp 0x10004f8a
mov eax, dword [ebp + 0x40]
mov ecx, dword [eax]
imul ecx, dword [eax]
mov eax, dword [ebp + 0x2c]
mov eax, dword [eax]
mov dword [eax], ecx
jmp 0x10004f8a
test cl, cl
je 0x10004f78
mov dword [ebp - 0x20], 0x7ca3
cmp dword [ebp - 0x20], 0x7ff3
jle 0x10004f06
xor esi, esi
mov dword [ebp - 0x1c], esi
mov edi, esi
mov dword [ebp - 0x18], 0x113b
mov ebx, edi
mov dword [ebp + 0xc], 0x2c8d
xor esi, esi
mov eax, ebx
mov ecx, 0x10080d98
and eax, esi
cdq
push edx
push eax
call fcn.10001b47
inc esi
cmp esi, 0x4b75
jl 0x10004ed1
dec ebx
dec dword [ebp + 0xc]
jne 0x10004ecf
dec edi
dec dword [ebp - 0x18]
jne 0x10004ec6
mov esi, dword [ebp - 0x1c]
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x306
jl 0x10004ebd
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x7b27
jge 0x10004f22
mov edx, str.wlgxjgfaz_rifjpqw_uqwyfxn_fbcpmhy_lzu
mov ecx, 0x10080d98
call fcn.10003a21
mov ebx, dword [ebp + 0x30]
mov edi, dword [ebp + 0x34]
mov esi, dword [ebp + 0x10]
mov edx, dword [ebp + 0x1c]
mov eax, dword [ebx]
mov eax, dword [ebx]
mov eax, dword [edi]
mov eax, dword [ebx]
mov eax, dword [esi]
mov eax, dword [ebx]
mov eax, dword [edi]
mov eax, dword [edx]
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
mov ecx, dword [edi]
mov eax, dword [ebp - 0x24]
add ecx, dword [eax]
mov eax, dword [ebp + 0x3c]
mov dword [eax], ecx
mov eax, dword [eax]
mov eax, dword [edx]
mov eax, dword [ebx]
mov eax, dword [esi]
imul eax, dword [ebx]
mov dword [edi], eax
jmp 0x10004f8a
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x10004f8a
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000e7c9
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x100640de
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x6c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x1000e80c
push 0x123a
push 1
push 0x47e
call fcn.1000e9de
add esp, 0xc
jmp 0x1000e9cd
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x1000e9b9
mov dword [ebp - 0x28], 0x49d4
mov dword [ebp - 0x3c], str.ubbgk_kqd_eouh_ozoidxtbb_oucrjbc_siohr_petyhx
cmp dword [ebp - 0x28], 0x4b92
jle 0x1000e8aa
and dword [ebp - 0x18], 0
jmp 0x1000e850
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x6a3d
jge 0x1000e8aa
and dword [ebp - 0x1c], 0
jmp 0x1000e866
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x319e
jge 0x1000e8a8
mov eax, dword [ebp - 0x18]
xor eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edx
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
lea ecx, [ebp - 0x7c]
call fcn.10001a65
pop ecx
pop ecx
mov dword [ebp - 0x34], eax
mov ecx, dword [ebp - 0x34]
call fcn.10001b27
push eax
call fcn.1004b9e4
pop ecx
lea ecx, [ebp - 0x7c]
call fcn.10001b1d
jmp 0x1000e85f
jmp 0x1000e849
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x44], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x28], 0x488a
jge 0x1000e8c6
push dword [ebp - 0x3c]
call fcn.1004b9e4
pop ecx
jmp 0x1000e8e2
or dword [ebp - 4], 0xffffffff
jmp 0x1000e8ec
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x4c], eax
mov dword [ebp - 0x2c], 0x386d
mov dword [ebp - 0x54], str.tsfcixsex_yyglm_yrmmrhct_lgobordch_gsa_ktwpdd_qjzdfpi_eamnqxqwb_jnw_abu_hshz
cmp dword [ebp - 0x2c], 0x3c03
jle 0x1000e965
and dword [ebp - 0x20], 0
jmp 0x1000e922
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x1cb1
jge 0x1000e965
and dword [ebp - 0x24], 0
jmp 0x1000e938
mov eax, dword [ebp - 0x24]
inc eax
mov dword [ebp - 0x24], eax
cmp dword [ebp - 0x24], 0x4ff7
jge 0x1000e963
mov eax, dword [ebp - 0x20]
cdq
idiv dword [ebp - 0x24]
mov eax, edx
cdq
mov dword [ebp - 0x64], eax
mov dword [ebp - 0x60], edx
push dword [ebp - 0x60]
push dword [ebp - 0x64]
mov ecx, 0x10080d98
call fcn.10001b47
jmp 0x1000e931
jmp 0x1000e91b
mov eax, dword [ebp - 0x4c]
movzx eax, word [eax]
push eax
mov ecx, dword [ebp - 0x50]
call fcn.10018b90
mov dword [ebp - 4], 2
cmp dword [ebp - 0x2c], 0x353d
jge 0x1000e991
mov edx, dword [ebp - 0x54]
mov ecx, 0x10080d98
call fcn.10003a21
jmp 0x1000e9ad
or dword [ebp - 4], 0xffffffff
jmp 0x1000e9b7
jmp 0x1000e9cd
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x1000e9cd
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10012c95
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10064224
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x30
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10012dbe
lea eax, [ebp + 0x10]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x10012cfc
mov byte [ebp - 0x11], 0
push 1
push 1
push 0x79b8
lea eax, [ebp - 0x11]
push eax
push 0x3073
call fcn.1000f030
add esp, 0x14
jmp 0x10012dbc
mov eax, dword [ebp - 0x28]
mov dword [ebp - 0x2c], eax
mov dword [ebp - 0x20], 0x15ba
mov dword [ebp - 0x34], str.smbpxo_lmejp_mju_ufkyz_oilka_qldpylgwx
cmp dword [ebp - 0x20], 0x18d8
jle 0x10012d66
and dword [ebp - 0x18], 0
jmp 0x10012d26
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x151f
jge 0x10012d66
and dword [ebp - 0x1c], 0
jmp 0x10012d3c
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x4b4c
jge 0x10012d64
mov eax, dword [ebp - 0x18]
or eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x40], eax
mov dword [ebp - 0x3c], edx
push dword [ebp - 0x3c]
push dword [ebp - 0x40]
mov ecx, 0x10080d98
call fcn.10001b47
jmp 0x10012d35
jmp 0x10012d1f
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x10012d7c
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x154b
jge 0x10012d96
mov edx, dword [ebp - 0x34]
mov ecx, 0x10080d98
call fcn.10003a21
jmp 0x10012db2
or dword [ebp - 4], 0xffffffff
jmp 0x10012dbc
jmp 0x10012dd6
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x38], eax
push dword [ebp - 0x38]
push 0
push 0x4c15
call fcn.10012be5
add esp, 0xc
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001371c
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x1001379f
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x10], eax
lea eax, [ebp + 0xc]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x10013790
mov eax, dword [ebp - 8]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x18]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov dword [ebp - 0x28], eax
push dword [ebp - 0x24]
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [ebp - 0x2c]
call fcn.10019019
mov ecx, eax
call fcn.10008905
jmp 0x1001379d
push 0x10c1
push 0
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
jmp 0x100137c5
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x30], eax
push 1
push 0x62c4
push 0x8a8
push dword [ebp - 0x30]
push dword [ebp - 0x34]
call fcn.1000db5a
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x1001e085
Capabilities:
Get file attributes

Disassembly:
mov eax, 0x10064658
call fcn.10063758
sub esp, 0x1c
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov byte [ebp - 0x14], cl
je 0x1001e0ea
cmp byte [ebp + 0x1c], 0
je 0x1001e0c8
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0x1001e0b7
push 0
call dword [sym.imp.KERNEL32.dll_DeleteCriticalSection]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp + 0x20]
mov esi, 0x144a
mov ecx, dword [eax]
mov eax, dword [ebp + 0x14]
mov eax, dword [eax]
mov dword [eax + ecx*4], esi
xor ecx, ecx
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
cmp eax, esi
setle cl
mov dword [edx], ecx
jmp 0x1001e0b7
test cl, cl
je 0x1001e100
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1001e0b7
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
jmp 0x1001e0b7
mov dword [ebp - 0x20], 0x509b
cmp dword [ebp - 0x20], 0x532c
jle 0x1001e16b
xor esi, esi
mov dword [ebp - 0x1c], esi
xor edi, edi
mov dword [ebp - 0x18], edi
mov eax, esi
mov dword [ebp + 8], 0x46fd
cdq
xor ebx, ebx
idiv edi
mov dword [ebp - 0x24], edx
mov esi, ebx
mov edi, 0x7605
mov eax, esi
mov ecx, 0x10080d98
cdq
push edx
push eax
call fcn.10001b47
dec esi
dec edi
jne 0x1001e132
add ebx, dword [ebp - 0x24]
dec dword [ebp + 8]
jne 0x1001e12b
mov edi, dword [ebp - 0x18]
mov esi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x18], edi
cmp edi, 0x4f6e
jl 0x1001e11a
inc esi
mov dword [ebp - 0x1c], esi
cmp esi, 0x1482
jl 0x1001e115
push 0
push 0
push 0x1496
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x5024
jge 0x1001e0b7
mov edx, str.dqcvabg_mzam_qclcxf_doziuhwlk_rpiyy_zkqi_calkcuuyi_cjxqe_cbmklo_abzlydm_gmlnj_jtilz
mov ecx, 0x10080d98
call fcn.10003a21
jmp 0x1001e0b7
Function at 0x1001e221
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 0x28], 0
mov byte [ebp - 4], dl
je 0x1001e254
test dl, dl
je 0x1001e240
mov eax, dword [ebp + 0x20]
mov dword [eax], 0xfffffffd
jmp 0x1001e2c5
mov eax, dword [ebp + 0x18]
cmp byte [eax], 0
je 0x1001e2c5
push 0
push 0
call dword [sym.imp.KERNEL32.dll_LoadResource]
jmp 0x1001e2c5
cmp byte [ebp + 8], 0
je 0x1001e261
mov ecx, dword [ecx]
mov eax, dword [ebp + 0xc]
jmp 0x1001e2c3
mov edx, dword [ebp + 0x10]
mov eax, dword [ebp + 0x14]
push ebx
mov ebx, dword [ebp + 0x2c]
mov ecx, dword [edx]
mov eax, dword [eax]
push esi
push edi
mov ecx, dword [ecx + 4]
sub ecx, eax
je 0x1001e282
mov ecx, dword [ebx]
mov eax, dword [edx]
cmp dword [eax + ecx*4], 0
jne 0x1001e284
mov eax, dword [ebx]
mov eax, dword [ebx]
mov eax, dword [ebx]
mov eax, dword [ebx]
mov eax, dword [ebx]
mov esi, dword [ebp + 0x1c]
mov ecx, dword [ebp + 0x10]
mov dword [esi], eax
mov edx, dword [ebx]
mov edi, dword [ebx]
mov ecx, dword [ecx]
mov eax, dword [ebx]
imul eax, dword [ecx + edx*4]
mov edx, dword [esi]
imul edx, eax
mov eax, dword [ebp + 0x10]
mov eax, dword [eax]
sub edx, 0xd338
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, dword [eax + edi*4]
mov eax, dword [ebp + 0x24]
pop edi
pop esi
setne cl
pop ebx
mov dword [eax], ecx
mov esp, ebp
pop ebp
ret
Function at 0x1001e36d
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10064662
call fcn.10063758
sub esp, 0x24
push ebx
push esi
mov dword [ebp - 0x28], 0x1063
xor ebx, ebx
cmp dword [ebp - 0x28], 0x1134
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], ecx
jle 0x1001e3cc
mov edi, ebx
mov dword [ebp - 0x24], ebx
mov dword [ebp - 0x18], 0x1bcc
mov eax, ebx
mov ecx, 0x10080d98
cdq
push edx
push eax
call fcn.10001b47
add ebx, edi
dec dword [ebp - 0x18]
jne 0x1001e3a4
inc edi
push 0
pop ebx
cmp edi, 0x7b92
jl 0x1001e39a
mov edx, dword [ebp - 0x20]
mov ecx, dword [ebp - 0x1c]
cmp byte [ebp + 0x10], 0
je 0x1001e4a8
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], 0
je 0x1001e3eb
push ebx
push 0x323
call dword [sym.imp.USER32.dll_SetWindowTextA]
mov dword [ebp - 0x24], 0x513d
cmp dword [ebp - 0x24], 0x5225
jle 0x1001e471
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov dword [ebp - 0x18], ebx
mov edi, ebx
mov dword [ebp - 0x20], ebx
mov ecx, ebx
mov dword [ebp - 0x1c], ebx
mov eax, edi
mov dword [ebp - 0x2c], ebx
cdq
idiv ecx
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x2c]
mov eax, edx
mov dword [ebp - 0x30], eax
xor eax, edi
mov ecx, 0x10080d98
xor eax, ebx
cdq
push edx
push eax
call fcn.10001b47
mov eax, dword [ebp - 0x30]
inc edi
cmp edi, 0x5caa
jl 0x1001e425
mov ecx, dword [ebp - 0x1c]
mov edi, dword [ebp - 0x20]
inc ecx
mov dword [ebp - 0x1c], ecx
push 0
pop ebx
cmp ecx, 0x7bff
jl 0x1001e412
inc edi
mov dword [ebp - 0x20], edi
cmp edi, 0x2f84
jl 0x1001e40d
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x2ace
jl 0x1001e408
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x24], 0x4e1a
jge 0x1001e48c
mov edx, str.vwfer_mxfzdc_rshin_aauztw_ofwl_skag
mov ecx, 0x10080d98
call fcn.10003a21
jmp 0x1001e4b7
mov eax, dword [ebp + 0xc]
mov eax, dword [eax]
sub eax, dword [edx]
sar eax, 1
push eax
call fcn.10018bc7
mov dword [ebp - 4], 2
cmp dword [ebp - 0x28], 0xfee
jge 0x1001e4d6
mov edx, str.kof_cckqwu_mvcuqsa_paiorjqfr_ksxkdkqwk
mov ecx, 0x10080d98
call fcn.10003a21
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001e976
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
mov dword [ebp - 0x1c], edx
mov byte [ebp - 4], cl
push ebx
push esi
push edi
test cl, cl
je 0x1001ead1
mov dword [ebp - 0x18], 0x3f2e
cmp dword [ebp - 0x18], 0x411f
push 1
pop ebx
jle 0x1001ea1d
xor esi, esi
mov dword [ebp - 0x14], esi
xor edi, edi
mov dword [ebp - 0x10], edi
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], 0x4f51
mov edi, dword [ebp - 8]
xor esi, esi
mov ecx, esi
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0x34]
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001e9d4
mov eax, dword [eax]
push eax
call fcn.1004b9e4
pop ecx
push 0
push ebx
lea ecx, [ebp - 0x34]
call fcn.10002062
inc esi
cmp esi, 0x1a27
jl 0x1001e9b9
mov edi, dword [ebp - 0x10]
add dword [ebp - 8], edi
dec dword [ebp - 0xc]
jne 0x1001e9b4
mov esi, dword [ebp - 0x14]
inc edi
mov dword [ebp - 0x10], edi
cmp edi, 0x4865
jl 0x1001e9aa
inc esi
mov dword [ebp - 0x14], esi
cmp esi, 0x478
jl 0x1001e9a5
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp dword [ebp - 0x18], 0x3e90
jge 0x1001ea31
push str.znuxm_cxeluteqd_zhczocpb_hqlzhhb_pubvchmks_aeugy_qkrletmup_xckmsocg_eegcrv_kryf_qlzxckph_vfpofp
call fcn.1004b9e4
pop ecx
mov edi, dword [ebp + 0x14]
xor ecx, ecx
mov edx, dword [ebp + 0x18]
mov esi, dword [edi]
mov eax, dword [edx]
cmp eax, 0x85b6
mov eax, dword [edx]
setg cl
xor edx, edx
imul ecx, ecx, 0xffff
cmp ecx, eax
mov eax, dword [edi]
setl dl
sub edx, 0x486a
neg edx
sbb edx, edx
xor ecx, ecx
inc edx
cmp edx, eax
mov edx, dword [ebp + 0x10]
setle cl
mov eax, dword [edx]
add ecx, dword [eax + esi*4]
mov eax, dword [ebp + 8]
mov dword [eax], ecx
xor ecx, ecx
mov edi, dword [edi]
mov eax, dword [eax]
test eax, eax
mov edx, dword [edx]
sete cl
xor eax, eax
mov esi, dword [edx]
add ecx, esi
cmp ecx, 0xfffffff6
setne al
add eax, dword [edx + edi*4]
mov edi, dword [ebp + 8]
cmp esi, eax
jle 0x1001eaa1
cmp dword [edi], 0
je 0x1001eaa1
mov esi, ebx
jmp 0x1001eaa3
xor esi, esi
mov ecx, dword [ebp + 0x14]
xor edx, edx
mov eax, dword [ebp + 0x10]
mov ecx, dword [ecx]
mov eax, dword [eax]
cmp dword [eax + ecx*4], esi
setl dl
add edx, 0x1449c9fb
cmp edx, 0xfc3e8ce6
jne 0x1001eac8
cmp dword [edi], 0
jne 0x1001eaca
xor ebx, ebx
mov eax, dword [ebp - 0x1c]
mov dword [eax], ebx
jmp 0x1001eadf
mov eax, dword [ebp + 0xc]
mov ecx, dword [eax]
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax]
and dword [eax + ecx*4], 0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001f184
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1006469a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x60
cmp byte [ebp + 0x18], 0
push ebx
push esi
push edi
mov ebx, edx
mov dword [esp + 0x1c], ecx
je 0x1001f262
cmp byte [ebp + 8], 0
je 0x1001f245
mov edi, dword [ebp + 0x10]
xor esi, esi
mov dword [edi], esi
jmp 0x1001f23b
push 0x4767
lea eax, [esp + 0x14]
mov dword [esp + 0x18], esi
push eax
push 0x7eb3
push 0x40be
push 1
push 0x30cf
push 0x1700
push 0x7a2b
lea eax, [esp + 0x34]
mov dword [esp + 0x30], 0xc3414b58
mov dl, 1
push 0x46aa
push eax
mov cl, dl
call fcn.1001d20f
add esp, 0x28
lea eax, [esp + 0x10]
lea edx, [esp + 0x14]
push dword [esp + 0x1c]
push 0x16e9
push edi
push eax
push 0x8e4
push ecx
push ecx
push 0x2a3b
push esi
mov ecx, ebx
call fcn.1002124c
add esp, 0x24
dec dword [edi]
cmp dword [edi], 0xfffffff6
je 0x1001f1c8
jmp 0x1001f3c7
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1001f3c7
push 0
mov ecx, 0x35b0
call fcn.1001f130
jmp 0x1001f3c6
cmp byte [ebp + 0x14], 0
je 0x1001f2a0
push 0x151d
push 0x1c54
push 0x2c4
push 0x1c64
push 0x2212
push 0x1ce1
push 0x9d3
push 0xe73
push 0x963
call dword [sym.imp.GDI32.dll_BitBlt]
jmp 0x1001f3c7
push dword [esp + 0x20]
movdqa xmm0, xmmword [0x10072eb0]
lea eax, [esp + 0x54]
push eax
xor esi, esi
lea eax, [esp + 0x48]
push eax
push esi
lea ecx, [esp + 0x38]
mov dword [esp + 0x38], esi
movdqu xmmword [esp + 0x50], xmm0
mov dword [esp + 0x3c], esi
mov dword [esp + 0x40], esi
call fcn.100043b1
push 3
lea ecx, [esp + 0x38]
mov dword [esp + 0x78], esi
call fcn.10001cd1
lea eax, [esp + 0x34]
mov byte [esp + 0x74], 1
push eax
lea eax, [esp + 0x28]
mov dword [esp + 0x24], 0x4b0ad8ea
mov dword [esp + 0x1c], 0xfffffff9
push eax
call fcn.1001e7d6
lea eax, [esp + 0x20]
push eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x30]
push eax
lea edx, [esp + 0x48]
call fcn.100205e9
add esp, 0x14
lea ecx, [esp + 0x34]
call fcn.10001d54
or dword [esp + 0x74], 0xffffffff
lea ecx, [esp + 0x28]
call fcn.10001d54
mov dword [esp + 0x1c], 0x4e2c
cmp dword [esp + 0x1c], 0x4e83
jle 0x1001f3b2
mov dword [esp + 0x18], esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], 0x65d6
mov edi, dword [esp + 0x10]
mov ebx, esi
mov eax, edi
lea ecx, [esp + 0x50]
xor eax, ebx
cdq
push edx
push eax
call fcn.10001a65
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1001f37b
mov eax, dword [eax]
push eax
call fcn.1004b9e4
pop ecx
push esi
push 1
lea ecx, [esp + 0x58]
call fcn.10002062
inc ebx
cmp ebx, 0xe0a
jl 0x1001f361
mov edi, dword [esp + 0x18]
add dword [esp + 0x10], edi
dec dword [esp + 0x14]
jne 0x1001f35b
inc edi
mov dword [esp + 0x18], edi
cmp edi, 0x5c88
jl 0x1001f34f
cmp dword [esp + 0x1c], 0x4b6d
jge 0x1001f3c7
push str.pmxkkao_wslha_wkep_akesfb_mqjmtm_xhcdcksjc_mwhfqf_vzn_iecogva_lzi
call fcn.1004b9e4
pop ecx
mov ecx, dword [esp + 0x6c]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001f404
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0xc], 0
push esi
mov esi, ecx
je 0x1001f45a
cmp byte [ebp + 0x1c], 0
je 0x1001f435
mov edx, dword [ebp + 8]
mov dword [edx], 0
jmp 0x1001f42e
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 9
inc dword [edx]
cmp dword [edx], 3
jl 0x1001f421
jmp 0x1001f48a
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x1001f48a
mov esi, dword [ebp + 0x14]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffff6
inc dword [edx]
cmp dword [edx], 1
jl 0x1001f446
jmp 0x1001f48a
cmp byte [ebp + 0x18], 0
je 0x1001f482
mov dword [edx], 0
cmp dword [edx], 2
jge 0x1001f48a
mov esi, dword [ebp + 0x20]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xffff
inc dword [edx]
cmp dword [edx], 2
jl 0x1001f46e
jmp 0x1001f48a
push 0
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
pop esi
pop ebp
ret

Function at 0x1001ffa9
Capabilities:
Get disk information

Disassembly:
push ebp
mov ebp, esp
push ecx
cmp byte [ebp + 8], 0
push esi
mov esi, ecx
je 0x10020006
cmp byte [ebp + 0x24], 0
je 0x1001ffe5
mov dword [esi], 0
cmp dword [esi], 2
jge 0x10020071
mov edx, dword [ebp + 0x10]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0xd5e4
inc dword [esi]
cmp dword [esi], 2
jl 0x1001ffce
jmp 0x10020071
mov eax, dword [ebp + 0x1c]
mov dword [eax], 0xffffffec
jmp 0x1001ffff
mov dword [ebp + 8], 0x3c89
cmp dword [ebp + 8], 0
jne 0x10020071
inc dword [eax]
cmp dword [eax], 7
je 0x1001fff0
jmp 0x10020071
cmp byte [ebp + 0x14], 0
je 0x10020014
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
jmp 0x10020071
mov ecx, dword [ebp + 0x20]
mov dword [ecx], 0
cmp dword [ecx], 1
jl 0x10020071
mov esi, dword [ebp + 0x18]
push edi
mov edi, dword [ebp + 0x28]
mov dword [ebp - 4], 0xd5b6062c
mov dword [ebp + 8], 0x7c0ce695
mov dword [ebp + 8], 0x6de21e52
mov eax, dword [edx]
mov eax, dword [edx]
mov eax, dword [esi]
mov eax, dword [edx]
mov eax, dword [ebp - 4]
mov eax, dword [edx]
mov eax, dword [esi]
mov eax, dword [edi]
mov dword [ebp + 8], eax
mov eax, dword [esi]
add eax, dword [ebp + 8]
mov dword [ebp + 8], eax
mov eax, dword [ebp + 8]
mov eax, dword [edi]
mov eax, dword [edx]
mov eax, dword [edx]
imul eax, dword [ebp - 4]
mov dword [esi], eax
inc dword [ecx]
cmp dword [ecx], 1
jge 0x10020029
pop edi
pop esi
mov esp, ebp
pop ebp
ret