joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10004c88
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov ecx, dword [ebp + 8]
xor edx, edx
push esi
mov dword [0x100b5be4], ecx
inc edx
mov esi, 0x270
mov eax, ecx
shr eax, 0x1e
xor eax, ecx
imul ecx, eax, 0x6c078965
add ecx, edx
mov dword [edx*4 + 0x100b5be4], ecx
inc edx
cmp edx, esi
jl 0x10004c9d
mov dword [0x100b5be0], esi
pop esi
pop ebp
ret 8

Function at 0x10004cc3
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x100b5be4
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x100b5f70
jl 0x10004cd1
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x100b6214
jl 0x10004d11
mov ecx, dword [0x100b6f60]
xor ecx, dword [0x100b5be4]
and ecx, edi
xor ecx, dword [0x100b6f60]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x100b5be0], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x100b6214]
mov dword [0x100b65a0], eax
pop esi
ret
Function at 0x1000bd29
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1000bd67
lea eax, [ebp + 0x10]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1000bd4f
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x1000bd65
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1000bd65
push 0
push 0
call dword [sym.imp.KERNEL32.dll_FindNextFileA]
jmp 0x1000bd88
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
push 0x56fd
push dword [ebp - 0xc]
push dword [ebp - 0x10]
push 0
call fcn.10011f28
add esp, 0x10
mov esp, ebp
pop ebp
ret

Function at 0x1000c0d6
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
movzx eax, byte [ebp + 0xc]
test eax, eax
je 0x1000c11f
lea eax, [ebp + 8]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x1000c117
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
push 0x10e2
push 0
push 0x4dbf
push 0x1f09
call fcn.1001e59d
add esp, 0x14
jmp 0x1000c11d
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
jmp 0x1000c141
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xc], eax
push 0
push 0x7e8
push 0x3b7b
push 0x6f9b
push dword [ebp - 0xc]
call fcn.1001ef11
add esp, 0x14
mov esp, ebp
pop ebp
ret
Function at 0x100112bc
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060c06
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x4c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x1c]
test eax, eax
je 0x10011311
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x20]
mov dword [ebp - 0x2c], eax
push dword [ebp - 0x28]
push dword [ebp - 0x2c]
push 0x6b17
push 0x12f2
push 0
call fcn.10012290
add esp, 0x14
jmp 0x10011466
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x40], eax
lea eax, [ebp + 8]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x44], eax
mov dword [ebp - 0x24], 0x762a
mov dword [ebp - 0x54], str.tawzie_zklgln_ckcurij_jrvdoct_ewzmctou_ykjps_icwbkopvb_orfziambq_iuhf_ckxthbbj_mjfrv
cmp dword [ebp - 0x24], 0x7843
jle 0x100113b3
and dword [ebp - 0x18], 0
jmp 0x1001134d
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x5bc5
jge 0x100113ab
and dword [ebp - 0x1c], 0
jmp 0x10011363
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x495c
jge 0x100113a9
and dword [ebp - 0x20], 0
jmp 0x10011379
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x1ad5
jge 0x100113a7
mov eax, dword [ebp - 0x18]
cdq
idiv dword [ebp - 0x1c]
sub edx, dword [ebp - 0x20]
mov eax, edx
cdq
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x58], edx
push dword [ebp - 0x58]
push dword [ebp - 0x5c]
mov ecx, 0x1007bb98
call fcn.100042e3
jmp 0x10011372
jmp 0x1001135c
jmp 0x10011346
push 0
call dword [sym.imp.KERNEL32.dll_FindClose]
mov eax, dword [ebp - 0x30]
movzx eax, byte [eax]
test eax, eax
je 0x100113db
mov eax, dword [ebp - 0x34]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp - 0x3c]
movzx eax, byte [eax]
test eax, eax
je 0x100113d9
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
jmp 0x10011426
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x48], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x48]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x4c]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp - 0x14]
mov dword [eax], 0
jmp 0x10011409
mov eax, dword [ebp - 0x14]
mov eax, dword [eax]
inc eax
mov ecx, dword [ebp - 0x14]
mov dword [ecx], eax
mov eax, dword [ebp - 0x14]
cmp dword [eax], 1
jge 0x10011426
mov eax, dword [ebp - 0x14]
push dword [eax]
mov ecx, dword [ebp - 0x50]
call fcn.100045fc
mov dword [eax], 0x13bf58aa
jmp 0x100113fe
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x74bf
jge 0x10011440
mov edx, dword [ebp - 0x54]
mov ecx, 0x1007bb98
call fcn.100067dc
jmp 0x1001145c
or dword [ebp - 4], 0xffffffff
jmp 0x10011466
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10011f4a
Capabilities:
Get file system object information

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10060c39
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x70
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
movzx eax, byte [ebp + 0x14]
test eax, eax
je 0x10011fd8
lea eax, [ebp + 0x1c]
mov dword [ebp - 0x28], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x38], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0x3c], eax
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x2c], eax
mov eax, dword [ebp - 0x28]
movzx eax, byte [eax]
test eax, eax
je 0x10011faa
mov eax, dword [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov eax, dword [ebp - 0x30]
mov dword [ebp - 0x34], eax
mov eax, dword [ebp - 0x34]
and dword [eax], 0
jmp 0x10011fd3
mov eax, dword [ebp - 0x38]
mov dword [ebp - 0x40], eax
mov eax, dword [ebp - 0x3c]
mov dword [ebp - 0x44], eax
mov eax, dword [ebp - 0x40]
mov dword [ebp - 0x4c], eax
mov eax, dword [ebp - 0x44]
mov dword [ebp - 0x48], eax
push 1
mov ecx, dword [ebp - 0x48]
call fcn.100045fc
mov ecx, dword [ebp - 0x4c]
mov eax, dword [eax]
mov dword [ecx], eax
jmp 0x10012112
lea eax, [ebp + 0x20]
mov dword [ebp - 0x50], eax
mov eax, dword [ebp + 8]
mov dword [ebp - 0x54], eax
mov eax, dword [ebp - 0x50]
movzx eax, byte [eax]
test eax, eax
je 0x10012024
mov byte [ebp - 0x11], 0
movzx eax, byte [ebp - 0x11]
test eax, eax
je 0x1001201f
push 0x3bb8
push 0x4552
push 0
push 0x701
push 0x2ee4
push 0
push 0x528f
call fcn.1000c165
add esp, 0x1c
jmp 0x10012112
mov eax, dword [ebp - 0x54]
mov dword [ebp - 0x5c], eax
mov dword [ebp - 0x20], 0x84
mov dword [ebp - 0x60], str.ewdyllsof_csiecu_rfajmn_fwc_zhxsinp_ipojd_djvevbcti_wjqvyh_gdpl_pxmury_guijcuth_fhwk_ujqehup_xee
cmp dword [ebp - 0x20], 0xe5
jle 0x100120c5
push 0x1a6e
push 0x80d
push 0
push 0x35a
push 0
call dword [sym.imp.SHELL32.dll_SHGetFileInfoW]
and dword [ebp - 0x18], 0
jmp 0x1001206b
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x301e
jge 0x100120c5
and dword [ebp - 0x1c], 0
jmp 0x10012081
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x15d
jge 0x100120c3
mov eax, dword [ebp - 0x18]
and eax, dword [ebp - 0x1c]
cdq
mov dword [ebp - 0x68], eax
mov dword [ebp - 0x64], edx
push dword [ebp - 0x64]
push dword [ebp - 0x68]
lea ecx, [ebp - 0x80]
call fcn.10001a85
pop ecx
pop ecx
mov dword [ebp - 0x58], eax
mov ecx, dword [ebp - 0x58]
call fcn.100042c3
push eax
call fcn.10049603
pop ecx
lea ecx, [ebp - 0x80]
call fcn.100042b9
jmp 0x1001207a
jmp 0x10012064
mov eax, dword [ebp - 0x5c]
mov dword [ebp - 0x24], eax
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0xfffffe30
jge 0x100120e1
push dword [ebp - 0x60]
call fcn.10049603
pop ecx
jmp 0x100120fd
or dword [ebp - 4], 0xffffffff
jmp 0x10012107
mov eax, dword [ebp - 0x24]
mov eax, dword [eax]
dec eax
mov ecx, dword [ebp - 0x24]
mov dword [ecx], eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001a7c1
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push esi
cmp dword [ebp + 8], 0xa
jle 0x1001a7d3
jmp 0x1001a9ee
mov ecx, 0x100b5b70
call fcn.10006e7b
cmp eax, 4
jne 0x1001a9c0
push 0x100b5b70
mov ecx, 0x100b5b64
call fcn.1001fcc8
mov byte [ebp - 1], 1
push 0
mov ecx, 0x100b5b64
call fcn.100045fc
mov esi, eax
push 1
mov ecx, 0x100b5b64
call fcn.100045fc
mov ecx, dword [esi]
add ecx, dword [eax]
cmp ecx, dword [0x1007de7c]
je 0x1001a823
mov byte [ebp - 1], 0
push 2
mov ecx, 0x100b5b64
call fcn.100045fc
mov esi, eax
push 3
mov ecx, 0x100b5b64
call fcn.100045fc
mov ecx, dword [esi]
add ecx, dword [eax]
cmp ecx, dword [0x1007cd74]
je 0x1001a84d
mov byte [ebp - 1], 0
push 0
mov ecx, 0x100b5b64
call fcn.100045fc
mov esi, eax
push 2
mov ecx, 0x100b5b64
call fcn.100045fc
mov ecx, dword [esi]
add ecx, dword [eax]
cmp ecx, dword [0x1007de84]
je 0x1001a877
mov byte [ebp - 1], 0
push 1
mov ecx, 0x100b5b64
call fcn.100045fc
mov esi, eax
push 3
mov ecx, 0x100b5b64
call fcn.100045fc
mov ecx, dword [esi]
add ecx, dword [eax]
cmp ecx, dword [0x1007de88]
je 0x1001a8a1
mov byte [ebp - 1], 0
push 0
mov ecx, 0x100b5b64
call fcn.100045fc
mov esi, eax
push 3
mov ecx, 0x100b5b64
call fcn.100045fc
mov ecx, dword [esi]
add ecx, dword [eax]
cmp ecx, dword [0x1007de8c]
je 0x1001a8cb
mov byte [ebp - 1], 0
push 1
mov ecx, 0x100b5b64
call fcn.100045fc
mov esi, eax
push 2
mov ecx, 0x100b5b64
call fcn.100045fc
mov ecx, dword [esi]
add ecx, dword [eax]
cmp ecx, dword [0x1007de80]
je 0x1001a8f5
mov byte [ebp - 1], 0
movzx eax, byte [ebp - 1]
test eax, eax
je 0x1001a98c
push fcn.1000b153
push 1
mov ecx, 0x100b5b64
call fcn.100045fc
push dword [eax]
push 0
mov ecx, 0x100b5b64
call fcn.100045fc
push dword [eax]
mov ecx, 0x1007bb98
call fcn.100090d3
mov dl, 0x20
mov ecx, eax
call fcn.100206cc
mov ecx, eax
call fcn.100090d3
mov ecx, eax
call fcn.100090c7
push fcn.1000b153
push 3
mov ecx, 0x100b5b64
call fcn.100045fc
push dword [eax]
push 2
mov ecx, 0x100b5b64
call fcn.100045fc
push dword [eax]
mov ecx, 0x1007bb98
call fcn.100090d3
mov dl, 0x20
mov ecx, eax
call fcn.100206cc
mov ecx, eax
call fcn.100090d3
mov ecx, eax
call fcn.100090c7
push 0
call fcn.1004a16a
lea eax, [ebp - 8]
push eax
mov ecx, 0x100b5b64
call fcn.1001fda3
push dword [eax]
lea eax, [ebp - 0xc]
push eax
mov ecx, 0x100b5b64
call fcn.10004c15
push dword [eax]
call fcn.10020882
pop ecx
pop ecx
movzx eax, al
test eax, eax
jne 0x1001a7f5
jmp 0x1001a9ee
mov eax, dword [ebp + 8]
inc eax
push eax
call fcn.1001a7c1
pop ecx
lea eax, [ebp + 8]
push eax
mov ecx, 0x100b5b70
call fcn.1001fdb2
mov eax, dword [ebp + 8]
inc eax
push eax
call fcn.1001a7c1
pop ecx
mov ecx, 0x100b5b70
call fcn.1001fe05
pop esi
mov esp, ebp
pop ebp
ret
Function at 0x10028f07
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
movzx eax, byte [ebp + 8]
test eax, eax
je 0x10028f4e
lea eax, [ebp + 0xc]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
movzx eax, byte [eax]
test eax, eax
je 0x10028f42
mov byte [ebp - 1], 0
lea eax, [ebp - 1]
push eax
push 0x5ac7
push 1
push 1
push 0
call fcn.10028f07
add esp, 0x14
jmp 0x10028f4c
push 0
push 0
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
jmp 0x10028fab
lea eax, [ebp + 0x10]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
movzx eax, byte [eax]
test eax, eax
je 0x10028f8f
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x18]
movzx eax, byte [eax]
test eax, eax
je 0x10028f8d
push 0
push 0xe71
call dword [sym.imp.USER32.dll_ValidateRect]
jmp 0x10028fab
mov eax, dword [ebp - 0x1c]
mov dword [ebp - 0x20], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0x24], eax
mov eax, dword [ebp - 0x24]
movzx eax, byte [eax]
test eax, eax
je 0x10028fab
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
mov esp, ebp
pop ebp
ret

Function at 0x1002b82b
Capabilities:
Enumerate gui resources

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
movzx eax, byte [ebp + 8]
test eax, eax
je 0x1002b84f
push 1
push 0x6f12
push 0x4bd8
call fcn.1002b89d
add esp, 0xc
jmp 0x1002b899
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0xc], eax
lea eax, [ebp + 0x10]
mov dword [ebp - 4], eax
mov eax, dword [ebp + 0x14]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
movzx eax, byte [eax]
test eax, eax
je 0x1002b88f
mov eax, dword [ebp - 8]
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0xc]
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x10]
mov dword [ebp - 0x18], eax
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
mov ecx, dword [ecx]
mov dword [eax], ecx
jmp 0x1002b899
push 0
push 0
call dword [sym.imp.USER32.dll_EnumWindows]
mov esp, ebp
pop ebp
ret
Function at 0x1002f1f7
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10061524
call fcn.100600a0
sub esp, 0x18
push ebx
push esi
mov dword [ebp - 0x20], 0x7c48
mov eax, edx
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
cmp dword [ebp - 0x20], 0x7ebe
mov dword [ebp - 0x24], eax
jle 0x1002f291
push esi
push 0x1f8c
push 0x173f
push 0x1160
call dword [sym.imp.GDI32.dll_SetPixel]
mov ebx, esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], 0x120b
mov edi, esi
mov esi, dword [ebp - 0x14]
mov ecx, edi
mov eax, esi
sar eax, cl
mov ecx, 0x1007bb98
xor eax, ebx
cdq
push edx
push eax
call fcn.100042e3
inc edi
cmp edi, 0x55dd
jl 0x1002f24b
mov edi, dword [ebp - 0x1c]
add esi, edi
dec dword [ebp - 0x18]
push 0
mov dword [ebp - 0x14], esi
pop esi
jne 0x1002f246
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x2cc7
jl 0x1002f23c
inc ebx
cmp ebx, 0x7a2
jl 0x1002f239
mov eax, dword [ebp - 0x24]
cmp byte [ebp + 0x10], 0
je 0x1002f2a6
cmp byte [eax], 0
je 0x1002f2ca
push esi
push esi
call dword [sym.imp.KERNEL32.dll_GetExitCodeProcess]
jmp 0x1002f2ca
mov eax, dword [ebp + 0xc]
cmp byte [eax], 0
je 0x1002f2ca
push 0x52f
push 0x23d5
push esi
push esi
push 0x19fe
push 0x253a
call dword [sym.imp.USER32.dll_ToUnicode]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x20], 0x7bd8
jge 0x1002f2e5
mov edx, str.jugixjazm_jnjcw_jnrtupow_whiclu_spdr_vxxb_bcdkejg
mov ecx, 0x1007bb98
call fcn.100067dc
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10030f16
Capabilities:
Get session user name

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push 0xffffffffffffffff
push 0x1006170a
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
sub esp, 0x90
push ebx
push esi
push edi
push 0x44
xor esi, esi
lea eax, [esp + 0x54]
mov ebx, edx
mov edi, ecx
push esi
push eax
mov dword [esp + 0x2c], ebx
mov dword [esp + 0x30], edi
call fcn.1001fa81
add esp, 0xc
lea eax, [esp + 0x28]
push 0x10
push esi
push eax
call fcn.1001fa81
mov dword [esp + 0x5c], 0x44
add esp, 0xc
mov dword [esp + 0x10], 0x779b
cmp dword [esp + 0x10], 0x7859
jle 0x10030fe6
push 0x1968
push 0x12d
push esi
call dword [sym.imp.USER32.dll_EnableMenuItem]
mov ebx, esi
mov edi, esi
mov eax, edi
lea ecx, [esp + 0x38]
xor eax, ebx
cdq
push edx
push eax
call fcn.10001a85
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10030fb1
mov eax, dword [eax]
push eax
call fcn.10049603
pop ecx
push esi
push 1
lea ecx, [esp + 0x40]
call fcn.100048ea
inc edi
cmp edi, 0x1f9d
jl 0x10030f97
inc ebx
cmp ebx, 0x4319
jl 0x10030f95
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_GetUserNameA]
mov edi, dword [esp + 0x24]
mov ebx, dword [esp + 0x20]
cmp dword [edi + 0x14], 8
jb 0x10030ff0
mov ecx, dword [edi]
jmp 0x10030ff2
mov ecx, edi
cmp dword [edi + 0x14], 8
mov eax, dword [edi + 0x10]
lea eax, [ecx + eax*2]
jb 0x10031000
mov edi, dword [edi]
push dword [esp + 0xc]
lea ecx, [esp + 0x18]
mov dword [esp + 0x18], esi
push eax
push edi
mov dword [esp + 0x24], esi
mov dword [esp + 0x28], esi
call fcn.1003433c
cmp dword [esp + 0x10], 0x7734
jge 0x10031030
push str.tkmkdonno_lgbjbgm_dgfbzhxw_ygkzdwpf_ssgol_nmzrcsmv_wajkyvm_vdc_rzm_lxwahvnb_svzxcmfn_vwnjxzu_vjcmh_ytquvtaop
call fcn.10049603
pop ecx
lea eax, [esp + 0xc]
mov dword [esp + 0xa4], esi
push eax
lea ecx, [esp + 0x18]
mov dword [esp + 0x10], esi
call fcn.10033ed8
cmp dword [ebx + 0x14], 8
jb 0x10031051
mov ebx, dword [ebx]
lea eax, [esp + 0x28]
push eax
lea eax, [esp + 0x54]
push eax
push ebx
push esi
push 0x8000000
push 1
push esi
push esi
push dword [esp + 0x34]
mov ebx, 0x65f7
push esi
push ebx
push 0xd9c9
call fcn.1001eed8
pop ecx
pop ecx
call eax
test eax, eax
je 0x100310a8
push dword [esp + 0x28]
mov edi, 0x37a3
push ebx
push edi
call fcn.1001eed8
pop ecx
pop ecx
call eax
push dword [esp + 0x2c]
push ebx
push edi
call fcn.1001eed8
pop ecx
pop ecx
call eax
jmp 0x100310ab
push 3
pop esi
lea ecx, [esp + 0x14]
call fcn.1002e8df
mov ecx, dword [esp + 0x9c]
mov eax, esi
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10031223
Capabilities:
Accept command line arguments

Disassembly:
mov eax, 0x10061714
call fcn.100600a0
sub esp, 0x28
cmp byte [ebp + 0x34], 0
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0x10], esp
mov ebx, edx
mov dword [ebp - 0x1c], edi
je 0x10031328
mov dword [ebp - 0x18], 0x28ab
cmp dword [ebp - 0x18], 0x2aae
jle 0x10031296
push 0x88b
push 0x2355
push 0x2384
call dword [sym.imp.USER32.dll_CheckDlgButton]
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x1007bb98
and eax, esi
cdq
push edx
push eax
call fcn.100042e3
inc edi
cmp edi, 0x94b
jl 0x10031270
inc esi
cmp esi, 0x207d
jl 0x1003126e
mov edi, dword [ebp - 0x1c]
mov eax, dword [ebp + 0x28]
mov edx, dword [ebp + 0x14]
cmp dword [eax], 0
jne 0x100312ad
cmp dword [edx], 0
jne 0x100312ad
mov esi, dword [ebp + 0x18]
xor ecx, ecx
jmp 0x100312d3
mov eax, dword [edx]
mov eax, dword [ebp + 0x2c]
mov esi, dword [ebp + 0x18]
mov eax, dword [eax]
mov eax, dword [edx]
mov eax, dword [esi]
mov ecx, dword [eax + 8]
mov eax, dword [ebp + 0x10]
sub ecx, 0x5e26160d
mov eax, dword [eax]
cmp ecx, dword [eax + 4]
jle 0x100312d0
mov eax, dword [edx]
xor ecx, ecx
inc ecx
mov eax, dword [esi]
mov eax, dword [eax + 8]
imul eax, ecx
xor ecx, ecx
cmp eax, 6
setl cl
mov dword [edx], ecx
mov eax, dword [ebx]
mov edx, dword [edx]
sub edx, eax
mov dword [edi], edx
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x2770
jge 0x10031309
mov edx, str.ysz_xqaergv_ajpnv_jdu_tpj_hmaqzbno
mov ecx, 0x1007bb98
call fcn.100067dc
jmp 0x100313c8
mov dword [ebp - 0x18], 0x7d83
cmp dword [ebp - 0x18], 0x8069
jle 0x10031382
xor esi, esi
xor edi, edi
mov ecx, edi
mov eax, esi
sar eax, cl
lea ecx, [ebp - 0x34]
cdq
push edx
push eax
call fcn.10001a85
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10031357
mov eax, dword [eax]
push eax
call fcn.10049603
pop ecx
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.100048ea
inc edi
cmp edi, 0x3961
jl 0x1003133c
inc esi
cmp esi, 0x1c78
jl 0x1003133a
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
mov eax, dword [ebp + 0x30]
xor ebx, ebx
mov ecx, dword [ebp + 0x24]
mov edx, dword [ebp + 0x20]
mov eax, dword [eax]
test eax, eax
mov eax, dword [ecx]
setne bl
mov eax, dword [eax + 8]
mov dword [edx], eax
mov eax, dword [ecx]
mov ecx, dword [eax + 8]
add ecx, dword [eax + 4]
xor eax, eax
cmp ebx, ecx
mov ecx, dword [edx]
setne al
imul ecx, eax
mov eax, dword [ebp + 0xc]
mov dword [eax], ecx
cmp dword [ebp - 0x18], 0x7a1e
jge 0x100313c8
push str.ctj_gqgyq_foesklwpl_ndvel_bonrnxfy_wmescwzv_emh_vlxrkvne_vis_kttdx
call fcn.10049603
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10031722
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1006174a
push eax
mov dword fs:[0], esp
sub esp, 0x28
cmp byte [ebp + 0x10], 0
push ebx
push esi
push edi
mov edi, edx
je 0x10031894
mov edx, dword [ebp + 0x14]
lea ecx, [esp + 0x18]
xor esi, esi
mov dword [esp + 0x14], esi
call fcn.10030c63
mov edx, dword [ebp + 0xc]
lea ecx, [esp + 0x24]
mov dword [esp + 0x3c], esi
call fcn.10030c63
xor ebx, ebx
inc ebx
mov byte [esp + 0x3c], bl
mov ecx, dword [esp + 0x28]
mov eax, dword [esp + 0x1c]
sub eax, dword [esp + 0x18]
sub ecx, dword [esp + 0x24]
sar eax, 2
sar ecx, 2
cmp eax, ecx
mov dword [esp + 0xc], esi
lea eax, [esp + 0xc]
jbe 0x100317cc
push ecx
push ecx
push eax
mov dl, bl
lea ecx, [esp + 0x24]
call fcn.1003143c
add esp, 0xc
lea eax, [esp + 0x24]
lea ecx, [esp + 0xc]
push 0x17c4
sub esp, 0x10
push ebx
sub esp, 0xc
push eax
lea eax, [esp + 0x38]
push eax
call fcn.100310ec
jmp 0x10031804
push 0x5d0b
push 0x31bc
push 0x933
push 0x7327
push ebx
push ebx
push esi
push eax
push 0x2bea
mov dword [esp + 0x30], ecx
lea edx, [esp + 0x3c]
push 0x6318
push 0x3a0
lea ecx, [esp + 0x3c]
call fcn.10032c27
add esp, 0x2c
mov dword [esp + 0x10], esi
cmp dword [esp + 0xc], 0
jle 0x1003187e
test esi, esi
jne 0x1003187e
lea eax, [esp + 0x24]
push eax
lea eax, [esp + 0x1c]
push eax
push 0x6731
push ecx
push ecx
push 0x71e7
lea eax, [esp + 0x2c]
push eax
push ebx
push 0x1a63
lea ecx, [esp + 0x34]
call fcn.100314f9
mov esi, dword [esp + 0x34]
add esp, 0x24
mov eax, dword [esp + 0x18]
mov ecx, dword [eax + esi*4]
mov eax, dword [esp + 0x24]
cmp ecx, dword [eax + esi*4]
jge 0x1003186f
lea eax, [esp + 0x14]
mov ecx, 0x6841
push eax
push 0x1059
push ebx
call fcn.1003163f
add esp, 0xc
inc esi
cmp esi, dword [esp + 0xc]
mov dword [esp + 0x10], esi
mov esi, dword [esp + 0x14]
jl 0x10031812
lea ecx, [esp + 0x24]
mov dword [edi], esi
call fcn.100340a5
lea ecx, [esp + 0x18]
call fcn.100340a5
jmp 0x100318a2
mov eax, dword [ebp + 8]
cmp byte [eax], 0
je 0x100318a2
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
mov ecx, dword [esp + 0x34]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret