joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000e968
Capabilities:
Resume thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10059632
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
push ecx
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x24], 0x4826
mov dword [ebp - 0x2c], str.lioiveeox_nwrtlw_tiouhj_zrshajl
cmp dword [ebp - 0x24], 0x4a39
jle 0x1000ea58
push 0
call dword [sym.imp.KERNEL32.dll_ResumeThread]
and dword [ebp - 0x14], 0
jmp 0x1000e9ba
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp dword [ebp - 0x14], 0x5dc5
jge 0x1000ea58
and dword [ebp - 0x18], 0
jmp 0x1000e9d4
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp dword [ebp - 0x18], 0x10a9
jge 0x1000ea53
and dword [ebp - 0x1c], 0
jmp 0x1000e9ea
mov eax, dword [ebp - 0x1c]
inc eax
mov dword [ebp - 0x1c], eax
cmp dword [ebp - 0x1c], 0x2f31
jge 0x1000ea4e
and dword [ebp - 0x20], 0
jmp 0x1000ea00
mov eax, dword [ebp - 0x20]
inc eax
mov dword [ebp - 0x20], eax
cmp dword [ebp - 0x20], 0x70ed
jge 0x1000ea4c
mov eax, dword [ebp - 0x14]
imul eax, dword [ebp - 0x18]
mov ecx, dword [ebp - 0x1c]
imul ecx, dword [ebp - 0x20]
sub eax, ecx
cdq
mov dword [ebp - 0x34], eax
mov dword [ebp - 0x30], edx
push dword [ebp - 0x30]
push dword [ebp - 0x34]
lea ecx, [ebp - 0x4c]
call fcn.1000207f
pop ecx
pop ecx
mov dword [ebp - 0x28], eax
mov ecx, dword [ebp - 0x28]
call fcn.10002135
push eax
call fcn.10042041
pop ecx
lea ecx, [ebp - 0x4c]
call fcn.1000212b
jmp 0x1000e9f9
jmp 0x1000e9e3
jmp 0x1000e9cd
jmp 0x1000e9b3
push 0x2cd5
push dword [ebp + 8]
push 1
push dword [ebp + 0xc]
push dword [ebp + 0x10]
call fcn.1000eabd
add esp, 0x14
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x456c
jge 0x1000ea86
push dword [ebp - 0x2c]
call fcn.10042041
pop ecx
jmp 0x1000eaa2
or dword [ebp - 4], 0xffffffff
jmp 0x1000eaac
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1001b900
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x10059a30
call fcn.100589e8
sub esp, 0x18
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov esi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x1c], esi
je 0x1001b9d8
mov dword [ebp - 0x18], 0x6a9
cmp dword [ebp - 0x18], 0x799
jle 0x1001b97b
xor edi, edi
mov dword [ebp - 0x14], edi
xor ebx, ebx
and dword [ebp - 0x20], 0
mov esi, edi
mov edi, dword [ebp - 0x20]
mov ecx, ebx
sar esi, cl
mov eax, esi
mov ecx, 0x100742b8
xor eax, edi
cdq
push edx
push eax
call fcn.1000793a
inc edi
cmp edi, 0x6d37
jl 0x1001b946
mov edi, dword [ebp - 0x14]
inc ebx
cmp ebx, 0x6571
jl 0x1001b939
inc edi
mov dword [ebp - 0x14], edi
cmp edi, 0x226d
jl 0x1001b937
mov esi, dword [ebp - 0x1c]
and dword [ebp - 4], 0
cmp dword [ebp - 0x18], 0x51f
jge 0x1001b9b6
mov edx, str.otomlltw_gstsqrpr_mlase_zunbtaby_bjs_rgoarmi_xifgxuoz_pleyu_mkb
mov ecx, 0x100742b8
call fcn.10009c90
jmp 0x1001b9b6
mov dword [esi], 0
cmp dword [esi], 2
jge 0x1001ba0d
mov edx, dword [ebp + 0x14]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 8
inc dword [esi]
cmp dword [esi], 2
jl 0x1001b9c4
jmp 0x1001ba0d
cmp byte [ecx], 0
je 0x1001ba0d
push 0
push 0xc9c
push 0x7e2
push 0x284
push 0x203d
push 0x60f
push 0x13b6
push 0x10ae
push 0x12a6
call dword [sym.imp.GDI32.dll_BitBlt]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10032913
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005a0d6
call fcn.100589e8
push ecx
push ecx
cmp byte [ebp + 0x20], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x100329f3
cmp byte [ebp + 0xc], 0
je 0x1003295e
mov esi, dword [ecx]
mov eax, dword [ecx]
xor ecx, ecx
cmp esi, eax
setle cl
sub ecx, 0x387f
neg ecx
sbb ecx, ecx
inc ecx
mov dword [edx], ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
mov dword [ebp - 0x14], 0x2d7c
cmp dword [ebp - 0x14], 0x3159
jle 0x100329a9
xor esi, esi
mov dword [ebp + 0x20], esi
mov edi, esi
mov ebx, 0x10e3
xor esi, esi
mov eax, edi
mov ecx, 0x100742b8
and eax, esi
cdq
push edx
push eax
call fcn.1000793a
inc esi
cmp esi, 0x2f83
jl 0x1003297c
dec edi
dec ebx
jne 0x1003297a
mov esi, dword [ebp + 0x20]
inc esi
mov dword [ebp + 0x20], esi
cmp esi, 0x723f
jl 0x10032973
mov eax, dword [ebp + 0x1c]
mov ecx, 0x4801
mov dword [eax], ecx
mov eax, dword [ebp + 0x14]
add dword [eax], ecx
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x2bfa
jge 0x1003294d
mov edx, str.zhjofef_etbedqsz_clti_mgq_ravohgkpb_tynk
mov ecx, 0x100742b8
call fcn.10009c90
jmp 0x1003294d
mov dword [ebp - 0x14], 0x40cf
cmp dword [ebp - 0x14], 0x4222
jle 0x10032a60
push 0
push 0xa5
push 0x1e6b
push 0x9b6
call dword [sym.imp.GDI32.dll_GetCharWidth32A]
xor esi, esi
xor edi, edi
mov eax, esi
mov ecx, 0x100742b8
cdq
idiv edi
mov eax, edx
cdq
push edx
push eax
call fcn.1000793a
inc edi
cmp edi, 0x9b2
jl 0x10032a1e
inc esi
cmp esi, 0x3204
jl 0x10032a1c
push 0x12bf
push 0
push 0x1b71
push 0x2e0
push 0x7fd
call dword [sym.imp.GDI32.dll_TextOutA]
cmp byte [ebp + 8], 0
je 0x10032add
mov dword [ebp + 0x20], 0x7573
cmp dword [ebp + 0x20], 0x78e1
jle 0x10032a9d
xor esi, esi
xor edi, edi
mov eax, edi
mov ecx, 0x100742b8
xor eax, esi
cdq
push edx
push eax
call fcn.1000793a
inc edi
cmp edi, 0x55d8
jl 0x10032a7a
inc esi
cmp esi, 0x42e
jl 0x10032a78
mov dword [ebp - 4], 2
cmp dword [ebp + 0x20], 0x73ab
jge 0x10032abc
mov edx, str.fxuazgo_mvu_mjzagkug_zygjtazhv_vkgoovo
mov ecx, 0x100742b8
call fcn.10009c90
mov eax, dword [ebp + 0x18]
dec dword [eax]
jmp 0x10032b00
mov edx, dword [ebp + 0x24]
mov dword [edx], 0
cmp dword [edx], 4
jge 0x10032b00
mov esi, dword [ebp + 0x10]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xe6bc044b
inc dword [edx]
cmp dword [edx], 4
jl 0x10032aee
mov dword [ebp - 4], 4
cmp dword [ebp - 0x14], 0x3f21
jge 0x1003294d
mov edx, str.qvtei_kgnt_ppq_lzwxtir_xay_efgt_bgdiojtvd_jxjostsm
mov ecx, 0x100742b8
call fcn.10009c90
jmp 0x1003294d
Function at 0x10032e38
Capabilities:
Resume thread

Disassembly:
mov eax, 0x1005a0e0
call fcn.100589e8
sub esp, 0x10
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x10032efe
mov eax, dword [ebp + 0x10]
cmp byte [eax], 0
je 0x10032ee2
mov dword [ebp - 0x18], 0x2aef
xor ebx, ebx
cmp dword [ebp - 0x18], 0x2c7b
jle 0x10032eb1
push ebx
call dword [sym.imp.KERNEL32.dll_ResumeThread]
mov esi, ebx
mov edi, ebx
mov ebx, 0x5cb9
mov eax, edi
mov ecx, 0x100742b8
cdq
push edx
push eax
call fcn.1000793a
add edi, esi
dec ebx
jne 0x10032e83
inc esi
cmp esi, 0x843
jl 0x10032e7c
push ebx
push 0x1327
push 0x2de
call dword [sym.imp.USER32.dll_SetDlgItemTextW]
push ebx
push 0x8bf
push 0x19ad
push 0x2104
call dword [sym.imp.GDI32.dll_GetCharABCWidthsW]
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0x2713
jge 0x10032ee2
mov edx, str.vbr_clvjo_inxw
mov ecx, 0x100742b8
call fcn.10009c90
jmp 0x10032f1a
xor ebx, ebx
mov byte [ebp - 0x11], bl
cmp byte [ebp - 0x11], bl
je 0x10032f1a
push ebx
push ebx
push 0x1b0e
push 0x24a9
call dword [sym.imp.USER32.dll_SetScrollInfo]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1003323f
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005a0ea
call fcn.100589e8
push ecx
push ecx
cmp byte [ebp + 0x24], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
je 0x1003330f
mov dword [ebp - 0x14], 0x252a
cmp dword [ebp - 0x14], 0x27b9
jle 0x100332b2
xor esi, esi
xor edi, edi
xor ebx, ebx
xor eax, eax
mov dword [ebp + 0x24], eax
and eax, ebx
mov ecx, 0x100742b8
xor eax, edi
xor eax, esi
cdq
push edx
push eax
call fcn.1000793a
mov eax, dword [ebp + 0x24]
inc eax
mov dword [ebp + 0x24], eax
cmp eax, 0x65e6
jl 0x10033276
inc ebx
cmp ebx, 0x5fb6
jl 0x10033271
inc edi
cmp edi, 0x55e5
jl 0x1003326f
inc esi
cmp esi, 0x2c54
jl 0x1003326d
cmp byte [ebp + 0xc], 0
je 0x100332bf
mov eax, dword [ebp + 0x10]
dec dword [eax]
jmp 0x100332d7
mov eax, dword [ebp + 0x18]
xor edx, edx
mov ecx, dword [ebp + 0x2c]
mov eax, dword [eax]
mov eax, dword [ecx]
mov eax, dword [ecx]
test eax, eax
mov eax, dword [ebp + 0x34]
sets dl
mov dword [eax], edx
and dword [ebp - 4], 0
cmp dword [ebp - 0x14], 0x2242
jge 0x100332f3
mov edx, str.arelka_efqqn_iizlyuw_zzkcs_xnkimiomy_lquwtyfeo_pghjra_qfsks_gnfqhib_czaahbsw_xmcv_foasu
mov ecx, 0x100742b8
call fcn.10009c90
jmp 0x1003332b
cmp byte [ebp + 0x30], 0
je 0x10033326
push 0
push 0x689
push 0
call dword [sym.imp.OLEAUT32.dll_SafeArrayGetLBound]
jmp 0x1003332b
mov eax, dword [ebp + 0x20]
inc dword [eax]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10033796
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005a108
call fcn.100589e8
sub esp, 0x20
push ebx
push esi
mov dword [ebp - 0x20], 0x2a79
xor esi, esi
cmp dword [ebp - 0x20], 0x2d21
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], edx
jle 0x1003382c
push esi
push esi
push esi
push esi
push esi
push esi
call dword [sym.imp.ADVAPI32.dll_AdjustTokenPrivileges]
mov edi, esi
mov dword [ebp - 0x1c], esi
mov ebx, esi
mov dword [ebp - 0x18], esi
mov ecx, ebx
mov dword [ebp - 0x24], edi
mov dword [ebp - 0x14], esi
shl edi, cl
mov ebx, esi
mov esi, dword [ebp - 0x14]
mov eax, ebx
mov ecx, 0x100742b8
and eax, esi
xor eax, edi
cdq
push edx
push eax
call fcn.1000793a
inc ebx
cmp ebx, 0x650a
jl 0x100337e3
inc esi
push 0
mov dword [ebp - 0x14], esi
cmp esi, 0x7a44
pop esi
jl 0x100337de
mov ebx, dword [ebp - 0x18]
mov edi, dword [ebp - 0x1c]
inc ebx
mov dword [ebp - 0x18], ebx
cmp ebx, 0x99f
jl 0x100337d4
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0xc3a
jl 0x100337cf
mov dword [ebp - 4], esi
cmp dword [ebp - 0x20], 0x2760
jge 0x10033865
mov edx, str.wnvdcdjn_rengz_nakwghb_gpt_pdpt_dzzgj_exj_nvydhu_xtboyzzrw
mov ecx, 0x100742b8
call fcn.10009c90
jmp 0x10033865
cmp byte [ebp + 0xc], 0
je 0x1003388c
mov edx, dword [ebp + 0x1c]
mov dword [edx], esi
cmp dword [edx], 2
jge 0x100338ae
mov esi, dword [ebp - 0x28]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 8
inc dword [edx]
cmp dword [edx], 2
jl 0x10033878
jmp 0x100338ae
mov edi, dword [ebp + 0x14]
mov dword [edi], 1
cmp dword [edi], esi
jl 0x100338ae
mov ebx, dword [ebp + 8]
mov eax, dword [edi]
mov edx, dword [edi]
mov ecx, dword [ebx]
mov eax, dword [ecx + eax*4]
mov dword [ecx + edx*4], eax
dec dword [edi]
cmp dword [edi], esi
jge 0x1003389c
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10034b1b
Capabilities:
Get keyboard layout

Disassembly:
mov eax, 0x1005a182
call fcn.100589e8
sub esp, 0x40
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov edi, edx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x18], edi
je 0x10034c1a
cmp byte [ebp + 0x24], 0
je 0x10034c0a
mov eax, dword [ebp + 0x1c]
cmp byte [eax], 0
je 0x10034d60
push 0x4096
push 1
push 0x6fe8
push ecx
xor esi, esi
push esi
push 0x4f3b
push ecx
push 0x2be0
push ecx
push 0x5d86
push 1
push ecx
call fcn.1003323f
mov dword [ebp - 0x1c], 0x30ab
add esp, 0x30
cmp dword [ebp - 0x1c], 0x339d
jle 0x10034bed
push esi
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov edi, esi
mov ebx, esi
mov eax, esi
mov dword [ebp + 8], esi
lea ecx, [eax + ebx]
mov eax, edi
sar eax, cl
lea ecx, [ebp - 0x34]
cdq
push edx
push eax
call fcn.1000207f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10034bbb
mov eax, dword [eax]
push eax
call fcn.10042041
pop ecx
push esi
push 1
lea ecx, [ebp - 0x34]
call fcn.100022c2
mov eax, dword [ebp + 8]
inc eax
mov dword [ebp + 8], eax
cmp eax, 0x30e4
jl 0x10034b9f
inc ebx
cmp ebx, 0x446c
jl 0x10034b9a
inc edi
cmp edi, 0x166c
jl 0x10034b98
cmp dword [ebp - 0x1c], 0x2f7b
jge 0x10034d60
push str.rzrf_pggapclz_eyuvlk_nugn_foccd_qmsixn
call fcn.10042041
pop ecx
jmp 0x10034d60
push 0x1c5b
call dword [sym.imp.USER32.dll_PostQuitMessage]
jmp 0x10034d60
mov dword [ebp + 8], 0x1477
xor esi, esi
cmp dword [ebp + 8], 0x15bb
jle 0x10034c61
push esi
push 0x1ba3
call dword [sym.imp.GDI32.dll_SetTextColor]
mov ebx, esi
mov edi, esi
mov esi, 0x653d
mov eax, edi
mov ecx, 0x100742b8
cdq
push edx
push eax
call fcn.1000793a
add edi, ebx
dec esi
jne 0x10034c41
inc ebx
cmp ebx, 0x1ab5
jl 0x10034c3a
mov edi, dword [ebp - 0x18]
mov dword [ebp - 4], 2
cmp dword [ebp + 8], 0x12c0
jge 0x10034c80
mov edx, str.oantkdqc_xekwxjsb_iijpxx_iqra
mov ecx, 0x100742b8
call fcn.10009c90
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 0x14], 0
je 0x10034d59
mov dword [ebp + 8], 0x54d2
cmp dword [ebp + 8], 0x5629
jle 0x10034ce2
mov ebx, esi
mov edi, esi
mov eax, edi
lea ecx, [ebp - 0x4c]
or eax, ebx
cdq
push edx
push eax
call fcn.1000207f
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10034cbb
mov eax, dword [eax]
push eax
call fcn.10042041
pop ecx
push esi
push 1
lea ecx, [ebp - 0x4c]
call fcn.100022c2
inc edi
cmp edi, 0x6629
jl 0x10034ca2
inc ebx
cmp ebx, 0x316a
jl 0x10034ca0
mov edi, dword [ebp - 0x18]
cmp dword [ebp + 8], 0x5241
jge 0x10034cf6
push str.kjqba_guqmvbza_uzw_pbj_sgcffjier
call fcn.10042041
pop ecx
mov eax, dword [ebp + 0x2c]
xor edx, edx
mov eax, dword [eax]
cmp eax, 1
mov eax, dword [ebp + 0x18]
setle dl
xor ecx, ecx
mov eax, dword [eax]
cmp edx, eax
setne cl
mov dword [edi], ecx
cmp dword [edi], esi
je 0x10034d18
xor esi, esi
inc esi
mov eax, dword [ebp + 0xc]
xor ecx, ecx
cmp esi, 0x856c
sete cl
mov dword [eax], ecx
mov ecx, dword [eax]
mov eax, dword [ebp + 0x10]
mov dword [eax], ecx
jmp 0x10034d60
push esi
call dword [sym.imp.USER32.dll_SetCursor]
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100353a7
Capabilities:
Create pipe

Disassembly:
mov eax, 0x1005a1a0
call fcn.100589e8
sub esp, 0x14
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov dword [ebp - 0x10], esp
mov esi, edx
mov byte [ebp - 0x14], cl
je 0x10035434
cmp byte [ebp + 8], 0
je 0x10035426
mov esi, dword [ebp + 0x1c]
xor ecx, ecx
mov eax, dword [esi]
cmp eax, 1
mov eax, dword [ebp + 0x18]
sete cl
xor edx, edx
mov dword [eax], ecx
mov ecx, dword [eax]
mov eax, dword [esi]
cmp ecx, eax
mov eax, dword [esi]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [esi]
setg cl
xor edx, edx
cmp ecx, eax
mov ecx, dword [esi]
mov eax, dword [esi]
setle dl
imul ecx, edx
xor edx, edx
cmp eax, ecx
mov eax, dword [esi]
setl dl
xor ecx, ecx
cmp edx, eax
mov eax, 0x9c28ade1
setne cl
sub eax, ecx
mov ecx, dword [esi]
add ecx, eax
mov eax, dword [ebp + 0x14]
mov dword [eax], ecx
jmp 0x10035503
mov eax, dword [ebp + 0x20]
mov dword [eax], 0x4e677b56
jmp 0x10035503
test cl, cl
je 0x100354e9
mov dword [ebp - 0x18], 0xa5e
xor ebx, ebx
cmp dword [ebp - 0x18], 0xd00
jle 0x10035495
mov esi, ebx
mov edi, ebx
mov dword [ebp - 0x1c], ebx
lea ecx, [ebx + edi]
mov eax, esi
shl eax, cl
mov ecx, 0x100742b8
cdq
push edx
push eax
call fcn.1000793a
inc ebx
cmp ebx, 0x48b8
jl 0x10035455
inc edi
push 0
pop ebx
cmp edi, 0x6555
jl 0x10035452
inc esi
cmp esi, 0x658c
jl 0x10035450
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
mov byte [ebp + 0xf], bl
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x18], 0xa2c
jge 0x100354b3
mov edx, str.kfla_tkv_tcfz_omtzcc_qxaw_fimbop_yrjrbxbrk
mov ecx, 0x100742b8
call fcn.10009c90
or dword [ebp - 4], 0xffffffff
lea eax, [ebp + 0xf]
push eax
push ebx
push ecx
call fcn.100357d5
add esp, 0xc
jmp 0x10035503
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
jmp 0x100354fe
mov ecx, dword [edx]
mov eax, dword [esi]
or dword [eax + ecx*4], 0xffffffff
inc dword [edx]
cmp dword [edx], 3
jl 0x100354f4
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10035c83
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005a1b4
call fcn.100589e8
sub esp, 0x20
cmp byte [ebp + 0xc], 0
push ebx
push esi
push edi
mov esi, ecx
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], edx
mov dword [ebp - 0x24], esi
je 0x10035cc8
mov byte [ebp - 0x11], 0
cmp byte [ebp - 0x11], 0
je 0x10035d96
push ecx
push 1
push 0x3cd0
push ecx
call fcn.10035386
add esp, 0x10
jmp 0x10035d96
mov dword [ebp - 0x20], 0x3e91
cmp dword [ebp - 0x20], 0x424a
jle 0x10035d3b
push 0
push 0x375
push 0
push 0x6d0
call dword [sym.imp.GDI32.dll_GetTextExtentPoint32A]
xor ebx, ebx
xor edi, edi
mov dword [ebp - 0x1c], edi
mov esi, edi
mov dword [ebp - 0x18], 0x3492
xor edi, edi
mov eax, esi
mov ecx, 0x100742b8
xor eax, edi
or eax, ebx
cdq
push edx
push eax
call fcn.1000793a
inc edi
cmp edi, 0x4955
jl 0x10035cfe
dec esi
dec dword [ebp - 0x18]
jne 0x10035cfc
mov edi, dword [ebp - 0x1c]
inc edi
mov dword [ebp - 0x1c], edi
cmp edi, 0x5e51
jl 0x10035cf3
inc ebx
cmp ebx, 0x4b0c
jl 0x10035cee
mov esi, dword [ebp - 0x24]
and dword [ebp - 4], 0
cmp dword [ebp - 0x20], 0x3bc8
jge 0x10035d76
mov edx, str.hnxtxufti_augnw_eebutj_kczcbmlcv_etsjpdn_pwybr
mov ecx, 0x100742b8
call fcn.10009c90
jmp 0x10035d76
mov dword [esi], 0
cmp dword [esi], 2
jge 0x10035d96
mov edx, dword [ebp - 0x28]
mov ecx, dword [esi]
mov eax, dword [edx]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [esi]
cmp dword [esi], 2
jl 0x10035d84
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003ba62
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005a444
call fcn.100589e8
sub esp, 0x20
push ebx
push esi
push edi
mov dword [ebp - 0x28], 0x2ad5
xor esi, esi
cmp dword [ebp - 0x28], 0x2d41
mov edi, 0x100742b8
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x2c], edx
jle 0x1003baf4
mov dword [ebp - 0x18], esi
mov dword [ebp - 0x14], esi
mov ebx, esi
mov esi, dword [ebp - 0x18]
mov dword [ebp - 0x24], ebx
mov eax, ebx
mov dword [ebp - 0x20], 0x1564
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 0x1c], eax
and eax, ebx
mov ecx, edi
xor eax, esi
cdq
push edx
push eax
call fcn.1000793a
mov eax, dword [ebp - 0x1c]
dec eax
dec dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
jne 0x1003baac
mov ebx, dword [ebp - 0x24]
inc ebx
mov dword [ebp - 0x24], ebx
cmp ebx, 0x11b3
jl 0x1003ba9d
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
push 0
pop esi
cmp eax, 0xe6e
jl 0x1003ba95
mov eax, dword [ebp - 0x18]
inc eax
mov dword [ebp - 0x18], eax
cmp eax, 0x10c7
jl 0x1003ba92
mov dword [ebp - 4], esi
cmp dword [ebp - 0x28], 0x280c
jge 0x1003bb0c
mov edx, str.xlrrtbfz_zmsnljv_tqaqhkwhq_cnoxpa_qlmsf_jqipbkve
mov ecx, edi
call fcn.10009c90
or dword [ebp - 4], 0xffffffff
cmp byte [ebp + 8], 0
je 0x1003bb4f
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x1c]
push dword [eax]
call fcn.1001817a
jmp 0x1003bc46
mov dword [ebp - 0x24], 0x32ae
cmp dword [ebp - 0x24], 0x3503
jle 0x1003bbc7
push esi
push esi
push 0x16c9
push esi
push esi
call dword [sym.imp.USER32.dll_DialogBoxParamA]
mov ebx, esi
mov dword [ebp - 0x14], esi
mov eax, esi
mov dword [ebp - 0x18], esi
mov ecx, esi
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x28], ecx
sar eax, cl
mov ecx, edi
and eax, esi
or eax, ebx
cdq
push edx
push eax
call fcn.1000793a
mov ecx, dword [ebp - 0x28]
mov eax, dword [ebp - 0x18]
inc ecx
mov dword [ebp - 0x28], ecx
cmp ecx, 0x7860
jl 0x1003bb80
inc eax
mov dword [ebp - 0x18], eax
push 0
pop esi
cmp eax, 0x5e89
jl 0x1003bb78
mov eax, dword [ebp - 0x14]
inc eax
mov dword [ebp - 0x14], eax
cmp eax, 0x65e4
jl 0x1003bb73
inc ebx
cmp ebx, 0x3d3a
jl 0x1003bb70
mov dword [ebp - 4], 2
cmp dword [ebp - 0x24], 0x31b1
jge 0x1003bbe3
mov edx, str.pvnfjkvqt_ojkd_yiklgajjj_ozfrwrr_kgeapifos_fwovcsg_jsvhe_xhpkfrro_chqytpgk_wlkislgu
mov ecx, edi
call fcn.10009c90
or dword [ebp - 4], 0xffffffff
mov edi, dword [ebp + 0x20]
cmp dword [edi], esi
jbe 0x1003bc46
mov ebx, dword [ebp + 0xc]
call fcn.1003a16e
push 0x34
pop ecx
xor edx, edx
div ecx
push 0x1a
mov eax, edx
pop ecx
cmp eax, ecx
jge 0x1003bc2d
movsx edx, byte [ebx]
jmp 0x1003bc36
cdq
idiv ecx
mov eax, dword [ebp + 0x18]
movsx eax, byte [eax]
mov ecx, dword [ebp - 0x2c]
add edx, eax
push edx
call fcn.10018146
inc esi
cmp esi, dword [edi]
jb 0x1003bbf1
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1003be54
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ebp + 8]
push ebx
push esi
xor esi, esi
mov dword [ecx + 4], edx
push edi
inc esi
lea edi, [ecx + 8]
mov ebx, 0x270
mov eax, edx
shr eax, 0x1e
xor eax, edx
imul edx, eax, 0x6c078965
add edx, esi
inc esi
mov dword [edi], edx
lea edi, [edi + 4]
cmp esi, ebx
jl 0x1003be6b
pop edi
pop esi
mov dword [ecx], ebx
pop ebx
pop ebp
ret 8

Function at 0x1003be8d
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
push esi
mov edx, 0x10575624
push edi
mov esi, edx
mov edi, 0x7fffffff
mov ecx, dword [esi + 0x9c4]
xor ecx, dword [esi + 0x9c0]
and ecx, edi
xor ecx, dword [esi + 0x9c0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, 0x9908b0df
xor eax, dword [esi + 0xff4]
xor eax, ecx
mov dword [esi], eax
add esi, 4
cmp esi, 0x105759b0
jl 0x1003be9b
mov esi, 0x9908b0df
mov ecx, dword [edx + 0xd50]
xor ecx, dword [edx + 0xd4c]
and ecx, edi
xor ecx, dword [edx + 0xd4c]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
sbb eax, eax
shr ecx, 1
and eax, esi
xor eax, ecx
xor eax, dword [edx]
mov dword [edx + 0x38c], eax
add edx, 4
cmp edx, 0x10575c54
jl 0x1003bedb
mov ecx, dword [0x105769a0]
xor ecx, dword [0x10575624]
and ecx, edi
xor ecx, dword [0x105769a0]
mov eax, ecx
and al, 1
movzx eax, al
neg eax
pop edi
sbb eax, eax
and dword [0x10575620], 0
and eax, esi
shr ecx, 1
xor eax, ecx
xor eax, dword [0x10575c54]
mov dword [0x10575fe0], eax
pop esi
ret
Function at 0x49ebc7
Capabilities:
Parse pe header

Disassembly:
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleHandleW]
test eax, eax
je 0x49ec06
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x49ec06
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x49ec06
mov eax, 0x10b
cmp word [ecx + 0x18], ax
jne 0x49ec06
cmp dword [ecx + 0x74], 0xe
jbe 0x49ec06
cmp dword [ecx + 0xe8], 0
setne al
ret
xor al, al
ret

Function at 0x4b2920
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
mov ecx, 0x5a4d
cmp word [eax], cx
jne 0x4b294d
mov ecx, dword [eax + 0x3c]
add ecx, eax
cmp dword [ecx], 0x4550
jne 0x4b294d
mov edx, 0x10b
xor eax, eax
cmp word [ecx + 0x18], dx
sete al
pop ebp
ret
xor eax, eax
pop ebp
ret

Function at 0x4b2d21
Capabilities:
Allocate thread local storage

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4da968
push 0x4da960
push str.FlsAlloc
push 0x1e
call fcn.004b33b4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4b2d55
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
jmp 0x4b2d5b
call dword [sym.imp.KERNEL32.dll_TlsAlloc]
pop esi
pop ebp
ret 4

Function at 0x4b2d9f
Capabilities:
Get thread local storage value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
push esi
push 0x4da978
push 0x4da970
push str.FlsGetValue
push 0x20
call fcn.004b33b4
mov esi, eax
add esp, 0x10
test esi, esi
je 0x4b2dd6
push dword [ebp + 8]
mov ecx, esi
call dword [section..00cfg]
call esi
pop esi
pop ebp
ret 4
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsGetValue]

Function at 0x4b4aea
Capabilities:
Hash data using murmur3

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, dword [ebp + 8]
pushal
pushfd

Function at 0x4b4b08
Capabilities:
Hash data using murmur3

Disassembly:
and ecx, dword [0x500725]
or esi, edi
mov edi, ecx
ror edx, 0x14
not edx
mov eax, edx
dec eax
xor esi, eax
rol esi, 0x1f
ror ebx, 6
xchg eax, edx
add edx, esi
or dword [0x504610], edi
rol eax, 1
mov eax, eax
and eax, eax
call fcn.0049e8e7
mov esi, eax
call fcn.0041fdff
test edx, esp
jo 0x4b4af4