joyce8/EMBER2024-capa huggingface dataset:
Function at 0x4324c5
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4caf9c
call fcn.00496e10
sub esp, 0x14
push ebx
mov ebx, ecx
push esi
push edi
mov eax, dword [ebx + 0xc]
cmp dword [eax - 8], 0
je 0x43254e
test byte [ebx + 4], 1
jne 0x43254e
and dword [ebp - 0x10], 0
mov edi, dword [ebp + 8]
mov dword [ebp - 0x20], str..jpg
mov dword [ebp - 0x1c], str..jpeg
mov dword [ebp - 0x18], str..png
mov dword [ebp - 0x14], str..bmp
lea esi, [ebp - 0x20]
push dword [esi]
mov eax, dword [ebx + 0xc]
push eax
lea eax, [ebp + 8]
push eax
call fcn.0041d04c
add esp, 0xc
and dword [ebp - 4], 0
push eax
mov ecx, edi
call fcn.004b20bd
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004b1f76
push dword [edi]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x432562
inc dword [ebp - 0x10]
add esi, 4
cmp dword [ebp - 0x10], 4
jb 0x43250c
or eax, 0xffffffff
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 4
xor eax, eax
jmp 0x432551

Function at 0x433fe2
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4cb224
call fcn.00496e10
sub esp, 0x48
push dword [ebp + 8]
mov dword [ebp - 0x18], ecx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43411f
push ebx
push esi
lea ecx, [ebp - 0x54]
call fcn.0042e0ee
xor ebx, ebx
lea ecx, [ebp - 0x54]
push ebx
mov dword [ebp - 4], ebx
push dword [ebp + 0xc]
call fcn.0042e198
push dword [ebp + 8]
lea ecx, [ebp - 0x14]
call fcn.004b1fea
mov eax, dword [0x5038b8]
mov dword [ebp - 0x10], eax
push 0x4fcc70
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.004b2367
lea ecx, [ebp - 0x34]
call fcn.004960fe
push ebx
lea ecx, [ebp - 0x34]
push dword [ebp - 0x14]
mov byte [ebp - 4], 3
call fcn.004961c3
xor esi, esi
cmp eax, ebx
je 0x4340ec
push edi
lea ecx, [ebp - 0x34]
call fcn.004963e9
lea ecx, [ebp - 0x34]
mov edi, eax
call fcn.004963ac
test eax, eax
jne 0x4340e3
lea eax, [ebp + 8]
lea ecx, [ebp - 0x34]
push eax
call fcn.004964b8
push eax
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 4
call fcn.004b20bd
lea ecx, [ebp + 8]
mov byte [ebp - 4], 3
call fcn.004b1f76
mov eax, dword [ebp - 0x34]
push 0x10
lea ecx, [ebp - 0x34]
call dword [eax + 0x38]
cmp eax, ebx
je 0x4340c7
cmp dword [ebp + 0x10], ebx
je 0x4340e3
push dword [ebp + 0x10]
mov ecx, dword [ebp - 0x18]
push dword [ebp + 0xc]
push dword [ebp - 0x10]
call fcn.00433fe2
jmp 0x4340e1
push dword [ebp - 0x10]
lea ecx, [ebp - 0x54]
call fcn.0042e270
test eax, eax
je 0x4340e3
push dword [ebp - 0x10]
mov ecx, dword [ebp - 0x18]
call fcn.00433daf
add esi, eax
cmp edi, ebx
jne 0x434065
pop edi
lea ecx, [ebp - 0x34]
mov byte [ebp - 4], 2
call fcn.0049613d
lea ecx, [ebp - 0x10]
mov byte [ebp - 4], 1
call fcn.004b1f76
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], bl
call fcn.004b1f76
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x54]
call fcn.0042e15c
mov eax, esi
pop esi
pop ebx
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x43412d
Capabilities:
Resume thread

Disassembly:
mov eax, 0x4cb239
call fcn.00496e10
push ecx
push esi
mov esi, ecx
push edi
xor edi, edi
mov eax, dword [esi + 0x1e8]
cmp eax, edi
jne 0x434152
call fcn.004341e8
push 1
pop eax
jmp 0x4341ca
push 0x74
call fcn.004b254a
pop ecx
mov ecx, eax
mov dword [ebp - 0x10], ecx
cmp ecx, edi
mov dword [ebp - 4], edi
je 0x43416e
push esi
call fcn.004327b3
jmp 0x434170
xor eax, eax
or dword [ebp - 4], 0xffffffff
cmp eax, edi
mov dword [esi + 0x1f8], eax
je 0x4341a4
push edi
push edi
push 4
mov ecx, eax
call fcn.004b61fe
test eax, eax
jne 0x4341a9
mov ecx, dword [esi + 0x1f8]
cmp ecx, edi
je 0x43419e
mov eax, dword [ecx]
push 1
call dword [eax + 4]
mov dword [esi + 0x1f8], edi
or eax, 0xffffffff
jmp 0x4341ca
mov eax, dword [esi + 0x1f8]
push edi
push dword [eax + 0x28]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [esi + 0x1f8]
push dword [eax + 0x28]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
leave
ret

Function at 0x4341e8
Capabilities:
Resume thread

Disassembly:
mov eax, 0x4cb24d
call fcn.00496e10
push ecx
push ebx
push esi
push edi
mov edi, ecx
mov eax, dword [edi + 0x168]
test eax, eax
jne 0x434207
push 1
pop eax
jmp 0x43426d
xor ebx, ebx
lea esi, [edi + 0x1fc]
push 0x78
call fcn.004b254a
pop ecx
mov dword [ebp - 0x10], eax
and dword [ebp - 4], 0
test eax, eax
je 0x43422d
push edi
push ebx
mov ecx, eax
call fcn.00432867
jmp 0x43422f
xor eax, eax
or dword [ebp - 4], 0xffffffff
mov dword [esi], eax
test eax, eax
je 0x434298
push 0
push 0
push 4
mov ecx, eax
call fcn.004b61fe
test eax, eax
je 0x43427c
mov eax, dword [esi]
push 0xffffffffffffffff
push dword [eax + 0x28]
call dword [sym.imp.KERNEL32.dll_SetThreadPriority]
mov eax, dword [esi]
push dword [eax + 0x28]
call dword [sym.imp.KERNEL32.dll_ResumeThread]
inc ebx
add esi, 4
cmp ebx, 2
jl 0x43420f
xor eax, eax
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret
mov ecx, dword [edi + ebx*4 + 0x1fc]
lea esi, [edi + ebx*4 + 0x1fc]
test ecx, ecx
je 0x434295
mov eax, dword [ecx]
push 1
call dword [eax + 4]
and dword [esi], 0
or eax, 0xffffffff
jmp 0x43426d

Function at 0x434548
Capabilities:
Check if file exists

Disassembly:
push dword [0x507f84]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43456d
push 0
push 0x414
push dword [0x507f84]
call fcn.0041ce52
add esp, 0xc
ret
Function at 0x439faa
Capabilities:
Check if file exists

Disassembly:
mov eax, 0x4cbc8c
call fcn.00496e10
push ecx
push ecx
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push ebx
mov edi, 0x507ed4
push str._sMediaProbe.exe
push edi
call fcn.004af8a7
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
add esp, 0xc
push dword [0x507ed4]
call esi
test eax, eax
jne 0x439fee
push str.MediaProbe.exe
mov ecx, edi
call fcn.004b210d
push ebx
mov edi, 0x507ed8
push str._sMediaEncode.exe
push edi
call fcn.004af8a7
add esp, 0xc
push dword [0x507ed8]
call esi
test eax, eax
jne 0x43a01a
push str.MediaEncode.exe
mov ecx, edi
call fcn.004b210d
push dword [0x507ed8]
lea eax, [ebp - 0x14]
push eax
call fcn.0041cf41
pop ecx
pop ecx
and dword [ebp - 4], 0
push str.Presets
push eax
lea eax, [ebp - 0x10]
push eax
call fcn.004b221b
push eax
mov ecx, 0x507edc
mov byte [ebp - 4], 1
call fcn.004b20bd
and byte [ebp - 4], 0
lea ecx, [ebp - 0x10]
call fcn.004b1f76
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x14]
call fcn.004b1f76
push ebx
mov edi, 0x507ee0
push str._sMediaPlay.exe
push edi
call fcn.004af8a7
add esp, 0xc
push dword [0x507ee0]
call esi
test eax, eax
jne 0x43a091
push str.MediaPlay.exe
mov ecx, edi
call fcn.004b210d
cmp dword [0x507ee4], 0
jne 0x43a195
mov eax, dword [0x5038b8]
mov dword [ebp + 8], eax
push 2
lea eax, [ebp + 8]
pop edi
push ebx
push str._s_avcodec_60.dll
push eax
mov dword [ebp - 4], edi
call fcn.004af8a7
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x43a0d1
mov dword [0x507ee4], 6
cmp dword [0x507ee4], 0
jne 0x43a189
push ebx
lea eax, [ebp + 8]
push str._s_avcodec_59.dll
push eax
call fcn.004af8a7
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x43a103
mov dword [0x507ee4], 5
cmp dword [0x507ee4], 0
jne 0x43a189
push ebx
lea eax, [ebp + 8]
push str._s_avcodec_58.dll
push eax
call fcn.004af8a7
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x43a131
mov dword [0x507ee4], 4
cmp dword [0x507ee4], 0
jne 0x43a189
push ebx
lea eax, [ebp + 8]
push str._s_avcodec_57.dll
push eax
call fcn.004af8a7
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x43a15f
mov dword [0x507ee4], 3
cmp dword [0x507ee4], 0
jne 0x43a189
push ebx
lea eax, [ebp + 8]
push str._s_avcodec_56.dll
push eax
call fcn.004af8a7
add esp, 0xc
push dword [ebp + 8]
call esi
test eax, eax
je 0x43a189
mov dword [0x507ee4], edi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp + 8]
call fcn.004b1f76
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword [0x507ee8], 1
xor eax, eax
pop ebx
mov dword fs:[0], ecx
leave
ret
Function at 0x43a1b0
Capabilities:
Check if file exists
Create process on windows

Disassembly:
push esi
mov esi, dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
push dword [0x507ee0]
call esi
test eax, eax
je 0x43a1d0
xor eax, eax
push eax
push eax
push eax
push dword [0x507ee0]
jmp 0x43a200
push dword [0x507ed8]
call esi
test eax, eax
je 0x43a1e9
xor eax, eax
push eax
push eax
push eax
push dword [0x507ed8]
jmp 0x43a200
push dword [0x507ed4]
call esi
test eax, eax
je 0x43a208
xor eax, eax
push eax
push eax
push eax
push dword [0x507ed4]
push eax
push eax
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
xor eax, eax
pop esi
ret

Function at 0x43b275
Capabilities:
Check if file exists
Set current directory

Disassembly:
mov eax, 0x4cbd84
call fcn.00496e10
sub esp, 0x1c
push ebx
push esi
push edi
mov esi, ecx
push dword [ebp + 8]
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x43b2b3
push dword [ebp + 8]
lea eax, [ebp - 0x10]
push eax
call fcn.0041cf41
pop ecx
pop ecx
push dword [ebp - 0x10]
call dword [sym.imp.KERNEL32.dll_SetCurrentDirectoryW]
lea ecx, [ebp - 0x10]
call fcn.004b1f76
lea eax, [ebp - 0x14]
push eax
call fcn.0041f21a
pop ecx
mov eax, dword [eax]
and dword [ebp - 4], 0
push 1
push 1
push eax
lea ecx, [ebp - 0x28]
call fcn.0041c453
lea ecx, [ebp - 0x14]
mov byte [ebp - 4], 2
call fcn.004b1f76
push dword [ebp + 8]
lea edi, [esi + 0x70]
mov ecx, edi
call fcn.004b210d
push dword [ebp + 0x10]
mov eax, esi
neg eax
push dword [ebp - 0x24]
lea ecx, [esi + 0x68]
sbb eax, eax
and eax, ecx
mov ecx, esi
push eax
call fcn.0043b056
test eax, eax
je 0x43b30a
mov esi, eax
jmp 0x43b33f
push dword [ebp + 0x10]
mov ebx, dword [ebp + 0xc]
mov eax, dword [esi]
mov ecx, esi
push ebx
push dword [ebp - 0x24]
call dword [eax + 0x28]
test eax, eax
je 0x43b324
or esi, 0xffffffff
jmp 0x43b33f
mov edi, dword [edi]
mov eax, dword [esi]
push edi
push ebx
mov ecx, esi
call dword [eax + 0x2c]
or esi, 0xffffffff
cmp eax, esi
je 0x43b33f
mov eax, dword [ebx]
mov ecx, ebx
call dword [eax + 0xc]
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea ecx, [ebp - 0x28]
call fcn.0041c4c0
mov ecx, dword [ebp - 0xc]
mov eax, esi
pop edi
pop esi
pop ebx
mov dword fs:[0], ecx
leave
ret 0xc
Function at 0x4ae8c0
Capabilities:
Get graphical window text

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
mov esi, dword [ebp + 0x10]
push 0xf00021
mov edx, dword [esi + 4]
mov ecx, dword [esi]
mov eax, dword [esi + 0xc]
sub eax, edx
push eax
mov eax, dword [esi + 8]
sub eax, ecx
push eax
push edx
push ecx
mov ecx, dword [ebp + 0xc]
push ecx
call dword [sym.imp.GDI32.dll_PatBlt]
mov edi, dword [ebp + 8]
push edi
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
mov ebx, eax
lea eax, [eax + 5]
add eax, 3
and eax, 0xfffffffc
call fcn.00497010
mov dword [ebp - 4], esp
cmp dword [ebp - 4], 0
je 0x4ae98b
add ebx, 2
mov eax, dword [ebp - 4]
push ebx
push eax
push edi
call dword [sym.imp.USER32.dll_GetWindowTextA]
test eax, eax
je 0x4ae98b
mov bx, 0x140
mov edi, dword [ebp + 0x14]
mov eax, edi
and al, 0xf
cmp al, 0xc
je 0x4ae93e
mov ebx, edi
and bx, 0xf
or bx, 0x150
test edi, 0x80
je 0x4ae949
or bh, 8
and edi, 0x8000000
je 0x4ae964
mov eax, dword [0x50be1c]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
mov dword [ebp - 8], eax
mov ecx, dword [ebp - 4]
mov edx, dword [ebp + 0xc]
movzx eax, bx
push eax
push esi
push 0xffffffffffffffff
push ecx
push edx
call dword [sym.imp.USER32.dll_DrawTextA]
test edi, edi
je 0x4ae98b
mov eax, dword [ebp - 8]
mov ecx, dword [ebp + 0xc]
push eax
push ecx
call dword [sym.imp.GDI32.dll_SetTextColor]
lea esp, [ebp - 0x14]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x4b4d70
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x4b4db2
call fcn.004c4bd2
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceW]
cmp eax, edi
je 0x4b4db2
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x4b4da9
xor eax, eax
jmp 0x4b4dba
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.004b4dc0
pop edi
pop esi
pop ebx
ret 4

Function at 0x4bc305
Capabilities:
Set registry value

Disassembly:
mov eax, 0x4cdc0c
call fcn.00496e10
push ecx
push ecx
push esi
push 0x10
call fcn.004b254a
mov esi, eax
pop ecx
mov dword [ebp - 0x14], esi
and dword [ebp - 4], 0
test esi, esi
je 0x4bc352
mov ecx, esi
call fcn.004b7531
mov eax, dword [0x5038b8]
lea ecx, [esi + 0xc]
mov dword [ecx], eax
mov eax, dword [ebp + 8]
push dword [ebp + 0xc]
mov byte [ebp - 4], 2
mov dword [esi], vtable.CArchiveException.0
mov dword [esi + 8], eax
call fcn.004b210d
jmp 0x4bc354
xor esi, esi
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x10]
push 0x4ea970
push eax
mov dword [ebp - 0x10], esi
call fcn.0049846c
pop esi
Function at 0x62b1b0
Capabilities:
Acquire debug privileges

Disassembly:
push ecx
lea eax, [esp]
mov dword [esp], 0
push eax
push 0x20
call dword [sym.imp.KERNEL32.dll_GetCurrentProcess]
push eax
call dword [sym.imp.ADVAPI32.dll_OpenProcessToken]
call dword [sym.imp.KERNEL32.dll_GetLastError]
mov ecx, dword [esp]
push 1
push str.SeBackupPrivilege
push ecx
call fcn.0062b140
mov edx, dword [esp + 0xc]
push 1
push str.SeDebugPrivilege
push edx
call fcn.0062b140
mov eax, dword [esp + 0x18]
push 1
push str.SeRestorePrivilege
push eax
call fcn.0062b140
mov ecx, dword [esp + 0x24]
push 1
push str.SeSecurityPrivilege
push ecx
call fcn.0062b140
mov edx, dword [esp + 0x30]
add esp, 0x30
push edx
call dword [sym.imp.KERNEL32.dll_CloseHandle]
mov al, 1
pop ecx
ret

Function at 0x62bbfa
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push esi
lea eax, [ebp - 4]
push eax
push 0x20019
xor esi, esi
push esi
push str.CLSIDADB880A6_D8FF_11CF_9377_00AA003B7A11InprocServer32
push SysReAllocString
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
test eax, eax
jne 0x62bc50
lea eax, [ebp - 8]
push eax
push dword [ebp + 8]
mov dword [ebp - 8], 0x104
push esi
push esi
push 0x63d87c
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
test eax, eax
jne 0x62bc43
inc esi
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
jmp 0x62bc52
xor eax, eax
pop esi
leave
ret 4

Function at 0x432000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
mov eax, section..text
nop
nop
nop
nop
push 4
nop
nop
nop
nop
nop
nop
pop edi
nop
nop
cmp eax, 0
nop
nop
nop
nop
je 0x432072
nop
nop
mov ebx, 0x40c7d0
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
div edi
nop
nop
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
nop
pop eax
nop
nop
nop
mov esi, 0x4a0715ac
nop
nop
nop
nop
xor dword [eax], esi
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x432060
nop
nop
mov eax, section..data
nop
nop
cmp eax, 0
nop
nop
nop
je 0x4320d2
nop
nop
nop
mov ebx, 0x42f314
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
nop
nop
nop
xor edx, edx
nop
nop
push eax
nop
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
div edi
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
nop
mov esi, 0x50b23fbe
nop
xor dword [eax], esi
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
nop
loop 0x4320c0
nop
nop
nop
popal
nop
nop
nop
jmp 0x431219
Function at 0x10002750
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push edi
mov edi, dword [ebp + 0xc]
test edi, edi
je 0x100027b1
mov eax, dword [ebp + 0x14]
shl dword [ebp + 0x10], 8
mov ecx, dword [ebp + 8]
push ebx
mov eax, dword [eax]
mov ebx, dword [ebp + 0x1c]
mov dword [ebp + 0xc], eax
mov eax, dword [ebp + 0x18]
push esi
mov cl, byte [ecx]
movsx edx, cl
sub cl, 0x61
cmp cl, 0x19
mov ecx, dword [ebp + 0x10]
lea esi, [edx - 0x20]
cmova esi, edx
mov edx, dword [ebp + 0xc]
add ecx, esi
add eax, ebx
xor eax, dword [edx + ecx*4]
mov ecx, ebx
shl ecx, 5
add ecx, 3
add ecx, esi
add ebx, ecx
mov ecx, dword [ebp + 8]
inc ecx
add ebx, eax
mov dword [ebp + 8], ecx
sub edi, 1
jne 0x10002772
pop esi
pop ebx
pop edi
pop ebp
ret 0x18
mov eax, dword [ebp + 0x18]
pop edi
pop ebp
ret 0x18
Function at 0x10005ad2
Capabilities:
Create pipe

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x3c
push ebx
push esi
push edi
mov dword [esp + 0x10], 0x3949
mov ebx, ecx
cmp dword [esp + 0x10], 0x3a40
push 0
mov dword [esp + 0x18], ebx
pop edi
jle 0x10005ba9
push 0x2114
push 0xcfb
push edi
push edi
push 0x19c5
push 0x22cb
push 0x1c21
push 0x1384
push 0xff
push 0x1bc2
push 0xa70
push 0x178f
push 0x15b5
call dword [sym.imp.GDI32.dll_StretchDIBits]
mov esi, edi
xor ebx, ebx
xor eax, eax
mov dword [esp + 0xc], eax
xor eax, ebx
lea ecx, [edi + esi]
or eax, ecx
lea ecx, [esp + 0x18]
cdq
push edx
push eax
call fcn.10001a85
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10005b63
mov eax, dword [eax]
push eax
call fcn.10045794
pop ecx
push 0
push 1
lea ecx, [esp + 0x20]
call fcn.1000224a
mov eax, dword [esp + 0xc]
inc eax
mov dword [esp + 0xc], eax
cmp eax, 0x5d6
jl 0x10005b46
inc ebx
cmp ebx, 0x38d
jl 0x10005b40
inc edi
cmp edi, 0x7ce7
jl 0x10005b3e
inc esi
push 0
pop edi
cmp esi, 0x6799
jl 0x10005b3e
mov ebx, dword [esp + 0x14]
cmp dword [esp + 0x10], 0x37a0
jge 0x10005bbe
push str.bwknvt_txznhul_zfojryl_apufbi_vzd_wwqdlpr_rmzkomnnv_qqmt
call fcn.10045794
pop ecx
cmp byte [ebp + 0xc], 0
je 0x10005bdc
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x10005c04
push 0x1e31
push edi
push edi
push edi
call dword [sym.imp.KERNEL32.dll_CreatePipe]
jmp 0x10005c04
mov eax, dword [ebp + 0x10]
mov ecx, ebx
mov eax, dword [eax]
inc eax
push eax
push edi
lea eax, [esp + 0x38]
push eax
call fcn.10009762
push eax
mov ecx, ebx
call fcn.10001e7f
push edi
push 1
lea ecx, [esp + 0x38]
call fcn.100023b6
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000783f
Capabilities:
Accept command line arguments

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
mov eax, dword fs:[0]
push 0xffffffffffffffff
push 0x1005ce7b
push eax
mov dword fs:[0], esp
sub esp, 0x48
cmp byte [ebp + 0x14], 0
push ebx
push esi
push edi
mov edi, edx
je 0x1000794b
mov edx, dword [ebp + 0xc]
lea ecx, [esp + 0x2c]
xor esi, esi
mov dword [esp + 0x14], esi
call fcn.10006fbb
mov edx, edi
mov dword [esp + 0x5c], esi
lea ecx, [esp + 0x20]
call fcn.10006fbb
lea eax, [esp + 0x18]
mov byte [esp + 0x5c], 1
push eax
lea eax, [esp + 0x24]
mov dword [esp + 0x1c], esi
push eax
lea eax, [esp + 0x34]
push eax
lea eax, [esp + 0x1c]
push eax
push 1
push 0x4ffa
call fcn.10007360
add esp, 0x18
mov dword [esp + 0x10], esi
cmp dword [esp + 0x18], esi
jle 0x10007932
test esi, esi
jne 0x10007932
push ecx
lea eax, [esp + 0x18]
push eax
push 0x3029
push 0x511e
push 0x983
push ecx
lea eax, [esp + 0x38]
push eax
push 0x7154
lea eax, [esp + 0x4c]
push eax
push ecx
lea eax, [esp + 0x38]
mov cl, 1
push 0x7684
push eax
call fcn.10007574
add esp, 0x2c
lea eax, [esp + 0x24]
mov dl, 1
push eax
push ecx
lea eax, [esp + 0x1c]
push eax
lea eax, [esp + 0x24]
push eax
lea ecx, [esp + 0x40]
call fcn.10007a47
mov eax, dword [esp + 0x24]
add esp, 0x14
mov esi, dword [esp + 0x14]
inc eax
mov dword [esp + 0x10], eax
cmp eax, dword [esp + 0x18]
jl 0x100078c3
mov eax, dword [ebp + 0x10]
lea ecx, [esp + 0x20]
mov dword [eax], esi
call fcn.1000a0db
lea ecx, [esp + 0x2c]
call fcn.1000a0db
jmp 0x100079c2
mov dword [esp + 0x1c], 0x19d2
cmp dword [esp + 0x1c], 0x1aac
jle 0x100079a8
xor esi, esi
mov edi, esi
mov ebx, esi
mov eax, ebx
lea ecx, [esp + 0x38]
or eax, edi
cdq
push edx
push eax
call fcn.10001a85
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x1000797d
mov eax, dword [eax]
push eax
call fcn.10045794
pop ecx
push esi
push 1
lea ecx, [esp + 0x40]
call fcn.1000224a
inc ebx
cmp ebx, 0x19d8
jl 0x10007963
inc edi
cmp edi, 0x1c87
jl 0x10007961
call dword [sym.imp.KERNEL32.dll_GetCommandLineA]
cmp dword [esp + 0x1c], 0x18d3
jge 0x100079bd
push str.gqphvzk_qmm_ygqa
call fcn.10045794
pop ecx
mov eax, dword [ebp + 8]
inc dword [eax]
mov ecx, dword [esp + 0x54]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000849d
Capabilities:
Encode data using xor
Query environment variable

Disassembly:
mov eax, 0x1005cec3
call fcn.1005c4f8
sub esp, 0x24
push ebx
push esi
mov dword [ebp - 0x18], 0x31a7
mov ebx, ecx
push edi
xor esi, esi
mov dword [ebp - 0x10], esp
cmp dword [ebp - 0x18], 0x347f
mov dword [ebp - 0x14], ebx
jle 0x100084fe
push 0x2e7
push esi
push esi
call dword [sym.imp.KERNEL32.dll_ExpandEnvironmentStringsA]
mov edi, esi
mov ebx, esi
mov eax, ebx
mov ecx, 0x10078fb8
xor eax, edi
cdq
push edx
push eax
call fcn.10001d2f
inc ebx
cmp ebx, 0x658c
jl 0x100084d8
inc edi
cmp edi, 0x6ab6
jl 0x100084d6
mov ebx, dword [ebp - 0x14]
mov dword [ebp - 4], esi
cmp dword [ebp - 0x18], 0x2ea5
jge 0x10008519
mov edx, str.whlh_dfp_didnk_kpffysjdq_dlv_yxpphlngg
mov ecx, 0x10078fb8
call fcn.10003c4d
or dword [ebp - 4], 0xffffffff
mov dword [ebp - 0x18], 0x123f
cmp dword [ebp - 0x18], 0x1599
jle 0x10008590
push esi
push 0x1be6
push esi
push 0x22a5
push esi
push 0x67e
call dword [sym.imp.USER32.dll_DrawTextExW]
mov edi, esi
mov ebx, esi
lea eax, [ebx + edi]
cdq
lea ecx, [ebp - 0x30]
push edx
push eax
call fcn.10001a85
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10008561
mov eax, dword [eax]
push eax
call fcn.10045794
pop ecx
push esi
push 1
lea ecx, [ebp - 0x30]
call fcn.1000224a
inc ebx
cmp ebx, 0x4603
jl 0x10008549
inc edi
cmp edi, 0x648a
jl 0x10008547
push esi
push esi
call dword [sym.imp.GDI32.dll_RectInRegion]
mov ebx, dword [ebp - 0x14]
cmp byte [ebp + 0xc], 0
je 0x100085cb
push ecx
push ecx
mov ecx, dword [ebp + 8]
push ebx
call fcn.1000acca
jmp 0x100085e7
mov edx, dword [ebp + 0x10]
mov dword [edx], esi
cmp dword [edx], 1
jge 0x100085e7
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
or dword [eax + ecx*4], 0xffffffff
inc dword [edx]
cmp dword [edx], 1
jl 0x100085d8
cmp dword [ebp - 0x18], 0x1087
jge 0x100085fb
push str.arduoac_oeske_jhbzw_popev_wshel
call fcn.10045794
pop ecx
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000c6cc
Capabilities:
Get disk information

Disassembly:
mov eax, 0x1005d0e4
call fcn.1005c4f8
sub esp, 0x20
push ebx
push esi
mov dword [ebp - 0x24], 0x3651
mov ebx, edx
cmp dword [ebp - 0x24], 0x3915
mov esi, ecx
push edi
mov dword [ebp - 0x10], esp
mov dword [ebp - 0x28], ebx
mov dword [ebp - 0x2c], esi
jle 0x1000c758
call dword [sym.imp.KERNEL32.dll_GetLogicalDrives]
xor edi, edi
mov eax, edi
mov dword [ebp - 0x20], 0x77b1
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0xe80
mov ebx, eax
mov esi, 0x42af
mov eax, ebx
mov ecx, 0x10078fb8
cdq
push edx
push eax
call fcn.10001d2f
dec ebx
dec esi
jne 0x1000c71e
mov eax, dword [ebp - 0x14]
dec eax
dec dword [ebp - 0x18]
mov dword [ebp - 0x14], eax
jne 0x1000c717
mov eax, dword [ebp - 0x1c]
dec eax
dec dword [ebp - 0x20]
mov dword [ebp - 0x1c], eax
jne 0x1000c70d
inc edi
cmp edi, 0x5d6d
jl 0x1000c701
mov esi, dword [ebp - 0x2c]
mov ebx, dword [ebp - 0x28]
and dword [ebp - 4], 0
cmp dword [ebp - 0x24], 0x362c
jge 0x1000c796
mov edx, str.slgjean_banvkrzx_cczetz_raqunq_rpjpw_cdukpte_mipha_noigi_loo_tpjjvxrtu_bgltilv_clt_ctari
mov ecx, 0x10078fb8
call fcn.10003c4d
jmp 0x1000c796
cmp byte [ebp + 0x1c], 0
je 0x1000c7c1
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
cmp dword [edx], 1
jge 0x1000c7db
mov esi, dword [ebp + 0xc]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xcefa9d19
inc dword [edx]
cmp dword [edx], 1
jl 0x1000c7ad
jmp 0x1000c7db
mov dword [esi], 0
jmp 0x1000c7d6
mov ecx, dword [esi]
mov eax, dword [ebx]
mov dword [eax + ecx*4], 0xf47
inc dword [esi]
cmp dword [esi], 3
jl 0x1000c7c9
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret