joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1002226a
Capabilities:
Get file version info
Print debug messages

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
cmp byte [0x1003e158], 0
je 0x10022295
mov ecx, dword [ebp + 0xc]
mov eax, dword [0x1003e15c]
mov dword [ecx], eax
mov ecx, dword [ebp + 0x10]
test ecx, ecx
je 0x10022291
mov eax, dword [0x1003e160]
mov dword [ecx], eax
xor eax, eax
leave
ret
push ebx
mov ebx, dword [ebp + 0xc]
lea eax, [ebp - 0xc]
push esi
push edi
push eax
push dword [ebp + 8]
xor esi, esi
mov dword [ebx], esi
call sub.VERSION.dll_GetFileVersionInfoSizeW
mov dword [ebp - 4], eax
test eax, eax
jne 0x100222fc
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
je 0x100222eb
cmp byte [0x1003cde0], 0
je 0x100222eb
push esi
push str.GetFileVersionInfoSizeW_error___d_n
mov edi, 0x1003d628
push edi
call fcn.100220a0
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100222eb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push 0xe
pop eax
push 0x14
cmp esi, 2
pop ecx
cmove eax, ecx
jmp 0x1002237d
push eax
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov edi, eax
pop ecx
test edi, edi
jne 0x1002230f
push 0xf
pop eax
jmp 0x1002237d
push edi
push dword [ebp - 4]
push esi
push dword [ebp + 8]
call sub.VERSION.dll_GetFileVersionInfoW
test eax, eax
jne 0x10022324
push 0x10
jmp 0x10022372
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 8]
push eax
push 0x1002fc74
push edi
call sub.VERSION.dll_VerQueryValueW
test eax, eax
jne 0x1002233f
push 0x11
jmp 0x10022372
mov ecx, dword [ebp - 8]
test ecx, ecx
je 0x10022370
cmp dword [ebp - 4], esi
jbe 0x10022370
mov eax, dword [ecx + 8]
mov ecx, dword [ecx + 0xc]
mov dword [0x1003e15c], eax
mov dword [ebx], eax
mov eax, dword [ebp + 0x10]
mov dword [0x1003e160], ecx
mov byte [0x1003e158], 1
test eax, eax
je 0x10022373
mov dword [eax], ecx
jmp 0x10022373
push 0x12
pop esi
push edi
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
pop ecx
mov eax, esi
pop edi
pop esi
pop ebx
leave
ret

Function at 0x100225b9
Capabilities:
Print debug messages

Disassembly:
push esi
push 0x10032094
xor esi, esi
call fcn.100220a0
pop ecx
test eax, eax
jne 0x100225da
push 0x100320ac
call fcn.100220a0
pop ecx
test eax, eax
je 0x100225dd
xor esi, esi
inc esi
cmp byte [0x1003cde0], 0
je 0x1002260c
push edi
push esi
push str._BrowserIntegrationWin__IsLoadedInProcByAcrobat__d
mov edi, 0x1003d628
push edi
call fcn.100220a0
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x1002260b
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
pop edi
mov eax, esi
pop esi
ret
Function at 0x100246d8
Capabilities:
Print debug messages

Disassembly:
push esi
push str.sftldr.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x1002473d
push str.sftldr_wow64.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
jne 0x1002473d
push ebx
push str.AppVEntSubsystems32.dll
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
test eax, eax
setne bl
cmp byte [0x1003cde0], 0
je 0x10024738
movzx eax, bl
mov esi, 0x1003e190
push eax
push str._ACTWinBrowser__IsRunningInAppV_isAppV5___d
push esi
call fcn.100220a0
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x10024738
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov al, bl
pop ebx
pop esi
ret
cmp byte [0x1003cde0], 0
je 0x10024768
push str._ACTWinBrowser__IsRunningInAppV_isAppV4OrEarlier
mov esi, 0x1003e190
push esi
call fcn.100220a0
cmp byte [0x1003cde0], 0
pop ecx
pop ecx
je 0x10024768
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov al, 1
pop esi
ret
Function at 0x10025de4
Capabilities:
Print debug messages

Disassembly:
push 0xac4
mov eax, 0x1002ce82
call fcn.1002a0fc
cmp byte [0x1003cde0], 0
mov ebx, 0x1003e190
mov eax, dword [ebp + 0x18]
mov esi, dword [ebp + 8]
mov dword [ebp - 0xacc], eax
mov eax, dword [ebp + 0x10]
mov dword [ebp - 0xad0], eax
je 0x10025e33
push str._ACTWinBrowser__SendAcroIPCMessage
push ebx
call fcn.100220a0
cmp byte [0x1003cde0], 0
pop ecx
pop ecx
je 0x10025e33
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push 0x208
xor ebx, ebx
lea eax, [ebp - 0x218]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea ecx, [ebp - 0xac8]
call fcn.10025dc7
mov eax, dword [ebp - 0xacc]
lea edi, [ebp - 0xac8]
test eax, eax
cmovne edi, eax
test esi, esi
je 0x1002602b
cmp dword [esi + 0x400], ebx
jne 0x10025e8a
push ebx
push ebx
push ebx
push ebx
call fcn.10022610
add esp, 0x10
test eax, eax
je 0x1002602b
push dword [esi + 0x400]
call dword [sym.imp.kernel32.dll_GetCurrentProcessId]
push eax
push str.AcroSBL
push str._s__lu__lu
lea eax, [ebp - 0x218]
push 0x104
push eax
call fcn.100220a0
add esp, 0x18
test eax, eax
jle 0x1002602b
lea ecx, [ebp - 0x6bc]
call fcn.10025da7
push dword [ebp + 0x14]
lea eax, [ebp - 0x6bc]
push dword [ebp - 0xad0]
push 1
push 1
push dword [ebp + 0xc]
push eax
call fcn.100220a0
add esp, 0x18
test eax, eax
jne 0x10026002
push ebx
lea eax, [ebp - 0x218]
push eax
push 1
lea ecx, [ebp - 0x2ac]
call fcn.10029305
push dword [esi + 0x400]
lea eax, [ebp - 0x6bc]
mov dword [ebp - 4], ebx
push 0x1388
push edi
push eax
lea ecx, [ebp - 0x2ac]
call fcn.1002952a
test eax, eax
jne 0x10025f6a
cmp dword [edi + 4], eax
sete bl
cmp byte [0x1003cde0], al
je 0x10025ff5
push dword [edi + 4]
mov esi, 0x1003e190
push str._ACTWinBrowser__SendAcroIPCMessage_IPC_call_success_status___lu
push esi
call fcn.100220a0
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x10025ff5
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
jmp 0x10025ff5
cmp byte [0x1003cde0], 0
mov esi, 0x1003e190
je 0x10025f95
push str.IPC_Error:_AIPC_ERR
push esi
call fcn.100220a0
cmp byte [0x1003cde0], 0
pop ecx
pop ecx
je 0x10025f95
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
call dword [sym.imp.kernel32.dll_GetLastError]
push ebx
push ebx
lea ecx, [ebp - 0xacc]
mov dword [ebp - 0xacc], ebx
push ecx
push 0x400
push eax
push ebx
push 0x1300
call dword [sym.imp.kernel32.dll_FormatMessageA]
cmp byte [0x1003cde0], 0
je 0x10025fe9
push dword [ebp - 0xacc]
push str._ACTWinBrowser__IPC_Error_:__s
push esi
call fcn.100220a0
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x10025fe9
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
push dword [ebp - 0xacc]
call dword [sym.imp.kernel32.dll_LocalFree]
lea ecx, [ebp - 0x2ac]
call fcn.100220a0
jmp 0x1002602b
cmp byte [0x1003cde0], bl
je 0x1002602b
push str.IPC_CreateMessage_Error:_CreateMessage_failed
mov esi, 0x1003e190
push esi
call fcn.100220a0
pop ecx
pop ecx
cmp byte [0x1003cde0], bl
je 0x1002602b
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
mov al, bl
call fcn.1002a0a6
ret
Function at 0x100277eb
Capabilities:
Print debug messages

Disassembly:
push esi
push 8
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov esi, eax
pop ecx
test esi, esi
je 0x10027808
push 8
push 0
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278ec
push edi
push 0x64
push str.sizeof__t_ASMBlock____d
mov edi, 0x1003e5e0
push edi
call fcn.100220a0
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278eb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cde0], 0
je 0x100278eb
push 4
push str.sizeof_Uns32____d
push edi
call fcn.100220a0
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278eb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cde0], 0
je 0x100278eb
push 4
push str.sizeof_HANDLE____d
push edi
call fcn.100220a0
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278eb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cde0], 0
je 0x100278eb
push 4
push str.sizeof_Handle32____d
push edi
call fcn.100220a0
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278eb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
cmp byte [0x1003cde0], 0
je 0x100278eb
push 4
push str.sizeof_void____d
push edi
call fcn.100220a0
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x100278eb
push edi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
pop edi
mov eax, esi
pop esi
ret

Function at 0x1002795e
Capabilities:
Print debug messages

Disassembly:
push 0x1c
mov eax, 0x1002cf70
call fcn.1002a0fc
cmp byte [0x1003cde0], 0
mov edi, dword [ebp + 8]
je 0x1002799d
lea eax, [edi + 4]
mov esi, 0x1003e5e0
push eax
push str.ASM_Release__s
push esi
call fcn.100220a0
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x1002799d
push esi
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
lea eax, [edi + 4]
push eax
lea ecx, [ebp - 0x28]
call fcn.10001b12
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.1000276d
mov ebx, eax
pop ecx
pop ecx
test ebx, ebx
je 0x100279d3
mov ecx, dword [ebx]
push 1
mov esi, dword [ecx]
mov ecx, esi
call dword [0x1002e5c4]
mov ecx, ebx
call esi
lea ecx, [ebp - 0x28]
call fcn.100220a0
and dword [edi + 0x4c], 0
and dword [edi + 0x44], 0
call fcn.1002a0a6
ret
Function at 0x100279e9
Capabilities:
Print debug messages

Disassembly:
push 0x24
mov eax, 0x1002cf9d
call fcn.1002a0fc
cmp byte [0x1003cde0], 0
mov ebx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
mov edi, dword [ebp + 8]
mov dword [ebp - 0x30], ebx
mov dword [ebp - 0x2c], esi
je 0x10027a48
call fcn.100220a0
test al, al
mov edx, 0x1002ea51
mov ecx, str._in_AppContaner
cmove ecx, edx
push ecx
push str.ASM_Retrieve_retrieving_shared_memory_in_Plug_in_s
push 0x1003e5e0
call fcn.100220a0
add esp, 0xc
cmp byte [0x1003cde0], 0
je 0x10027a48
push 0x1003e5e0
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
and dword [esi], 0
lea eax, [edi + 4]
and dword [ebx], 0
lea ecx, [ebp - 0x28]
push eax
call fcn.10001b12
push dword [edi + 0x48]
and dword [ebp - 4], 0
lea eax, [ebp - 0x28]
push eax
call fcn.1000276d
or dword [ebp - 4], 0xffffffff
mov ebx, eax
pop ecx
pop ecx
lea ecx, [ebp - 0x28]
call fcn.100220a0
test ebx, ebx
jne 0x10027aae
cmp byte [0x1003cde0], bl
je 0x10027b0f
push str.ASM_Retrieve_ERROR__finding_memory_mapped_file_
mov ebx, 0x1003e5e0
push ebx
call fcn.100220a0
cmp byte [0x1003cde0], 0
pop ecx
pop ecx
je 0x10027b0f
push ebx
call dword [sym.imp.kernel32.dll_OutputDebugStringA]
jmp 0x10027b0f
mov eax, dword [ebx]
mov esi, dword [eax + 0x20]
mov ecx, esi
call dword [0x1002e5c4]
mov ecx, ebx
call esi
mov dword [edi + 0x44], eax
test eax, eax
jne 0x10027ad5
cmp byte [0x1003cde0], al
je 0x10027b0f
push str.ASM_Retrieve_ERROR__getting_memory_mapped_file_handle_
jmp 0x10027a8f
mov eax, dword [ebx]
push dword [edi + 0x48]
mov esi, dword [eax + 0xc]
mov ecx, esi
call dword [0x1002e5c4]
mov ecx, ebx
call esi
mov dword [edi + 0x4c], eax
test eax, eax
jne 0x10027aff
cmp byte [0x1003cde0], al
je 0x10027b0f
push str.ASM_Retrieve_ERROR__mapping_for_writing_
jmp 0x10027a8f
mov ecx, dword [ebp - 0x2c]
mov eax, dword [edi + 0x48]
mov dword [ecx], eax
mov ecx, dword [ebp - 0x30]
mov eax, dword [edi + 0x4c]
mov dword [ecx], eax
call fcn.1002a0a6
ret
Function at 0x100023a4
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x1005e01a
call fcn.1005db30
sub esp, 0x1c
cmp byte [ebp + 8], 0
push ebx
push esi
push edi
mov esi, edx
mov byte [ebp - 0x10], cl
je 0x100024b2
mov dword [ebp - 0x14], 0x4062
cmp dword [ebp - 0x14], 0x43e3
push 0
pop ebx
jle 0x100023fd
mov esi, ebx
mov edi, ebx
mov eax, edi
mov ecx, 0x10075b78
xor eax, esi
cdq
push edx
push eax
call fcn.1000c233
inc edi
cmp edi, 0x73db
jl 0x100023da
inc esi
cmp esi, 0x4844
jl 0x100023d8
cmp dword [ebp - 0x14], 0x3ed9
jge 0x10002415
mov edx, str.fhekon_atucatx_jnskkb_dwy
mov ecx, 0x10075b78
call fcn.1000e4aa
mov dword [ebp - 0x14], 0x7feb
cmp dword [ebp - 0x14], 0x8108
jle 0x1000244b
mov esi, ebx
mov edi, ebx
mov ebx, 0x6a48
mov eax, edi
mov ecx, 0x10075b78
cdq
push edx
push eax
call fcn.1000c233
add edi, esi
dec ebx
jne 0x1000242e
inc esi
cmp esi, 0x555
jl 0x10002427
cmp byte [ebp + 0x10], 0
je 0x10002472
mov edx, dword [ebp + 0xc]
mov dword [edx], ebx
cmp dword [edx], 3
jge 0x10002491
mov esi, dword [ebp + 0x20]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 3
inc dword [edx]
cmp dword [edx], 3
jl 0x1000245e
jmp 0x10002491
mov edx, dword [ebp + 0x14]
mov dword [edx], ebx
cmp dword [edx], 1
jge 0x10002491
mov esi, dword [ebp + 0x18]
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], 0xfffffff8
inc dword [edx]
cmp dword [edx], 1
jl 0x1000247f
cmp dword [ebp - 0x14], 0x7ea5
jge 0x10002568
mov edx, str.rgdxhd_xblfohcm_farwx_rbgui_lqasy_vrpdetps_byuujwdwy_ock_glnqijk_labfcd_gned_bnappwp
mov ecx, 0x10075b78
call fcn.1000e4aa
jmp 0x10002568
test cl, cl
je 0x10002551
mov dword [ebp - 0x14], 0xfffffff7
lea ecx, [ebp - 0x28]
push 3
call fcn.1000c44b
push 0x6829
lea eax, [ebp - 0x1c]
xor ebx, ebx
push eax
push 0x7f34
push 0x6830
push 1
push 0x929
mov dword [ebp - 4], ebx
lea edx, [ebp - 0x28]
mov dword [ebp - 0x18], 0x52487223
xor cl, cl
push ebx
call fcn.100023a4
add esp, 0x18
mov byte [ebp + 0xb], bl
lea eax, [ebp + 0xb]
mov edx, 0x9fe
push ebx
push ecx
push eax
mov ecx, 0x7c48
call fcn.10002c4a
mov eax, dword [ebp - 0x14]
add esp, 0x10
mov eax, dword [ebp - 0x14]
add eax, 3
je 0x1000252a
cmp dword [ebp - 0x14], ebx
jne 0x10002532
cmp dword [ebp - 0x14], ebx
jne 0x10002532
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
lea ecx, [ebp - 0x28]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x18]
mov eax, dword [ebp - 0x14]
mov eax, dword [ebp - 0x14]
mov dword [ebp - 0x18], eax
call fcn.1000c4ce
jmp 0x10002568
mov edx, dword [ebp + 0x1c]
xor ebx, ebx
mov dword [edx], ebx
jmp 0x10002563
mov ecx, dword [edx]
mov eax, dword [esi]
mov dword [eax + ecx*4], ebx
inc dword [edx]
cmp dword [edx], 3
jl 0x1000255a
mov ecx, dword [ebp - 0xc]
pop edi
pop esi
mov dword fs:[0], ecx
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003b4f
Capabilities:
Encode data using xor
Hide graphical window

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x34
push ebx
mov dword [esp + 0x18], 0x4ca6
mov eax, ecx
cmp dword [esp + 0x18], 0x4fee
push esi
push edi
mov dword [esp + 0x24], edx
mov dword [esp + 0x14], eax
jle 0x10003be0
push 0
push 0
call dword [sym.imp.USER32.dll_ShowWindow]
xor edi, edi
xor esi, esi
mov dword [esp + 0x10], esi
mov ebx, esi
mov esi, 0x7492
mov eax, ebx
lea ecx, [esp + 0x28]
and eax, edi
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10003baa
mov eax, dword [eax]
push eax
call fcn.10048abc
pop ecx
push 0
push 1
lea ecx, [esp + 0x30]
call fcn.1000c80a
dec ebx
dec esi
jne 0x10003b90
mov esi, dword [esp + 0x10]
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0x2b6f
jl 0x10003b89
inc edi
cmp edi, 0x2708
jl 0x10003b83
mov eax, dword [esp + 0x14]
cmp byte [ebp + 8], 0
je 0x10003c0c
mov edx, dword [ebp + 0x10]
mov dword [edx], 0
jmp 0x10003c02
mov ecx, dword [edx]
mov eax, dword [eax]
mov dword [eax + ecx*4], 0x1713b910
inc dword [edx]
mov eax, dword [esp + 0x14]
cmp dword [edx], 1
jl 0x10003bf1
jmp 0x10003cfb
mov dword [esp + 0x1c], 0x2b6d
mov ebx, 0x10075b78
cmp dword [esp + 0x1c], 0x2eae
jle 0x10003c46
xor esi, esi
xor edi, edi
lea eax, [edi + esi]
mov ecx, ebx
cdq
push edx
push eax
call fcn.1000c233
inc edi
cmp edi, 0x1e4f
jl 0x10003c27
inc esi
cmp esi, 0x7ec2
jl 0x10003c25
mov dword [esp + 0x18], 0x39c7
cmp dword [esp + 0x18], 0x3b3f
jle 0x10003cbb
xor esi, esi
mov dword [esp + 0x10], esi
xor edi, edi
mov dword [esp + 0x14], edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov edi, edx
xor esi, esi
mov eax, edi
mov ecx, 0x10075b78
xor eax, esi
xor eax, ebx
cdq
push edx
push eax
call fcn.1000c233
inc esi
cmp esi, 0x79a7
jl 0x10003c6f
inc ebx
cmp ebx, 0x1188
jl 0x10003c6d
mov edi, dword [esp + 0x14]
mov esi, dword [esp + 0x10]
inc edi
mov dword [esp + 0x14], edi
cmp edi, 0x699f
jl 0x10003c64
inc esi
mov dword [esp + 0x10], esi
cmp esi, 0x50bf
jl 0x10003c5e
mov ebx, 0x10075b78
cmp dword [esp + 0x18], 0x37d1
jge 0x10003cd1
mov edx, str.cwbeyj_jbey_imtky
mov ecx, ebx
call fcn.1000e4aa
mov eax, dword [esp + 0x24]
cmp byte [eax], 0
je 0x10003ce5
xor eax, eax
push eax
push eax
push eax
call dword [sym.imp.KERNEL32.dll_GetModuleHandleExW]
cmp dword [esp + 0x1c], 0x27bd
jge 0x10003cfb
mov edx, str.jxy_vktskbaq_yippevipk_wsqsyj_pba_hjjjgnk_llm
mov ecx, ebx
call fcn.1000e4aa
cmp dword [esp + 0x20], 0x4bf4
jge 0x10003d10
push str.gvecq_afpafrlp_cnyyp_yol_assypxi_wuwbjtyak
call fcn.10048abc
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10003d3e
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
cmp byte [ebp + 0x10], 0
push ebx
push edi
mov edi, edx
mov ebx, ecx
je 0x10003dc3
push esi
mov esi, dword [ebp + 0x18]
mov eax, dword [esi]
cmp dword [eax + 4], 0x7840
jl 0x10003dbc
mov eax, dword [ebp + 0x14]
xor edx, edx
mov ecx, dword [ebp + 0xc]
push 1
mov eax, dword [eax]
mov ecx, dword [ecx]
mov eax, dword [ebp + 0x1c]
mov eax, dword [eax]
cmp ecx, eax
mov eax, dword [ebp + 0x1c]
setle dl
xor ecx, ecx
mov eax, dword [eax]
cmp edx, eax
mov eax, dword [ebp + 0x20]
setg cl
pop edx
mov dword [eax], ecx
xor ecx, ecx
cmp dword [eax], ecx
je 0x10003d99
mov eax, dword [esi]
cmp dword [eax + 4], ecx
je 0x10003d99
cmp dword [edi], ecx
je 0x10003d99
mov ecx, edx
xor eax, eax
cmp ecx, 0x9bb5
setne al
xor ecx, ecx
cmp eax, 0x7d79
mov eax, dword [ebp + 0x1c]
setle cl
mov eax, dword [eax]
sub ecx, eax
mov eax, dword [ebp + 0xc]
cmp dword [eax], ecx
jne 0x10003dbe
xor edx, edx
mov dword [ebx], edx
pop esi
jmp 0x10003dcb
push 0
call dword [sym.imp.KERNEL32.dll_DeleteFileA]
pop edi
pop ebx
pop ebp
ret
Function at 0x100051ca
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
push ebx
push esi
push edi
mov dword [ebp - 4], 0x5b74
cmp dword [ebp - 4], 0x5c82
push 0
mov dword [ebp - 0x10], edx
mov dword [ebp - 0x14], ecx
pop esi
jle 0x10005235
call dword [sym.imp.KERNEL32.dll_GetCurrentProcessId]
mov edi, esi
mov ebx, esi
mov ecx, ebx
mov eax, edi
shl eax, cl
lea ecx, [ebp - 0x2c]
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10005211
mov eax, dword [eax]
push eax
call fcn.10048abc
pop ecx
push esi
push 1
lea ecx, [ebp - 0x2c]
call fcn.1000c80a
inc ebx
cmp ebx, 0x449f
jl 0x100051f6
inc edi
cmp edi, 0x7348
jl 0x100051f4
cmp dword [ebp - 4], 0x5b2b
jge 0x10005249
push str.spfyc_kjsnhanw_ruynlx_kfiaqdtku_vplrlhcgn_eedjp_nyn_keucjwpm_bikdvj_gxsm_msrjt_edberxl_twonbb
call fcn.10048abc
pop ecx
cmp byte [ebp + 0x1c], 0
je 0x10005273
mov eax, dword [ebp + 0x14]
cmp byte [eax], 0
je 0x1000535a
push ecx
push ecx
push esi
sub esp, 0xc
push 0x79e5
call fcn.100033e6
add esp, 0x1c
jmp 0x1000535a
mov dword [ebp - 8], 0x5b80
cmp dword [ebp - 8], 0x5e64
jle 0x100052c9
mov edi, esi
mov dword [ebp - 4], esi
mov ebx, esi
mov dword [ebp - 0xc], esi
mov esi, ebx
and esi, edi
mov edi, dword [ebp - 0xc]
mov eax, esi
mov ecx, 0x10075b78
xor eax, edi
cdq
push edx
push eax
call fcn.1000c233
inc edi
cmp edi, 0x51f2
jl 0x10005294
mov edi, dword [ebp - 4]
inc ebx
push 0
pop esi
cmp ebx, 0x5a6f
jl 0x1000528a
inc edi
mov dword [ebp - 4], edi
cmp edi, 0x5bda
jl 0x10005288
cmp dword [ebp - 8], 0x57ee
jge 0x100052e1
mov edx, str.bkeiybb_vlrkug_gdvgifwry_tnntbot_jqplb_mllrfcp_xniqjbfp
mov ecx, 0x10075b78
call fcn.1000e4aa
mov edi, dword [ebp + 0x18]
xor edx, edx
mov eax, dword [edi]
mov ecx, dword [edi]
mov eax, dword [edi]
cmp ecx, eax
mov eax, dword [edi]
setg dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [edi]
setl cl
sub ecx, eax
lea eax, [ecx + 7]
cmp eax, dword [edi]
jle 0x10005309
cmp dword [edi], esi
je 0x1000530c
xor esi, esi
inc esi
mov eax, dword [edi]
mov ecx, dword [ebp + 0x20]
mov edx, dword [ebp + 0x10]
mov dword [ecx], eax
mov eax, dword [ecx]
xor ecx, ecx
mov dword [edx], eax
mov eax, dword [edi]
cmp eax, esi
mov eax, dword [edx]
setle cl
xor edx, edx
cmp eax, ecx
mov eax, dword [edi]
setle dl
xor ecx, ecx
cmp edx, eax
mov eax, dword [ebp - 0x10]
setne cl
mov eax, dword [eax]
mov dword [eax + 8], ecx
mov eax, dword [edi]
mov eax, dword [edi]
mov eax, dword [edi]
mov eax, dword [ebp + 0x24]
mov eax, dword [eax]
mov eax, dword [ebp + 0x28]
mov dword [eax], 0xffffffff
mov eax, dword [ebp - 0x14]
mov dword [eax], 0xffffffff
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10005361
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
mov dword [ebp - 0xc], 0x31d2
cmp dword [ebp - 0xc], 0x3317
push esi
push edi
jle 0x100053bc
xor esi, esi
mov dword [ebp - 8], esi
xor edi, edi
mov eax, esi
xor ebx, ebx
cdq
idiv edi
mov esi, edx
mov eax, esi
mov ecx, 0x10075b78
xor eax, ebx
cdq
push edx
push eax
call fcn.1000c233
inc ebx
cmp ebx, 0x29df
jl 0x1000538a
mov esi, dword [ebp - 8]
inc edi
cmp edi, 0x2f53
jl 0x10005381
inc esi
mov dword [ebp - 8], esi
cmp esi, 0x6daf
jl 0x1000537f
cmp dword [ebp - 0xc], 0x318d
jge 0x100053d4
mov edx, str.clydit_jcseagyt_jmavsfg_ufr_xyexwxmcu_tny_osyfuhsc_hrbgqlw_yrnugfl_xpiaeyim_aycp
mov ecx, 0x10075b78
call fcn.1000e4aa
cmp byte [ebp + 0xc], 0
je 0x10005402
mov byte [ebp - 1], 0
cmp byte [ebp - 1], 0
je 0x1000540c
push 1
push ecx
push ecx
push 0xed6
push 0x134e
push 0x3e2b
push ecx
call fcn.10001ccf
add esp, 0x1c
jmp 0x1000540c
push 0
push 0
call dword [sym.imp.ADVAPI32.dll_InitializeSecurityDescriptor]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x100057fd
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push ebx
push esi
push edi
mov dword [ebp - 0x14], 0x360f
mov esi, edx
cmp dword [ebp - 0x14], 0x3972
push 0
mov dword [ebp - 0x1c], esi
pop ebx
jle 0x1000586b
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.ADVAPI32.dll_SetSecurityDescriptorDacl]
mov edi, ebx
mov eax, ebx
lea ecx, [ebp - 0x34]
xor eax, edi
cdq
push edx
push eax
call fcn.100019c5
pop ecx
pop ecx
cmp dword [eax + 0x14], 0x10
jb 0x10005843
mov eax, dword [eax]
push eax
call fcn.10048abc
pop ecx
push 0
push 1
lea ecx, [ebp - 0x34]
call fcn.1000c80a
inc ebx
cmp ebx, 0x3b93
jl 0x1000582a
inc edi
push 0
pop ebx
cmp edi, 0x416f
jl 0x1000582a
cmp byte [ebp + 0xc], 0
je 0x10005974
mov dword [esi], ebx
jmp 0x1000590d
push ecx
push dword [ebp + 8]
push esi
push ecx
mov cl, 1
call fcn.10002aab
mov dword [ebp - 0x10], 0x266b
add esp, 0x10
cmp dword [ebp - 0x10], 0x2775
jle 0x100058f3
xor edi, edi
mov dword [ebp - 0xc], edi
xor esi, esi
mov dword [ebp - 0x18], edi
mov dword [ebp - 8], 0x4ecf
mov eax, edi
mov ecx, 0x10075b78
xor eax, ebx
cdq
push edx
push eax
call fcn.1000c233
add edi, esi
dec dword [ebp - 8]
jne 0x100058ad
mov edi, dword [ebp - 0xc]
inc esi
cmp esi, 0x3fe4
jl 0x100058a3
inc edi
mov dword [ebp - 0xc], edi
cmp edi, 0x433e
jl 0x100058a1
inc ebx
cmp ebx, 0xcd0
jl 0x1000589c
xor ebx, ebx
push ebx
push ebx
call dword [sym.imp.USER32.dll_GetClientRect]
mov esi, dword [ebp - 0x1c]
cmp dword [ebp - 0x10], 0x265a
jge 0x1000590b
mov edx, str.eqtcukkg_nvlauce_fsupa_qthkfcp_vva_fjyuwwki_dpd_gti_nfjxdj_qtrudhjh
mov ecx, 0x10075b78
call fcn.1000e4aa
inc dword [esi]
cmp dword [esi], 1
jl 0x1000587c
mov dword [ebp - 0x10], 0x110
cmp dword [ebp - 0x10], 0x1d9
jle 0x1000595a
mov esi, ebx
mov edi, ebx
lea eax, [edi + esi]
mov ecx, 0x10075b78
and eax, ebx
cdq
push edx
push eax
call fcn.1000c233
inc ebx
cmp ebx, 0x7b76
jl 0x1000592a
inc edi
push 0
pop ebx
cmp edi, 0x4e0d
jl 0x1000592a
inc esi
cmp esi, 0x4150
jl 0x10005928
cmp dword [ebp - 0x10], 0xfffffdf9
jge 0x10005981
mov edx, str.nejdqe_uowve_dnk_vfsq_oxric_hrlu_abvhln_wcin_qvsuolei_gfiqs_sklwwyl
mov ecx, 0x10075b78
call fcn.1000e4aa
jmp 0x10005981
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
call dword [sym.imp.KERNEL32.dll_FormatMessageA]
cmp dword [ebp - 0x14], 0x3245
jge 0x10005995
push str.lavo_mdp_tiujgh_ehjkjxw_orsox_rqrsdlwcg_avuvxxkre_bykq_ewjfxbrh_uonk_ypsrrk_udpmlfhew_tjhq
call fcn.10048abc
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret