joyce8/EMBER2024-capa huggingface dataset:
Function at 0x101c176e
Capabilities:
Parse pe header
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push esi
and esp, 0xfffffff8
sub esp, 0x98
lea eax, [esp + 0x80]
lea ecx, [esp + 0x20]
mov edx, dword [0x101d85c0]
mov esi, edx
add esi, 0xffffddef
mov dword [0x101d85c4], esi
add edx, 0xfffff1ae
mov dword [0x101d85c0], edx
mov dword [esp], eax
mov dword [esp + 0x1c], ecx
call fcn.101c0f59
lea ecx, [0x101c0452]
mov edx, dword [esp + 0x80]
mov dword [esp + 0x44], edx
mov dword [esp + 0x2c], 0x133200
mov edx, dword [0x101d85ac]
mov dword [esp + 0x60], edx
mov edx, dword [0x101d85b0]
mov dword [esp + 0x78], edx
mov dword [0x101d85c0], 0x1a6c
mov edx, dword [0x101d85b4]
mov dword [esp + 0x28], edx
mov edx, dword [0x101d85b8]
mov dword [esp + 0x4c], edx
mov edx, dword [0x101d85bc]
mov dword [esp + 0x68], edx
mov edx, dword [0x101d85c4]
add edx, 0xc86
mov dword [0x101d85c4], edx
mov dword [esp + 0x18], eax
mov dword [esp + 0x14], ecx
jmp 0x101c1871
mov eax, dword [esp + 0x10]
mov dword [esp + 0x58], eax
mov dword [0x101d85c4], 0x8e8
mov ecx, dword [esp + 0xc]
mov edx, dword [eax + ecx + 0x50]
mov dword [esp + 0x50], edx
mov dword [0x101d85c0], 0x1277
call fcn.101c0d05
xor ecx, ecx
cmp eax, 0
mov dword [esp + 8], ecx
je 0x101c1896
jmp 0x101c18cd
mov eax, dword [esp + 0x10]
add eax, 0xfffff000
and eax, 0xfffff000
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0x14]
cmp word [eax], 0x5a4d
mov dword [esp + 0x10], eax
jne 0x101c185f
mov eax, dword [esp + 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
mov dword [esp + 0xc], ecx
je 0x101c1823
jmp 0x101c185f
lea eax, [esp + 0x20]
mov ecx, dword [esp + 0x88]
mov dword [esp], eax
mov dword [esp + 4], ecx
call fcn.101c0882
mov ecx, esp
lea edx, [esp + 0x20]
mov dword [ecx], edx
call eax
sub esp, 4
mov eax, 2
mov dword [0x101d85c4], 0xd4a
mov dword [esp + 8], eax
mov eax, dword [esp + 8]
lea esp, [ebp - 4]
pop esi
pop ebp
ret
Function at 0x4099a4
Capabilities:
Create process on windows
Create process suspended

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffffa8
push ebx
push esi
push edi
xor ebx, ebx
mov dword [ebp - 4], ebx
mov edi, ecx
mov esi, edx
mov ebx, eax
xor eax, eax
push ebp
push 0x409a77
push dword fs:[eax]
mov dword fs:[eax], esp
push 0x409a90
push ebx
push 0x409a9c
push esi
lea eax, [ebp - 4]
mov edx, 4
call fcn.004033b4
lea eax, [ebp - 0x48]
xor ecx, ecx
mov edx, 0x44
call fcn.0040277c
mov dword [ebp - 0x48], 0x44
lea eax, [ebp - 0x58]
push eax
lea eax, [ebp - 0x48]
push eax
push 0
push 0
push 0
push 0
push 0
push 0
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
push 0
call sub.kernel32.dll_CreateProcessA
test eax, eax
jne 0x409a24
mov al, 0x69
call fcn.00409648
mov eax, dword [ebp - 0x54]
push eax
call sub.kernel32.dll_CloseHandle_1
call fcn.00409978
push 0xff
push 0xffffffffffffffff
push 0
lea eax, [ebp - 0x58]
push eax
push 1
call sub.user32.dll_MsgWaitForMultipleObjects
dec eax
je 0x409a2d
call fcn.00409978
push edi
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_GetExitCodeProcess
mov eax, dword [ebp - 0x58]
push eax
call sub.kernel32.dll_CloseHandle_1
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x409a7e
lea eax, [ebp - 4]
call fcn.00403198
ret

Function at 0x409b30
Capabilities:
Allocate or change rwx memory
Get system information on windows

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xffffffbc
mov edi, eax
lea esi, [esp + 0x28]
lea eax, [esp + 4]
push eax
call sub.kernel32.dll_GetSystemInfo
mov ebx, edi
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
jmp 0x409bd9
cmp dword [esi + 0x10], 0x1000
jne 0x409bc5
test byte [esi + 0x15], 1
jne 0x409bc5
xor ebx, ebx
mov eax, dword [esi + 0x14]
cmp eax, 1
je 0x409b84
cmp eax, 2
je 0x409b84
cmp eax, 0x10
je 0x409b84
cmp eax, 0x20
jne 0x409b99
push esp
push 0x40
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
test eax, eax
je 0x409b99
mov bl, 1
xor ebp, ebp
jmp 0x409baa
mov eax, dword [esi]
add eax, ebp
call fcn.00409b28
add ebp, dword [esp + 8]
cmp ebp, dword [esi + 0xc]
jb 0x409b9d
test bl, bl
je 0x409bc5
push esp
mov eax, dword [esp + 4]
push eax
mov eax, dword [esi + 0xc]
push eax
mov eax, dword [esi]
push eax
call sub.kernel32.dll_VirtualProtect
mov eax, dword [esi]
add eax, dword [esi + 0xc]
mov ebx, eax
push 0x1c
push esi
push ebx
call sub.kernel32.dll_VirtualQuery
test eax, eax
je 0x409be4
mov eax, dword [esi + 4]
cmp eax, edi
je 0x409b5c
add esp, 0x44
pop ebp
pop edi
pop esi
pop ebx
ret

Function at 0x100010a0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
sub dword [ebp + 0xc], 1
jne 0x100010c7
push dword [ebp + 8]
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
push 0
push 0
push 0
push section..text
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov eax, 1
pop ebp
ret 0xc
Function at 0x100018e4
Capabilities:
Create process on windows
Get common file path

Disassembly:
push 0x21c
mov eax, 0x10009593
call fcn.100089a7
mov ebx, dword [ebp + 8]
mov esi, dword [ebp + 0xc]
mov eax, dword [0x1000e04c]
cmp eax, 0x1000e04c
je 0x10001927
test dword [eax + 0x1c], 0x100
je 0x10001927
cmp byte [eax + 0x19], 6
jb 0x10001927
push ebx
push 0x1000a79c
push 0x19
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.10005161
xor edi, edi
test esi, esi
jne 0x10001937
mov eax, 0x80004005
jmp 0x10001b10
push dword [esi]
lea ecx, [ebp - 0x228]
call fcn.10002f0d
mov dword [ebp - 4], 1
call fcn.100012d5
push eax
lea ecx, [ebp - 0x224]
call fcn.10005161
lea eax, [ebp - 0x218]
mov byte [ebp - 4], 2
push eax
mov esi, 0x104
mov dword [ebp - 0x21c], edi
push esi
call dword [sym.imp.kernel32.dll_GetTempPathW]
test eax, eax
jne 0x1000198f
push 0x1000a630
push esi
lea eax, [ebp - 0x218]
push eax
call fcn.10005161
lea eax, [ebp - 0x218]
push eax
lea ecx, [ebp - 0x220]
call fcn.10002f0d
push 0xd
push str.Join.ocsmeet
lea ecx, [ebp - 0x220]
mov byte [ebp - 4], 3
call fcn.10005161
push 0x1000a654
push dword [ebp - 0x220]
lea eax, [ebp - 0x21c]
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen_s]
add esp, 0xc
test eax, eax
jne 0x10001a17
cmp dword [ebp - 0x21c], eax
je 0x10001a17
push dword [ebp - 0x21c]
push dword [ebp - 0x228]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputws]
pop ecx
pop ecx
lea eax, [ebp - 0x220]
push eax
lea ecx, [ebp - 0x224]
call fcn.10005161
push dword [ebp - 0x21c]
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
pop ecx
mov dword [ebp - 0x21c], edi
mov esi, dword [ebp - 0x224]
cmp dword [esi - 0xc], edi
jne 0x10001a2c
mov edi, 0x80004005
jmp 0x10001abc
push 0xa
mov eax, 0x1000a798
push eax
push eax
push esi
push 0x1000a658
push edi
call dword [sym.imp.SHELL32.dll_ShellExecuteW]
cmp eax, 0x20
ja 0x10001abc
cmp eax, 0x1b
ja 0x10001a8c
je 0x10001ab0
dec eax
sub eax, 1
je 0x10001a85
sub eax, 1
je 0x10001a7e
dec eax
sub eax, 1
je 0x10001a77
sub eax, 3
je 0x10001a70
sub eax, 3
jne 0x10001a22
mov edi, 0x8007000b
jmp 0x10001abc
mov edi, 0x8007000e
jmp 0x10001abc
mov edi, 0x80070005
jmp 0x10001abc
mov edi, 0x80070003
jmp 0x10001abc
mov edi, 0x80070002
jmp 0x10001abc
sub eax, 0x1c
je 0x10001ab7
sub eax, 1
je 0x10001ab7
sub eax, 1
je 0x10001ab7
sub eax, 1
je 0x10001ab0
sub eax, 1
jne 0x10001a22
mov edi, 0x80070485
jmp 0x10001abc
mov edi, 0x80070483
jmp 0x10001abc
mov edi, 0x80070484
mov eax, dword [0x1000e04c]
cmp eax, 0x1000e04c
je 0x10001aea
test dword [eax + 0x1c], 0x100
je 0x10001aea
cmp byte [eax + 0x19], 6
jb 0x10001aea
push ebx
push 0x1000a79c
push 0x1a
push dword [eax + 0x14]
push dword [eax + 0x10]
call fcn.10005161
mov ecx, dword [ebp - 0x220]
lea ecx, [ecx - 0x10]
call fcn.10005161
lea ecx, [esi - 0x10]
call fcn.10005161
mov ecx, dword [ebp - 0x228]
add ecx, 0xfffffff0
call fcn.10005161
mov eax, edi
call fcn.10008959
ret 8
Function at 0x10005161
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x10005170
pop dword [ebp - 0x40]
mov eax, 0x2e7f2a25
add eax, 0xe181274b
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x61027381
sub dword [ebp - 0x50], 0x12b02e36
mov dword [ebp - 0x4c], 0x3af51531
add dword [ebp - 0x4c], 0xf73e3714
mov dword [ebp - 0x48], 0xe538d8c5
add dword [ebp - 0x48], 0x67136b69
mov dword [ebp - 0x44], 0x6bc6d9ae
sub dword [ebp - 0x44], 0x6bc6d9ae
lea eax, [ebp - 0x50]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x65162b02
sub dword [ebp - 0x50], 0xf0a3c1ac
mov dword [ebp - 0x4c], 0xdaa0e39
add dword [ebp - 0x4c], 0x33c2533c
mov dword [ebp - 0x48], 0xc81b9150
sub dword [ebp - 0x48], 0x64ac24e4
mov dword [ebp - 0x44], 0x36740e21
sub dword [ebp - 0x44], 0x36740e21
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x356ef218
add eax, 0xda91ae58
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x34bbc
push 0
call eax
mov ecx, 0x3add
mov edi, eax
mov esi, 0xd54831e
add esi, 0x2acaee2
add esi, dword [ebp - 0x40]
mov ebx, 0x16cff214
xor dword [ebp - 0x2c], 0xa058e2a3
mov edx, dword [esi]
xor dword [ebp - 0x28], 0x979ff420
xor edx, ebx
sub dword [ebp - 0x24], 0xb7dc27bd
mov dword [edi], edx
sub dword [ebp - 4], 0xe7d434fc
add edi, 4
add esi, 0x4e65d935
sub esi, 0x4e65d931
loop 0x10005281
add eax, 0x8cc6ffdd
sub eax, 0x8cc62196
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x5f1fdd37
add ecx, 0xb0e022c9
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x401c20
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x401c2f
pop dword [ebp - 0x30]
mov eax, 0xda853a6f
sub eax, 0xda451e40
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x37025ca
sub dword [ebp - 0x40], 0xb51de07f
mov dword [ebp - 0x3c], 0x7ee16aae
add dword [ebp - 0x3c], 0xb351e197
mov dword [ebp - 0x38], 0xc2682c59
sub dword [ebp - 0x38], 0x761be82b
mov dword [ebp - 0x34], 0x84993fb0
sub dword [ebp - 0x34], 0x84993fb0
lea eax, [ebp - 0x40]
push eax
mov eax, 0xb885e258
add eax, 0x47bdbe58
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0xe1c66037
add dword [ebp - 0x40], 0x92ac091f
mov dword [ebp - 0x3c], 0x5b377f28
sub dword [ebp - 0x3c], 0x19cb1db3
mov dword [ebp - 0x38], 0xdddb0c5d
add dword [ebp - 0x38], 0x8594600f
mov dword [ebp - 0x34], 0x72b50017
sub dword [ebp - 0x34], 0x72b50017
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x4093b
push 0
call eax
mov ecx, 0x50f7
xor edi, edi
add edi, eax
mov esi, 0xdd6b73ce
sub esi, 0xdd25f9ce
add esi, dword [ebp - 0x30]
mov ebx, 0xdce3541d
sub ebx, 0x70bc220e
add dword [ebp - 0x2c], 0x77c18d71
mov edx, dword [esi]
add edx, ebx
sub dword [ebp - 0x2c], 0x2e34a0b6
mov dword [edi], edx
xor dword [ebp - 0x10], 0x8bdf9ed0
add edi, 4
add esi, 4
loop 0x401d48
add eax, 0xefdda974
sub eax, 0xefdc72c5
xor ebx, ebx
add ebx, eax
add eax, 0xc0775734
add eax, 0x3f88a8d1
mov ecx, 0x9ba1f542
sub ecx, 0x9b61f542
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x1001af10
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
pushal
call 0x1001af1f
pop dword [ebp - 0x20]
mov eax, 0x4864c55f
add eax, 0xc79ce9c0
sub dword [ebp - 0x20], eax
mov dword [ebp - 0x30], 0x5bf0a5af
sub dword [ebp - 0x30], 0xd9e6064
mov dword [ebp - 0x2c], 0xd1eac096
add dword [ebp - 0x2c], 0x60488baf
mov dword [ebp - 0x28], 0xa110c0f8
sub dword [ebp - 0x28], 0x54c47cca
mov dword [ebp - 0x24], 0x301188d4
sub dword [ebp - 0x24], 0x301188d4
lea eax, [ebp - 0x30]
push eax
mov eax, 0xb9043471
sub eax, 0xa901e3ed
add eax, dword [ebp - 0x20]
call dword [eax]
mov dword [ebp - 0x30], 0x75cf4ada
sub dword [ebp - 0x30], 0x15ce184
mov dword [ebp - 0x2c], 0xf164e06b
add dword [ebp - 0x2c], 0x5007810a
mov dword [ebp - 0x28], 0x64895f68
sub dword [ebp - 0x28], 0x119f2fc
mov dword [ebp - 0x24], 0xba7f4bf
add dword [ebp - 0x24], 0xf4580b41
lea ebx, [ebp - 0x30]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x20]
call dword [eax]
push 0x40
push 0x1000
push 0x399d4
push 0
call eax
mov ecx, 0x73477f80
add ecx, 0x8cb8c148
xor esi, esi
add esi, eax
mov edi, 0x10030c00
add edi, dword [ebp - 0x20]
mov edx, 0xc51555e5
sub edx, 0x5c4e3b28
xor dword [ebp - 8], 0x5d1274ad
mov ebx, dword [edi]
sub ebx, edx
xor dword [ebp - 0x10], esi
mov dword [esi], ebx
xor dword [ebp - 4], 0x3f5f8bdb
add esi, 0xd6a6f4a8
sub esi, 0xd6a6f4a4
add edi, 4
loop 0x1001b038
add eax, 0xb615540c
sub eax, 0xb6145e19
mov ebx, eax
add eax, 0xd6500cdb
add eax, 0x29aff32a
mov ecx, 0x5afcce84
sub ecx, 0x4afcce84
add ecx, dword [ebp - 0x20]
call ebx
leave
ret

Function at 0x1001c940
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push edi
mov edi, dword [ebp + 8]
cmp byte [edi + 0x2d], 0
jne 0x1001c9db
push ebx
mov ebx, dword [ebp + 0x10]
lea eax, [ebp - 4]
push esi
push 0
push eax
push ebx
push dword [ebp + 0xc]
push dword [edi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov esi, dword [ebp - 4]
cmp esi, ebx
je 0x1001c992
mov byte [edi + 0x2d], 0xff
test esi, esi
je 0x1001c992
cmp esi, ebx
jge 0x1001c992
mov eax, ebx
sub eax, esi
push eax
mov eax, dword [ebp + 0xc]
add eax, esi
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
cmp dword [edi + 0x18], 0
je 0x1001c9d5
add dword [edi + 0x1c], ebx
cmp dword [edi + 0x1c], 0xffff
jle 0x1001c9d5
xor eax, eax
mov word [edi + 0x1e], ax
mov eax, dword [edi]
push edi
mov esi, dword [eax + 0x2c]
mov ecx, esi
call dword [0x100252e4]
call esi
mov ecx, dword [edi + 0x18]
push 1
push dword [edi + 0x20]
mov esi, dword [ecx]
push eax
push ecx
mov ecx, dword [esi + 0xc]
call dword [0x100252e4]
call dword [esi + 0xc]
mov esi, dword [ebp - 4]
mov eax, esi
pop esi
pop ebx
jmp 0x1001c9ed
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
xor eax, eax
pop edi
leave
ret 0xc
Function at 0x1001cc10
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
mov eax, dword [ebp + 8]
je 0x1001cc38
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001cc52
lea ecx, [ebp - 0x108]
push ecx
push eax
call sym.drvSOFT.x3d_public:_enum_E3RESULT___stdcall_FILETYPE::QueryFormatInfo_class_e3_XMLNODE____unsigned_int_
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.10022930
leave
ret 4

Function at 0x1001ce20
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
push edi
mov edi, dword [ebp + 0xc]
je 0x1001ce56
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001ceb5
push 0x104
lea eax, [ebp - 0x108]
push 0
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call sym.drvSOFT.x3d_public:_enum_E3RESULT___stdcall_FILETYPE::QueryFormatInfo_class_e3_XMLNODE____unsigned_int_
lea eax, [ebp - 0x20c]
push eax
push edi
call sym.drvSOFT.x3d_public:_enum_E3RESULT___stdcall_FILETYPE::QueryFormatInfo_class_e3_XMLNODE____unsigned_int_
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
lea eax, [ebp - 0x108]
push ebx
push eax
call sym.drvSOFT.x3d_public:_enum_E3RESULT___stdcall_FILETYPE::QueryFormatInfo_class_e3_XMLNODE____unsigned_int_
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10022930
leave
ret 0x10

Function at 0x1001ced0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x1002d6f4]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x1002da0c], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001cefc
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001cf2d
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001cf2b
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call sym.drvSOFT.x3d_public:_enum_E3RESULT___stdcall_FILETYPE::QueryFormatInfo_class_e3_XMLNODE____unsigned_int_
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001cf2d
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.10022930
leave
ret 8
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40d02c], 0x8088405
inc edx
mov dword [0x40d02c], edx
mul edx
mov eax, edx
ret

Function at 0x407d0c
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x40d560
mov eax, esi
mov edx, 8
test al, 1
je 0x407d28
shr eax, 1
xor eax, 0xedb88320
jmp 0x407d2a
shr eax, 1
dec edx
jne 0x407d1b
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x407d14
pop esi
ret

Function at 0x407d57
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x40d55c], 0
jne 0x407d63
call fcn.00407d0c
push 1
push 0x40d55c
call fcn.004043fc
mov eax, edi
test esi, esi
je 0x407d8e
mov edx, ebx
and dx, 0xff
xor ecx, ecx
mov cl, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x40d560]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x407d69
mov eax, ebx
pop edi
pop esi
pop ebx
ret
Function at 0x4057e2
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x4057f1
pop dword [ebp - 0x24]
mov eax, 0x6fa01d89
sub eax, 0x6f5fc598
sub dword [ebp - 0x24], eax
push 0x40
push 0x1000
push 0x4e32a
push 0
mov eax, 0x2f03f4da
sub eax, 0x2ebf422a
add eax, dword [ebp - 0x24]
call dword [eax]
mov ecx, 0x3f59
xor edi, edi
add edi, eax
mov ebx, 0xc81080e3
add ebx, 0x38380d1d
add ebx, dword [ebp - 0x24]
mov edx, 0x5ba8f873
add edx, 0x9b6cf633
mov esi, dword [ebx]
xor dword [ebp - 4], 0xe87820a5
add esi, edx
mov dword [ebp - 0x14], 0xd4ee94e8
mov dword [edi], esi
sub dword [ebp - 0x14], edx
add edi, 4
add ebx, 4
loop 0x40584c
add eax, 0xbc5555f0
add eax, 0x43ab9a47
mov ebx, eax
add eax, 0x748bbfcd
sub eax, 0x748bbfc8
mov ecx, 0xc8bad691
add ecx, 0x3785296f
add ecx, dword [ebp - 0x24]
call ebx
leave
ret

Function at 0x4400c9
Capabilities:
Encrypt data using dpapi

Disassembly:
push esi
push edi
push 0x46c6d0
push str.AdvApi32.dll
call main
mov edi, dword [sym.imp.kernel32.dll_GetProcAddress]
mov esi, eax
test esi, esi
js 0x44010c
push str.SystemFunction040
push dword [0x46c6d0]
call edi
push str.SystemFunction041
push dword [0x46c6d0]
mov dword [0x46c6c0], eax
call edi
mov dword [0x46c6c4], eax
jmp 0x440111
mov eax, dword [0x46c6c4]
cmp dword [0x46c6c0], 0
je 0x440122
test eax, eax
jne 0x4401c9
push 0x46c6d4
push str.Crypt32.dll
call main
mov esi, eax
test esi, esi
js 0x4401d3
push str.CryptProtectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c0], 0
mov dword [0x46c6c8], eax
jne 0x440187
test eax, eax
jne 0x440187
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x440171
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x440178
mov esi, 0x80004005
push esi
push 0x28
push str.c:_agent_work138_s_srclibsdutilcryputil.cpp
call fcn.004038f5
jmp 0x4401d3
push str.CryptUnprotectMemory
push dword [0x46c6d4]
call edi
cmp dword [0x46c6c4], 0
mov dword [0x46c6cc], eax
jne 0x4401c9
test eax, eax
jne 0x4401c9
call dword [sym.imp.kernel32.dll_GetLastError]
mov esi, eax
test esi, esi
jle 0x4401bd
movzx esi, si
or esi, 0x80070000
test esi, esi
js 0x4401c4
mov esi, 0x80004005
push esi
push 0x2d
jmp 0x44017b
mov dword [0x46c6d8], 1
pop edi
mov eax, esi
pop esi
ret
Function at 0x421120
Capabilities:
Create pipe

Disassembly:
sub esp, 0x24
mov eax, dword [0x42c004]
xor eax, esp
mov dword [esp + 0x1c], eax
mov eax, dword [0x42cdb0]
push ebx
mov ebx, dword [0x2bd2234]
push edi
mov edi, dword [0x2bd46b4]
call fcn.00421090
cmp dword [0x2bd46b4], 0x2f
jne 0x42118d
push 0
call dword [sym.imp.KERNEL32.dll_FreeEnvironmentStringsA]
push 0
push 0
push 0
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateNamedPipeA]
lea eax, [esp + 0xc]
push eax
lea ecx, [esp + 0x18]
push ecx
mov dword [esp + 0x14], 0
mov dword [esp + 0x18], 0
call dword [sym.imp.KERNEL32.dll_SystemTimeToFileTime]
call fcn.004210c0
mov ecx, dword [esp + 0x24]
pop edi
pop ebx
xor ecx, esp
call fcn.00401100
add esp, 0x24
ret
Function at 0x421480
Capabilities:
Get disk information
Manipulate console buffer
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x820
mov eax, dword [0x42c004]
xor eax, ebp
mov dword [ebp - 0x20], eax
mov dword [ebp - 4], 0
jmp 0x4214a5
mov eax, dword [ebp - 4]
add eax, 1
mov dword [ebp - 4], eax
cmp dword [ebp - 4], 0x1519a5
jge 0x4214ee
mov dword [0x2bd431c], 0x8e46a6f0
cmp dword [0x2bd46b4], 0x3dc
jne 0x4214ec
xor ecx, ecx
mov word [ebp - 8], cx
xor edx, edx
mov word [ebp - 6], dx
lea eax, [ebp - 0xc]
push eax
mov ecx, dword [ebp - 8]
push ecx
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteConsoleOutputCharacterW]
push 0
call dword [sym.imp.KERNEL32.dll_GetTimeZoneInformation]
jmp 0x42149c
mov dword [ebp - 0x10], 0
jmp 0x421500
mov edx, dword [ebp - 0x10]
add edx, 1
mov dword [ebp - 0x10], edx
cmp dword [ebp - 0x10], 0x12cad2a
jge 0x42159b
cmp dword [0x2bd46b4], 0xa5f
jne 0x421552
push 0
push 0
push 0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_WriteFile]
push 0
lea eax, [ebp - 0x420]
push eax
lea ecx, [ebp - 0x18]
push ecx
lea edx, [ebp - 0x1c]
push edx
lea eax, [ebp - 0x14]
push eax
push 0
lea ecx, [ebp - 0x820]
push ecx
push str.xonatoyuhejigoriramadiguyo
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
cmp dword [ebp - 0x10], 0x84620b
jne 0x421576
mov edx, dword [0x42dbd0]
mov dword [0x2bd46b4], edx
mov eax, dword [0x2bd46b4]
add eax, 0xa231
mov dword [0x2bd46b4], eax
cmp dword [0x2bd46b4], 0x141
jne 0x421596
mov dword [0x42f1a0], 0xec58acac
mov dword [0x42f1a4], 0xffffffff
jmp 0x4214f7
call fcn.004211b0
jmp dword [0x2bd2234]
Function at 0x401870
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
push dword [ebp + 0x10]
push ebx
call sym.Argon2OptBench.exe_argon2_ctx
add esp, 8
test eax, eax
jne 0x401937
mov esi, dword [ebx + 4]
xor dl, dl
test esi, esi
je 0x401924
mov edi, dword [ebp + 0xc]
cmp esi, 0x20
jb 0x401915
mov edx, dword [ebx]
mov ecx, esi
and ecx, 0xffffffe0
xorps xmm3, xmm3
xorps xmm2, xmm2
nop
movups xmm0, xmmword [eax + edi]
movups xmm1, xmmword [edx + eax]
pxor xmm1, xmm0
movups xmm0, xmmword [edx + eax + 0x10]
por xmm3, xmm1
movups xmm1, xmmword [eax + edi + 0x10]
add eax, 0x20
pxor xmm1, xmm0
por xmm2, xmm1
cmp eax, ecx
jb 0x4018b0
por xmm2, xmm3
movaps xmm0, xmm2
psrldq xmm0, 8
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 4
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 2
por xmm2, xmm0
movups xmm0, xmm2
psrldq xmm0, 1
por xmm2, xmm0
movd edx, xmm2
cmp eax, esi
jae 0x401924
mov ebx, dword [ebx]
mov cl, byte [ebx + eax]
xor cl, byte [eax + edi]
inc eax
or dl, cl
cmp eax, esi
jb 0x401917
movzx eax, dl
dec eax
and eax, 0x100
neg eax
sbb eax, eax
and eax, 0x23
add eax, 0xffffffdd
pop edi
pop esi
pop ebx
pop ebp
ret