joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1003c5c1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push esi
mov esi, dword [ecx + 8]
mov eax, edx
push edi
mov edi, dword [ebp + 8]
xor edx, edx
mov dword [ebp - 4], eax
test edi, edi
jle 0x1003c5f5
push ebx
mov ebx, dword [ecx]
mov al, byte [edx + eax]
xor byte [ebx + esi], al
lea eax, [esi + 1]
xor esi, esi
cmp eax, dword [ecx + 4]
cmovl esi, eax
mov eax, dword [ebp - 4]
inc edx
cmp edx, edi
jl 0x1003c5db
pop ebx
add dword [ecx + 0xc], edi
pop edi
mov dword [ecx + 8], esi
pop esi
leave
ret 4

Function at 0x1003fb92
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
mov ebx, ecx
push esi
push edi
mov edi, edx
mov esi, dword [ebx + 0x88]
mov dword [ebp - 4], edi
test esi, esi
je 0x1003fbc7
mov eax, dword [ebp + 0xc]
xor ecx, ecx
mov dword [eax], esi
mov eax, dword [esi + 0x10]
mov dword [ebx + 0x88], eax
mov eax, dword [esi + 8]
mov dword [esi + 0x10], ecx
mov dword [eax], ecx
mov dword [eax + 4], ecx
jmp 0x1003fc26
movzx eax, word [ebx + 0x8c]
cdq
add eax, 0x28
adc edx, 0
push edx
push eax
call fcn.10036688
mov ecx, dword [ebp + 0xc]
mov esi, eax
mov dword [ecx], esi
test esi, esi
jne 0x1003fc0f
push dword [ebp + 8]
mov ecx, dword [ebp - 4]
mov eax, dword [ebx + 0x98]
dec ecx
mov esi, dword [ebx + 0x3c]
push 0
cdq
push ecx
mov edi, dword [esi]
push edx
push eax
call fcn.100ab1b4
push edx
push eax
push esi
call dword [edi + 0x48]
push 7
pop eax
jmp 0x1003fc34
lea eax, [esi + 0x28]
mov dword [esi + 0x14], ebx
mov dword [esi + 8], eax
push 0x20
pop eax
mov word [esi + 0x1c], ax
xor eax, eax
inc eax
mov word [esi + 0x1e], ax
mov eax, dword [ebp + 8]
mov dword [esi + 4], eax
mov dword [esi + 0x18], edi
inc dword [ebx + 0x78]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x10063a99
Capabilities:
Reference sql statements

Disassembly:
push ebp
mov ebp, esp
push esi
push edi
push dword [ebp + 8]
mov esi, edx
mov edi, ecx
push esi
push esi
push str.SELECT_1_FROM___w_.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name___d_NULL
push edi
call fcn.100675b9
add esp, 0x14
cmp dword [ebp + 8], 0
jne 0x10063aca
push esi
push str.SELECT_1_FROM_temp.sqlite_master_WHERE_name_NOT_LIKE_sqliteX____ESCAPE_X_AND_sql_NOT_LIKE_create_virtual___AND_sqlite_rename_test__Q__sql__type__name__1_NULL
push edi
call fcn.100675b9
add esp, 0xc
pop edi
pop esi
pop ebp
ret 4
Function at 0x1007040e
Capabilities:
Enumerate pe sections

Disassembly:
mov ecx, dword [esp + 8]
push esi
push edi
xor edi, edi
movzx eax, word [ecx + 0x14]
movzx esi, word [ecx + 6]
test esi, esi
lea eax, [eax + ecx + 0x18]
jbe 0x10070449
mov ecx, dword [eax + 8]
test ecx, ecx
jne 0x10070430
mov ecx, dword [eax + 0x10]
mov edx, dword [eax + 0xc]
cmp dword [esp + 0xc], edx
jb 0x10070441
add edx, ecx
cmp dword [esp + 0xc], edx
jb 0x1007044b
inc edi
add eax, 0x28
cmp edi, esi
jb 0x10070426
xor eax, eax
pop edi
pop esi
ret
Function at 0x10070aec
Capabilities:
Inspect section memory permissions

Disassembly:
mov esi, dword [ebp - 0x88]
mov ax, word [ebp - 8]
cmp ax, word [esi + 6]
jne 0x10070ab1
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov esi, 0x60000000
jmp 0x10070ad9
call fcn.100703ce
insb byte es:[edi], dx
out 0x4d, al
push ss
movzx eax, word [ebp - 8]
lea eax, [eax + eax*4]
mov ecx, dword [esi + eax*8 + 0x104]
mov edx, dword [esi + eax*8 + 0x108]
lea eax, [esi + eax*8 + 0xf8]
mov esi, dword [eax + 0x24]
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp + 8], eax
mov eax, ecx
div dword [ebp - 0xac]
cmp eax, dword [ebp + 8]
ja 0x10070b2f
mov edx, esi
mov edi, esi
and edx, 0x20000000
and edi, 0x40000000
and esi, 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x10070b18
or byte [eax + ecx], 1
cmp edi, ebx
je 0x10070b20
or byte [eax + ecx], 2
cmp esi, ebx
je 0x10070b29
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp + 8]
jbe 0x10070b0d
inc dword [ebp - 8]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp - 8]
cmp cx, word [eax + 6]
jbe 0x10070a92
mov esi, dword [ebp + 0xc]
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x10070b7c
dec eax
je 0x10070b73
sub eax, 3
je 0x10070b6a
mov dword [ebp - 4], 0x40
jmp 0x10070b7f
mov dword [ebp - 4], 4
jmp 0x10070b7f
mov dword [ebp - 4], 0x20
jmp 0x10070b7f
mov dword [ebp - 4], ecx
call fcn.100703ce
adc esp, esp
arpl word [esi - 0x7d], bp
jge 0x10070b87
outsb dx, byte [esi]
cmp dword [ebp - 4], 0x40
inc eax
je 0x10070ba6
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push esi
call dword [ebp - 0xc4]
test eax, eax
je 0x10070bd9
add esi, dword [ebp - 0xac]
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x10070b4b
mov eax, dword [ebp - 0x88]
mov esi, dword [eax + 0x28]
add esi, dword [ebp + 0xc]
call fcn.100703ce
inc eax
push cs
fcompi st(3)
push dword [ebp + 0x14]
push 1
push dword [ebp + 0xc]
call esi
mov eax, dword [ebp + 0xc]
jmp 0x10070be7
push 0x8000
push ebx
push dword [ebp + 0xc]
call dword [ebp - 0xc]
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100a03a0
Capabilities:
Delete file

Disassembly:
push 0x34
mov eax, 0x100b1bf9
call fcn.100aaeb4
push ecx
lea ecx, [ebp - 0x40]
call fcn.10004eb1
and dword [ebp - 4], 0
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
call fcn.100a0add
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.10004eea
cmp dword [ebp - 0x14], 7
lea eax, [ebp - 0x28]
cmova eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea ecx, [ebp - 0x28]
mov esi, eax
call fcn.10003549
mov eax, esi
call fcn.100aae69
ret

Function at 0x100a054a
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push 0x34
mov eax, 0x100b1bf9
call fcn.100aaeb4
push ecx
lea ecx, [ebp - 0x40]
call fcn.10004eb1
xor ebx, ebx
lea edx, [ebp - 0x40]
lea ecx, [ebp - 0x28]
mov dword [ebp - 4], ebx
call fcn.100a0add
lea ecx, [ebp - 0x40]
mov byte [ebp - 4], 2
call fcn.10004eea
cmp dword [ebp - 0x14], 7
lea eax, [ebp - 0x28]
cmova eax, dword [ebp - 0x28]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
je 0x100a0598
test al, 0x10
jne 0x100a0598
mov bl, 1
lea ecx, [ebp - 0x28]
call fcn.10003549
mov al, bl
call fcn.100aae69
ret

Function at 0x100a08fe
Capabilities:
Get common file path

Disassembly:
push 0x254
mov eax, 0x100b1cff
call fcn.100aaeb4
mov esi, ecx
mov dword [ebp - 0x25c], esi
xor edi, edi
mov dword [ebp - 4], edi
mov dword [ebp - 0x260], esi
push 0x100b3a5d
mov dword [ebp - 0x258], edi
call fcn.10004eb1
push 0x20a
xor ebx, ebx
mov dword [ebp - 4], edi
lea eax, [ebp - 0x224]
inc ebx
push edi
push eax
mov dword [ebp - 0x258], ebx
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x224]
push eax
push 0x104
call dword [sym.imp.KERNEL32.dll_GetTempPathW]
test eax, eax
je 0x100a09ab
lea eax, [ebp - 0x224]
push eax
lea ecx, [ebp - 0x23c]
call fcn.1000350a
lea edx, [ebp - 0x23c]
mov dword [ebp - 4], ebx
lea ecx, [ebp - 0x254]
call fcn.100a0b5a
push eax
mov ecx, esi
call fcn.1000911b
lea ecx, [ebp - 0x254]
call fcn.10004eea
lea ecx, [ebp - 0x23c]
call fcn.10003549
mov eax, esi
call fcn.100aae69
ret
Function at 0x100a0d74
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
and dword [ebp - 8], 0
lea eax, [ebp - 8]
push ebx
push esi
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
mov ebx, ecx
push eax
push 0x20019
push 0
push 0x100c36d8
push 0x80000000
call edi
mov esi, dword [sym.imp.ADVAPI32.dll_RegCloseKey]
test eax, eax
jne 0x100a0e0b
and dword [ebp - 4], 0
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push ebx
push dword [ebp - 8]
call edi
test eax, eax
jne 0x100a0e00
push 4
pop edi
lea eax, [ebp - 0xc]
mov dword [ebp - 0xc], edi
push eax
lea eax, [ebp - 0x10]
push eax
push 0
push 0
push str.InsecureQI
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100a0e00
cmp dword [ebp - 0xc], edi
jne 0x100a0e00
mov edi, dword [ebp - 0x10]
cmp edi, 3
ja 0x100a0e00
cmp dword [ebp - 4], eax
je 0x100a0e0d
push dword [ebp - 4]
call esi
jmp 0x100a0e0d
cmp dword [ebp - 4], 0
je 0x100a0e0b
push dword [ebp - 4]
call esi
xor edi, edi
cmp dword [ebp - 8], 0
je 0x100a0e18
push dword [ebp - 8]
call esi
mov eax, edi
pop edi
pop esi
pop ebx
leave
ret
Function at 0x100a1110
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
cmp byte [0x100d4cc4], 0
je 0x100a1125
mov eax, dword [0x100d4ccc]
leave
ret
push esi
lea eax, [ebp - 4]
xor esi, esi
push eax
push 0x20019
push esi
push str.SoftwarePoliciesMicrosoftSecurity
push 0x80000001
mov dword [ebp - 4], esi
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100a1173
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x100d4ccc
push esi
push esi
push str.CLSIDInterfaceTest
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100a1173
cmp dword [ebp - 8], 4
je 0x100a11cc
mov eax, dword [ebp - 4]
mov dword [ebp - 4], esi
test eax, eax
je 0x100a1184
push eax
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
lea eax, [ebp - 4]
push eax
push 0x20019
push esi
push str.SoftwareMicrosoftSecurity
push 0x80000001
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
test eax, eax
jne 0x100a11d4
lea eax, [ebp - 8]
mov dword [ebp - 8], 4
push eax
push 0x100d4ccc
push esi
push esi
push str.CLSIDInterfaceTest
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExW]
test eax, eax
jne 0x100a11d4
cmp dword [ebp - 8], 4
jne 0x100a11d4
mov esi, dword [0x100d4ccc]
jmp 0x100a11da
mov dword [0x100d4ccc], esi
cmp dword [ebp - 4], 0
mov al, 1
mov byte [0x100d4cc4], al
je 0x100a11f0
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
leave
ret
Function at 0x100a14bc
Capabilities:
Encode data using xor
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
mov esi, ecx
push edi
push 0x10
mov dword [ebp - 0x10], esi
lea ebx, [esi + 0x20]
mov ecx, ebx
pop edx
mov eax, dword [ecx]
bswap eax
mov dword [ecx], eax
lea ecx, [ecx + 4]
sub edx, 1
jne 0x100a14d2
push 0x40
lea ecx, [esi + 0x28]
pop edx
mov eax, dword [ecx + 0x2c]
xor eax, dword [ecx + 0x18]
xor eax, dword [ecx - 8]
xor eax, dword [ecx]
lea ecx, [ecx + 4]
rol eax, 1
mov dword [ecx + 0x34], eax
sub edx, 1
jne 0x100a14e6
mov eax, dword [esi + 0xc]
mov ecx, dword [esi + 0x1c]
mov edi, dword [esi + 0x14]
mov dword [ebp - 4], eax
mov dword [ebp - 0x20], eax
mov eax, dword [esi + 0x10]
mov dword [ebp - 8], ecx
push 0x14
pop ecx
mov dword [ebp - 0x14], eax
mov eax, dword [esi + 0x18]
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x18], ecx
mov ecx, dword [ebp - 4]
mov dword [ebp - 0xc], eax
jmp 0x100a1530
mov eax, dword [ebp - 0xc]
mov edx, ecx
mov ecx, esi
not ecx
rol edx, 5
and ecx, eax
mov eax, edi
and eax, esi
or ecx, eax
mov eax, dword [ebp - 8]
add edx, ecx
mov ecx, dword [ebp - 0xc]
add edx, dword [ebx]
lea ebx, [ebx + 4]
add eax, edx
mov dword [ebp - 8], ecx
mov edx, edi
mov edi, esi
mov esi, dword [ebp - 4]
rol edi, 0x1e
sub dword [ebp - 0x18], 1
lea ecx, [eax + 0x5a827999]
mov dword [ebp - 0xc], edx
mov dword [ebp - 4], ecx
jne 0x100a152d
mov eax, dword [ebp - 0x10]
mov ebx, esi
add eax, 0x70
mov dword [ebp - 0x14], esi
mov dword [ebp - 0x18], 0x14
mov esi, eax
mov eax, ecx
mov ecx, edx
xor ecx, edi
rol eax, 5
add eax, dword [ebp - 8]
xor ecx, ebx
add ecx, 0x6ed9eba1
mov dword [ebp - 8], edx
mov edx, edi
add ecx, eax
add ecx, dword [esi]
mov edi, ebx
mov ebx, dword [ebp - 4]
lea esi, [esi + 4]
rol edi, 0x1e
sub dword [ebp - 0x18], 1
mov dword [ebp - 4], ecx
jne 0x100a1583
mov eax, dword [ebp - 0x10]
mov esi, edx
add eax, 0xc0
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], 0x14
mov edx, ecx
mov eax, edi
mov ecx, edi
rol edx, 5
add edx, dword [ebp - 8]
or ecx, ebx
and ecx, esi
mov dword [ebp - 8], esi
and eax, ebx
mov esi, edi
or ecx, eax
mov edi, ebx
mov eax, dword [ebp - 0x14]
add ecx, 0x8f1bbcdc
add dword [ebp - 0x14], 4
mov ebx, dword [ebp - 4]
rol edi, 0x1e
add ecx, dword [eax]
add ecx, edx
sub dword [ebp - 0x18], 1
mov dword [ebp - 4], ecx
jne 0x100a15cb
mov eax, dword [ebp - 0x10]
mov edx, esi
add eax, 0x110
mov dword [ebp - 0xc], esi
mov esi, eax
rol ecx, 5
mov eax, edx
xor eax, edi
add ecx, 0xca62c1d6
add ecx, dword [ebp - 8]
xor eax, ebx
add eax, dword [esi]
lea esi, [esi + 4]
mov dword [ebp - 8], edx
add eax, ecx
mov edx, edi
mov ecx, eax
mov edi, ebx
mov ebx, dword [ebp - 4]
rol edi, 0x1e
sub dword [ebp - 0x1c], 1
mov dword [ebp - 4], ecx
jne 0x100a1615
mov esi, dword [ebp - 0x10]
add eax, dword [ebp - 0x20]
add dword [esi + 0x10], ebx
add dword [esi + 0x14], edi
add dword [esi + 0x18], edx
mov dword [esi + 0xc], eax
mov eax, dword [ebp - 8]
add dword [esi + 0x1c], eax
add dword [esi], 0x200
pop edi
adc dword [esi + 4], 0
and dword [esi + 8], 0
pop esi
pop ebx
leave
ret
Function at 0x100a190a
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x100d20c0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, ecx
mov dword [ebp - 0x10], edx
xor ecx, ecx
mov dword [esi], ecx
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], ecx
cmp dword [edi + 0x10], eax
je 0x100a1a4a
cmp dword [edi + 0x10], 0x20
jne 0x100a1a4a
xorps xmm0, xmm0
mov dword [ebp - 0x14], ecx
mov ebx, ecx
mov dword [ebp - 0x18], ecx
movlpd qword [ebp - 0xc], xmm0
mov edx, ecx
cmp dword [edi + 0x14], 0xf
mov ecx, edi
jbe 0x100a1963
mov ecx, dword [edi]
mov cl, byte [ecx + edx]
call fcn.100a185e
cmp al, 0xff
je 0x100a1a4a
shl ebx, 4
movzx eax, al
add ebx, eax
inc edx
mov dword [ebp - 0x1c], ebx
cmp edx, 8
jl 0x100a1959
jmp 0x100a19b3
cmp dword [edi + 0x14], 0xf
mov ecx, edi
jbe 0x100a1990
mov ecx, dword [edi]
mov cl, byte [ecx + edx]
call fcn.100a185e
cmp al, 0xff
je 0x100a1a4a
mov ecx, dword [ebp - 0x14]
shl ecx, 4
movzx eax, al
add cx, ax
inc edx
movzx ecx, cx
mov dword [ebp - 0x14], ecx
cmp edx, 0xc
jl 0x100a1986
cmp edx, 0x10
jae 0x100a19eb
cmp dword [edi + 0x14], 0xf
mov ecx, edi
jbe 0x100a19c7
mov ecx, dword [edi]
mov cl, byte [ecx + edx]
call fcn.100a185e
cmp al, 0xff
je 0x100a1a4a
mov ecx, dword [ebp - 0x18]
shl ecx, 4
movzx eax, al
add cx, ax
inc edx
movzx ecx, cx
mov dword [ebp - 0x18], ecx
cmp edx, 0x10
jl 0x100a19bd
xor bh, bh
mov bl, 1
cmp edx, 0x20
jae 0x100a1a29
lea eax, [ebp - 0xc]
mov dword [ebp - 0x10], eax
xor bl, 1
mov ecx, edi
cmp dword [edi + 0x14], 0xf
jbe 0x100a1a07
mov ecx, dword [edi]
mov cl, byte [ecx + edx]
call fcn.100a185e
shl bh, 4
add bh, al
test bl, bl
je 0x100a1a23
mov eax, dword [ebp - 0x10]
mov byte [eax], bh
xor bh, bh
inc eax
mov dword [ebp - 0x10], eax
inc edx
cmp edx, 0x20
jl 0x100a19fa
mov eax, dword [ebp - 0x1c]
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 8]
mov dword [esi], eax
mov eax, dword [ebp - 0x14]
mov word [esi + 4], ax
mov eax, dword [ebp - 0x18]
mov word [esi + 6], ax
mov dword [esi + 8], ecx
mov dword [esi + 0xc], edx
jmp 0x100a1a50
mov eax, dword [ebp - 0x10]
mov byte [eax], 1
mov ecx, dword [ebp - 4]
mov eax, esi
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100a9985
leave
ret 4
Function at 0x100a4343
Capabilities:
Hash data using sha1

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x194
mov eax, dword [0x100d20c0]
xor eax, esp
mov dword [esp + 0x190], eax
push ebx
xor ebx, ebx
mov dword [esp + 0x1c], 0x67452301
push esi
xorps xmm0, xmm0
mov dword [esp + 0x24], 0xefcdab89
mov edx, ebx
movlpd qword [esp + 0x14], xmm0
push edi
mov edi, ecx
mov dword [esp + 0x20], edx
mov dword [esp + 0x2c], 0x98badcfe
mov esi, ebx
mov dword [esp + 0x30], 0x10325476
mov dword [esp + 0x34], 0xc3d2e1f0
mov al, byte [esi + 0x100b6420]
mov byte [esp + edx + 0x38], al
mov edx, dword [esp + 0x20]
inc edx
mov dword [esp + 0x20], edx
cmp edx, 0x40
jne 0x100a43c2
lea ecx, [esp + 0x18]
call fcn.100a14bc
mov edx, dword [esp + 0x20]
inc esi
cmp esi, 0x10
jne 0x100a439d
cmp byte [edi], bl
je 0x100a4437
mov dword [esp + 0x14], edi
mov esi, ebx
lea ecx, [esp + 0x17c]
lea ecx, [ecx + esi*2]
lea edx, [esp + 0x14]
call fcn.100a1671
add esi, eax
mov eax, dword [esp + 0x14]
mov al, byte [eax]
mov byte [esp + 0x13], al
test al, al
je 0x100a43fa
cmp esi, 0xf
jb 0x100a43d2
push ebx
push ebx
push ebx
push esi
lea eax, [esp + 0x18c]
push eax
push esi
push eax
push 0xa00
push 0x100b371c
call dword [sym.imp.KERNEL32.dll_LCMapStringEx]
lea eax, [esi + esi]
push eax
lea eax, [esp + 0x180]
push eax
lea ecx, [esp + 0x20]
call fcn.100a1483
cmp byte [esp + 0x13], bl
jne 0x100a43d0
mov edx, dword [esp + 0x20]
mov esi, edx
xor edi, edi
shl esi, 3
add esi, dword [esp + 0x18]
adc edi, dword [esp + 0x1c]
mov byte [esp + edx + 0x38], 0x80
jmp 0x100a4451
mov byte [esp + eax + 0x38], bl
mov eax, dword [esp + 0x20]
inc eax
mov dword [esp + 0x20], eax
cmp eax, 0x40
jne 0x100a446c
lea ecx, [esp + 0x18]
call fcn.100a14bc
mov eax, dword [esp + 0x20]
cmp eax, 0x38
jne 0x100a444d
bswap esi
bswap edi
lea ecx, [esp + 0x18]
mov dword [esp + 0x70], edi
mov dword [esp + 0x74], esi
call fcn.100a14bc
mov eax, dword [esp + ebx*4 + 0x24]
bswap eax
mov dword [esp + ebx*4 + 0x24], eax
inc ebx
cmp ebx, 5
jne 0x100a4486
mov al, byte [esp + 0x2b]
lea esi, [esp + 0x24]
and al, 0xf
mov ecx, dword [esp + 0x19c]
or al, 0x50
mov byte [esp + 0x2b], al
mov eax, dword [ebp + 8]
mov edi, eax
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
pop edi
pop esi
pop ebx
xor ecx, esp
call fcn.100a9985
mov esp, ebp
pop ebp
ret 4
Function at 0x100a5750
Capabilities:
Resolve function by parsing pe exports

Disassembly:
push esi
push edi
test ecx, ecx
je 0x100a579e
cmp dword [ecx + 0x20], 0
je 0x100a579e
cmp dword [ecx + 0x24], 0
je 0x100a579e
mov eax, dword [ecx + 0x1c]
test eax, eax
je 0x100a579e
cmp dword [eax], ecx
jne 0x100a579e
mov eax, dword [eax + 4]
cmp eax, 0x2a
je 0x100a579a
cmp eax, 0x39
je 0x100a579a
cmp eax, 0x45
je 0x100a579a
cmp eax, 0x49
je 0x100a579a
cmp eax, 0x5b
je 0x100a579a
cmp eax, 0x67
je 0x100a579a
cmp eax, 0x71
je 0x100a579a
cmp eax, 0x29a
jne 0x100a579e
xor eax, eax
jmp 0x100a57a3
mov eax, 1
mov edx, ecx
mov esi, 0x1c
lea edi, [esi + edx]
test eax, eax
je 0x100a57b7
pop edi
lea eax, [esi - 0x1e]
pop esi
ret
mov esi, dword [edi]
mov dword [ecx + 0x14], 0
mov dword [ecx + 8], 0
mov dword [ecx + 0x18], 0
mov dword [ecx + 0x2c], 2
mov edx, dword [esi + 0x18]
mov eax, dword [esi + 8]
mov dword [esi + 0x14], 0
mov dword [esi + 0x10], eax
test edx, edx
jns 0x100a57ee
neg edx
mov dword [esi + 0x18], edx
cmp edx, 2
jne 0x100a57f8
lea eax, [edx + 0x37]
jmp 0x100a5809
push ebx
mov ebx, 0x2a
test edx, edx
mov eax, 0x71
cmovne eax, ebx
pop ebx
mov dword [esi + 4], eax
xor eax, eax
cmp edx, 2
setne al
mov dword [ecx + 0x30], eax
lea eax, [esi + 0x94]
mov dword [esi + 0xb18], eax
mov ecx, esi
lea eax, [esi + 0x988]
mov dword [esi + 0x28], 0
mov dword [esi + 0xb24], eax
lea eax, [esi + 0xa7c]
mov dword [esi + 0xb30], eax
xor eax, eax
mov dword [esi + 0xb20], 0x100c6288
mov dword [esi + 0xb2c], 0x100c68c4
mov dword [esi + 0xb38], 0x100c6898
mov word [esi + 0x16b8], ax
mov dword [esi + 0x16bc], eax
call fcn.100a7aa8
mov esi, dword [edi]
xor edx, edx
mov eax, dword [esi + 0x2c]
mov ecx, dword [esi + 0x4c]
add eax, eax
mov dword [esi + 0x3c], eax
mov eax, dword [esi + 0x44]
mov word [eax + ecx*2 - 2], dx
mov eax, dword [esi + 0x4c]
lea eax, [eax*2 - 2]
push eax
push edx
push dword [esi + 0x44]
call sub.VCRUNTIME140.dll_memset
mov eax, dword [esi + 0x84]
add esp, 0xc
lea ecx, [eax + eax*2]
movzx eax, word [ecx*4 + 0x100c5dc2]
mov dword [esi + 0x80], eax
movzx eax, word [ecx*4 + 0x100c5dc0]
mov dword [esi + 0x8c], eax
movzx eax, word [ecx*4 + 0x100c5dc4]
mov dword [esi + 0x90], eax
xor eax, eax
movzx ecx, word [ecx*4 + 0x100c5dc6]
pop edi
mov dword [esi + 0x7c], ecx
mov dword [esi + 0x6c], 0
mov dword [esi + 0x5c], 0
mov dword [esi + 0x74], 0
mov dword [esi + 0x16b4], 0
mov dword [esi + 0x78], 2
mov dword [esi + 0x60], 2
mov dword [esi + 0x68], 0
mov dword [esi + 0x48], 0
pop esi
ret
Function at 0x4287df
Capabilities:
Get keyboard layout

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
push ebx
push esi
push edi
cmp dword [0x45aa24], 0
je 0x428816
push 0
call dword [sym.imp.USER32.dll_GetKeyboardLayout]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 4]
push eax
call main
add esp, 4
jmp 0x42882f
call main
mov dword [ebp - 8], eax
mov eax, dword [ebp - 8]
push eax
call main
add esp, 4
jmp 0x42882f
pop edi
pop esi
pop ebx
leave
ret

Function at 0x4372c1
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x4372d0
pop dword [ebp - 0x2c]
mov eax, 0x4372d0
sub dword [ebp - 0x2c], eax
push 0x40
push 0x1000
push 0x4ee08
push 0
mov eax, 0xc0cc673b
add eax, 0x3f7a009d
add eax, dword [ebp - 0x2c]
call dword [eax]
mov ecx, 0x4cef
mov edx, eax
mov esi, 0xe6693be3
add esi, 0x19dfa41d
add esi, dword [ebp - 0x2c]
mov ebx, 0x61249f9e
add ebx, 0x8ae735f6
add dword [ebp - 0x1c], edx
mov edi, dword [esi]
add dword [ebp - 4], ebx
add edi, ebx
xor dword [ebp - 4], 0xaf7ae916
mov dword [edx], edi
add dword [ebp - 0x14], 0x109efda7
add edx, 4
add esi, 0x9ee00ae1
add esi, 0x611ff523
loop 0x437324
add eax, 0x1268f
mov ebx, eax
add eax, 0x2dd3c571
sub eax, 0x2dd3c56c
mov ecx, 0xad48cf3a
sub ecx, 0xad08cf3a
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret

Function at 0x44c8c0
Capabilities:
Move file

Disassembly:
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
push eax
push ecx
call dword [sym.imp.kernel32.dll_MoveFileA]
test eax, eax
mov eax, 0
jne 0x44c8df
call dword [sym.imp.kernel32.dll_GetLastError]
test eax, eax
je 0x44c8f2
push eax
call fcn.0044d700
add esp, 4
mov eax, 0xffffffff
ret
xor eax, eax
ret