joyce8/EMBER2024-capa huggingface dataset:
Function at 0x2a82cc8b
Capabilities:
Encode data using base64

Disassembly:
push 0x14
mov eax, 0x2a84f345
call fcn.2a8015aa
mov edi, dword [ebp + 0xc]
xor ecx, ecx
mov dword [ebp - 0x1c], ecx
mov dword [ebp - 0x14], edi
cmp dword [edi + 0x14], 0x10
jb 0x2a82ccad
mov eax, dword [edi]
mov dword [ebp - 0x14], eax
mov esi, dword [ebp + 8]
mov ebx, dword [edi + 0x10]
mov dword [ebp - 0x10], ebx
mov dword [ebp - 0x20], esi
mov dword [esi + 0x10], ecx
mov dword [esi + 0x14], 0xf
mov byte [esi], cl
push ecx
mov eax, ebx
mov dword [ebp - 4], ecx
shl eax, 2
push 3
pop ecx
cdq
idiv ecx
mov dword [ebp - 0x1c], 1
add eax, ecx
mov ecx, esi
push eax
call fcn.2a8359ac
cmp dword [esi + 0x14], 0x10
mov edx, esi
jb 0x2a82ccef
mov edx, dword [esi]
xor ecx, ecx
test ebx, ebx
jle 0x2a82cda0
mov esi, dword [ebp - 0x14]
movzx eax, byte [esi + ecx]
shr eax, 2
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx], al
mov bl, byte [esi + ecx]
and bl, 3
shl bl, 4
inc ecx
cmp ecx, dword [ebp - 0x10]
jge 0x2a82cd22
mov al, byte [esi + ecx]
shr al, 4
or bl, al
movzx eax, bl
mov al, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov byte [edx + 1], al
mov eax, dword [ebp - 0x10]
cmp ecx, eax
jge 0x2a82cd63
cmp dword [edi + 0x14], 0x10
mov ebx, edi
jb 0x2a82cd3f
mov ebx, dword [edi]
mov bl, byte [ebx + ecx]
and bl, 0xf
shl bl, 2
inc ecx
cmp ecx, eax
jge 0x2a82cd55
mov al, byte [esi + ecx]
shr al, 6
or bl, al
movzx eax, bl
mov bl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov eax, dword [ebp - 0x10]
jmp 0x2a82cd65
mov bl, 0x3d
lea esi, [edx + 3]
mov byte [edx + 2], bl
mov dword [ebp - 0x18], esi
mov edx, esi
mov esi, dword [ebp - 0x14]
inc edx
cmp ecx, eax
jge 0x2a82cd8a
movzx eax, byte [esi + ecx]
and eax, 0x3f
mov bl, byte [eax + str.ABCDEFGHIJKLMNOPQRSTUVWXYZabcdefghijklmnopqrstuvwxyz0123456789_]
mov eax, dword [ebp - 0x10]
jmp 0x2a82cd8c
mov bl, 0x3d
mov esi, dword [ebp - 0x18]
inc ecx
mov byte [esi], bl
mov esi, dword [ebp - 0x14]
cmp ecx, eax
jl 0x2a82ccfc
mov esi, dword [ebp - 0x20]
cmp dword [esi + 0x14], 0x10
mov eax, esi
jb 0x2a82cdaa
mov eax, dword [esi]
push 0
sub edx, eax
mov ecx, esi
push edx
call fcn.2a8359ac
mov eax, esi
call fcn.2a80187a
ret

Function at 0x2a82f2c5
Capabilities:
Get hostname

Disassembly:
push 0x448
mov eax, 0x2a84f81b
call fcn.2a84a907
mov esi, dword [ebp + 8]
lea eax, [ebp - 0x410]
mov edi, 0x400
mov dword [ebp - 0x450], esi
push edi
xor ebx, ebx
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
lea eax, [ebp - 0x410]
push edi
push eax
call dword [sym.imp.WS2_32.dll_gethostname]
test eax, eax
jne 0x2a82f329
lea eax, [ebp - 0x410]
mov dword [esi + 0x10], ebx
mov dword [esi + 0x14], 0xf
mov ecx, esi
push eax
mov byte [esi], bl
call fcn.2a805678
mov eax, esi
call fcn.2a84a8e5
ret
push 0x93
lea ecx, [ebp - 0x454]
call fcn.2a8359ac
lea ecx, [ebp - 0x44c]
mov dword [ebp - 4], ebx
push ecx
mov ecx, eax
call fcn.2a827d86
push eax
lea ecx, [ebp - 0x434]
mov byte [ebp - 4], 1
call fcn.2a821de4
push 0x2a85dc48
lea eax, [ebp - 0x434]
push eax
call sub.VCRUNTIME140.dll__CxxThrowException
int3
Function at 0x2a8359ac
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x2c
pushal
call 0x2a8359bb
pop dword [ebp - 0x1c]
mov eax, 0x4545cc68
add eax, 0xe53d8d53
sub dword [ebp - 0x1c], eax
mov dword [ebp - 0x2c], 0x3302541
sub dword [ebp - 0x2c], 0xb4dddff6
mov dword [ebp - 0x28], 0xac1e110
sub dword [ebp - 0x28], 0xd88e94cb
mov dword [ebp - 0x24], 0x72ee8a0c
add dword [ebp - 0x24], 0xd95dba22
mov dword [ebp - 0x20], 0x1d01d329
sub dword [ebp - 0x20], 0x1d01d329
lea eax, [ebp - 0x2c]
push eax
mov eax, 0xff342909
add eax, 0x2b50f83b
add eax, dword [ebp - 0x1c]
call dword [eax]
mov dword [ebp - 0x2c], 0xb4e38989
sub dword [ebp - 0x2c], 0x40712033
mov dword [ebp - 0x28], 0xe845287f
sub dword [ebp - 0x28], 0xa6d8c70a
mov dword [ebp - 0x24], 0x2323ba9b
add dword [ebp - 0x24], 0x404bb1d1
mov dword [ebp - 0x20], 0x940bace0
sub dword [ebp - 0x20], 0x940bace0
lea ebx, [ebp - 0x2c]
push ebx
push eax
mov eax, 0x42f2d43b
sub eax, 0x186db2ff
add eax, dword [ebp - 0x1c]
call dword [eax]
push 0x40
push 0x1000
push 0x44b33
push 0
call eax
mov ecx, 0xdebd9ec4
add ecx, 0x2142930b
mov edi, eax
mov ebx, 0xa9bed359
sub ebx, 0x7f36e959
add ebx, dword [ebp - 0x1c]
mov edx, 0x9ad51178
add dword [ebp - 0x18], ebx
mov esi, dword [ebx]
xor dword [ebp - 0x14], ebx
add esi, edx
add dword [ebp - 0x18], 0x5cbc5fbd
mov dword [edi], esi
add dword [ebp - 0xc], 0x819065f2
add edi, 0x169c97db
sub edi, 0x169c97d7
add ebx, 0x920faf71
sub ebx, 0x920faf6d
loop 0x2a835ad7
add eax, 0xd66af113
add eax, 0x2995c8fc
xor ebx, ebx
add ebx, eax
add eax, 0x122084f9
add eax, 0xeddf7b0c
mov ecx, 0xdc836f14
add ecx, 0x4dfc90ec
add ecx, dword [ebp - 0x1c]
call ebx
leave
ret
Function at 0x2a84a76f
Capabilities:
Create process on windows

Disassembly:
push 0x48
mov eax, 0x2a851e75
call fcn.2a8015aa
mov edi, ecx
push 0x44
pop esi
push esi
xor ebx, ebx
lea eax, [ebp - 0x54]
push ebx
push eax
call sub.VCRUNTIME140.dll_memset
push 0x10
mov dword [ebp - 0x54], esi
call fcn.2a8359ac
mov esi, eax
add esp, 0x10
mov dword [ebp - 0x10], esi
mov dword [ebp - 4], ebx
test esi, esi
je 0x2a84a7b4
push 0x10
push ebx
push esi
call sub.VCRUNTIME140.dll_memset
add esp, 0xc
jmp 0x2a84a7b6
mov esi, ebx
or dword [ebp - 4], 0xffffffff
mov ecx, edi
mov dword [edi + 0x24], esi
call fcn.2a849b77
push dword [edi + 0x24]
lea ecx, [ebp - 0x54]
push ecx
push ebx
push ebx
push ebx
push ebx
push ebx
push ebx
push eax
push ebx
call dword [sym.imp.kernel32.dll_CreateProcessW]
call fcn.2a80187a
ret
Function at 0x1012507
Capabilities:
Query or enumerate registry value

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
mov eax, 0x200c
call fcn.01017ee0
mov eax, dword [0x101f128]
push esi
push edi
mov edi, dword [ebp + 8]
xor esi, esi
push esi
push esi
push esi
push esi
mov dword [ebp - 4], eax
lea eax, [ebp - 0x2008]
push eax
push esi
push esi
push esi
push esi
push esi
push esi
push edi
mov dword [ebp - 0x2008], esi
call dword [sym.imp.ADVAPI32.dll_RegQueryInfoKeyW]
test eax, eax
jne 0x1012584
cmp dword [ebp - 0x2008], 1
jne 0x1012588
push esi
push esi
push esi
push esi
lea eax, [ebp - 0x200c]
push eax
lea eax, [ebp - 0x2004]
push eax
push esi
push edi
mov dword [ebp - 0x200c], 0x1000
call dword [sym.imp.ADVAPI32.dll_RegEnumValueW]
test eax, eax
jne 0x1012584
cmp word [ebp - 0x2004], si
je 0x1012584
inc eax
jmp 0x1012594
xor eax, eax
jmp 0x1012594
xor eax, eax
cmp eax, dword [ebp - 0x2008]
sbb eax, eax
neg eax
mov ecx, dword [ebp - 4]
pop edi
pop esi
jmp 0x11e206a

Function at 0x1012e2e
Capabilities:
Get user security identifier

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
xor ebx, ebx
push esi
mov esi, dword [ebp + 0xc]
cmp esi, ebx
mov dword [ebp - 4], ebx
mov dword [ebp - 8], ebx
jne 0x1012e51
mov eax, 0x80004003
jmp 0x1012f03
cmp dword [ebp + 8], ebx
jne 0x1012e60
mov eax, 0x80070057
jmp 0x1012f03
push edi
mov edi, dword [sym.imp.ADVAPI32.dll_LookupAccountNameW]
lea eax, [ebp - 0xc]
push eax
lea eax, [ebp - 4]
push eax
push ebx
lea eax, [ebp - 8]
push eax
push ebx
push dword [ebp + 8]
mov dword [esi], ebx
push ebx
call edi
call dword [sym.imp.KERNEL32.dll_GetLastError]
cmp eax, 0x7a
je 0x1012e98
cmp eax, ebx
jle 0x1012f02
and eax, 0xffff
or eax, 0x80070000
jmp 0x1012f02
mov eax, dword [ebp - 4]
add eax, eax
push eax
call sub.msvcrt.dll_void____cdecl_operator_new_unsigned_int_
cmp eax, ebx
pop ecx
mov dword [ebp + 0xc], eax
jne 0x1012eb2
mov eax, 0x8007000e
jmp 0x1012f02
push dword [ebp - 8]
call dword [sym.imp.msvcrt.dll_malloc]
cmp eax, ebx
pop ecx
mov dword [esi], eax
je 0x1012ef2
lea ecx, [ebp - 0xc]
push ecx
lea ecx, [ebp - 4]
push ecx
push dword [ebp + 0xc]
lea ecx, [ebp - 8]
push ecx
push eax
push dword [ebp + 8]
push ebx
call edi
test eax, eax
jne 0x1012ef7
call fcn.01011087
push dword [esi]
mov edi, eax
call dword [sym.imp.msvcrt.dll_free]
mov dword [esi], ebx
pop ecx
mov ebx, edi
jmp 0x1012ef7
mov ebx, 0x8007000e
push dword [ebp + 0xc]
call fcn.01017c44
pop ecx
mov eax, ebx
pop edi
pop esi
pop ebx
leave
ret 8
Function at 0x62a630
Capabilities:
Packed with generic packer

Disassembly:
pushal
mov esi, section.UPX1
lea edi, [esi - 0x16e000]
lea eax, [edi + 0x1daf24]
push dword [eax]
mov dword [eax], 0x12a41fa4
push eax
push edi
jmp 0x62a65a
mov al, byte [esi]
inc esi
mov byte [edi], al
inc edi
add ebx, ebx
jne 0x62a661
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x62a650
mov eax, 1
add ebx, ebx
jne 0x62a673
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
add ebx, ebx
jae 0x62a684
jne 0x62a6a3
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x62a6a3
dec eax
add ebx, ebx
jne 0x62a690
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc eax, eax
jmp 0x62a668
add ebx, ebx
jne 0x62a69f
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
jmp 0x62a6f5
xor ecx, ecx
sub eax, 3
jb 0x62a6bb
shl eax, 8
mov al, byte [esi]
inc esi
xor eax, 0xffffffff
je 0x62a72a
sar eax, 1
mov ebp, eax
jmp 0x62a6c6
add ebx, ebx
jne 0x62a6c6
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x62a694
inc ecx
add ebx, ebx
jne 0x62a6d4
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jb 0x62a694
add ebx, ebx
jne 0x62a6e1
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
adc ecx, ecx
add ebx, ebx
jae 0x62a6d6
jne 0x62a6f2
mov ebx, dword [esi]
sub esi, 0xfffffffc
adc ebx, ebx
jae 0x62a6d6
add ecx, 2
cmp ebp, 0xfffffb00
adc ecx, 2
lea edx, [edi + ebp]
cmp ebp, 0xfffffffc
jbe 0x62a714
mov al, byte [edx]
inc edx
mov byte [edi], al
inc edi
dec ecx
jne 0x62a706
jmp 0x62a656
mov eax, dword [edx]
add edx, 4
mov dword [edi], eax
add edi, 4
sub ecx, 4
ja 0x62a714
add edi, ecx
jmp 0x62a656
pop esi
pop edi
pop eax
mov dword [edi], eax
mov edi, esi
mov ecx, 0xb441
mov al, byte [edi]
inc edi
sub al, 0xe8
cmp al, 1
ja 0x62a736
cmp byte [edi], 0x22
jne 0x62a736
mov eax, dword [edi]
mov bl, byte [edi + 4]
shr ax, 8
rol eax, 0x10
xchg ah, al
sub eax, edi
sub bl, 0xe8
add eax, esi
mov dword [edi], eax
add edi, 5
mov al, bl
loop 0x62a73b
lea edi, [esi + 0x215000]
mov eax, dword [edi]
or eax, eax
je 0x62a7b3
mov ebx, dword [edi + 4]
lea eax, [eax + esi + 0x23c2d8]
add ebx, esi
push eax
add edi, 8
call dword [esi + 0x23c460]
xchg ebp, eax
mov al, byte [edi]
inc edi
or al, al
je 0x62a768
mov ecx, edi
jns 0x62a797
movzx eax, word [edi]
inc edi
push eax
inc edi
mov ecx, 0xaef24857
push edi
dec eax
repne scasb al, byte es:[edi]
push ebp
call dword [esi + 0x23c468]
or eax, eax
je 0x62a7ad
mov dword [ebx], eax
add ebx, 4
jmp 0x62a785
call dword [esi + 0x23c464]
add edi, 4
lea ebx, [esi - 4]
xor eax, eax
mov al, byte [edi]
inc edi
or eax, eax
je 0x62a7e4
cmp al, 0xef
ja 0x62a7d7
add ebx, eax
mov eax, dword [ebx]
xchg ah, al
rol eax, 0x10
xchg ah, al
add eax, esi
mov dword [ebx], eax
jmp 0x62a7b9
and al, 0xf
shl eax, 0x10
mov ax, word [edi]
add edi, 2
jmp 0x62a7c6
mov ebp, dword [esi + 0x23c46c]
lea edi, [esi - 0x1000]
mov ebx, 0x1000
push eax
push esp
push 4
push ebx
push edi
call ebp
lea eax, [edi + 0x237]
and byte [eax], 0x7f
and byte [eax + 0x28], 0x7f
pop eax
push eax
push esp
push eax
push ebx
push edi
call ebp
pop eax
popal
lea eax, [esp - 0x80]
push 0
cmp esp, eax
jne 0x62a818
sub esp, 0xffffff80
jmp 0x549a8b
Function at 0x401cb8
Capabilities:
Manipulate console buffer

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov al, byte [ebp + 8]
cmp al, 7
jb 0x401d0d
sub al, 7
je 0x401d81
dec al
je 0x401cdb
sub al, 2
je 0x401d05
sub al, 3
je 0x401cf7
jmp 0x401d0d
mov eax, dword [0x406230]
cmp eax, dword [0x4060d0]
jle 0x401d81
dec dword [0x406230]
jmp 0x401d81
mov edi, dword [0x4060d0]
mov dword [0x406230], edi
jmp 0x401d81
inc dword [0x406220]
jmp 0x401d81
mov word [ebp - 8], 1
mov word [ebp - 6], 1
mov word [ebp - 0xc], 0
mov word [ebp - 0xa], 0
movzx ax, byte [ebp + 8]
mov word [ebp - 4], ax
movzx ax, byte [0x4061b0]
mov word [ebp - 2], ax
mov eax, dword [0x406230]
dec eax
mov word [ebp - 0x14], ax
mov eax, dword [0x406220]
dec eax
mov word [ebp - 0x12], ax
mov eax, dword [0x406230]
dec eax
mov word [ebp - 0x10], ax
mov eax, dword [0x406220]
dec eax
mov word [ebp - 0xe], ax
lea edi, [ebp - 0x14]
push edi
push dword [ebp - 0xc]
push dword [ebp - 8]
lea eax, [ebp - 4]
push eax
push dword [0x406120]
call sub.kernel32.dll_WriteConsoleOutputA
inc dword [0x406230]
mov eax, dword [0x406230]
cmp eax, dword [0x4060c0]
jle 0x401daf
mov edi, dword [0x4060d0]
mov dword [0x406230], edi
inc dword [0x406220]
jmp 0x401daf
push 1
call fcn.00401e18
dec dword [0x406220]
mov eax, dword [0x406220]
cmp eax, dword [0x4060e0]
jg 0x401da2
leave
ret 4
Function at 0x1000f672
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
pushal
call 0x1000f681
pop dword [ebp - 8]
mov eax, 0x59de15fc
add eax, 0xb622e085
sub dword [ebp - 8], eax
mov dword [ebp - 0x18], 0xc47ca64e
add dword [ebp - 0x18], 0x89d59efd
mov dword [ebp - 0x14], 0x3a5df835
add dword [ebp - 0x14], 0xf7d55410
mov dword [ebp - 0x10], 0xb0953838
add dword [ebp - 0x10], 0x9bb70bf6
mov dword [ebp - 0xc], 0x36f8030f
sub dword [ebp - 0xc], 0x36f8030f
lea eax, [ebp - 0x18]
push eax
mov eax, 0x3023fb59
add eax, 0xdfe125b7
add eax, dword [ebp - 8]
call dword [eax]
mov dword [ebp - 0x18], 0xbc2bf741
add dword [ebp - 0x18], 0xb8467215
mov dword [ebp - 0x14], 0xe8904b17
add dword [ebp - 0x14], 0x58dc165e
mov dword [ebp - 0x10], 0x5fe9125d
add dword [ebp - 0x10], 0x3865a0f
mov dword [ebp - 0xc], 0x2106563d
add dword [ebp - 0xc], 0xdef9a9c3
lea ebx, [ebp - 0x18]
push ebx
push eax
mov eax, 0x9529cb7
add eax, 0x6b2838d
add eax, dword [ebp - 8]
call dword [eax]
push 0x40
push 0x1000
push 0x5d14a
push 0
call eax
mov ecx, 0xd77662d7
sub ecx, 0xd77613f1
xor ebx, ebx
add ebx, eax
mov edi, 0x10061000
add edi, dword [ebp - 8]
mov edx, 0xaaa66e33
add dword [ebp - 4], 0x8eb0f354
mov esi, dword [edi]
add dword [ebp - 4], edx
xor esi, edx
xor dword [ebp - 4], ebx
mov dword [ebx], esi
xor dword [ebp - 4], 0x3f48b5cb
add ebx, 0xc40b5914
sub ebx, 0xc40b5910
add edi, 4
loop 0x1000f799
add eax, 0xa806164f
sub eax, 0xa804e7e4
xor ebx, ebx
add ebx, eax
add eax, 0x6ea89c29
add eax, 0x915763dc
mov ecx, 0xe15fdec8
add ecx, 0x2ea02138
add ecx, dword [ebp - 8]
call ebx
leave
ret
Function at 0x10030e10
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10110b21
mov eax, dword fs:[0]
push eax
push ecx
mov eax, dword [0x1013d040]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov eax, dword [edx]
xorps xmm0, xmm0
mov dword [ecx + 0xc], 0
mov dword [ecx + 0x14], 0
mov dword [ecx + 0x30], 0
mov dword [ecx + 0x34], 0
mov dword [ecx + 0x38], 0
mov dword [ecx + 0x3c], 0
mov dword [ecx + 0x40], 0
mov dword [ecx + 0x44], 0
mov dword [ecx + 0x48], 0
mov dword [ecx + 0x4c], 0
mov dword [ecx + 0x50], 0
mov dword [ecx + 0x54], 0
mov dword [ecx + 0x58], 0
mov dword [ecx + 0x5c], 0
mov dword [ecx + 0x60], 0
mov dword [ecx + 0x64], 0
mov dword [ecx + 0x68], 0
mov dword [ecx + 0x70], 0
mov dword [ecx + 0x74], 0
mov dword [ecx + 0x78], 0
mov dword [ecx + 0x7c], 0
mov dword [ecx + 0x80], 0
mov dword [ecx + 0x84], 0
movups xmmword [ecx + 0x90], xmm0
mov dword [ecx + 0xa0], 0
mov dword [ecx + 0xa4], 0xf
mov dword [ebp - 0x10], ecx
mov byte [ecx + 0x90], 0
mov dword [ebp - 4], 0
movups xmmword [ecx + 0xa8], xmm0
mov dword [ecx + 0xb8], 0
mov dword [ecx + 0xbc], 0xf
mov byte [ecx + 0xa8], 0
mov byte [ebp - 4], 1
mov word [ecx + 0xc1], 0
mov byte [ecx + 0xc3], 0
mov dword [ecx + 0xc0], 0
mov dword [ecx + 0x400], 0
mov dword [ecx + 0x404], 0
mov dword [ecx + 0x408], 0
mov dword [ecx + 0x40c], 0
mov dword [ecx + 0x410], 0
mov dword [ecx + 0x414], 0
mov dword [ecx + 0x418], 0
mov dword [ecx + 0x41c], 0
mov byte [ecx + 0x424], 0
push eax
mov byte [ecx + 0x3428], 0
mov dword [ecx + 0x342c], 0
mov dword [ecx + 0x3430], 0
mov dword [ecx + 0x3434], 0
mov dword [ecx + 0x3438], 0
mov dword [ecx + 0x343c], 0
mov dword [ecx + 0x3440], 0
mov dword [ecx + 0x3444], 0
mov dword [ecx + 0x3448], 0
mov dword [ecx + 0x344c], 0
mov byte [ecx + 0x345d], 0
mov byte [ecx + 0x3468], 0
mov byte [ecx + 0x3754], 0
mov dword [ecx + 0x3758], 0
mov dword [ecx + 0x375c], 0
mov dword [ecx + 0x3760], 0
mov dword [ecx + 0x3764], 0
mov dword [ecx + 0x3768], 0
mov dword [ecx + 0x376c], 0
mov byte [ecx + 0x3774], 0
mov dword [ecx + 0x3784], 0
mov byte [ecx + 0x378a], 0
mov dword [ecx + 0x378c], 0
mov dword [ecx + 0x3790], 0
call fcn.10026df0
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
mov esp, ebp
pop ebp
ret
Function at 0x100313e0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebp + 8]
push ebx
push esi
mov dword [ebp - 0x10], eax
mov ebx, ecx
dec eax
push edi
mov edi, edx
mov dword [ebp - 0x14], eax
mov edx, dword [ebp + 0xc]
mov esi, edi
sar eax, 1
mov ecx, edi
mov dword [ebp - 4], edx
mov dword [ebp - 8], esi
mov dword [ebp - 0xc], eax
cmp edi, eax
jge 0x1003143e
nop dword [eax]
lea esi, [ecx + ecx]
push dword [ebx + esi*4 + 4]
push dword [ebx + esi*4 + 8]
call fcn.1002a370
movzx ecx, al
xor ecx, 1
inc ecx
add ecx, esi
mov eax, dword [ebx + ecx*4]
mov dword [ebx + edi*4], eax
mov edi, ecx
mov eax, dword [ebp - 0xc]
cmp ecx, eax
jl 0x10031410
mov edx, dword [ebp - 4]
mov esi, dword [ebp - 8]
mov edi, ecx
cmp ecx, eax
jne 0x10031455
mov eax, dword [ebp - 0x10]
test al, 1
jne 0x10031455
mov eax, dword [ebx + eax*4 - 4]
mov edi, dword [ebp - 0x14]
mov dword [ebx + ecx*4], eax
cmp esi, edi
jge 0x100314a0
nop dword [eax]
push dword [edx]
lea esi, [edi - 1]
sar esi, 1
push dword [ebx + esi*4]
call fcn.1002a370
test al, al
je 0x10031491
mov eax, dword [ebx + esi*4]
mov edx, dword [ebp - 4]
mov dword [ebx + edi*4], eax
mov edi, esi
cmp dword [ebp - 8], esi
jl 0x10031460
mov eax, edx
mov eax, dword [eax]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov eax, dword [eax]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [edx]
mov dword [ebx + edi*4], eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10037cc0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x28
mov eax, dword [0x1013d040]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
mov esi, ecx
cmp dword [esi + 0x38], 0
je 0x10037d7c
cmp byte [esi + 0x3d], 0
je 0x10037d7c
mov eax, dword [esi]
push edi
push 0xffffffffffffffff
call dword [eax + 0xc]
cmp eax, 0xffffffff
je 0x10037d6a
mov ecx, dword [esi + 0x38]
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::unshift_struct__Mbstatet___char___char___char___const]
sub eax, 0
je 0x10037d31
sub eax, 1
je 0x10037d35
sub eax, 2
jne 0x10037d6a
mov byte [esi + 0x3d], al
mov al, 1
pop edi
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010e0bc
mov esp, ebp
pop ebp
ret
mov byte [esi + 0x3d], 0
mov edi, dword [ebp - 0x28]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x10037d53
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x10037d6a
cmp byte [esi + 0x3d], 0
pop edi
sete al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010e0bc
mov esp, ebp
pop ebp
ret
pop edi
xor al, al
pop esi
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.1010e0bc
mov esp, ebp
pop ebp
ret
mov ecx, dword [ebp - 4]
mov al, 1
xor ecx, ebp
pop esi
call fcn.1010e0bc
mov esp, ebp
pop ebp
ret

Function at 0x1003a7f0
Capabilities:
Create thread

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10111104
mov eax, dword fs:[0]
push eax
sub esp, 0x14
mov eax, dword [0x1013d040]
xor eax, ebp
mov dword [ebp - 0x14], eax
push esi
push edi
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, dword [ebp + 8]
push 0x1c
call fcn.1010e0d8
mov edi, eax
add esp, 4
mov dword [ebp - 0x18], edi
push esi
mov ecx, edi
mov dword [ebp - 4], 0
call fcn.1002e820
mov dword [edi + 0x18], 0x1003a6b0
mov dword [ebp - 0x18], edi
lea eax, [ebp - 0x1c]
mov dword [ebp - 4], 1
push eax
push 0
push edi
push 0x1003f040
push 0
push 0
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__beginthreadex]
add esp, 0x18
mov dword [ebp - 0x20], eax
test eax, eax
je 0x1003a8b8
lea ecx, [ebp - 0x18]
mov dword [ebp - 0x18], 0
call fcn.1003ef40
lea ecx, [ebp - 0x20]
mov dword [ebp - 4], 2
call fcn.10039ba0
cmp dword [ebp - 0x1c], 0
je 0x1003a896
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll_terminate]
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov ecx, dword [ebp - 0x14]
xor ecx, ebp
call fcn.1010e0bc
mov esp, ebp
pop ebp
ret 4
push 6
mov dword [ebp - 0x1c], 0
call dword [sym.imp.MSVCP140.dll_void___cdecl_std::_Throw_Cpp_error_int_]
int3
Function at 0x1003b530
Capabilities:
Encode data using xor
Hash data using fnv

Disassembly:
push ebp
mov ebp, esp
sub esp, 8
cmp byte [0x10150f10], 0
push ebx
push esi
push edi
je 0x1003b6be
mov ecx, dword [0x10222334]
mov eax, dword [ecx]
mov eax, dword [eax + 0x68]
call eax
test al, al
je 0x1003b6be
mov ecx, dword [0x102223c4]
xor ebx, ebx
mov dword [ebp - 4], ecx
mov eax, dword [ecx + 0x28]
mov dword [ebp - 8], eax
test eax, eax
je 0x1003b6be
mov eax, dword [ecx + 0x1c]
mov ecx, dword [eax + ebx*4]
mov eax, dword [ecx]
mov eax, dword [eax + 0x30]
call eax
mov esi, eax
mov edi, 0x811c9dc5
xor ecx, ecx
nop word [eax + eax]
inc ecx
cmp byte [esi + ecx], 0
jne 0x1003b590
xor edx, edx
test ecx, ecx
je 0x1003b5b9
nop dword [eax]
movsx eax, byte [esi + edx]
inc edx
xor eax, edi
imul edi, eax, 0x1000193
cmp edx, ecx
jb 0x1003b5a0
cmp edi, 0x5ff56dc5
je 0x1003b5c8
inc ebx
cmp ebx, dword [ebp - 8]
jae 0x1003b6be
mov ecx, dword [ebp - 4]
jmp 0x1003b574
mov eax, dword [ebp - 4]
mov eax, dword [eax + 0x1c]
mov edi, dword [eax + ebx*4]
test edi, edi
je 0x1003b6be
mov edx, dword [edi + 0x88]
test edx, edx
je 0x1003b6be
movss xmm1, dword [0x101311f8]
xor ebx, ebx
cmp edx, 4
jl 0x1003b68b
mov ecx, dword [edi + 0x7c]
lea esi, [edx - 4]
shr esi, 2
add ecx, 0x1078
inc esi
lea ebx, [esi*4]
movss xmm0, dword [ecx - 0xc60]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1003b62c
mov dword [ecx - 0xc60], 0x7f7fffff
movss xmm0, dword [ecx - 0x840]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1003b647
mov dword [ecx - 0x840], 0x7f7fffff
movss xmm0, dword [ecx - 0x420]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1003b662
mov dword [ecx - 0x420], 0x7f7fffff
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1003b675
mov dword [ecx], 0x7f7fffff
add ecx, 0x1080
sub esi, 1
jne 0x1003b611
cmp ebx, edx
jl 0x1003b68f
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
test edx, edx
jle 0x1003b6be
imul ecx, ebx, 0x420
add ecx, 0x418
add ecx, dword [edi + 0x7c]
sub edx, ebx
movss xmm0, dword [ecx]
ucomiss xmm0, xmm1
lahf
test ah, 0x44
jp 0x1003b6b3
mov dword [ecx], 0x7f7fffff
add ecx, 0x420
sub edx, 1
jne 0x1003b6a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret