joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10001060
Capabilities:
Encode data using xor

Disassembly:
xor eax, eax
test edx, edx
jle 0x1000116c
cmp edx, 0x40
jb 0x10001155
movaps xmm1, xmmword [0x1001d670]
mov ecx, edx
movaps xmm2, xmmword [0x1001d650]
movaps xmm3, xmmword [str.3333333333333333mmmmmmmmmmmmmmmmwwwwwwwwwwwwwwwwxxxxxxxxxxxxxxxx]
movaps xmm4, xmmword [0x1001d680]
movaps xmm5, xmmword [0x1001d660]
movaps xmm6, xmmword [0x1001d690]
push esi
and ecx, 0x8000003f
jns 0x100010ad
dec ecx
or ecx, 0xffffffc0
inc ecx
mov esi, edx
sub esi, ecx
movups xmm0, xmmword [eax + 0x1001f850]
pxor xmm0, xmm1
pxor xmm0, xmm2
pxor xmm0, xmm3
pxor xmm0, xmm4
pxor xmm0, xmm5
pxor xmm0, xmm6
movups xmmword [eax + 0x1001f850], xmm0
movups xmm0, xmmword [eax + 0x1001f860]
pxor xmm0, xmm1
pxor xmm0, xmm2
pxor xmm0, xmm3
pxor xmm0, xmm4
pxor xmm0, xmm5
pxor xmm0, xmm6
movups xmmword [eax + 0x1001f860], xmm0
movups xmm0, xmmword [eax + 0x1001f870]
pxor xmm0, xmm1
pxor xmm0, xmm2
pxor xmm0, xmm3
pxor xmm0, xmm4
pxor xmm0, xmm5
pxor xmm0, xmm6
movups xmmword [eax + 0x1001f870], xmm0
movups xmm0, xmmword [eax + 0x1001f880]
pxor xmm0, xmm1
pxor xmm0, xmm2
pxor xmm0, xmm3
pxor xmm0, xmm4
pxor xmm0, xmm5
pxor xmm0, xmm6
movups xmmword [eax + 0x1001f880], xmm0
add eax, 0x40
cmp eax, esi
jl 0x100010b1
pop esi
cmp eax, edx
jge 0x1000116c
nop dword [eax]
xor byte [eax + 0x1001f850], 0x34
inc eax
cmp eax, edx
jl 0x10001160
ret
Function at 0x10001170
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
xor edx, edx
nop dword [eax + eax]
mov eax, dword [0x1005f850]
movzx ecx, byte [edx + 0x1001f850]
xor cl, al
xor cl, ah
xor cl, byte [0x1005f852]
xor cl, byte [0x1005f853]
mov byte [edx + 0x1001f850], cl
mov eax, dword [0x1005f850]
movzx ecx, byte [edx + 0x1001f852]
xor al, ah
xor al, byte [0x1005f852]
xor al, byte [0x1005f853]
xor byte [edx + 0x1001f851], al
mov eax, dword [0x1005f850]
xor cl, al
xor cl, ah
xor cl, byte [0x1005f852]
xor cl, byte [0x1005f853]
mov byte [edx + 0x1001f852], cl
movzx ecx, byte [edx + 0x1001f853]
mov eax, dword [0x1005f850]
xor cl, al
xor cl, ah
xor cl, byte [0x1005f852]
xor cl, byte [0x1005f853]
mov byte [edx + 0x1001f853], cl
add edx, 4
cmp edx, 0x40000
jb 0x10001180
mov edx, 0x40000
call fcn.10001060
sub esp, 0x10
call fcn.10003430
add esp, 0x10
mov dword [ebp - 0xc], eax
test eax, eax
je 0x100012dd
mov ecx, dword [eax + 4]
push ebx
push edi
mov edi, dword [eax]
mov dword [ebp - 8], ecx
cmp dword [edi + 0x7c], 0
jne 0x10001258
push 0x7f
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
call eax
mov ecx, dword [ebp - 0xc]
call fcn.10003970
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov edi, dword [edi + 0x78]
add edi, ecx
push esi
mov edx, dword [edi + 0x18]
test edx, edx
je 0x100012c6
mov esi, dword [edi + 0x14]
test esi, esi
je 0x100012c6
mov ebx, 0x1001d4f0
mov eax, ebx
shr eax, 0x10
test eax, eax
jne 0x10001288
mov eax, dword [edi + 0x10]
movzx edx, bx
cmp edx, eax
jb 0x100012c6
sub edx, eax
jmp 0x100012ea
mov esi, dword [edi + 0x20]
xor ebx, ebx
mov eax, dword [edi + 0x24]
add esi, ecx
add eax, ecx
mov dword [ebp - 4], eax
test edx, edx
je 0x100012c6
nop dword [eax + eax]
mov eax, dword [esi]
add eax, ecx
push eax
push 0x1001d4f0
call fcn.100081db
mov ecx, dword [ebp - 8]
add esp, 8
test eax, eax
je 0x100012e1
add dword [ebp - 4], 2
inc ebx
add esi, 4
cmp ebx, dword [edi + 0x18]
jb 0x100012a0
push 0x7f
call dword [sym.imp.KERNEL32.dll_SetLastError]
xor eax, eax
pop esi
call eax
mov ecx, dword [ebp - 0xc]
call fcn.10003970
pop edi
pop ebx
mov esp, ebp
pop ebp
ret
mov eax, dword [ebp - 4]
mov esi, dword [edi + 0x14]
movzx edx, word [eax]
cmp edx, esi
ja 0x100012c6
mov eax, dword [edi + 0x1c]
pop esi
lea eax, [eax + edx*4]
mov eax, dword [eax + ecx]
add eax, ecx
call eax
mov ecx, dword [ebp - 0xc]
call fcn.10003970
pop edi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x10001340
Capabilities:
Create thread

Disassembly:
push esi
push 0
call fcn.10007e4d
push eax
call fcn.10007f33
add esp, 8
call dword [sym.imp.KERNEL32.dll_GetTickCount]
xor edx, edx
mov ecx, 3
div ecx
lea esi, [edx + 1]
call fcn.10007f12
cdq
idiv esi
push 0
push 0
push 0
push 0
lea esi, [edx + 1]
call dword [sym.imp.KERNEL32.dll_CreateEventW]
mov dword [0x10060688], eax
test eax, eax
je 0x100013b3
test esi, esi
je 0x100013ac
push edi
mov edi, dword [sym.imp.KERNEL32.dll_CreateThread]
push 0
push 0
push 0
push 0x10001310
push 0
push 0
call edi
sub esi, 1
jne 0x10001390
mov eax, dword [0x10060688]
pop edi
push eax
call dword [sym.imp.KERNEL32.dll_SetEvent]
pop esi
ret
Function at 0x100013c0
Capabilities:
Get common file path
Get disk information

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x210
mov eax, dword [0x1001f008]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push 0xfa
lea eax, [ebp - 0xfe]
mov esi, edx
push 0
push eax
call fcn.10005a20
mov ecx, dword [0x10060684]
add esp, 0xc
test ecx, ecx
jne 0x10001492
push 0x104
push ecx
lea eax, [ebp - 0x20c]
push eax
call fcn.10005a20
add esp, 0xc
mov dword [ebp - 0x210], 0
lea eax, [ebp - 0x20c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryA]
test eax, eax
je 0x1000148c
lea eax, [ebp - 0x20c]
push 0x1001d4f4
push eax
call fcn.10004d50
add esp, 8
test eax, eax
je 0x1000148c
push 0
push 0
push 0
mov byte [eax + 1], 0
lea eax, [ebp - 0x210]
push 0
push eax
push 0
push 0
lea eax, [ebp - 0x20c]
mov dword [0x10060684], 0
push eax
call dword [sym.imp.KERNEL32.dll_GetVolumeInformationA]
mov ecx, dword [0x10060684]
test eax, eax
cmovne ecx, dword [ebp - 0x210]
mov dword [0x10060684], ecx
jmp 0x10001492
mov ecx, dword [0x10060684]
push ebx
imul ebx, ecx, 0x19660d
mov eax, 0x51eb851f
add ebx, 0x3c6ef35c
mul ebx
mov cl, bl
imul ebx, ebx, 0x19660d
shr edx, 3
movsx eax, dl
imul eax, eax, 0x19
add ebx, 0x3c6ef35c
sub cl, al
mov eax, 0x51eb851f
mul ebx
add cl, 0x61
mov byte [ebp - 0x108], cl
mov cl, bl
shr edx, 3
movsx eax, dl
imul eax, eax, 0x19
imul ebx, ebx, 0x19660d
sub cl, al
mov eax, 0x51eb851f
add ebx, 0x3c6ef35c
add cl, 0x61
mul ebx
mov byte [ebp - 0x107], cl
mov cl, bl
shr edx, 3
movsx eax, dl
imul eax, eax, 0x19
imul ebx, ebx, 0x19660d
sub cl, al
mov eax, 0x51eb851f
add ebx, 0x3c6ef35c
add cl, 0x61
mul ebx
mov byte [ebp - 0x106], cl
mov cl, bl
shr edx, 3
movsx eax, dl
imul eax, eax, 0x19
imul ebx, ebx, 0x19660d
sub cl, al
mov eax, 0x51eb851f
add ebx, 0x3c6ef35c
add cl, 0x61
mul ebx
mov byte [ebp - 0x105], cl
mov cl, bl
shr edx, 3
movsx eax, dl
imul eax, eax, 0x19
imul ebx, ebx, 0x19660d
sub cl, al
mov eax, 0x51eb851f
add ebx, 0x3c6ef35c
add cl, 0x61
mul ebx
mov byte [ebp - 0x104], cl
mov cl, bl
shr edx, 3
movsx eax, dl
imul eax, eax, 0x19
imul ebx, ebx, 0x19660d
sub cl, al
mov eax, 0x51eb851f
add ebx, 0x3c6ef35c
add cl, 0x61
mul ebx
mov byte [ebp - 0x103], cl
mov cl, bl
shr edx, 3
movsx eax, dl
imul eax, eax, 0x19
imul ebx, ebx, 0x19660d
sub cl, al
mov eax, 0x51eb851f
add cl, 0x61
add ebx, 0x3c6ef35c
mov byte [ebp - 0x102], cl
mul ebx
mov cl, bl
imul ebx, ebx, 0x19660d
shr edx, 3
movsx eax, dl
imul eax, eax, 0x19
add ebx, 0x3c6ef35c
sub cl, al
mov eax, 0x51eb851f
mul ebx
add cl, 0x61
mov eax, 0x51eb851f
shr edx, 3
mov byte [ebp - 0x101], cl
movsx ecx, dl
mov dl, bl
imul ecx, ecx, 0x19
sub dl, cl
imul ecx, ebx, 0x19660d
add dl, 0x61
mov byte [ebp - 0x100], dl
pop ebx
add ecx, 0x3c6ef35c
mul ecx
shr edx, 3
movsx eax, dl
imul eax, eax, 0x19
sub cl, al
lea eax, [ebp - 0x108]
add cl, 0x61
mov byte [ebp - 0xff], cl
mov ecx, eax
sub esi, ecx
mov cl, byte [eax]
lea eax, [eax + 1]
mov byte [eax + esi - 1], cl
test cl, cl
jne 0x10001636
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.100039f1
mov esp, ebp
pop ebp
ret
Function at 0x10001660
Capabilities:
Accept command line arguments
Contain obfuscated stackstrings
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x598
mov eax, dword [0x1001f008]
xor eax, ebp
mov dword [ebp - 4], eax
sub dword [ebp + 0xc], 1
mov eax, dword [ebp + 8]
mov dword [ebp - 0x598], eax
jne 0x10001873
push 0x208
lea eax, [ebp - 0x594]
push 0
push eax
call fcn.10005a20
add esp, 0xc
lea eax, [ebp - 0x594]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameW]
lea eax, [ebp - 0x40]
mov dword [ebp - 0x40], 0x760073
push eax
lea eax, [ebp - 0x594]
mov dword [ebp - 0x3c], 0x680063
push eax
mov dword [ebp - 0x38], 0x73006f
mov dword [ebp - 0x34], 0x2e0074
mov dword [ebp - 0x30], 0x780065
mov dword [ebp - 0x2c], 0x65
call fcn.10004fb3
add esp, 8
test eax, eax
je 0x10001873
push esi
call dword [sym.imp.KERNEL32.dll_GetCommandLineW]
push 0x104
mov esi, eax
lea eax, [ebp - 0x184]
push 0
push eax
call fcn.10005a20
lea edx, [ebp - 0x184]
call fcn.100013c0
push 0x40
lea eax, [ebp - 0x80]
push 0
push eax
call fcn.10005a20
lea ecx, [ebp - 0x184]
add esp, 0x18
lea edx, [ecx + 1]
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001735
push ebx
push edi
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea eax, [ebp - 0x184]
push 0
push 0
sub ecx, edx
push ecx
push eax
push 0
push 0
call edi
mov ebx, eax
lea ecx, [ebx + 1]
test ecx, ecx
je 0x10001775
xor eax, eax
lea edi, [ebp - 0x80]
shr ecx, 1
rep stosd dword es:[edi], eax
adc ecx, ecx
rep stosw word es:[edi], ax
mov edi, dword [sym.imp.KERNEL32.dll_MultiByteToWideChar]
lea ecx, [ebp - 0x184]
lea edx, [ecx + 1]
nop
mov al, byte [ecx]
inc ecx
test al, al
jne 0x10001780
push ebx
lea eax, [ebp - 0x80]
sub ecx, edx
push eax
push ecx
lea eax, [ebp - 0x184]
push eax
push 0
push 0
call edi
xor eax, eax
mov dword [ebp - 0x14], 0x65006e
mov word [ebp + ebx*2 - 0x80], ax
lea eax, [ebp - 0x14]
push eax
push esi
mov dword [ebp - 0x10], 0x730074
mov dword [ebp - 0xc], 0x630076
mov dword [ebp - 8], 0x73
call fcn.10004fb3
add esp, 8
test eax, eax
je 0x1000185a
xor eax, eax
mov dword [ebp - 0x28], 0x650053
push 0x208
push eax
mov word [ebp - 0x18], ax
lea eax, [ebp - 0x38c]
push eax
mov dword [ebp - 0x24], 0x73006e
mov dword [ebp - 0x20], 0x64002e
mov dword [ebp - 0x1c], 0x6c006c
call fcn.10005a20
add esp, 0xc
lea eax, [ebp - 0x38c]
push 0x104
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, dword [sym.imp.KERNEL32.dll_lstrcatW]
lea eax, [ebp - 0x38c]
push 0x1001d520
push eax
call esi
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x38c]
push eax
call esi
lea eax, [ebp - 0x38c]
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryW]
mov ecx, dword [ebp - 0x598]
mov edx, eax
call fcn.100018b0
jmp 0x1000186b
lea eax, [ebp - 0x80]
push eax
push esi
call fcn.10004fb3
add esp, 8
test eax, eax
je 0x10001870
call fcn.10001340
pop edi
pop ebx
pop esi
mov ecx, dword [ebp - 4]
mov eax, 1
xor ecx, ebp
call fcn.100039f1
mov esp, ebp
pop ebp
ret 0xc
Function at 0x401237
Capabilities:
Encode data using xor
Encrypt data using tea

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
and dword [ebp - 0x10], 0
push ebx
push esi
mov esi, ecx
lea ecx, [ebp - 0x10]
push edi
mov dword [ebp - 0x30], esi
mov eax, dword [esi + 4]
mov edi, dword [esi]
mov dword [ebp - 0x14], eax
mov eax, dword [0x41b2f8]
mov dword [ebp - 0x20], eax
mov eax, dword [0x41b2fc]
mov dword [ebp - 0xc], edi
mov dword [ebp - 0x24], eax
call fcn.00401230
mov ebx, dword [ebp - 0x10]
mov ecx, dword [0x41b300]
add ebx, 0x23f
mov edx, dword [0x41b304]
mov esi, dword [ebp - 0x14]
mov dword [ebp - 0x28], ecx
mov dword [ebp - 0x2c], edx
mov dword [ebp - 0x18], 0x20
mov dword [ebp - 0x14], 2
add dword [ebp - 0x14], 3
mov eax, edi
mov dword [ebp - 0x10], 0xedeb2e40
shl eax, 4
add eax, ecx
cmp dword [0xb5fd0c], 0xfa9
mov dword [ebp - 4], eax
mov eax, dword [0xb5fd08]
cmove eax, dword [ebp - 0x10]
and dword [ebp - 0x10], 0
cmp dword [0xb5fd0c], 0x3eb
mov dword [0xb5fd08], eax
mov eax, dword [0xb5fc60]
cmove eax, dword [ebp - 0x10]
mov dword [0xb5fc60], eax
lea eax, [ebx + edi]
mov dword [ebp - 0x1c], eax
mov eax, dword [ebp - 0xc]
shr eax, 5
mov dword [ebp - 8], eax
mov eax, dword [ebp - 4]
add dword [ebp - 8], edx
and dword [ebp - 0xc], 0
mov dword [0xb5fd04], 0xf4ea3dee
mov dword [ebp - 0x10], eax
mov eax, dword [ebp - 0x1c]
add dword [ebp - 0xc], eax
mov eax, dword [ebp - 0xc]
xor dword [ebp - 0x10], eax
mov eax, dword [ebp - 8]
xor eax, dword [ebp - 0x10]
sub esi, eax
mov dword [ebp - 8], eax
mov eax, esi
shl eax, 4
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x20]
add dword [ebp - 4], eax
mov ecx, dword [ebp - 0x14]
lea eax, [ebx + esi]
mov edx, esi
lea ebx, [ebx + 0x61c88647]
shr edx, cl
add edx, dword [ebp - 0x24]
mov ecx, dword [ebp - 0x28]
mov dword [ebp - 8], edx
xor edx, eax
mov eax, dword [ebp - 4]
xor eax, edx
mov edx, dword [ebp - 0x2c]
sub edi, eax
mov dword [ebp - 4], eax
dec dword [ebp - 0x18]
mov dword [ebp - 0xc], edi
jne 0x401291
mov dword [ebp - 0x14], esi
mov esi, dword [ebp - 0x30]
mov eax, dword [ebp - 0x14]
mov dword [esi], edi
pop edi
mov dword [esi + 4], eax
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1002830
Capabilities:
Set registry value

Disassembly:
push ebp
mov ebp, esp
push ecx
mov eax, dword [0x100405c]
push ebx
xor ebx, ebx
push esi
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
push edi
sub eax, ebx
mov dword [ebp - 4], ebx
mov edi, 0x20006
je 0x1002858
dec eax
je 0x100289a
jmp 0x10028ed
lea eax, [ebp - 4]
push eax
push edi
push ebx
push 0x10010e4
push 0x80000001
call esi
cmp eax, ebx
jne 0x1002893
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, ebx
je 0x10028db
push ebx
jmp 0x10028d5
push ebx
push eax
call fcn.0100306a
lea eax, [ebp - 4]
push eax
push edi
push ebx
push 0x1001164
push 0x80000002
call esi
cmp eax, ebx
jne 0x10028e6
push dword [ebp + 0xc]
call dword [sym.imp.KERNEL32.dll_lstrlenA]
inc eax
push eax
push dword [ebp + 0xc]
push dword [ebp + 0x10]
push ebx
push dword [ebp + 8]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegSetValueExA]
cmp eax, ebx
je 0x10028db
push dword [ebp + 8]
push eax
call fcn.0100306a
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10028ed
push ebx
push eax
call fcn.0100306a
pop edi
pop esi
pop ebx
leave
ret 0xc

Function at 0x10028f4
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xc
push ebx
push esi
mov esi, dword [sym.imp.MSVCRT.dll__strcmpi]
push edi
push 0x10011b8
xor edi, edi
push dword [ebp + 8]
xor ebx, ebx
mov dword [ebp - 4], edi
mov dword [ebp - 8], edi
call esi
pop ecx
test eax, eax
pop ecx
jne 0x1002920
push 1
pop ebx
push 0x10011a4
push dword [ebp + 8]
call esi
pop ecx
test eax, eax
pop ecx
jne 0x1002933
push 2
pop ebx
mov esi, dword [sym.imp.ADVAPI32.dll_RegOpenKeyExA]
mov eax, ebx
sub eax, edi
je 0x100294a
dec eax
je 0x1002955
dec eax
je 0x100299c
jmp 0x10029e1
push edi
push 0x13b0
call fcn.0100306a
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebp + 0xc]
push 0x80000002
call esi
cmp eax, edi
jne 0x1002995
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push dword [ebp + 0x14]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
cmp eax, edi
je 0x10029cf
push edi
push eax
call fcn.0100306a
jmp 0x10029cf
push edi
push eax
call fcn.0100306a
lea eax, [ebp - 4]
push eax
push 1
push edi
push dword [ebp + 0xc]
push 0x80000001
call esi
cmp eax, edi
jne 0x10029da
mov eax, dword [ebp + 0x18]
mov dword [ebp - 8], eax
lea eax, [ebp - 8]
push eax
lea eax, [ebp - 0xc]
push dword [ebp + 0x14]
push eax
push edi
push dword [ebp + 0x10]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegQueryValueExA]
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
jmp 0x10029e1
push edi
push eax
call fcn.0100306a
mov eax, dword [ebp - 0xc]
pop edi
pop esi
pop ebx
leave
ret 0x14
Function at 0x1002f06
Capabilities:
Terminate process

Disassembly:
push esi
mov esi, dword [sym.imp.MSVCRT.dll_puts]
push edi
push 0x1001a2c
call esi
mov dword [esp], 0x1001a1c
call esi
mov dword [esp], 0x10019cc
call esi
mov dword [esp], 0x1001980
call esi
mov dword [esp], 0x1001940
call esi
mov dword [esp], 0x10018f0
call esi
mov dword [esp], 0x10018a0
call esi
mov dword [esp], 0x1001880
call esi
mov dword [esp], 0x1001860
call esi
mov dword [esp], 0x1001844
call esi
mov dword [esp], 0x1001830
call esi
mov dword [esp], 0x10017f0
call esi
mov dword [esp], 0x10017cc
call esi
mov dword [esp], 0x1001780
call esi
mov dword [esp], 0x100176c
call esi
mov dword [esp], 0x100171c
call esi
mov dword [esp], 0x1001708
call esi
mov dword [esp], 0x10016b4
call esi
mov dword [esp], 0x1001678
call esi
mov dword [esp], 0x100165c
call esi
mov edi, 0x1001648
push edi
call esi
push 0x10015e4
call esi
push 0x100159c
call esi
push 0x1001538
call esi
push 0x10014f4
call esi
push 0x10014a8
call esi
push 0x1001490
call esi
push edi
call esi
push 0x1001474
call esi
push 0x100142c
call esi
push 0x1001404
call esi
push 0x10013c4
call esi
push 0x100138c
call esi
push 0x1001360
call esi
push 0x1001314
call esi
add esp, 0x40
push 0x10012e0
call esi
mov dword [esp], 0x10012ac
call esi
mov dword [esp], 0x100126c
call esi
mov dword [esp], 0x1001238
call esi
mov dword [esp], 0x1001218
call esi
mov dword [esp], 0x10011f8
call esi
push 0
call dword [sym.imp.MSVCRT.dll_exit]
pop ecx
pop ecx
pop edi
pop esi
ret
Function at 0x100306a
Capabilities:
Terminate process

Disassembly:
mov ecx, dword [esp + 4]
push ebx
push ebp
mov ebp, dword [esp + 0x10]
push esi
mov esi, dword [sym.imp.MSVCRT.dll_exit]
push edi
mov edi, dword [sym.imp.MSVCRT.dll_printf]
mov eax, 0x1393
push 1
cmp ecx, eax
pop ebx
jg 0x10031b6
cmp ecx, eax
je 0x1003182
cmp ecx, 6
jg 0x1003190
je 0x100310a
cmp ecx, 0x80040150
je 0x1003152
cmp ecx, 0x80040151
je 0x100315e
cmp ecx, 0x80040152
je 0x100316a
test ecx, ecx
je 0x10030e1
cmp ecx, 2
je 0x10030e6
cmp ecx, 3
je 0x10030f2
cmp ecx, 5
je 0x10030fe
jmp case.0x10031cc.5018
push 0
call esi
pop ecx
push 0x1001ef8
call edi
push ebx
call esi
pop ecx
pop ecx
push 0x1001ecc
call edi
push ebx
call esi
pop ecx
pop ecx
push 0x1001eb8
call edi
push ebx
call esi
pop ecx
pop ecx
push 0x1001ea0
call edi
push ebx
call esi
pop ecx
pop ecx
push 0x1001e64
call edi
push ebx
call esi
pop ecx
pop ecx
push 0x1001e44
call edi
push ebx
call esi
pop ecx
pop ecx
push 0x1001e28
call edi
push ebx
call esi
pop ecx
pop ecx
push 0x1001e10
call edi
push ebx
call esi
pop ecx
pop ecx
push 0x1001de4
call edi
push ebx
call esi
pop ecx
pop ecx
push 0x1001dc0
call edi
push ebx
call esi
pop ecx
pop ecx
push 0x1001d9c
call edi
push ebx
call esi
pop ecx
pop ecx
push 0x1001d74
call edi
push ebx
call esi
pop ecx
pop ecx
push 0x1001d4c
call edi
push ebx
call esi
pop ecx
pop ecx
push 0x1001d18
call edi
push ebx
call esi
pop ecx
pop ecx
jmp case.0x10031cc.5012
mov eax, ecx
sub eax, 8
je 0x1003116
dec eax
dec eax
je 0x1003122
dec eax
dec eax
je 0x100312e
dec eax
je 0x100313a
dec eax
dec eax
je 0x1003146
sub eax, 0x1383
je 0x1003176
jmp case.0x10031cc.5018
lea eax, [ecx - 0x1394]
cmp eax, 0x1e
ja case.0x10031cc.5018
movzx eax, byte [eax + 0x10032ce]
jmp dword [eax*4 + 0x1003296]
push ebp
push 0x1001cd4
call edi
push ebx
call esi
add esp, 0xc
push 0x1001c90
call edi
push ebx
call esi
pop ecx
pop ecx
push 0x1001c68
call edi
push ebx
call esi
pop ecx
pop ecx
push ebp
push 0x1001c38
call edi
push ebx
call esi
add esp, 0xc
push ebp
push 0x1001c0c
call edi
push ebx
call esi
add esp, 0xc
push 0x1001bd0
call edi
push ebx
call esi
pop ecx
pop ecx
push ebp
push 0x1001b90
call edi
push ebx
call esi
add esp, 0xc
push ebp
push 0x1001b6c
call edi
push ebx
call esi
add esp, 0xc
push 0x1001b4c
call edi
push ebx
call esi
pop ecx
pop ecx
push 0x1001b20
call edi
push ebx
call esi
pop ecx
pop ecx
push 0x1001ae0
call edi
push ebx
call esi
pop ecx
pop ecx
push ebp
push 0x1001a9c
call edi
push ebx
call esi
add esp, 0xc
push ebp
push 0x1001a78
call edi
push ebx
call esi
mov ecx, dword [esp + 0x20]
add esp, 0xc
push ecx
push 0x1001a40
call edi
push ebx
call esi
add esp, 0xc
pop edi
pop esi
pop ebp
pop ebx
ret 8
Function at 0x10032ed
Capabilities:
Terminate process

Disassembly:
push ebx
push esi
mov esi, dword [sym.imp.MSVCRT.dll_puts]
push edi
push 0x1002280
call esi
mov dword [esp], 0x1002238
call esi
mov dword [esp], 0x1002208
call esi
mov ebx, 0x10021f0
push ebx
call esi
mov edi, 0x10021b0
push edi
call esi
push 0x1002178
call esi
push ebx
call esi
push edi
call esi
push 0x1002124
call esi
push 0x100210c
call esi
push 0x10020d8
call esi
push 0x1002098
call esi
push 0x100204c
call esi
push 0x1002034
call esi
push 0x1002000
call esi
push 0x1001fb4
call esi
push 0x1001f68
call esi
push 0x1001f38
call esi
add esp, 0x40
push 0
call dword [sym.imp.MSVCRT.dll_exit]
pop ecx
pop edi
pop esi
pop ebx
ret

Function at 0x1003390
Capabilities:
Terminate process

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10022c0
push 0x1003530
mov eax, dword fs:[0]
push eax
mov dword fs:[0], esp
add esp, 0xffffffe0
push ebx
push esi
push edi
mov dword [ebp - 0x18], esp
mov dword [ebp - 4], 0
push 1
call dword [sym.imp.MSVCRT.dll___set_app_type]
add esp, 4
mov dword [0x1004074], 0xffffffff
mov dword [0x1004078], 0xffffffff
call dword [sym.imp.MSVCRT.dll___p__fmode]
mov ecx, dword [0x100406c]
mov dword [eax], ecx
call dword [sym.imp.MSVCRT.dll___p__commode]
mov edx, dword [0x1004068]
mov dword [eax], edx
mov eax, dword [sym.imp.MSVCRT.dll__adjust_fdiv]
mov ecx, dword [eax]
mov dword [0x100407c], ecx
call fcn.01003520
mov eax, dword [0x1004030]
test eax, eax
jne 0x1003421
push 0x1003510
call dword [sym.imp.MSVCRT.dll___setusermatherr]
add esp, 4
call fcn.010034f0
push 0x100400c
push 0x1004008
call sub.MSVCRT.dll__initterm
add esp, 8
mov edx, dword [0x1004064]
mov dword [ebp - 0x28], edx
lea eax, [ebp - 0x28]
push eax
mov ecx, dword [0x1004060]
push ecx
lea edx, [ebp - 0x20]
push edx
lea eax, [ebp - 0x2c]
push eax
lea ecx, [ebp - 0x1c]
push ecx
call dword [sym.imp.MSVCRT.dll___getmainargs]
add esp, 0x14
push 0x1004004
push section..data
call sub.MSVCRT.dll__initterm
add esp, 8
call dword [sym.imp.MSVCRT.dll___p___initenv]
mov edx, dword [ebp - 0x20]
mov dword [eax], edx
mov eax, dword [ebp - 0x20]
push eax
mov ecx, dword [ebp - 0x2c]
push ecx
mov edx, dword [ebp - 0x1c]
push edx
call fcn.010022d0
add esp, 0xc
mov dword [ebp - 0x24], eax
push eax
call dword [sym.imp.MSVCRT.dll_exit]
jmp 0x10034c0
add esp, 4
mov dword [ebp - 4], 0xffffffff
mov ecx, dword [ebp - 0x10]
mov dword fs:[0], ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x406c81
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
cmp dword [0x460114], 0
jne 0x406cbf
xor ecx, ecx
push esi
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
movzx edx, dl
neg edx
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406c95
mov dword [ecx*4 + 0x460110], eax
inc ecx
cmp ecx, 0x100
jl 0x406c90
pop esi
cmp dword [ebp + 0x10], 0
mov eax, dword [ebp + 8]
not eax
jbe 0x406cec
mov ecx, dword [ebp + 0xc]
movzx edx, byte [ecx]
dec dword [ebp + 0x10]
xor edx, eax
and edx, 0xff
shr eax, 8
xor eax, dword [edx*4 + 0x460110]
inc ecx
cmp dword [ebp + 0x10], 0
ja 0x406ccd
not eax
pop ebp
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x401de0
Capabilities:
Get process heap flags
Terminate process

Disassembly:
push ebp
mov ebp, esp
push edi
push esi
push ebx
sub esp, 0xc
mov dword [esp], 1
call sub.ucrtbase.dll__configure_wide_argv
call sub.ucrtbase.dll__initialize_wide_environment
call 0x401e50
mov esi, dword [eax]
call sub.ucrtbase.dll___p___wargv
mov edi, dword [eax]
call sub.ucrtbase.dll__get_initial_wide_environment
mov ebx, eax
mov eax, dword fs:[0x18]
mov eax, dword [eax + 0x30]
mov eax, dword [eax + 8]
mov edx, dword [eax + 0x3c]
cmp word [eax + edx + 0x5c], 2
sete al
movzx eax, al
add eax, 1
mov dword [esp], eax
call sub.ucrtbase.dll__set_app_type
mov dword [esp + 8], ebx
mov dword [esp + 4], edi
mov dword [esp], esi
call fcn.00401350
mov dword [esp], eax
call sub.ucrtbase.dll_exit
nop
nop
nop
jmp dword [sym.imp.ucrtbase.dll___p___argc]