joyce8/EMBER2024-capa huggingface dataset:
Function at 0x1000cb10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x1001d160]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
mov esi, edx
call fcn.10011ac0
mov ecx, eax
call fcn.10011930
test eax, eax
je 0x1000cb76
lea ecx, [esp + 4]
push ecx
push eax
mov dword [esp + 0xf], 0x65736165
mov word [esp + 0xd], 0x6c65
mov byte [esp + 0xc], 0x52
mov word [esp + 0x14], 0x43
mov byte [esp + 0x13], 0x44
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000cb76
push esi
push 0
call eax
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.10001e2b
add esp, 0x10
ret
mov ecx, dword [esp + 0x10]
pop esi
xor ecx, esp
xor eax, eax
call fcn.10001e2b
add esp, 0x10
ret

Function at 0x1000cb90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x1001d160]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
mov esi, ecx
call fcn.10011ac0
mov ecx, eax
call fcn.10011930
test eax, eax
je 0x1000cbf8
lea ecx, [esp + 4]
push ecx
push eax
mov dword [esp + 0xc], 0x776f6853
mov word [esp + 0x12], 0x646e
mov word [esp + 0x15], 0x77
mov word [esp + 0x10], 0x6957
mov byte [esp + 0x14], 0x6f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000cbf8
push 0
push esi
call eax
pop esi
mov ecx, dword [esp + 0xc]
xor ecx, esp
call fcn.10001e2b
add esp, 0x10
ret
mov ecx, dword [esp + 0x10]
pop esi
xor ecx, esp
xor eax, eax
call fcn.10001e2b
add esp, 0x10
ret

Function at 0x1000cc10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1001d160]
xor eax, esp
mov dword [esp + 0x10], eax
lea eax, [esp]
push eax
mov word [esp + 0xf], 0x74
mov dword [esp + 5], 0x69547465
mov dword [esp + 0xa], 0x756f436b
mov byte [esp + 0xe], 0x6e
mov byte [esp + 4], 0x47
mov byte [esp + 9], 0x63
call fcn.10011ac0
mov ecx, eax
call fcn.10011a50
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000cc70
call eax
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10001e2b
add esp, 0x14
ret
mov ecx, dword [esp + 0x10]
xor ecx, esp
xor eax, eax
call fcn.10001e2b
add esp, 0x14
ret

Function at 0x1000cc90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1001d160]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov esi, ecx
call fcn.10011ac0
mov ecx, eax
call fcn.100118d0
test eax, eax
je 0x1000ccfe
lea ecx, [esp + 4]
push ecx
push eax
mov dword [esp + 0x14], 0x70614365
mov word [esp + 0x18], 0x73
mov dword [esp + 0xc], 0x44746547
mov word [esp + 0x11], 0x6976
mov byte [esp + 0x10], 0x65
mov byte [esp + 0x13], 0x63
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ccfe
push 0x58
push esi
call eax
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10001e2b
add esp, 0x14
ret
mov ecx, dword [esp + 0x14]
pop esi
xor ecx, esp
mov eax, 0x60
call fcn.10001e2b
add esp, 0x14
ret
Function at 0x1000cd20
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x1001d160]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
push edi
mov edi, dword [esp + 0x28]
mov esi, ecx
call fcn.10011ac0
mov ecx, eax
call fcn.100119f0
test eax, eax
je 0x1000cdab
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x17], 0x6e656b6f
mov dword [esp + 0x13], 0x54747375
mov dword [esp + 0x1d], 0x6c697669
mov dword [esp + 0x21], 0x73656765
mov word [esp + 0x1b], 0x7250
mov word [esp + 0x11], 0x6a64
mov byte [esp + 0x25], 0
mov byte [esp + 0x10], 0x41
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000cdab
push 0
push 0
push 0x10
push edi
push 0
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.10001e2b
add esp, 0x1c
ret
mov ecx, dword [esp + 0x20]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.10001e2b
add esp, 0x1c
ret

Function at 0x1000cdc0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x1001d160]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
push edi
mov edi, dword [esp + 0x28]
mov esi, edx
call fcn.10011ac0
mov ecx, eax
call fcn.100119f0
test eax, eax
je 0x1000ce54
lea ecx, [esp + 8]
push ecx
push eax
mov word [esp + 0x19], 0x6976
mov dword [esp + 0x1f], 0x756c6156
mov word [esp + 0x1c], 0x6765
mov dword [esp + 0x12], 0x70756b6f
mov word [esp + 0x10], 0x6f4c
mov word [esp + 0x24], 0x41
mov word [esp + 0x17], 0x6972
mov byte [esp + 0x23], 0x65
mov byte [esp + 0x16], 0x50
mov byte [esp + 0x1b], 0x6c
mov byte [esp + 0x1e], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000ce54
push edi
push esi
push 0
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.10001e2b
add esp, 0x1c
ret
mov ecx, dword [esp + 0x20]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.10001e2b
add esp, 0x1c
ret

Function at 0x1000ce70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x1001d160]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
push edi
mov edi, dword [esp + 0x24]
mov esi, ecx
call fcn.10011ac0
mov ecx, eax
call fcn.100119f0
test eax, eax
je 0x1000cef7
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x1b], 0x656b6f54
mov word [esp + 0x16], 0x636f
mov word [esp + 0x10], 0x704f
mov word [esp + 0x13], 0x506e
mov word [esp + 0x18], 0x7365
mov word [esp + 0x1f], 0x6e
mov byte [esp + 0x1a], 0x73
mov byte [esp + 0x15], 0x72
mov byte [esp + 0x12], 0x65
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000cef7
push edi
push 0x20
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10001e2b
add esp, 0x18
ret
mov ecx, dword [esp + 0x1c]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.10001e2b
add esp, 0x18
ret
Function at 0x1000cf10
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1001d160]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
lea eax, [esp + 8]
push eax
mov edi, edx
mov esi, ecx
mov dword [esp + 0x16], 0x747865
mov word [esp + 0x11], 0x7373
mov dword [esp + 0xd], 0x65636f72
mov word [esp + 0x14], 0x4e32
mov byte [esp + 0xc], 0x50
mov byte [esp + 0x13], 0x33
call fcn.10011ac0
mov ecx, eax
call fcn.10011a50
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000cf7d
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10001e2b
add esp, 0x14
ret
mov ecx, dword [esp + 0x18]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.10001e2b
add esp, 0x14
ret

Function at 0x1000cf90
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1001d160]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
lea eax, [esp + 8]
push eax
mov edi, edx
mov esi, ecx
mov dword [esp + 0x10], 0x33737365
mov dword [esp + 0x16], 0x74737269
mov word [esp + 0xd], 0x6f72
mov word [esp + 0x14], 0x4632
mov byte [esp + 0xc], 0x50
mov byte [esp + 0xf], 0x63
mov byte [esp + 0x1a], 0
call fcn.10011ac0
mov ecx, eax
call fcn.10011a50
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000d002
push edi
push esi
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10001e2b
add esp, 0x14
ret
mov ecx, dword [esp + 0x18]
pop edi
pop esi
xor ecx, esp
xor eax, eax
call fcn.10001e2b
add esp, 0x14
ret

Function at 0x1000d020
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x20
mov eax, dword [0x1001d160]
xor eax, esp
mov dword [esp + 0x1c], eax
lea eax, [esp]
push eax
mov word [esp + 4], 0x7243
mov dword [esp + 0x10], 0x3233706c
mov word [esp + 0xe], 0x6568
mov dword [esp + 9], 0x6f6f5465
mov word [esp + 7], 0x7461
mov word [esp + 0x18], 0x6873
mov word [esp + 0x1b], 0x74
mov dword [esp + 0x14], 0x70616e53
mov byte [esp + 0xd], 0x6c
mov byte [esp + 0x1a], 0x6f
mov byte [esp + 6], 0x65
call fcn.10011ac0
mov ecx, eax
call fcn.10011a50
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000d0a8
push 0
push 2
call eax
mov ecx, dword [esp + 0x1c]
xor ecx, esp
call fcn.10001e2b
add esp, 0x20
ret
mov ecx, dword [esp + 0x1c]
xor ecx, esp
or eax, 0xffffffff
call fcn.10001e2b
add esp, 0x20
ret
Function at 0x1000d0c0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x24
mov eax, dword [0x1001d160]
xor eax, esp
mov dword [esp + 0x20], eax
mov eax, dword [esp + 0x34]
push ebx
mov ebx, dword [esp + 0x30]
push ebp
mov ebp, dword [esp + 0x38]
mov dword [esp + 8], eax
mov eax, dword [esp + 0x40]
push esi
mov dword [esp + 0x10], eax
push edi
lea eax, [esp + 0x18]
push eax
mov edi, edx
mov esi, ecx
mov dword [esp + 0x2e], 0x416e6f
mov dword [esp + 0x29], 0x74616d72
mov dword [esp + 0x22], 0x49656d75
mov dword [esp + 0x1d], 0x6f567465
mov word [esp + 0x27], 0x6f66
mov byte [esp + 0x26], 0x6e
mov byte [esp + 0x2d], 0x69
mov byte [esp + 0x21], 0x6c
mov byte [esp + 0x1c], 0x47
call fcn.10011ac0
mov ecx, eax
call fcn.10011a50
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000d170
push 0x105
push dword [esp + 0x18]
push dword [esp + 0x18]
push ebp
push ebx
push 0x105
push edi
push esi
call eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x20]
xor ecx, esp
call fcn.10001e2b
add esp, 0x24
ret
mov ecx, dword [esp + 0x30]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
xor eax, eax
call fcn.10001e2b
add esp, 0x24
ret

Function at 0x1000d190
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x1001d160]
xor eax, esp
mov dword [esp + 0x14], eax
push ebx
mov ebx, dword [esp + 0x28]
push ebp
mov ebp, dword [esp + 0x30]
push esi
push edi
mov edi, edx
mov esi, ecx
call fcn.10011ac0
mov ecx, eax
call fcn.100119f0
test eax, eax
je 0x1000d21f
lea ecx, [esp + 0x10]
push ecx
push eax
mov word [esp + 0x1b], 0x7551
mov dword [esp + 0x25], 0x417845
mov dword [esp + 0x1e], 0x61567972
mov word [esp + 0x23], 0x6575
mov word [esp + 0x18], 0x6552
mov byte [esp + 0x1a], 0x67
mov byte [esp + 0x1d], 0x65
mov byte [esp + 0x22], 0x6c
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000d21f
push ebp
push ebx
push 0
push 0
push edi
push esi
call eax
pop edi
pop esi
pop ebp
pop ebx
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10001e2b
add esp, 0x18
ret
mov ecx, dword [esp + 0x24]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
mov eax, 1
call fcn.10001e2b
add esp, 0x18
ret

Function at 0x1000d240
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1001d160]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
push edi
mov edi, dword [esp + 0x28]
mov esi, edx
call fcn.10011ac0
mov ecx, eax
call fcn.100119f0
test eax, eax
je 0x1000d2be
lea ecx, [esp + 8]
push ecx
push eax
mov dword [esp + 0x14], 0x4b6e6570
mov dword [esp + 0x1a], 0x417845
mov word [esp + 0x18], 0x7965
mov word [esp + 0x11], 0x6765
mov byte [esp + 0x10], 0x52
mov byte [esp + 0x13], 0x4f
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000d2be
push edi
push dword [esp + 0x28]
push 0
push esi
push 0x80000002
call eax
pop edi
pop esi
mov ecx, dword [esp + 0x10]
xor ecx, esp
call fcn.10001e2b
add esp, 0x14
ret
mov ecx, dword [esp + 0x18]
pop edi
pop esi
xor ecx, esp
mov eax, 1
call fcn.10001e2b
add esp, 0x14
ret
Function at 0x1000d360
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x18
mov eax, dword [0x1001d160]
xor eax, esp
mov dword [esp + 0x14], eax
push esi
lea eax, [esp + 4]
push eax
mov esi, ecx
mov dword [esp + 0x10], 0x6c6f5674
mov dword [esp + 8], 0x646e6946
mov dword [esp + 0xc], 0x73726946
mov dword [esp + 0x15], 0x41656d
mov byte [esp + 0x14], 0x75
call fcn.10011ac0
mov ecx, eax
call fcn.10011a50
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000d3ca
push 0x104
push esi
call eax
pop esi
mov ecx, dword [esp + 0x14]
xor ecx, esp
call fcn.10001e2b
add esp, 0x18
ret
mov ecx, dword [esp + 0x18]
pop esi
xor ecx, esp
or eax, 0xffffffff
call fcn.10001e2b
add esp, 0x18
ret

Function at 0x1000d3e0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x1c
mov eax, dword [0x1001d160]
xor eax, esp
mov dword [esp + 0x18], eax
push esi
mov esi, edx
call fcn.10011ac0
mov ecx, eax
call fcn.10011990
test eax, eax
je 0x1000d46c
lea ecx, [esp + 4]
push ecx
push eax
mov word [esp + 0x16], 0x6c61
mov dword [esp + 0x1d], 0x74615072
mov dword [esp + 0x11], 0x63657053
mov dword [esp + 0xc], 0x65474853
mov dword [esp + 0x19], 0x65646c6f
mov word [esp + 0x22], 0x41
mov byte [esp + 0x21], 0x68
mov byte [esp + 0x15], 0x69
mov byte [esp + 0x10], 0x74
mov byte [esp + 0x18], 0x46
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x1000d46c
push 0
push 0x25
push esi
push 0
call eax
pop esi
mov ecx, dword [esp + 0x18]
xor ecx, esp
call fcn.10001e2b
add esp, 0x1c
ret
mov ecx, dword [esp + 0x1c]
pop esi
xor ecx, esp
xor eax, eax
call fcn.10001e2b
add esp, 0x1c
ret

Function at 0x1000d480
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x808
mov eax, dword [0x1001d160]
xor eax, esp
mov dword [esp + 0x804], eax
mov eax, dword [esp + 0x810]
mov dword [0x10024074], eax
mov eax, dword [esp + 0x818]
push esi
mov dword [0x10024078], eax
mov eax, dword [esp + 0x818]
push 0x3ff
mov dword [0x10024070], eax
lea eax, [esp + 0x40d]
push 0
push eax
mov byte [esp + 0x414], 0
call fcn.10007c80
push 0x3ff
lea eax, [esp + 0x19]
push 0
push eax
mov byte [esp + 0x20], 0
call fcn.10007c80
add esp, 0x18
lea ecx, [esp + 0x408]
call fcn.1000e510
lea ecx, [esp + 8]
call fcn.1000e510
push 0
push 0x80
push 2
push 0
push 0
push 0x40000000
lea eax, [esp + 0x420]
push eax
call dword [sym.imp.KERNEL32.dll_CreateFileA]
mov esi, eax
cmp esi, 0xffffffff
je 0x1000d550
push 0
lea eax, [esp + 8]
push eax
lea eax, [esp + 0x10]
push eax
call dword [sym.imp.KERNEL32.dll_lstrlenA]
push eax
lea eax, [esp + 0x14]
push eax
push esi
call dword [sym.imp.KERNEL32.dll_WriteFile]
mov ecx, esi
call fcn.1000c6f0
mov ecx, dword [esp + 0x808]
pop esi
xor ecx, esp
call fcn.10001e2b
add esp, 0x808
ret
Function at 0x1000e270
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x3c
mov eax, dword [0x1001d160]
xor eax, esp
mov dword [esp + 0x34], eax
lea eax, [esp + 4]
push eax
mov dword [esp + 8], 0
call fcn.1000c860
mov ecx, eax
call fcn.1000ce70
add esp, 4
test eax, eax
je 0x1000e312
lea eax, [esp + 8]
push eax
lea edx, [esp + 0x24]
mov dword [esp + 0x2b], 0x76697250
mov dword [esp + 0x31], 0x656765
mov dword [esp + 0x24], 0x65446553
mov word [esp + 0x28], 0x7562
mov byte [esp + 0x2a], 0x67
mov word [esp + 0x2f], 0x6c69
call fcn.1000cdc0
add esp, 4
test eax, eax
je 0x1000e312
mov eax, dword [esp + 8]
mov ecx, dword [esp + 4]
mov dword [esp + 0x14], eax
mov eax, dword [esp + 0xc]
mov dword [esp + 0x18], eax
sub esp, 0xc
lea eax, [esp + 0x1c]
push eax
mov dword [esp + 0x20], 1
mov dword [esp + 0x2c], 2
call fcn.1000cd20
add esp, 0x10
mov ecx, dword [esp + 4]
call fcn.1000c6f0
mov ecx, dword [esp + 0x34]
xor ecx, esp
call fcn.10001e2b
add esp, 0x3c
ret

Function at 0x1000f0a0
Capabilities:
Hash data with md5

Disassembly:
push esi
mov esi, ecx
push 0x40
lea eax, [esi + 4]
push 0
push eax
mov dword [esi], 0x1001b348
call fcn.10007c80
add esp, 0xc
mov dword [esi + 0x48], 0
mov dword [esi + 0x44], 0
mov dword [esi + 0x4c], 0x67452301
mov dword [esi + 0x50], 0xefcdab89
mov dword [esi + 0x54], 0x98badcfe
mov dword [esi + 0x58], 0x10325476
mov eax, esi
pop esi
ret
Function at 0x100118d0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x10
mov eax, dword [0x1001d160]
xor eax, esp
mov dword [esp + 0xc], eax
push esi
mov esi, ecx
cmp dword [esi + 0x14], 0
jne 0x10011915
lea eax, [esp + 4]
push eax
mov word [esp + 0x10], 0x6c
mov dword [esp + 0xb], 0x642e3233
mov word [esp + 9], 0x6964
mov byte [esp + 8], 0x47
mov byte [esp + 0xf], 0x6c
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esi + 0x14], eax
mov eax, dword [esi + 0x14]
mov ecx, dword [esp + 0x10]
pop esi
xor ecx, esp
call fcn.10001e2b
add esp, 0x10
ret

Function at 0x100119f0
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1001d160]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov esi, ecx
cmp dword [esi + 4], 0
jne 0x10011a38
lea eax, [esp + 4]
push eax
mov word [esp + 0xc], 0x6970
mov dword [esp + 0xf], 0x6c642e32
mov word [esp + 0x13], 0x6c
mov dword [esp + 8], 0x61766441
mov byte [esp + 0xe], 0x33
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov dword [esi + 4], eax
mov eax, dword [esi + 4]
mov ecx, dword [esp + 0x14]
pop esi
xor ecx, esp
call fcn.10001e2b
add esp, 0x14
ret

Function at 0x10011a50
Capabilities:
Contain obfuscated stackstrings

Disassembly:
sub esp, 0x14
mov eax, dword [0x1001d160]
xor eax, esp
mov dword [esp + 0x10], eax
push esi
mov esi, ecx
cmp dword [esi], 0
jne 0x10011a9f
lea eax, [esp + 4]
push eax
mov dword [esp + 0x11], 0x6c6c64
mov word [esp + 0xb], 0x656e
mov word [esp + 0xe], 0x3233
mov word [esp + 8], 0x654b
mov byte [esp + 0xa], 0x72
mov byte [esp + 0xd], 0x6c
mov byte [esp + 0x10], 0x2e
call dword [sym.imp.KERNEL32.dll_GetModuleHandleA]
mov dword [esi], eax
mov eax, dword [esi]
mov ecx, dword [esp + 0x14]
pop esi
xor ecx, esp
call fcn.10001e2b
add esp, 0x14
ret
Function at 0x1001cf50
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x30
mov eax, dword [0x100df320]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 8]
push esi
mov esi, ecx
cmp ebx, 0xffffffff
jne 0x1001cf80
pop esi
xor eax, eax
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
mov eax, dword [esi + 0x20]
mov eax, dword [eax]
test eax, eax
je 0x1001cfb0
mov edx, dword [esi + 0x30]
mov edx, dword [edx]
add edx, eax
cmp eax, edx
jae 0x1001cfb0
call dword [sym.imp.MSVCP140.dll_protected:_char____thiscall_std::basic_streambuf_char__struct_std::char_traits_char__::_Pninc_void_]
pop esi
mov byte [eax], bl
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
cmp dword [esi + 0x4c], 0
push edi
je 0x1001d0ab
mov edi, dword [esi + 0xc]
lea eax, [esi + 0x3c]
cmp dword [edi], eax
jne 0x1001cfd9
mov edx, dword [esi + 0x54]
mov ecx, dword [esi + 0x50]
sub edx, ecx
mov dword [edi], ecx
mov eax, dword [esi + 0x1c]
mov dword [eax], ecx
mov eax, dword [esi + 0x2c]
mov dword [eax], edx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1001d00d
push dword [esi + 0x4c]
movsx eax, bl
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fputc]
add esp, 8
or ecx, 0xffffffff
cmp eax, ecx
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x28], bl
push eax
lea eax, [ebp - 4]
push eax
lea eax, [ebp - 0x24]
push eax
lea eax, [ebp - 0x30]
push eax
lea eax, [ebp - 0x27]
push eax
lea eax, [ebp - 0x28]
push eax
lea eax, [esi + 0x40]
push eax
call dword [sym.imp.MSVCP140.dll_public:_int___thiscall_std::codecvt_char__char__struct__Mbstatet_::out_struct__Mbstatet___char_const___char_const___char_const____char___char___char___const]
sub eax, 0
je 0x1001d06c
sub eax, 1
je 0x1001d06c
sub eax, 2
jne 0x1001d0ab
push dword [esi + 0x4c]
push dword [ebp - 0x28]
call fcn.10077600
add esp, 8
or ecx, 0xffffffff
test al, al
cmovne ecx, ebx
pop edi
pop esi
mov eax, ecx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
mov edi, dword [ebp - 0x2c]
lea eax, [ebp - 0x24]
sub edi, eax
je 0x1001d08a
push dword [esi + 0x4c]
push edi
push 1
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fwrite]
add esp, 0x10
cmp edi, eax
jne 0x1001d0ab
lea eax, [ebp - 0x28]
mov byte [esi + 0x3d], 1
cmp dword [ebp - 0x30], eax
je 0x1001d0ab
pop edi
pop esi
mov eax, ebx
pop ebx
mov ecx, dword [ebp - 4]
xor ecx, ebp
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
mov ecx, dword [ebp - 4]
or eax, 0xffffffff
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.100a7270
mov esp, ebp
pop ebp
ret 4
Function at 0x10077600
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x5c
pushal
call 0x1007760f
pop dword [ebp - 0x4c]
mov eax, 0x746c19a0
add eax, 0x9b9b5c6f
sub dword [ebp - 0x4c], eax
mov dword [ebp - 0x5c], 0x65f73570
sub dword [ebp - 0x5c], 0x17a4f025
mov dword [ebp - 0x58], 0x6be70fd2
add dword [ebp - 0x58], 0xc64c3c73
mov dword [ebp - 0x54], 0xef03239e
add dword [ebp - 0x54], 0x5d492090
mov dword [ebp - 0x50], 0x4502a695
sub dword [ebp - 0x50], 0x4502a695
lea eax, [ebp - 0x5c]
push eax
mov eax, 0x19041748
sub eax, 0x8f8a668
add eax, dword [ebp - 0x4c]
call dword [eax]
mov dword [ebp - 0x5c], 0x4a429bbd
sub dword [ebp - 0x5c], 0xd5d03267
mov dword [ebp - 0x58], 0xf1d1da49
sub dword [ebp - 0x58], 0xb06578d4
mov dword [ebp - 0x54], 0x980bb081
add dword [ebp - 0x54], 0xcb63bbeb
mov dword [ebp - 0x50], 0x14262900
add dword [ebp - 0x50], 0xebd9d700
lea ebx, [ebp - 0x5c]
push ebx
push eax
mov eax, 0x3c69557e
add eax, 0xd3a21b1e
add eax, dword [ebp - 0x4c]
call dword [eax]
push 0x40
push 0x1000
push 0x5d279
push 0
call eax
mov ecx, 0x4592
mov ebx, eax
mov esi, 0x95248a1
sub esi, 0xf94314a1
add esi, dword [ebp - 0x4c]
mov edx, 0x7466eb93
xor dword [ebp - 0x34], 0x6724ab31
mov edi, dword [esi]
xor dword [ebp - 0x38], 0x846e4cb2
add edi, edx
mov dword [ebp - 0x2c], 0x292bcb73
mov dword [ebx], edi
xor dword [ebp - 0x1c], 0xbf31ad0f
add ebx, 4
add esi, 0xb5086853
add esi, 0x4af797b1
loop 0x10077725
add eax, 0x7c9edcc9
sub eax, 0x7c9dd3ae
mov ebx, eax
add eax, 0xeceb9f78
add eax, 0x1314608d
mov ecx, 0x8d7aae00
sub ecx, 0x7d7aae00
add ecx, dword [ebp - 0x4c]
call ebx
leave
ret