joyce8/EMBER2024-capa huggingface dataset:
Function at 0x100441b0
Capabilities:
Check for software breakpoints

Disassembly:
push esi
mov esi, dword [esp + 8]
cmp dword [esi + 0x10], 0xca
jne 0x100441e3
push esi
call fcn.100472c0
mov eax, dword [esi + 0x40]
add esp, 4
test eax, eax
je 0x100441dc
mov dword [esi + 0x10], 0xcf
mov eax, 1
pop esi
ret
mov dword [esi + 0x10], 0xcb
mov eax, dword [esi + 0x10]
cmp eax, 0xcb
jne 0x10044269
mov eax, dword [esi + 0x1b0]
mov ecx, dword [eax + 0x10]
test ecx, ecx
je 0x10044252
mov eax, dword [esi + 8]
test eax, eax
je 0x10044207
push esi
call dword [eax]
add esp, 4
mov ecx, dword [esi + 0x1b0]
push esi
call dword [ecx]
add esp, 4
test eax, eax
je 0x1004424e
cmp eax, 2
je 0x10044252
mov ecx, dword [esi + 8]
test ecx, ecx
je 0x100441fa
cmp eax, 3
je 0x1004422d
cmp eax, 1
jne 0x100441fa
mov eax, dword [ecx + 4]
inc eax
mov dword [ecx + 4], eax
mov eax, dword [esi + 8]
mov ecx, dword [eax + 8]
mov edx, dword [eax + 4]
cmp edx, ecx
jl 0x100441fa
mov edx, dword [esi + 0x13c]
add edx, ecx
mov dword [eax + 8], edx
jmp 0x100441fa
xor eax, eax
pop esi
ret
mov eax, dword [esi + 0x90]
push esi
mov dword [esi + 0x98], eax
call fcn.10044290
add esp, 4
pop esi
ret
cmp eax, 0xcc
je 0x10044278
mov ecx, dword [esi]
push esi
call dword [ecx]
add esp, 4
push esi
call fcn.10044290
add esp, 4
pop esi
ret

Function at 0x100630d5
Capabilities:
Get graphical window text

Disassembly:
push esi
mov esi, ecx
mov ecx, dword [esi + 0x38]
test ecx, ecx
jne 0x1006310d
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextLengthA]
lea ecx, [eax + 1]
push ecx
mov ecx, dword [esp + 0xc]
push eax
call fcn.1006118c
push eax
push dword [esi + 0x1c]
call dword [sym.imp.USER32.dll_GetWindowTextA]
mov ecx, dword [esp + 8]
push 0xffffffffffffffff
call fcn.10061164
jmp 0x10063119
mov eax, dword [ecx]
push dword [esp + 8]
call dword [eax + 0x88]
pop esi
ret 4

Function at 0x100647c3
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
push esi
push edi
xor edi, edi
cmp dword [esp + 0x10], edi
mov ebx, ecx
je 0x10064805
call fcn.1006a299
mov esi, dword [eax + 0xc]
push 0xf0
push dword [esp + 0x14]
push esi
call dword [sym.imp.KERNEL32.dll_FindResourceA]
cmp eax, edi
je 0x10064805
push eax
push esi
call dword [sym.imp.KERNEL32.dll_LoadResource]
cmp eax, edi
jne 0x100647fc
xor eax, eax
jmp 0x1006480d
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov edi, eax
push edi
mov ecx, ebx
call fcn.10064813
pop edi
pop esi
pop ebx
ret 4
Function at 0x44a400
Capabilities:
Read file on windows

Disassembly:
mov eax, 0x1020
call fcn.004b63b0
mov eax, dword [0x78e580]
xor eax, esp
mov dword [esp + 0x101c], eax
mov eax, dword [esp + 0x1024]
push ebx
push ebp
mov ebp, dword [esp + 0x1030]
xor ebx, ebx
mov dword [esp + 0xc], eax
mov eax, dword [esp + 0x1034]
push esi
mov dword [esp + 0x24], eax
xor esi, esi
mov eax, dword [esp + 0x103c]
push edi
mov dword [esp + 0x24], eax
xor edi, edi
mov eax, dword [esp + 0x1044]
push ebp
mov dword [esp + 0x1c], eax
call fcn.004ca943
pop ecx
jmp 0x44a510
push ebp
push 0x1000
lea eax, [esp + 0x34]
push 1
push eax
call fcn.004bd0d6
add esp, 0x10
mov dword [esp + 0x10], eax
call fcn.004bb8cc
mov ecx, dword [esp + 0x10]
mov eax, dword [eax]
mov dword [esp + 0x20], eax
or eax, 0xffffffff
sub eax, ecx
cmp esi, eax
ja 0x44a5ce
lea eax, [ecx + esi]
mov dword [esp + 0x1c], eax
cmp eax, edi
jb 0x44a4e1
test ebx, ebx
je 0x44a4b5
cmp edi, 0x7fffffff
ja 0x44a5ce
add edi, edi
jmp 0x44a4c4
lea eax, [ecx + 1]
mov ecx, 0x1000
cmp eax, ecx
mov edi, ecx
cmovb edi, eax
push edi
push ebx
call fcn.00441e99
pop ecx
pop ecx
test eax, eax
je 0x44a562
mov ebx, eax
mov ecx, dword [esp + 0x10]
cmp dword [esp + 0x1c], edi
jae 0x44a4a1
push ebp
call fcn.004ca96f
pop ecx
test eax, eax
jne 0x44a59f
mov eax, dword [esp + 0x10]
push eax
lea eax, [esp + 0x30]
push eax
lea eax, [esi + ebx]
push eax
call fcn.004b8970
mov esi, dword [esp + 0x28]
push ebp
call fcn.004ca943
add esp, 0x10
test eax, eax
je 0x44a461
push ebp
call fcn.004bcd32
pop ecx
test edi, edi
jne 0x44a532
push 1
push 1
call fcn.00441e16
pop ecx
pop ecx
mov ebx, eax
xor esi, esi
mov eax, dword [esp + 0x24]
mov byte [esi + ebx], 0
test eax, eax
je 0x44a540
mov dword [eax], esi
mov ecx, dword [esp + 0x28]
xor eax, eax
inc eax
mov dword [ecx], ebx
mov ecx, dword [esp + 0x102c]
pop edi
pop esi
pop ebp
pop ebx
xor ecx, esp
call fcn.004b5ec4
add esp, 0x1020
ret
push dword [esp + 0x14]
call fcn.00458495
pop ecx
mov esi, eax
push esi
push edi
push edi
push str.Could_not_allocate__lu_bytes_to_read_file__s
push str.Could_not_allocate__lu_byte_to_read_file__s
push str.glib20
call fcn.00451b36
add esp, 0x10
push eax
push 0xd
call fcn.00449b7d
push eax
push dword [esp + 0x2c]
call fcn.004418a5
add esp, 0x18
jmp 0x44a5fb
push dword [esp + 0x14]
call fcn.00458495
mov edi, dword [esp + 0x24]
mov esi, eax
push edi
call fcn.00447d32
pop ecx
pop ecx
push eax
push esi
push str.Error_reading_file__s:__s
call fcn.00451b5b
pop ecx
push eax
push edi
call fcn.00449a7e
pop ecx
push eax
jmp 0x44a58b
push dword [esp + 0x14]
call fcn.00458495
pop ecx
mov esi, eax
push esi
push str.File__s_is_too_large
call fcn.00451b5b
pop ecx
push eax
push 0x18
call fcn.00449b7d
push eax
push dword [esp + 0x28]
call fcn.004418a5
add esp, 0x14
push esi
call fcn.00441dce
push ebx
call fcn.00441dce
push ebp
call fcn.004bcd32
add esp, 0xc
xor eax, eax
jmp 0x44a549
Function at 0x44cf06
Capabilities:
Contain obfuscated stackstrings

Disassembly:
and al, dh
inc ebp
movsd dword es:[edi], dword [esi]
xor eax, 0x41a645c6
call fcn.0044cb18
push eax
push esi
push dword [ebp + 8]
call fcn.0044cacd
mov dword [ebp - 0xbc], eax
lea eax, [ebp - 0x2c]
mov byte [ebp - 0x2c], bl
push eax
mov byte [ebp - 0x2b], bl
mov byte [ebp - 0x2a], 0xd4
mov byte [ebp - 0x29], bl
mov byte [ebp - 0x28], 0x67
mov byte [ebp - 0x27], 0x44
mov byte [ebp - 0x26], 0x4a
mov byte [ebp - 0x25], 0x4f
mov byte [ebp - 0x24], 0x67
mov byte [ebp - 0x23], 0x42
inc ebp
fld qword [edx - 0x3a]
inc ebp
fimul word [ecx - 0x3a]
inc ebp
fistp word [ecx - 0x3a]
inc ebp
loopne 0x44cfa3

Function at 0x44d1b7
Capabilities:
Inspect section memory permissions

Disassembly:
cmp dword [eax], ebx
je 0x44d1bc
mov edx, dword [eax + 4]
lea ecx, [eax + 8]
add edx, eax
mov dword [ebp + 8], ecx
cmp ecx, edx
jae fcn.0044d1b7
mov ecx, dword [ebp + 8]
movzx ecx, word [ecx]
mov edx, ecx
and edx, 0xf000
cmp edx, 0x3000
jne 0x44d1a1
and ecx, 0xfff
mov edx, esi
sub edx, dword [edi + 0x34]
add ecx, esi
add ecx, dword [eax]
add dword [ecx], edx
jmp 0x44d1a9
cmp edx, ebx
jne 0x44d2f7
mov ecx, dword [eax + 4]
add dword [ebp + 8], 2
add ecx, eax
cmp dword [ebp + 8], ecx
jb 0x44d178
add eax, dword [eax + 4]
jmp 0x44d165
mov dword [ebp + 0xc], ebx
jmp 0x44d1c7
Function at 0x44d1d6
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x44d1df
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x44d1fd
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
xbegin 0x8b44d1fb
js 0x44d221
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
sal edi, 0xb5
push esp
invalid
invalid
invalid
cmp eax, dword [ebp - 0x44]
ja 0x44d25b
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
inc eax
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x44d242
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x44d24b
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x44d255
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x44d237
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x44d1c1
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x44d2a8
dec eax
je 0x44d29f
sub eax, 3
je 0x44d296
mov dword [ebp - 4], 0x40
jmp 0x44d2c5
mov dword [ebp - 4], 4
jmp 0x44d2ab
mov dword [ebp - 4], 0x20
jmp 0x44d2ab
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x44d2f7
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x44d277
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0044cb08
push cs
adc al, 0xe4
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x44d303
Function at 0x44d1e1
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x44d1df
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x44d1fd
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
xbegin 0x8b44d1fb
js 0x44d221
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
sal edi, 0xb5
push esp
invalid
invalid
invalid
cmp eax, dword [ebp - 0x44]
ja 0x44d25b
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
inc eax
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x44d242
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x44d24b
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x44d255
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x44d237
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x44d1c1
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x44d2a8
dec eax
je 0x44d29f
sub eax, 3
je 0x44d296
mov dword [ebp - 4], 0x40
jmp 0x44d2c5
mov dword [ebp - 4], 4
jmp 0x44d2ab
mov dword [ebp - 4], 0x20
jmp 0x44d2ab
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x44d2f7
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x44d277
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0044cb08
push cs
adc al, 0xe4
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x44d303
Function at 0x44d226
Capabilities:
Inspect section memory permissions

Disassembly:
mov edi, dword [ebp - 0x88]
mov eax, dword [ebp + 0xc]
cmp ax, word [edi + 6]
jne 0x44d1df
mov edx, dword [ebp - 0xb4]
xor ecx, ecx
mov edi, 0x60000000
jmp 0x44d1fd
movzx eax, ax
lea eax, [eax + eax*4]
mov ecx, dword [edi + eax*8 + 0x104]
mov edx, dword [edi + eax*8 + 0x108]
lea eax, [edi + eax*8 + 0xf8]
xbegin 0x8b44d1fb
js 0x44d221
lea eax, [edx + ecx - 1]
xor edx, edx
div dword [ebp - 0xac]
xor edx, edx
mov dword [ebp - 0x44], eax
mov eax, ecx
sal edi, 0xb5
push esp
invalid
invalid
invalid
cmp eax, dword [ebp - 0x44]
ja 0x44d25b
mov edx, edi
mov dword [ebp + 8], edi
and dword [ebp + 8], 0x40000000
inc eax
mov dword [ebp + 0x10], edi
and edx, 0x20000000
and dword [ebp + 0x10], 0x80000000
mov ecx, dword [ebp + 0x18]
cmp edx, ebx
je 0x44d242
or byte [eax + ecx], 1
cmp dword [ebp + 8], ebx
je 0x44d24b
or byte [eax + ecx], 2
cmp dword [ebp + 0x10], ebx
je 0x44d255
add ecx, eax
or byte [ecx], 4
inc eax
cmp eax, dword [ebp - 0x44]
jbe 0x44d237
inc dword [ebp + 0xc]
mov eax, dword [ebp - 0x88]
mov cx, word [ebp + 0xc]
cmp cx, word [eax + 6]
jbe 0x44d1c1
mov dword [ebp + 8], esi
xor edi, edi
mov eax, dword [ebp + 0x18]
push 2
pop ecx
movzx eax, byte [edi + eax]
sub eax, ecx
je 0x44d2a8
dec eax
je 0x44d29f
sub eax, 3
je 0x44d296
mov dword [ebp - 4], 0x40
jmp 0x44d2c5
mov dword [ebp - 4], 4
jmp 0x44d2ab
mov dword [ebp - 4], 0x20
jmp 0x44d2ab
mov dword [ebp - 4], ecx
lea eax, [ebp - 4]
push eax
push dword [ebp - 4]
push dword [ebp - 0xac]
push dword [ebp + 8]
call dword [ebp - 0xbc]
test eax, eax
je 0x44d2f7
mov eax, dword [ebp - 0xac]
add dword [ebp + 8], eax
inc edi
cmp edi, dword [ebp - 0x8c]
jbe 0x44d277
mov eax, dword [ebp - 0x88]
mov edi, dword [eax + 0x28]
add edi, esi
call fcn.0044cb08
push cs
adc al, 0xe4
push dword [ebp + 0x14]
push 1
push esi
call edi
mov eax, esi
jmp 0x44d303

Function at 0x44d9cc
Capabilities:
Contain obfuscated stackstrings

Disassembly:
add byte [edx + 0x40], ch
pop ecx
xor eax, eax
lea edi, [ebp - 0x22f]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
and byte [ebp - 0x12c], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x12b]
invalid
invalid
push ebx
stosd dword es:[edi], eax
Function at 0x45589a
Capabilities:
Encode data using xor
Generate random numbers using a mersenne twister

Disassembly:
mov edx, dword [esp + 4]
push edi
mov edi, dword [edx + 0x9c0]
cmp edi, 0x270
jb 0x45594a
push ebx
xor edi, edi
mov ebx, 0x7fffffff
push esi
mov esi, edi
mov ecx, dword [edx + esi*4 + 4]
xor ecx, dword [edx + esi*4]
and ecx, ebx
xor ecx, dword [edx + esi*4]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x52b1b4]
xor ecx, dword [edx + esi*4 + 0x634]
mov dword [edx + esi*4], ecx
inc esi
cmp esi, 0xe3
jl 0x4558bc
mov ecx, dword [edx + esi*4 + 4]
xor ecx, dword [edx + esi*4]
and ecx, ebx
xor ecx, dword [edx + esi*4]
mov eax, ecx
shr ecx, 1
and eax, 1
xor ecx, dword [eax*4 + 0x52b1b4]
xor ecx, dword [edx + esi*4 - 0x38c]
mov dword [edx + esi*4], ecx
inc esi
cmp esi, 0x26f
jl 0x4558e9
mov ecx, dword [edx + 0x9bc]
xor ecx, dword [edx]
and ecx, ebx
xor ecx, dword [edx + 0x9bc]
mov eax, ecx
shr ecx, 1
and eax, 1
pop esi
pop ebx
mov eax, dword [eax*4 + 0x52b1b4]
xor eax, dword [edx + 0x630]
xor eax, ecx
mov dword [edx + 0x9bc], eax
mov dword [edx + 0x9c0], edi
mov ecx, dword [edx + edi*4]
lea eax, [edi + 1]
mov dword [edx + 0x9c0], eax
mov eax, ecx
shr eax, 0xb
xor ecx, eax
mov eax, ecx
and eax, 0xff3a58ad
shl eax, 7
xor ecx, eax
mov eax, ecx
and eax, 0xffffdf8c
shl eax, 0xf
xor ecx, eax
mov eax, ecx
shr eax, 0x12
xor eax, ecx
pop edi
ret

Function at 0x45ac4c
Capabilities:
Hash data using sha1

Disassembly:
push esi
mov esi, dword [esp + 8]
push dword [esi + 4]
call fcn.00441dce
mov eax, dword [esi]
pop ecx
xor ecx, ecx
mov dword [esi + 4], ecx
sub eax, ecx
je 0x45aca1
sub eax, 1
je 0x45ac95
sub eax, 1
je 0x45ac87
sub eax, 1
lea eax, [esi + 8]
push eax
je 0x45ac80
call fcn.0045f271
pop ecx
pop esi
ret
call fcn.0045f4a0
jmp 0x45ac7d
lea eax, [esi + 8]
push eax
call fcn.0045c96f
add esp, 4
pop esi
ret
mov dword [esi + 0x18], 0xc3d2e1f0
mov dword [esi + 0x20], ecx
jmp 0x45aca4
mov dword [esi + 0x18], ecx
mov dword [esi + 0x1c], ecx
mov dword [esi + 0x14], 0x10325476
mov dword [esi + 0x10], 0x98badcfe
mov dword [esi + 0xc], 0xefcdab89
mov dword [esi + 8], 0x67452301
pop esi
ret
Function at 0x4796cb
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
push edi
push 8
mov edx, dword [esi]
mov eax, edx
shr eax, 0x13
movzx ecx, al
mov eax, edx
shr eax, 0x11
shr edx, 0xf
and eax, 3
and edx, 2
add ecx, eax
lea eax, [edx + 1]
add eax, ecx
push eax
push dword [esi + 0xc]
call fcn.00441e4b
mov edi, dword [esi]
mov ebx, eax
mov ecx, edi
mov dword [esi + 0xc], ebx
shr ecx, 0x13
add esp, 0xc
movzx eax, cl
test cl, cl
je 0x479737
mov edx, edi
shr edi, 0x11
shr edx, 0x10
and edi, 3
and edx, 1
add edx, edx
lea ecx, [edx + edi]
add edx, edi
add edx, eax
mov eax, dword [ebx + ecx*8]
mov ecx, dword [ebx + ecx*8 + 4]
mov dword [ebx + edx*8], eax
mov dword [ebx + edx*8 + 4], ecx
mov eax, dword [esi]
mov edx, eax
mov ecx, dword [esi + 0xc]
shr eax, 0xf
shr edx, 0x11
and eax, 2
and edx, 3
add edx, eax
mov eax, dword [esp + 0x14]
mov dword [ecx + edx*8], eax
mov ecx, dword [esi + 0xc]
mov eax, dword [esp + 0x18]
mov dword [ecx + edx*8 + 4], eax
mov ecx, dword [esi]
lea eax, [ecx + 0x20000]
xor eax, ecx
and eax, 0x60000
xor eax, ecx
push eax
push ecx
push esi
call fcn.0044131a
add esp, 0xc
test eax, eax
je 0x47975e
pop edi
pop esi
pop ebx
ret

Function at 0x479782
Capabilities:
Encode data using xor

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push esi
push edi
push 8
mov edx, dword [ebx]
mov eax, edx
shr eax, 0x13
movzx ecx, al
mov eax, edx
shr eax, 0x11
shr edx, 0xf
and eax, 3
and edx, 2
add ecx, eax
lea eax, [edx + 1]
add eax, ecx
push eax
push dword [ebx + 0xc]
call fcn.00441e4b
mov edx, dword [ebx]
mov edi, eax
mov eax, dword [esp + 0x20]
mov ecx, edx
shr ecx, 0x13
add esp, 0xc
movzx esi, cl
mov ecx, edx
shr ecx, 0x11
and ecx, 3
shr edx, 0xf
add esi, ecx
mov dword [ebx + 0xc], edi
and edx, 2
add esi, edx
mov dword [edi + esi*8], eax
mov ecx, dword [ebx + 0xc]
mov eax, dword [esp + 0x18]
mov dword [ecx + esi*8 + 4], eax
mov ecx, dword [ebx]
lea eax, [ecx + 0x80000]
xor eax, ecx
and eax, 0x7f80000
xor eax, ecx
push eax
push ecx
push ebx
call fcn.0044131a
add esp, 0xc
test eax, eax
je 0x4797e9
pop edi
pop esi
pop ebx
ret

Function at 0x479ab5
Capabilities:
Encode data using xor

Disassembly:
push esi
mov esi, dword [esp + 8]
mov edx, dword [esi]
lea ecx, [edx + 1]
xor ecx, edx
and ecx, 0x7fff
xor ecx, edx
push ecx
push edx
push esi
call fcn.0044131a
add esp, 0xc
test eax, eax
je 0x479aba
mov eax, esi
pop esi
ret

Function at 0x479b66
Capabilities:
Encode data using xor

Disassembly:
push ebx
push esi
mov esi, dword [esp + 0xc]
mov ebx, 0x7fff
push edi
mov eax, dword [esi]
and eax, ebx
cmp eax, 1
jne 0x479b82
push esi
call fcn.00479983
pop ecx
mov ecx, dword [esi]
lea eax, [ecx - 1]
xor eax, ecx
and eax, ebx
xor eax, ecx
push eax
push ecx
mov edi, eax
push esi
and edi, ebx
call fcn.0044131a
add esp, 0xc
test eax, eax
je 0x479b82
test edi, edi
jne 0x479bbf
push edi
push esi
call fcn.00478fe2
push dword [esi + 0xc]
call fcn.00441dce
lea eax, [esi - 0x10]
push eax
call fcn.00441dce
add esp, 0x10
pop edi
pop esi
pop ebx
ret
Function at 0x100010a0
Capabilities:
Check os version

Disassembly:
cmp dword [0x1009c330], 0
push esi
mov esi, ecx
jne 0x100010c9
push 0x1009c330
mov dword [0x1009c330], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
test eax, eax
je case.default.0x100010ce
cmp esi, 5
ja case.default.0x100010ce
jmp dword [esi*4 + 0x10001150]
cmp dword [0x1009c340], 1
pop esi
sete al
ret
cmp dword [0x1009c340], 2
pop esi
sete al
ret
cmp dword [0x1009c340], 2
jne case.default.0x100010ce
cmp dword [0x1009c334], 4
jne case.default.0x100010ce
mov al, 1
pop esi
ret
cmp dword [0x1009c340], 2
jne case.default.0x100010ce
cmp dword [0x1009c334], 5
jne case.default.0x100010ce
cmp dword [0x1009c338], 1
jb case.default.0x100010ce
mov al, 1
pop esi
ret
cmp dword [0x1009c340], 2
jne case.default.0x100010ce
mov eax, dword [0x1009c334]
cmp eax, 5
ja 0x100010ff
jmp 0x10001113
cmp dword [0x1009c340], 2
jne case.default.0x100010ce
cmp dword [0x1009c334], 6
jae 0x100010ff
xor al, al
pop esi
ret

Function at 0x10002fa0
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1007bd70
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x10099018]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov dword [ebp - 0x10], esp
mov esi, ecx
xor bl, bl
mov dword [ebp - 4], 0
mov ecx, 5
mov byte [ebp - 0x11], bl
call fcn.100010a0
test al, al
je 0x100030c5
push str.ieframe.dll
mov dword [ebp - 0x18], 0
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
test eax, eax
je 0x10003116
push str.IEGetWriteableFolderPath
push eax
call dword [sym.imp.KERNEL32.dll_GetProcAddress]
test eax, eax
je 0x10003116
lea ecx, [ebp - 0x18]
push ecx
push 0x10081880
call eax
test eax, eax
js 0x100030be
mov ecx, dword [ebp - 0x18]
test ecx, ecx
je 0x100030be
lea edx, [ecx + 2]
nop word [eax + eax]
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10003040
sub ecx, edx
mov edx, 2
sar ecx, 1
lea eax, [ecx + 1]
xor ecx, ecx
mul edx
seto cl
neg ecx
or ecx, eax
push ecx
call fcn.1002dc41
mov edx, eax
add esp, 4
mov dword [esi], edx
test edx, edx
je 0x10003116
mov esi, dword [ebp - 0x18]
mov ecx, esi
lea edi, [ecx + 2]
nop
mov ax, word [ecx]
add ecx, 2
test ax, ax
jne 0x10003080
sub ecx, edi
sar ecx, 1
push 0xffffffffffffffff
push esi
lea eax, [ecx + 1]
push eax
push edx
call fcn.1004e705
add esp, 0x10
push dword [ebp - 0x18]
call dword [sym.imp.ole32.dll_CoTaskMemFree]
mov bl, 1
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
cmp eax, 0x80004001
jne 0x10003116
push 0x208
call fcn.1002dc41
add esp, 4
mov dword [esi], eax
test eax, eax
je 0x10003116
push eax
push 0
push 0
push 0x20
push 0
call dword [sym.imp.SHELL32.dll_SHGetFolderPathW]
test eax, eax
setns bl
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
mov al, bl
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10008fd0
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0x14
cmp dword [ecx + 0x38], 0
push ebx
push esi
push edi
mov dword [esp + 0xc], ecx
je 0x100090b6
mov esi, dword [ebp + 0x10]
mov ebx, esi
mov edx, dword [ebp + 0xc]
mov edi, edx
mov eax, dword [ebp + 8]
mov dword [esp + 0x10], eax
test esi, esi
jl 0x100090a5
jg 0x10009010
test edx, edx
je 0x100090a5
nop dword [eax]
call fcn.1000b480
mov esi, eax
mov eax, edx
mov dword [esp + 0x14], eax
test eax, eax
jl 0x10009064
jg 0x10009027
test esi, esi
je 0x10009064
cmp ebx, eax
jg 0x10009037
jl 0x10009031
cmp edi, esi
jae 0x10009037
mov esi, edi
mov dword [esp + 0x14], ebx
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
push esi
push eax
mov eax, dword [ecx + 0x20]
push dword [eax]
call fcn.1002f550
mov ecx, dword [esp + 0x18]
add esp, 0xc
sub edi, esi
sbb ebx, dword [esp + 0x14]
mov eax, dword [ecx + 0x30]
sub dword [eax], esi
mov eax, dword [ecx + 0x20]
add dword [eax], esi
jmp 0x10009089
mov ecx, dword [esp + 0xc]
mov eax, dword [esp + 0x10]
mov edx, dword [ecx]
movzx eax, byte [eax]
push eax
call dword [edx + 0xc]
cmp eax, 0xffffffff
je 0x1000909f
mov ecx, dword [esp + 0xc]
add edi, 0xffffffff
mov esi, 1
adc ebx, 0xffffffff
add dword [esp + 0x10], esi
test ebx, ebx
jg 0x10009010
jl 0x1000909f
test edi, edi
jne 0x10009010
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 0x10]
sub edx, edi
mov eax, edx
sbb esi, ebx
mov edx, esi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc
mov eax, dword [ecx + 0x20]
mov esi, dword [ebp + 0xc]
mov edi, dword [ebp + 0x10]
mov dword [esp + 0x18], esi
mov eax, dword [eax]
mov dword [esp + 0x1c], edi
mov dword [esp + 0x10], eax
test eax, eax
je 0x100090d8
mov eax, dword [ecx + 0x30]
mov eax, dword [eax]
jmp 0x100090da
xor eax, eax
cdq
mov ebx, eax
mov eax, edx
mov dword [esp + 0x14], eax
test edi, edi
jl 0x10009158
jg 0x100090ed
test esi, esi
je 0x10009158
test eax, eax
jl 0x10009132
jg 0x100090f7
test ebx, ebx
je 0x10009132
cmp edi, eax
jg 0x10009107
jl 0x10009101
cmp esi, ebx
jae 0x10009107
mov ebx, esi
mov dword [esp + 0x14], edi
push ebx
push dword [ebp + 8]
push dword [esp + 0x18]
call fcn.1002f550
mov ecx, dword [esp + 0x18]
add esp, 0xc
mov edx, dword [ebp + 8]
add edx, ebx
sub esi, ebx
mov eax, dword [ecx + 0x30]
sbb edi, dword [esp + 0x14]
sub dword [eax], ebx
mov eax, dword [ecx + 0x20]
add dword [eax], ebx
jmp 0x10009135
mov edx, dword [ebp + 8]
test edi, edi
jl 0x10009158
jg 0x1000913f
test esi, esi
je 0x10009158
mov eax, dword [ecx + 0x4c]
test eax, eax
je 0x10009158
push eax
push esi
push 1
push edx
call fcn.1004fa8d
add esp, 0x10
sub esi, eax
sbb edi, 0
mov eax, dword [esp + 0x18]
mov edx, dword [esp + 0x1c]
sub eax, esi
sbb edx, edi
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 0xc