joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411ad0
Capabilities:
Write file on windows

Disassembly:
sub esp, 0x1c
mov eax, dword [sym.imp.msvcrt.dll__iob]
mov dword [esp + 8], 0xe
mov dword [esp + 4], 1
mov dword [esp], str.out_of_memory_n
add eax, 0x40
mov dword [esp + 0xc], eax
call sub.msvcrt.dll_fwrite
mov dword [esp], 1
call sub.msvcrt.dll_exit
nop
add byte [eax], al
add byte [eax], al
add byte [eax], al
add byte [eax], al
push ebp
mov ebp, esp
sub esp, 0x18
call fcn.004014f0
mov dword [esp], 0x401540
call fcn.0040ecc0
leave
ret
Function at 0x472e70
Capabilities:
Contain obfuscated stackstrings

Disassembly:
test dword [esi - 0x25000004], ebp
and byte [ebp - 0x351], 0
mov byte [ebp - 0x350], 0x62
mov byte [ebp - 0x34f], 0x40
mov byte [ebp - 0x34e], 0x51
mov byte [ebp - 0x34d], 0x75
mov byte [ebp - 0x34c], 0x57
mov byte [ebp - 0x34b], 0x4a
mov byte [ebp - 0x34a], 0x46
mov byte [ebp - 0x349], 0x40
mov byte [ebp - 0x348], 0x56
mov byte [ebp - 0x347], 0x56
mov byte [ebp - 0x346], 0x6d
mov byte [ebp - 0x345], 0x40
mov byte [ebp - 0x344], 0x44
mov byte [ebp - 0x343], 0x55
mov byte [ebp - 0x342], 0x25
lea eax, [ebp - 0x354]
push eax
call fcn.0047265e
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00472613
add esp, 0xc
mov dword [ebp - 0x68c], eax
call dword [ebp - 0x68c]
mov dword [ebp - 0x674], eax
mov dword [ebp - 0x384], 4
and byte [ebp - 0x334], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x333]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
mov dword [ebp - 0x670], 4
and byte [ebp - 0x3c4], 0
and byte [ebp - 0x3c3], 0
mov byte [ebp - 0x3c2], 0x99
and byte [ebp - 0x3c1], 0
mov byte [ebp - 0x3c0], 0x21
mov byte [ebp - 0x3bf], 3
mov byte [ebp - 0x3be], 0x12
mov byte [ebp - 0x3bd], 0x2b
mov byte [ebp - 0x3bc], 9
mov byte [ebp - 0x3bb], 2
mov byte [ebp - 0x3ba], 0x13
mov byte [ebp - 0x3b9], 0xa
mov byte [ebp - 0x3b8], 3
mov byte [ebp - 0x3b7], 0x20
mov byte [ebp - 0x3b6], 0xf
mov byte [ebp - 0x3b5], 0xa
mov byte [ebp - 0x3b4], 3
mov byte [ebp - 0x3b3], 0x28
mov byte [ebp - 0x3b2], 7
mov byte [ebp - 0x3b1], 0xb
mov byte [ebp - 0x3b0], 3
mov byte [ebp - 0x3af], 0x27
mov byte [ebp - 0x3ae], 0x66
lea eax, [ebp - 0x3c4]
push eax
call fcn.0047265e
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00472613
add esp, 0xc
mov dword [ebp - 0x538], eax
and byte [ebp - 0x3ec], 0
and byte [ebp - 0x3eb], 0
mov byte [ebp - 0x3ea], 0x11
and byte [ebp - 0x3e9], 0
mov byte [ebp - 0x3e8], 0xa9
mov byte [ebp - 0x3e7], 0x8b
mov byte [ebp - 0x3e6], 0x9a
mov byte [ebp - 0x3e5], 0xa3
mov byte [ebp - 0x3e4], 0x81
mov byte [ebp - 0x3e3], 0x8a
mov byte [ebp - 0x3e2], 0x9b
mov byte [ebp - 0x3e1], 0x82
mov byte [ebp - 0x3e0], 0x8b
mov byte [ebp - 0x3df], 0xa6
mov byte [ebp - 0x3de], 0x8f
mov byte [ebp - 0x3dd], 0x80
mov byte [ebp - 0x3dc], 0x8a
mov byte [ebp - 0x3db], 0x82
mov byte [ebp - 0x3da], 0x8b
mov byte [ebp - 0x3d9], 0xaf
mov byte [ebp - 0x3d8], 0xee
lea eax, [ebp - 0x3ec]
push eax
call fcn.0047265e
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00472613
add esp, 0xc
mov dword [ebp - 0x340], eax
call fcn.0047264e
popal
inc edi
mov byte [0xcca58062], al
cli
invalid
Function at 0x473550
Capabilities:
Contain obfuscated stackstrings

Disassembly:
stosb byte es:[edi], al
and byte [ebp - 0x504], 0
push 0x40
pop ecx
xor eax, eax
lea edi, [ebp - 0x503]
rep stosd dword es:[edi], eax
stosw word es:[edi], ax
stosb byte es:[edi], al
call fcn.0047262c
or byte [eax + 0x2ff845c6], ah
mov byte [ebp - 0x24], 0x34
and byte [ebp - 0x36c], 0
and byte [ebp - 0x36b], 0
mov byte [ebp - 0x36a], 0xaa
and byte [ebp - 0x369], 0
mov byte [ebp - 0x368], 0x12
mov byte [ebp - 0x367], 0x30
mov byte [ebp - 0x366], 0x21
mov byte [ebp - 0x365], 6
mov byte [ebp - 0x364], 0x2c
mov byte [ebp - 0x363], 0x26
mov byte [ebp - 0x362], 0x21
mov byte [ebp - 0x361], 0x30
mov byte [ebp - 0x360], 0x38
mov byte [ebp - 0x35f], 0x11
mov byte [ebp - 0x35e], 0x3c
mov byte [ebp - 0x35d], 0x27
mov byte [ebp - 0x35c], 0x30
mov byte [ebp - 0x35b], 0x36
mov byte [ebp - 0x35a], 0x21
mov byte [ebp - 0x359], 0x3a
mov byte [ebp - 0x358], 0x27
mov byte [ebp - 0x357], 0x2c
mov byte [ebp - 0x356], 0x14
mov byte [ebp - 0x355], 0x55
lea eax, [ebp - 0x36c]
push eax
call fcn.0047265e
pop ecx
push eax
push dword [ebp + 0x18]
push dword [ebp + 0x14]
call fcn.00472613
add esp, 0xc
mov dword [ebp - 0x3d4], eax
call fcn.0047264e
mov dh, 0x54
invalid
Function at 0x47c05b
Capabilities:
Query or enumerate registry value

Disassembly:
push ebp
mov ebp, esp
add esp, 0xfffffff8
push ebx
xor ebx, ebx
lea eax, [ebp - 4]
push eax
push 0x20019
push 0
push 0x4d3b4e
push 0x80000002
call sub.advapi32.dll_RegOpenKeyExA_1
test eax, eax
jne 0x47c0b3
movzx edx, word [ebp + 8]
mov dword [ebp - 8], edx
lea ecx, [ebp - 8]
push ecx
push dword [ebp + 0xc]
push 0
push 0
push 0x4d3b6f
push dword [ebp - 4]
call sub.advapi32.dll_RegQueryValueExA_1
test eax, eax
je 0x47c0a9
mov bx, 0x2a04
push dword [ebp - 4]
call sub.advapi32.dll_RegCloseKey_1
jmp 0x47c0b7
mov bx, 0x2a04
mov eax, ebx
pop ebx
pop ecx
pop ecx
pop ebp
ret 8
Function at 0x406624
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x23c
push esi
mov esi, 0x104
lea eax, [ebp - 0x23c]
push esi
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
cmp eax, esi
pop esi
jbe 0x406648
xor eax, eax
test eax, eax
je 0x40665b
cmp word [ebp + eax*2 - 0x23e], 0x5c
je 0x40665b
xor ecx, ecx
jmp 0x40665e
xor ecx, ecx
inc ecx
push dword [ebp + 8]
lea ecx, [ecx*2 + 0x40a014]
lea eax, [ebp + eax*2 - 0x23c]
push ecx
push str._s_S.dll
push eax
call dword [sym.imp.USER32.dll_wsprintfW]
add esp, 0x10
lea eax, [ebp - 0x23c]
push 8
push 0
push eax
call dword [sym.imp.KERNEL32.dll_LoadLibraryExW]
leave
ret 4

Function at 0x406787
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
cmp dword [0x4698ec], 0
push esi
jne 0x4067be
xor ecx, ecx
push 8
mov eax, ecx
pop esi
mov edx, eax
and dl, 1
neg dl
sbb edx, edx
and edx, 0xedb88320
shr eax, 1
xor eax, edx
dec esi
jne 0x406798
mov dword [ecx*4 + 0x4698e8], eax
inc ecx
cmp ecx, 0x100
jl 0x406793
mov edx, dword [esp + 0x10]
mov eax, dword [esp + 8]
test edx, edx
not eax
jbe 0x4067ef
mov ecx, dword [esp + 0xc]
push edi
movzx edi, byte [ecx]
mov esi, eax
and esi, 0xff
xor esi, edi
shr eax, 8
mov esi, dword [esi*4 + 0x4698e8]
xor eax, esi
inc ecx
dec edx
jne 0x4067d1
pop edi
not eax
pop esi
ret 0xc

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x4032a0
Capabilities:
Accept command line arguments
Hide graphical window

Disassembly:
mov ecx, ebp
push ebp
mov ebp, esp
mov dword [0x405076], ecx
call dword [sym.imp.kernel32.dll_GetCommandLineA]
mov dword [0x405258], eax
mov dword [0x4051e0], 0x402b80
mov dword [0x4051dc], 2
jmp 0x4032d0
mov dword [0x4051e4], 0
mov dword [0x4051e8], 0
mov dword [0x4051d8], 0x30
push 0
call dword [sym.imp.kernel32.dll_GetModuleHandleA]
mov dword [0x4051ec], eax
mov dword [0x405200], 0x404080
mov dword [0x4051f8], 0xf
mov dword [0x40506e], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadIconA]
mov dword [0x4051f0], eax
mov dword [0x405204], eax
push 0x7f00
push 0
call dword [sym.imp.user32.dll_LoadCursorA]
mov dword [0x4051f4], eax
push 0x4051d8
call dword [sym.imp.user32.dll_RegisterClassExA]
push 0
push dword [0x40506e]
push 0
push 0
push 0x1e5
push 0x21e
push 0xffffe52a
push 0xfffff588
push 0x40000
push str.wait
push str.aroka
push 0
call dword [sym.imp.user32.dll_CreateWindowExA]
mov dword [0x405250], eax
push 5
push dword [0x405250]
call dword [sym.imp.user32.dll_ShowWindow]
push dword [0x405250]
call dword [sym.imp.user32.dll_UpdateWindow]
jmp 0x4033a3
push 0
push 0
push 0
push 0x405208
call dword [sym.imp.user32.dll_GetMessageA]
or eax, eax
je 0x4033d0
push 0x405208
call dword [sym.imp.user32.dll_TranslateMessage]
push 0x405208
call dword [sym.imp.user32.dll_DispatchMessageA]
jmp 0x4033a3
mov eax, dword [0x405210]
jmp 0x4033dd
call 0x402474
ret

Function at 0x42e000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x42e00c
nop
nop
nop
pop eax
nop
nop
add eax, 0x403ac5
nop
nop
sub eax, 0x403a6b
mov ebx, dword [eax]
nop
nop
nop
nop
nop
mov ecx, dword [eax + 4]
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
nop
jl 0x42e030
nop
nop
add eax, 0xc
nop
cmp dword [eax], 0
nop
nop
nop
nop
nop
nop
nop
jne 0x42e01e
nop
nop
popal
nop
nop
nop
jmp loc.00401219
Function at 0x430003
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
mov eax, section..text
nop
nop
push 4
nop
nop
nop
nop
pop edi
nop
nop
nop
nop
nop
nop
nop
cmp eax, 0
nop
je 0x430072
nop
nop
nop
mov ebx, 0x408f6c
nop
nop
nop
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
xor edx, edx
nop
nop
nop
nop
nop
push eax
nop
nop
nop
nop
nop
mov eax, ecx
nop
nop
nop
nop
div edi
nop
nop
nop
nop
nop
nop
nop
xchg ecx, eax
nop
pop eax
nop
nop
nop
nop
nop
mov esi, 0x415a7aaf
xor dword [eax], esi
nop
nop
nop
nop
nop
nop
nop
nop
add eax, edi
nop
nop
nop
nop
loop 0x430060
mov eax, section..data
nop
nop
nop
nop
cmp eax, 0
nop
je 0x4300d2
nop
nop
nop
nop
mov ebx, 0x42e3d0
nop
mov ecx, ebx
nop
nop
nop
nop
nop
sub ecx, eax
nop
nop
nop
xor edx, edx
nop
nop
nop
nop
nop
nop
push eax
nop
nop
mov eax, ecx
nop
nop
nop
nop
nop
nop
nop
nop
div edi
nop
nop
nop
xchg ecx, eax
nop
nop
nop
nop
nop
nop
nop
pop eax
nop
mov esi, 0x21cd68d8
nop
nop
nop
xor dword [eax], esi
nop
nop
nop
add eax, edi
nop
nop
nop
nop
nop
loop 0x4300c0
nop
nop
nop
nop
nop
nop
popal
jmp 0x401219
Function at 0x10008160
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x100081c1
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x100081a4
cmp edi, 2
jb 0x100081a4
cmp byte [esi], cl
jne 0x100081a4
cmp byte [esi + 1], cl
jne 0x100081a4
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10169bc8]
jmp 0x10008175
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10169bc8]
test edi, edi
jne 0x10008175
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x100081f0
cmp cl, 0x23
jne 0x100081d7
cmp byte [esi], cl
jne 0x100081d7
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x10169bc8]
test cl, cl
jne 0x100081c8
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x100082b0
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
test ebx, ebx
je 0x100082c3
mov dword [ebx], 0
mov edx, 0x10169a3c
call fcn.10008200
mov esi, eax
test esi, esi
je 0x100083a0
push esi
call fcn.10121a2e
add esp, 4
mov dword [ebp + 8], eax
cmp eax, 0xffffffff
je 0x10008397
push 2
push 0
push esi
call fcn.101226a9
add esp, 0xc
test eax, eax
jne 0x10008397
push esi
call fcn.10121a2e
mov edi, eax
add esp, 4
cmp edi, 0xffffffff
je 0x10008397
push 0
push dword [ebp + 8]
push esi
call fcn.101226a9
add esp, 0xc
test eax, eax
jne 0x10008397
mov eax, dword [0x101f0cc8]
test eax, eax
je 0x10008336
inc dword [eax + 0x374]
push edi
call fcn.1012a3cf
add esp, 4
mov dword [ebp + 8], eax
test eax, eax
je 0x10008397
push esi
push edi
push 1
push eax
call fcn.10125556
add esp, 0x10
push esi
cmp eax, edi
je 0x10008381
call fcn.10122356
mov eax, dword [0x101f0cc8]
add esp, 4
test eax, eax
je 0x1000836f
dec dword [eax + 0x374]
push dword [ebp + 8]
call fcn.10125362
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
pop ebp
ret
call fcn.10122356
add esp, 4
test ebx, ebx
je 0x1000838f
mov dword [ebx], edi
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
pop ebp
ret
push esi
call fcn.10122356
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
pop ebp
ret
Function at 0x10009e20
Capabilities:
Encode data using xor
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov edx, dword [ecx + 0xcc]
mov eax, dword [ecx + 0xd4]
push esi
push edi
lea esi, [ebp + 8]
mov edi, 4
mov eax, dword [eax + edx*4 - 4]
not eax
nop
movzx ecx, byte [esi]
lea esi, [esi + 1]
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x10169bc8]
sub edi, 1
jne 0x10009e40
mov ecx, dword [0x101f0cc8]
not eax
pop edi
pop esi
cmp dword [ecx + 0x19ec], eax
jne 0x10009e72
mov dword [ecx + 0x19f0], eax
cmp dword [ecx + 0x1a20], eax
jne 0x10009e81
mov byte [ecx + 0x1a24], 1
pop ebp
ret 4

Function at 0x1000a8c0
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
mov eax, dword [0x101f0cc8]
sub esp, 0x1c
push ebx
push esi
push edi
test eax, eax
je 0x1000a8d8
inc dword [eax + 0x374]
push 0x3b90
call fcn.1012a3cf
add esp, 4
test eax, eax
je 0x1000a8f5
push ecx
mov ecx, eax
call fcn.10006ab0
mov edi, eax
jmp 0x1000a8f7
xor edi, edi
cmp dword [0x101f0cc8], 0
jne 0x1000a908
mov ebx, edi
mov dword [0x101f0cc8], ebx
or edx, 0xffffffff
mov dword [ebp - 4], 0
mov dword [ebp - 0x18], str.Window
mov esi, 0x10169991
mov al, 0x57
or ebx, 0xffffffff
cmp al, 0x23
jne 0x1000a931
cmp byte [esi], al
jne 0x1000a931
cmp byte [esi + 1], al
cmove edx, ebx
movzx ecx, dl
movzx eax, al
xor ecx, eax
shr edx, 8
mov al, byte [esi]
inc esi
xor edx, dword [ecx*4 + 0x10169bc8]
test al, al
jne 0x1000a923
mov esi, dword [edi + 0x2d48]
not edx
mov ecx, dword [edi + 0x2d4c]
mov ebx, dword [0x101f0cc8]
mov dword [ebp - 0x14], edx
mov dword [ebp - 0x10], 0x10016180
mov dword [ebp - 0xc], 0x10016220
mov dword [ebp - 8], 0x100162d0
cmp esi, ecx
jne 0x1000aa06
inc esi
test ecx, ecx
je 0x1000a98e
mov eax, ecx
cdq
sub eax, edx
sar eax, 1
add eax, ecx
jmp 0x1000a993
mov eax, 8
cmp eax, esi
cmovg esi, eax
cmp esi, ecx
jle 0x1000aa06
test ebx, ebx
je 0x1000a9a6
inc dword [ebx + 0x374]
lea eax, [esi + esi*2]
shl eax, 3
push eax
call fcn.1012a3cf
mov ebx, eax
add esp, 4
mov eax, dword [edi + 0x2d50]
test eax, eax
je 0x1000a9fa
mov ecx, dword [edi + 0x2d48]
lea ecx, [ecx + ecx*2]
shl ecx, 3
push ecx
push eax
push ebx
call fcn.1011d900
mov ecx, dword [edi + 0x2d50]
add esp, 0xc
test ecx, ecx
je 0x1000a9f1
mov eax, dword [0x101f0cc8]
test eax, eax
je 0x1000a9f1
dec dword [eax + 0x374]
push ecx
call fcn.10125362
add esp, 4
mov dword [edi + 0x2d50], ebx
mov dword [edi + 0x2d4c], esi
mov eax, dword [edi + 0x2d48]
movups xmm0, xmmword [ebp - 0x18]
lea ecx, [eax + eax*2]
mov eax, dword [edi + 0x2d50]
movups xmmword [eax + ecx*8], xmm0
movq xmm0, qword [ebp - 8]
movq qword [eax + ecx*8 + 0x10], xmm0
mov eax, edi
inc dword [edi + 0x2d48]
mov byte [edi], 1
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x1000cae0
Capabilities:
Hash data with crc32

Disassembly:
push ebx
mov bl, byte [ecx]
or eax, 0xffffffff
push esi
lea esi, [ecx + 1]
or ecx, 0xffffffff
push edi
test bl, bl
je 0x1000cb1f
cmp bl, 0x23
jne 0x1000cb01
cmp byte [esi], bl
jne 0x1000cb01
cmp byte [esi + 1], bl
cmove eax, ecx
movzx edx, al
movzx ecx, bl
mov bl, byte [esi]
xor edx, ecx
shr eax, 8
inc esi
mov ecx, 0xffffffff
xor eax, dword [edx*4 + 0x10169bc8]
test bl, bl
jne 0x1000caf2
mov ecx, dword [0x101f0cc8]
not eax
mov esi, dword [ecx + 0x19a0]
mov edi, dword [ecx + 0x19a8]
lea ebx, [edi + esi*8]
test esi, esi
je 0x1000cb5e
nop word [eax + eax]
mov edx, esi
shr edx, 1
cmp dword [edi + edx*8], eax
lea ecx, [edi + edx*8]
jae 0x1000cb58
lea edi, [ecx + 8]
or ecx, 0xffffffff
sub ecx, edx
add esi, ecx
jmp 0x1000cb5a
mov esi, edx
test esi, esi
jne 0x1000cb40
cmp edi, ebx
je 0x1000cb6d
cmp dword [edi], eax
jne 0x1000cb6d
mov eax, dword [edi + 4]
pop edi
pop esi
pop ebx
ret
pop edi
pop esi
xor eax, eax
pop ebx
ret
Function at 0x10038320
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x40
push ebx
mov ebx, dword [0x101f1ef4]
mov dword [ebp - 8], ebx
push esi
push edi
test ebx, ebx
je 0x10038470
mov dword [ebp - 0xc], 1
test ebx, ebx
je 0x10038470
mov eax, dword fs:[0x30]
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + 0x18]
mov dword [ebp - 0x18], ebx
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ecx + ebx + 0x78]
add ecx, ebx
mov dword [ebp - 0x14], ecx
cmp ecx, ebx
je 0x100383d8
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x100383d8
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, ebx
nop word [eax + eax]
sub ecx, 4
dec edx
mov dword [ebp - 0x10], ecx
mov edi, 0x4db3cd9
mov dword [ebp - 4], edx
mov ecx, dword [ecx]
add ecx, ebx
mov bl, byte [ecx]
inc ecx
test bl, bl
je 0x100383ce
nop word [eax + eax]
movsx esi, bl
lea ecx, [ecx + 1]
sub bl, 0x41
mov edx, esi
or edx, 0x20
cmp bl, 0x19
mov bl, byte [ecx - 1]
cmova edx, esi
xor edx, edi
imul edi, edx, 0x1000193
test bl, bl
jne 0x100383a0
mov edx, dword [ebp - 4]
cmp edi, 0xb18c8f0c
je 0x100383df
mov ecx, dword [ebp - 0x10]
mov ebx, dword [eax + 0x18]
test edx, edx
jne 0x10038380
mov eax, dword [eax]
jmp 0x10038355
mov eax, dword [ebp - 0x14]
mov esi, dword [ebp - 0x18]
mov ebx, dword [ebp - 8]
push 0x1c
mov ecx, dword [eax + 0x1c]
mov eax, dword [eax + 0x24]
add ecx, esi
add eax, esi
movzx eax, word [eax + edx*2]
mov eax, dword [ecx + eax*4]
lea ecx, [ebp - 0x40]
push ecx
add eax, esi
push ebx
call eax
test eax, eax
je 0x10038470
mov eax, dword [ebp - 0x2c]
test al, 1
jne 0x10038470
test eax, 0x100
jne 0x10038470
sub dword [ebp - 0xc], 1
mov ebx, dword [ebx]
mov dword [ebp - 8], ebx
jne 0x10038341
test ebx, ebx
je 0x10038470
mov ecx, 1
mov eax, ecx
cmp byte [ebx + eax], 0
je 0x1003843f
inc eax
inc ecx
cmp eax, 0x80
jl 0x10038430
mov edx, 0x1f
mov dword [ebp - 0x24], 0x20
sub edx, ecx
mov dword [ebp - 0x1c], 3
cmp edx, 3
mov dword [ebp - 0x20], edx
lea eax, [ebp - 0x20]
lea ecx, [ebp - 0x1c]
cmovge ecx, eax
cmp edx, 0x20
lea eax, [ebp - 0x24]
cmovle eax, ecx
mov eax, dword [eax]
jmp 0x10038475
mov eax, 3
push 0x14
push eax
mov dword [0x101f0cd0], eax
call fcn.1012a684
xor ebx, ebx
mov dword [0x101f804c], eax
add esp, 8
cmp dword [0x101f0cd0], ebx
jbe 0x100384f5
xor ecx, ecx
mov dword [ebp - 0xc], ecx
nop dword [eax]
lea edi, [ecx + eax]
mov dword [edi + 0xc], ebx
push 0x18
call fcn.100bf307
add esp, 4
mov esi, eax
push esi
call dword [sym.imp.KERNEL32.dll_InitializeCriticalSection]
push ecx
mov edx, edi
mov dword [edi + 4], esi
mov dword [edi + 8], 0x101f1ad8
call fcn.10038570
push 4
mov esi, eax
call fcn.1012a3cf
mov ecx, dword [ebp - 0xc]
inc ebx
add ecx, 0x14
mov dword [edi + 0x10], eax
add esp, 8
mov dword [ebp - 0xc], ecx
mov dword [eax], esi
cmp ebx, dword [0x101f0cd0]
jae 0x100384f5
mov eax, dword [0x101f804c]
jmp 0x100384a0
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
Function at 0x10038570
Capabilities:
Access peb ldr_data
Encode data using xor
Hash data using fnv
Resolve function by parsing pe exports

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [0x101f8268]
mov dword [ebp - 0x14], edx
test eax, eax
jne 0x10038645
mov eax, dword fs:[0x30]
push ebx
push esi
push edi
mov eax, dword [eax + 0xc]
mov eax, dword [eax + 0xc]
mov ebx, dword [eax + 0x18]
mov dword [ebp - 0x10], ebx
mov ecx, dword [ebx + 0x3c]
mov ecx, dword [ecx + ebx + 0x78]
add ecx, ebx
mov dword [ebp - 0xc], ecx
cmp ecx, ebx
je 0x10038618
mov edx, dword [ecx + 0x18]
test edx, edx
je 0x10038618
mov ecx, dword [ecx + 0x20]
lea ecx, [ecx + edx*4]
add ecx, ebx
nop word [eax + eax]
sub ecx, 4
dec edx
mov dword [ebp - 8], ecx
mov edi, 0x81e73a93
mov dword [ebp - 4], edx
mov ecx, dword [ecx]
add ecx, ebx
mov bl, byte [ecx]
inc ecx
test bl, bl
je 0x1003860e
nop word [eax + eax]
movsx esi, bl
lea ecx, [ecx + 1]
sub bl, 0x41
mov edx, esi
or edx, 0x20
cmp bl, 0x19
mov bl, byte [ecx - 1]
cmova edx, esi
xor edx, edi
imul edi, edx, 0x1000193
test bl, bl
jne 0x100385e0
cmp edi, 0x990bb32b
je 0x1003861f
mov edx, dword [ebp - 4]
mov ecx, dword [ebp - 8]
mov ebx, dword [eax + 0x18]
test edx, edx
jne 0x100385c0
mov eax, dword [eax]
jmp 0x10038595
mov esi, dword [ebp - 0xc]
mov ecx, dword [ebp - 4]
mov edx, dword [ebp - 0x10]
pop edi
mov eax, dword [esi + 0x24]
lea eax, [eax + ecx*2]
movzx ecx, word [eax + edx]
mov eax, dword [esi + 0x1c]
pop esi
pop ebx
lea eax, [eax + ecx*4]
mov eax, dword [eax + edx]
add eax, edx
mov dword [0x101f8268], eax
lea ecx, [ebp - 0x18]
push ecx
push 0
push dword [ebp - 0x14]
push 0x100381e0
push 0
push 0
call eax
mov eax, dword [ebp - 0x18]
mov esp, ebp
pop ebp
ret

Function at 0x10039840
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
and esp, 0xfffffff8
sub esp, 0xc
push ebx
push esi
mov esi, ecx
push edi
cmp byte [esi], 0
lea edi, [esi + 2]
je 0x100398b0
cmp byte [esi + 1], 0
jne 0x100398f7
xor ecx, ecx
mov byte [esi + 1], 1
mov dword [esp + 0xc], ecx
nop word [eax + eax]
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, bl
xor byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x1f
jb 0x10039870
jmp 0x100398f7
xor ecx, ecx
mov dword [esp + 0xc], ecx
mov ebx, ecx
xor edx, edx
xor edx, dword [esi + 0x2c]
xor ebx, dword [esi + 0x28]
xor edx, 0xd28f2c5
xor ebx, 0x1de26cd5
mov ecx, edx
mov eax, ebx
shld ecx, eax, 0xd
shl eax, 0xd
xor edx, ecx
mov ecx, dword [esp + 0xc]
xor ebx, eax
mov eax, ebx
shrd eax, edx, 7
xor al, byte [edi + ecx]
xor al, bl
mov byte [edi + ecx], al
inc ecx
mov dword [esp + 0xc], ecx
cmp ecx, 0x1f
jb 0x100398b6
push ecx
mov ecx, dword [ebp + 8]
lea eax, [esi + 0x20]
push eax
push edi
call fcn.1003b2a0
mov eax, dword [ebp + 8]
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4