joyce8/EMBER2024-capa huggingface dataset:
Function at 0x411080
Capabilities:
Delete registry key

Disassembly:
push ebp
mov ebp, esp
push ecx
push ecx
and dword [ebp - 4], 0
mov eax, ecx
push ebx
push esi
lea ecx, [ebp - 4]
mov dword [ebp - 8], eax
push ecx
push 0x2001f
push 0
mov ebx, edx
push ebx
push eax
call dword [sym.imp.ADVAPI32.dll_RegOpenKeyExW]
cmp eax, 2
jne 0x4110af
xor esi, esi
inc esi
jmp 0x4110f4
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
test esi, esi
js 0x4110f4
mov ecx, dword [ebp - 4]
call fcn.00410ec8
mov esi, eax
test esi, esi
js 0x4110f4
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
and dword [ebp - 4], 0
push ebx
push dword [ebp - 8]
call dword [sym.imp.ADVAPI32.dll_RegDeleteKeyW]
movzx esi, ax
or esi, 0x80070000
test eax, eax
cmovle esi, eax
cmp dword [ebp - 4], 0
je 0x411103
push dword [ebp - 4]
call dword [sym.imp.ADVAPI32.dll_RegCloseKey]
mov eax, esi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret

Function at 0x413fe7
Capabilities:
Allocate thread local storage

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsAlloc
push 0x4253f0
push str.FlsAlloc
push 0
call fcn.00413f60
mov esi, eax
add esp, 0x10
test esi, esi
je 0x414019
push dword [ebp + 8]
mov ecx, esi
call fcn.00411dbb
call esi
pop esi
pop ebp
ret
pop esi
pop ebp
jmp dword [sym.imp.KERNEL32.dll_TlsAlloc]

Function at 0x41405b
Capabilities:
Get thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsGetValue
push 0x425414
push str.FlsGetValue
push 2
call fcn.00413f60
add esp, 0x10
mov esi, eax
push dword [ebp + 8]
test esi, esi
je 0x41408c
mov ecx, esi
call fcn.00411dbb
call esi
jmp 0x414092
call dword [sym.imp.KERNEL32.dll_TlsGetValue]
pop esi
pop ebp
ret

Function at 0x414095
Capabilities:
Set thread local storage value

Disassembly:
push ebp
mov ebp, esp
push esi
push str.FlsSetValue
push 0x425428
push str.FlsSetValue
push 3
call fcn.00413f60
add esp, 0x10
mov esi, eax
push dword [ebp + 0xc]
push dword [ebp + 8]
test esi, esi
je 0x4140c9
mov ecx, esi
call fcn.00411dbb
call esi
jmp 0x4140cf
call dword [sym.imp.KERNEL32.dll_TlsSetValue]
pop esi
pop ebp
ret
Function at 0x41fed2
Capabilities:
Contain obfuscated stackstrings

Disassembly:
cmp dword [0x42f6b0], 0
je 0x421507
sub esp, 8
stmxcsr dword [esp + 4]
mov eax, dword [esp + 4]
and eax, 0x7f80
cmp eax, 0x1f80
jne 0x41ff06
fnstcw word [esp]
mov ax, word [esp]
and ax, 0x7f
cmp ax, 0x7f
lea esp, [esp + 8]
jne 0x421507
movq xmm0, qword [esp + 4]
movapd xmm2, xmmword [0x429490]
movapd xmm1, xmm0
movapd xmm7, xmm0
psrlq xmm0, 0x34
movd eax, xmm0
andpd xmm0, xmmword [0x4294b0]
psubd xmm2, xmm0
psrlq xmm1, xmm2
test eax, 0x800
je 0x41ff92
cmp eax, 0xbff
jl 0x41ffca
psllq xmm1, xmm2
cmp eax, 0xc32
jg 0x41ff63
movq qword [esp + 4], xmm1
fld qword [esp + 4]
ret
ucomisd xmm7, xmm7
jnp 0x41ff8d
mov edx, 0x3ec
sub esp, 0x10
mov dword [esp + 0xc], edx
mov edx, esp
add edx, 0x14
mov dword [esp + 8], edx
mov dword [esp + 4], edx
mov dword [esp], edx
call fcn.004212ef
add esp, 0x10
fld qword [esp + 4]
ret
movq xmm0, qword [esp + 4]
psllq xmm1, xmm2
movapd xmm3, xmm0
cmpnlepd xmm0, xmm1
cmp eax, 0x3ff
jl 0x41ffd1
cmp eax, 0x432
jg 0x41ff63
andpd xmm0, xmmword [0x429480]
addsd xmm1, xmm0
movq qword [esp + 4], xmm1
fld qword [esp + 4]
ret
fld qword [0x4294c0]
ret
cmpnlepd xmm3, xmmword [0x4294a0]
andpd xmm3, xmmword [0x429480]
movq qword [esp + 4], xmm3
fld qword [esp + 4]
ret
outsb dx, byte [esi]
lea eax, [ebp - 0x58]
push eax
call fcn.00421270
mov esi, dword [ebp + 0xc]
push eax
push esi
push dword [ebp + 8]
call fcn.00421225
add esp, 0x10
lea ecx, [ebp - 0xb0]
push ecx
call eax
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 0xac]
xor edx, edx
div ecx
xor edx, edx
mov dword [ebp - 0x8c], eax
mov eax, dword [ebp - 8]
div ecx
test edx, edx
je 0x42154e
inc dword [ebp - 0x8c]
imul ecx, dword [ebp - 0x8c]
mov dword [ebp + 0xc], ecx
mov byte [ebp - 0x40], bl
mov byte [ebp - 0x3f], bl
mov byte [ebp - 0x3e], 0xec
mov byte [ebp - 0x3d], bl
mov byte [ebp - 0x3c], 0x45
mov byte [ebp - 0x3b], 0x7a
mov byte [ebp - 0x3a], 0x61
mov byte [ebp - 0x39], 0x67
mov byte [ebp - 0x38], 0x66
mov byte [ebp - 0x37], 0x72
mov byte [ebp - 0x36], 0x7f
mov byte [ebp - 0x35], 0x52
mov byte [ebp - 0x34], 0x7f
mov byte [ebp - 0x33], 0x7f
mov byte [ebp - 0x32], 0x7c
mov byte [ebp - 0x31], 0x70
mov byte [ebp - 0x30], 0x13
call fcn.00421260
mov ecx, dword [edi + 0x27]
std
lea eax, [ebp - 0x40]
push eax
call fcn.00421270
push eax
push esi
push dword [ebp + 8]
call fcn.00421225
add esp, 0x10
mov dword [ebp - 0x88], eax
invalid
popfd
Function at 0x4216af
Capabilities:
Contain obfuscated stackstrings

Disassembly:
loopne 0x4216fb
mov byte [ebp - 0x1f], 0x59
mov byte [ebp - 0x1e], 0x52
mov byte [ebp - 0x1d], 0x6a
mov byte [ebp - 0x1c], 0x2b
call fcn.00421270
push eax
push esi
push dword [ebp + 8]
call fcn.00421225
add esp, 0x30
mov dword [ebp - 0xb8], eax
call fcn.00421260
insd dword es:[edi], dx
xchg edx, eax
jle 0x4216fb
invalid
invalid
mov byte [ebp - 0x84], bl
mov byte [ebp - 0x83], bl
mov byte [ebp - 0x82], 0xe9
mov byte [ebp - 0x81], bl
mov byte [ebp - 0x80], 0x51
mov byte [ebp - 0x7f], 0x73
mov byte [ebp - 0x7e], 0x62
mov byte [ebp - 0x7d], 0x5b
mov byte [ebp - 0x7c], 0x79
mov byte [ebp - 0x7b], 0x72
mov byte [ebp - 0x7a], 0x63
mov byte [ebp - 0x79], 0x7a
mov byte [ebp - 0x78], 0x73
mov byte [ebp - 0x77], 0x5e
mov byte [ebp - 0x76], 0x77
mov byte [ebp - 0x75], 0x78
mov byte [ebp - 0x74], 0x72
mov byte [ebp - 0x73], 0x7a
mov byte [ebp - 0x72], 0x73
mov byte [ebp - 0x71], 0x57
mov byte [ebp - 0x70], 0x16
call fcn.00421260
pop ds
jl 0x4216ce
loop 0x4216d6
test dword [edi + edi*8 - 1], edi
call dword [eax - 0x18]
sbb al, 0xfb
invalid

Function at 0x422c0d
Capabilities:
Contain obfuscated stackstrings

Disassembly:
lea eax, [ebp - 0x230]
mov dword [ebp - 0x3a0], eax
cmp dword [ebp - 0x6fc], 0
jne 0x422ddb
and byte [ebp - 0x77c], 0
and byte [ebp - 0x77b], 0
invalid
invalid
xchg al, bh
Function at 0x401368
Capabilities:
Extract resource via kernel32 functions

Disassembly:
push esi
push 0xa
push 1
push dword [0x40715c]
call sub.kernel32.dll_FindResourceA
push eax
push eax
push dword [0x40715c]
call sub.kernel32.dll_SizeofResource
mov dword [0x407178], eax
pop eax
push eax
push dword [0x40715c]
call sub.kernel32.dll_LoadResource
push eax
call sub.kernel32.dll_LockResource
mov esi, eax
mov eax, dword [0x407178]
add eax, 4
push eax
push 0x40
call sub.kernel32.dll_GlobalAlloc
mov dword [0x40717c], eax
mov ecx, dword [0x407178]
mov dword [eax], ecx
add eax, 4
mov edi, eax
rep movsb byte es:[edi], byte [esi]
pop esi
push dword [0x40717c]
call fcn.00401691
ret

Function at 0x401654
Capabilities:
Resume thread
Suspend thread

Disassembly:
mov eax, dword [0x40e184]
not eax
mov dword [0x40e184], eax
push eax
push dword [0x407194]
test eax, eax
jne 0x40167d
push dword [0x40e17c]
call sub.winmm.dll_waveOutRestart
call sub.kernel32.dll_ResumeThread
jmp 0x40168d
call sub.kernel32.dll_SuspendThread
push dword [0x40e17c]
call sub.winmm.dll_waveOutPause
pop eax
neg eax
ret
Function at 0x401cae
Capabilities:
Create thread

Disassembly:
mov eax, dword [0x40e170]
push ebx
cdq
idiv dword [0x40e16c]
push esi
mov esi, dword [esp + 0xc]
xor ebx, ebx
push edi
cmp esi, ebx
mov edi, eax
jne 0x401cd0
xor al, al
jmp 0x401e46
movzx eax, byte [esi + 0x128]
or dword [esi + 0x150], 0xffffffff
or dword [esi + 0x14c], 0xffffffff
mov dword [esi + 0x12c], eax
movsx eax, word [esi + 0x24]
mov dword [esi + 0x138], eax
mov eax, dword [esi + 0x158]
cmp eax, ebx
mov dword [esi + 0x140], ebx
mov dword [esi + 0x144], ebx
mov dword [esi + 8], ebx
mov dword [esi + 0x134], ebx
mov dword [esi + 0x148], ebx
mov dword [esi + 0x154], ebx
je 0x401d24
push esi
call eax
pop ecx
movsx eax, word [esi + 0x26]
push eax
push esi
call fcn.00401b29
add esp, 8
movsx eax, word [esi + 0x14]
imul eax, eax, 0x2b
push edi
mov ecx, eax
mov edi, 0x407208
mov eax, ebx
rep stosd dword es:[edi], eax
pop edi
xor edx, edx
cmp word [esi + 0x14], bx
jle 0x401d6e
push ebp
mov ecx, 0x40720c
mov eax, 0x408928
mov dword [ecx], eax
inc edx
movsx ebp, word [esi + 0x14]
add eax, 0x58
add ecx, 0xac
cmp edx, ebp
jl 0x401d59
pop ebp
lea eax, [edi + edi*2]
mov dword [0x4071a0], esi
mov esi, sub.kernel32.dll_GlobalAlloc
shl eax, 1
push eax
push 0x40
call esi
mov dword [0x4088dc], eax
mov eax, dword [0x40e170]
mov edi, eax
shl edi, 2
push edi
push 0x40
call esi
or dword [0x40e15c], 0xffffffff
mov dword [0x40e14c], edi
mov edi, 0x40e148
push 0x20
push edi
push dword [0x40e17c]
mov dword [0x40e168], eax
mov dword [0x40e158], 0xc
mov dword [0x40e148], eax
mov dword [0x40e150], ebx
mov dword [0x40e154], ebx
call sub.winmm.dll_waveOutPrepareHeader
mov eax, dword [0x40e170]
lea eax, [eax*8 + 0x100]
push eax
push 0x40
call esi
mov dword [0x40e178], eax
add eax, 0xf
and al, 0xf0
mov dword [0x40e128], eax
mov dword [0x407198], ebx
call fcn.004018ff
cmp dword [0x407198], ebx
jne 0x401dfd
push 0x20
push edi
push dword [0x40e17c]
call sub.winmm.dll_waveOutWrite
mov byte [0x407190], bl
lea eax, [esp + 0x10]
push eax
push 2
push ebx
push 0x401a79
push ebx
push ebx
call sub.kernel32.dll_CreateThread
mov dword [0x407194], eax
push 0xf
push dword [0x407194]
call sub.kernel32.dll_SetThreadPriority
mov al, 1
pop edi
pop esi
pop ebx
ret
Function at 0x101f6ea1
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1020c650]
jne 0x101f6eab
repz ret
jmp fcn.101fd9dc

Function at 0x10200f5b
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.101f5d14
and dword [ebp - 4], 0
cmp dword [0x1020dd5c], 0
mov ebx, eax
jne 0x1020100c
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x102010bd
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x102010bd
push eax
call fcn.101f5ca2
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1020dd5c], eax
call esi
push eax
call fcn.101f5ca2
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x1020dd60], eax
call esi
push eax
call fcn.101f5ca2
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x1020dd64], eax
call esi
push eax
call fcn.101f5ca2
pop ecx
mov dword [0x1020dd6c], eax
test eax, eax
je 0x1020100c
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.101f5ca2
pop ecx
mov dword [0x1020dd68], eax
mov eax, dword [0x1020dd68]
cmp eax, ebx
je 0x10201064
cmp dword [0x1020dd6c], ebx
je 0x10201064
push eax
call fcn.101f5d1d
push dword [0x1020dd6c]
mov esi, eax
call fcn.101f5d1d
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x10201064
test edi, edi
je 0x10201064
call esi
test eax, eax
je 0x1020105b
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x1020105b
test byte [ebp - 0xc], 1
jne 0x10201064
or dword [ebp + 0x10], 0x200000
jmp 0x1020109d
mov eax, dword [0x1020dd60]
cmp eax, ebx
je 0x1020109d
push eax
call fcn.101f5d1d
pop ecx
test eax, eax
je 0x1020109d
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x1020109d
mov eax, dword [0x1020dd64]
cmp eax, ebx
je 0x1020109d
push eax
call fcn.101f5d1d
pop ecx
test eax, eax
je 0x1020109d
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1020dd5c]
call fcn.101f5d1d
pop ecx
test eax, eax
je 0x102010bd
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x102010bf
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10204810
Capabilities:
Parse pe header

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x10
lea eax, [fcn.10204810]
mov ecx, 0x1c5a
mov dword [ebp - 4], eax
mov dword [ebp - 8], ecx
jmp 0x10204829
mov eax, dword [ebp - 8]
mov ecx, dword [ebp - 4]
cmp word [ecx], 0x5a4d
mov dword [ebp - 0xc], eax
mov dword [ebp - 0x10], ecx
jne 0x1020485b
mov eax, dword [ebp - 0x10]
mov ecx, dword [eax + 0x3c]
cmp dword [eax + ecx], 0x4550
jne 0x1020485b
mov eax, dword [ebp - 0xc]
mov dword [0x1020bea0], eax
mov eax, dword [ebp - 0x10]
add esp, 0x10
pop ebp
ret
mov eax, dword [ebp - 0xc]
add eax, 0xffffddc4
mov ecx, dword [ebp - 0x10]
add ecx, 0xfffff000
and ecx, 0xfffff000
mov dword [ebp - 4], ecx
mov dword [ebp - 8], eax
jmp 0x10204829
Function at 0x10204880
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x14
mov eax, dword [ebp + 0x10]
mov ecx, dword [ebp + 0xc]
mov edx, dword [ebp + 8]
xor esi, esi
mov dword [0x1020beac], 0
mov byte [0x1020beb0], 0
mov dword [0x1020bea0], 0x25ab
mov dword [0x1020bea8], 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov eax, dword [ebp - 0x1c]
mov ecx, eax
mov dl, cl
mov ecx, dword [ebp - 0x18]
mov byte [ecx + eax], dl
mov dword [0x1020bea0], 0x1b02
mov eax, dword [0x1020bea8]
add eax, 1
mov dword [0x1020bea8], eax
cmp eax, 0x100
mov dword [ebp - 0x1c], eax
jl 0x102048c5
mov dword [0x1020bea0], 0x213c
mov dword [0x1020bea8], 0
mov eax, 0x100
mov dword [0x1020beb4], 0
mov ecx, dword [0x1020beac]
mov edx, dword [0x1020bea8]
mov esi, dword [ebp - 0x18]
movzx edi, byte [esi + edx]
add edi, ecx
mov dword [ebp - 0x20], eax
mov eax, edx
xor edx, edx
mov ecx, dword [ebp - 0x10]
div ecx
mov ebx, dword [ebp - 0x14]
movzx edx, byte [ebx + edx]
add edi, edx
mov dword [0x1020beb4], edi
mov eax, edi
cdq
mov edi, dword [ebp - 0x20]
idiv edi
mov dword [0x1020beac], edx
mov ecx, dword [0x1020bea8]
mov bl, byte [esi + ecx]
mov byte [0x1020beb0], bl
mov bl, byte [esi + edx]
mov byte [esi + ecx], bl
mov bl, byte [0x1020beb0]
mov ecx, dword [0x1020beac]
mov byte [esi + ecx], bl
mov ecx, dword [0x1020bea8]
add ecx, 1
mov dword [0x1020bea8], ecx
cmp ecx, 0x100
jl 0x10204909
add esp, 0x14
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x10205360
Capabilities:
Get number of processors

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x20
mov eax, dword [0x1020bea4]
add eax, 0xfffff55c
mov dword [0x1020bea0], eax
mov dword [ebp - 4], 0
mov eax, dword fs:[0x30]
mov dword [ebp - 4], eax
xor ecx, ecx
mov edx, dword [ebp - 4]
mov edx, dword [edx + 0x10]
mov edx, dword [edx + 0x3c]
mov dword [0x1020bea4], 0x1ffe
mov dword [ebp - 8], eax
mov dword [ebp - 0xc], edx
mov dword [ebp - 0x10], ecx
mov eax, dword [ebp - 0x10]
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2], 0
mov edx, eax
mov dword [ebp - 0x14], eax
mov dword [ebp - 0x18], edx
je 0x102053d0
mov eax, dword [ebp - 0x14]
add eax, 1
cmp eax, 0x104
mov ecx, eax
mov dword [ebp - 0x10], ecx
mov dword [ebp - 0x18], eax
jl 0x102053a3
mov eax, dword [ebp - 0x18]
mov ecx, dword [0x1020bea4]
add ecx, 0x10f2
mov dword [0x1020bea4], ecx
mov ecx, dword [ebp - 0xc]
cmp word [ecx + eax*2 - 0x1a], 0x6c
mov dword [ebp - 0x1c], eax
jne 0x10205482
mov dword [0x1020bea4], 0xe77
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x18], 0x6f
jne 0x10205482
mov dword [0x1020bea0], 0xa83
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x16], 0x61
jne 0x10205482
mov dword [0x1020bea0], 0xca
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x14], 0x64
jne 0x10205482
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x12], 0x64
jne 0x10205482
mov dword [0x1020bea0], 0xf8e
mov eax, dword [ebp - 0xc]
mov ecx, dword [ebp - 0x1c]
cmp word [eax + ecx*2 - 0x10], 0x6c
jne 0x10205482
mov eax, 1
mov ecx, dword [ebp - 0xc]
mov edx, dword [ebp - 0x1c]
cmp word [ecx + edx*2 - 0xe], 0x6c
mov dword [ebp - 0x20], eax
je 0x10205489
xor eax, eax
mov dword [ebp - 0x20], eax
jmp 0x10205489
mov eax, dword [ebp - 0x20]
add esp, 0x20
pop ebp
ret
Function at 0x10205690
Capabilities:
Encrypt data using rc4 ksa

Disassembly:
push ebp
mov ebp, esp
push ebx
push edi
push esi
sub esp, 0x24
mov eax, dword [ebp + 0x14]
mov ecx, dword [ebp + 0x10]
mov edx, dword [ebp + 0xc]
mov esi, dword [ebp + 8]
xor edi, edi
mov dword [0x1020bea8], 0
mov dword [0x1020beac], 0
mov dword [0x1020beb8], 0
mov ebx, dword [0x1020bea0]
add ebx, 0xfffff25f
mov dword [0x1020bea4], ebx
cmp eax, 0
mov dword [ebp - 0x10], eax
mov dword [ebp - 0x14], ecx
mov dword [ebp - 0x18], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x20], edi
je 0x102057c8
mov eax, dword [ebp - 0x20]
mov ecx, 0x100
mov edx, eax
add edx, 1
mov esi, dword [0x1020bea8]
add esi, 1
mov dword [ebp - 0x24], eax
mov eax, esi
mov dword [ebp - 0x28], edx
cdq
idiv ecx
mov dword [0x1020bea8], edx
mov dword [0x1020bea0], 0xffffe88b
mov esi, dword [0x1020beac]
mov edi, dword [ebp - 0x1c]
movzx edx, byte [edi + edx]
add edx, esi
mov eax, edx
cdq
idiv ecx
mov dword [0x1020beac], edx
mov ecx, dword [0x1020bea8]
mov bl, byte [edi + ecx]
mov byte [0x1020beb0], bl
mov bl, byte [edi + edx]
mov byte [edi + ecx], bl
mov bl, byte [0x1020beb0]
mov ecx, dword [0x1020beac]
mov byte [edi + ecx], bl
mov ecx, dword [0x1020bea8]
movzx ecx, byte [edi + ecx]
mov edx, dword [0x1020beac]
movzx edx, byte [edi + edx]
add edx, ecx
mov dword [0x1020bea0], 0x1ae9
and edx, 0xff
mov dword [0x1020beb8], edx
mov bl, byte [edi + edx]
mov ecx, dword [ebp - 0x14]
mov edx, dword [ebp - 0x24]
movzx esi, byte [ecx + edx]
mov dword [esp], esi
movzx esi, bl
mov dword [esp + 4], esi
call fcn.10001000
mov ecx, dword [ebp - 0x18]
mov edx, dword [ebp - 0x24]
mov byte [ecx + edx], al
mov esi, dword [ebp - 0x28]
mov edi, dword [ebp - 0x10]
cmp esi, edi
mov dword [ebp - 0x20], esi
jne 0x102056f1
mov dword [0x1020bea0], 0x18d5
add esp, 0x24
pop esi
pop edi
pop ebx
pop ebp
ret
Function at 0x403e4a
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x50
pushal
call 0x403e59
pop dword [ebp - 0x40]
mov eax, 0x1ae4ec1d
sub eax, 0x1aa4adc4
sub dword [ebp - 0x40], eax
mov dword [ebp - 0x50], 0x2855d7d4
sub dword [ebp - 0x50], 0xda039289
mov dword [ebp - 0x4c], 0x6667f5c6
add dword [ebp - 0x4c], 0xcbcb567f
mov dword [ebp - 0x48], 0xd2943804
add dword [ebp - 0x48], 0x79b80c2a
mov dword [ebp - 0x44], 0xcd1a5573
sub dword [ebp - 0x44], 0xcd1a5573
lea eax, [ebp - 0x50]
push eax
mov eax, 0x7b178546
sub eax, 0x7ad704ba
add eax, dword [ebp - 0x40]
call dword [eax]
mov dword [ebp - 0x50], 0x2996feb8
add dword [ebp - 0x50], 0x4adb6a9e
mov dword [ebp - 0x4c], 0xbb83e451
add dword [ebp - 0x4c], 0x85e87d24
mov dword [ebp - 0x48], 0xa2fcd4e2
sub dword [ebp - 0x48], 0x3f8d6876
mov dword [ebp - 0x44], 0x82bb57c8
sub dword [ebp - 0x44], 0x82bb57c8
lea ebx, [ebp - 0x50]
push ebx
push eax
mov eax, 0x3e5730e8
sub eax, 0x3e16b014
add eax, dword [ebp - 0x40]
call dword [eax]
push 0x40
push 0x1000
push 0x397c1
push 0
call eax
mov ecx, 0x52f3
mov edx, eax
mov ebx, 0x724f8e35
sub ebx, 0x720e7e35
add ebx, dword [ebp - 0x40]
mov esi, 0x83f00c92
add esi, 0xf20104
mov edi, dword [ebx]
add dword [ebp - 0x14], ecx
xor edi, esi
sub dword [ebp - 0x14], 0xc3fe8668
mov dword [edx], edi
mov dword [ebp - 0x38], 0x1e7a538
add edx, 0xf893b789
sub edx, 0xf893b785
add ebx, 4
loop 0x403f75
add eax, 0x13e9f
xor ebx, ebx
add ebx, eax
add eax, 0x375364a4
sub eax, 0x3753649f
mov ecx, 0xc08a20a3
add ecx, 0x3fb5df5d
add ecx, dword [ebp - 0x40]
call ebx
leave
ret
Function at 0x4a091a
Capabilities:
Encode data using xor

Disassembly:
mov ah, 0xfd
sbb bl, al
sub al, 0xda
mov cl, 0x9c
invalid

Function at 0x4b96dd
Capabilities:
Write file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1a4
mov edx, dword [ebp + 8]
xor ecx, ecx
mov eax, 0x4c2378
cmp edx, dword [eax]
je 0x4b96ff
add eax, 8
inc ecx
cmp eax, 0x4c2408
jl 0x4b96f0
push esi
mov esi, ecx
shl esi, 3
cmp edx, dword [esi + 0x4c2378]
jne 0x4b982d
mov eax, dword [0x4c6dfc]
cmp eax, 1
je 0x4b9807
test eax, eax
jne 0x4b9730
cmp dword [0x4c22a0], 1
je 0x4b9807
cmp edx, 0xfc
je 0x4b982d
lea eax, [ebp - 0x1a4]
push 0x104
push eax
push 0
call dword [sym.imp.KERNEL32.dll_GetModuleFileNameA]
test eax, eax
jne 0x4b9767
lea eax, [ebp - 0x1a4]
push str._program_name_unknown_
push eax
call fcn.004ba0c0
pop ecx
pop ecx
lea eax, [ebp - 0x1a4]
push edi
push eax
lea edi, [ebp - 0x1a4]
call fcn.004ba550
inc eax
pop ecx
cmp eax, 0x3c
jbe 0x4b97aa
lea eax, [ebp - 0x1a4]
push eax
call fcn.004ba550
mov edi, eax
lea eax, [ebp - 0x1a4]
sub eax, 0x3b
push 3
add edi, eax
push 0x4bea34
push edi
call fcn.004bc420
add esp, 0x10
lea eax, [ebp - 0xa0]
push str.Runtime_Error__n_nProgram:
push eax
call fcn.004ba0c0
lea eax, [ebp - 0xa0]
push edi
push eax
call fcn.004ba0d0
lea eax, [ebp - 0xa0]
push 0x4bea14
push eax
call fcn.004ba0d0
push dword [esi + 0x4c237c]
lea eax, [ebp - 0xa0]
push eax
call fcn.004ba0d0
push 0x12010
lea eax, [ebp - 0xa0]
push str.Microsoft_Visual_C_Runtime_Library
push eax
call fcn.004bc394
add esp, 0x2c
pop edi
jmp 0x4b982d
lea eax, [ebp + 8]
lea esi, [esi + 0x4c237c]
push 0
push eax
push dword [esi]
call fcn.004ba550
pop ecx
push eax
push dword [esi]
push 0xfffffffffffffff4
call dword [sym.imp.KERNEL32.dll_GetStdHandle]
push eax
call dword [sym.imp.KERNEL32.dll_WriteFile]
pop esi
leave
ret
Function at 0x10004840
Capabilities:
Hash data with crc32

Disassembly:
push ebp
mov ebp, esp
push ebx
mov ebx, dword [ebp + 8]
push esi
push edi
mov edi, edx
not ebx
mov esi, ecx
mov eax, ebx
test edi, edi
je 0x100048a1
mov cl, byte [esi]
lea esi, [esi + 1]
dec edi
cmp cl, 0x23
jne 0x10004884
cmp edi, 2
jb 0x10004884
cmp byte [esi], cl
jne 0x10004884
cmp byte [esi + 1], cl
jne 0x10004884
mov eax, ebx
movzx ecx, cl
movzx edx, al
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100806c8]
jmp 0x10004855
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
xor eax, dword [edx*4 + 0x100806c8]
test edi, edi
jne 0x10004855
pop edi
pop esi
not eax
pop ebx
pop ebp
ret
mov cl, byte [esi]
inc esi
test cl, cl
je 0x100048d0
cmp cl, 0x23
jne 0x100048b7
cmp byte [esi], cl
jne 0x100048b7
cmp byte [esi + 1], cl
cmove eax, ebx
movzx edx, al
movzx ecx, cl
xor edx, ecx
shr eax, 8
mov cl, byte [esi]
inc esi
xor eax, dword [edx*4 + 0x100806c8]
test cl, cl
jne 0x100048a8
pop edi
pop esi
not eax
pop ebx
pop ebp
ret

Function at 0x10004a70
Capabilities:
Read file on windows

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
mov esi, ecx
push edi
test esi, esi
jne 0x10004a95
push 0x621
push str.D:2022UNITY_CHEAT_2.2imgui_dockingimgui.cpp
push str.filename__mode
call dword [sym.imp.api_ms_win_crt_runtime_l1_1_0.dll__wassert]
add esp, 0xc
mov edi, dword [ebp + 8]
test edi, edi
je 0x10004aa2
mov dword [edi], 0
mov edx, 0x100c0e40
mov ecx, esi
call fcn.100048e0
mov esi, eax
test esi, esi
je 0x10004b92
mov ebx, dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_ftell]
push esi
call ebx
add esp, 4
mov dword [ebp - 4], eax
cmp eax, 0xffffffff
je 0x10004b88
push 2
push 0
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10004b88
push esi
call ebx
mov ebx, eax
add esp, 4
mov dword [ebp + 8], ebx
cmp ebx, 0xffffffff
je 0x10004b88
push 0
push dword [ebp - 4]
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fseek]
add esp, 0xc
test eax, eax
jne 0x10004b88
mov eax, dword [0x10496788]
test eax, eax
je 0x10004b1c
inc dword [eax + 0x370]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_malloc]
mov ebx, eax
add esp, 4
test ebx, ebx
je 0x10004b88
push esi
push dword [ebp + 8]
push 1
push ebx
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fread]
add esp, 0x10
push esi
cmp eax, dword [ebp + 8]
je 0x10004b6d
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
mov eax, dword [0x10496788]
add esp, 4
test eax, eax
je 0x10004b5a
dec dword [eax + 0x370]
push ebx
call dword [sym.imp.api_ms_win_crt_heap_l1_1_0.dll_free]
add esp, 4
xor eax, eax
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
test edi, edi
je 0x10004b7f
mov eax, dword [ebp + 8]
mov dword [edi], eax
mov eax, ebx
pop edi
pop esi
pop ebx
mov esp, ebp
pop ebp
ret
push esi
call dword [sym.imp.api_ms_win_crt_stdio_l1_1_0.dll_fclose]
add esp, 4
pop edi
pop esi
xor eax, eax
pop ebx
mov esp, ebp
pop ebp
ret