joyce8/EMBER2024-capa huggingface dataset:
Function at 0x10042cd1
Capabilities:
Check if file exists

Disassembly:
push 0xa8
mov eax, 0x10062d72
call fcn.1004b0ba
mov ebx, dword [ebp + 8]
mov esi, ecx
mov edi, edx
push esi
mov dword [ebp - 0x54], edi
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10042cff
mov eax, 0x44f
jmp 0x10042ea1
push esi
call fcn.100426d3
pop ecx
test eax, eax
je 0x10042d1a
push ebx
mov edx, edi
mov ecx, esi
call fcn.10042905
pop ecx
jmp 0x10042ea1
push esi
push 0x1006f420
push str.__s__l___s_
lea esi, [ebp - 0x48]
call fcn.100275a7
add esp, 0xc
xor edi, edi
mov dword [ebp - 4], edi
cmp ebx, edi
je 0x10042d7b
mov eax, 0x1006f424
lea ecx, [ebp - 0x98]
call fcn.10002e30
push eax
lea esi, [ebp - 0x74]
mov byte [ebp - 4], 1
call fcn.100171c0
pop ecx
push edi
push eax
or eax, 0xffffffff
lea esi, [ebp - 0x48]
mov byte [ebp - 4], 2
call fcn.10004e80
lea esi, [ebp - 0x74]
call fcn.10009500
lea esi, [ebp - 0x98]
call fcn.10009500
push edi
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x14], 0xf
call fcn.10004da0
mov byte [ebp - 4], 3
cmp dword [ebp - 0x30], 8
mov eax, dword [ebp - 0x44]
jae 0x10042d9b
lea eax, [ebp - 0x44]
lea ecx, [ebp - 0x2c]
push ecx
push eax
call fcn.10042667
pop ecx
pop ecx
mov dword [ebp - 0x58], eax
cmp eax, edi
jne 0x10042e8e
cmp dword [ebp - 0x14], 0x10
mov eax, dword [ebp - 0x28]
jae 0x10042dbe
lea eax, [ebp - 0x28]
push eax
lea eax, [ebp - 0x70]
push eax
mov edi, 0x1006f478
call fcn.10027440
pop ecx
pop ecx
lea esi, [ebp - 0x50]
lea edi, [ebp - 0x70]
mov byte [ebp - 4], 4
xor ebx, ebx
call fcn.100031d0
jmp 0x10042e69
lea esi, [ebp - 0x50]
call fcn.100031f0
push eax
call fcn.1002b960
test eax, eax
jne 0x10042dfa
inc ebx
jmp 0x10042e61
cmp ebx, 1
jne 0x10042e5c
lea esi, [ebp - 0x50]
call fcn.100031f0
cmp dword [eax + 0x14], 0x35
jbe 0x10042e61
call fcn.100031f0
push 0xffffffffffffffff
push 0x35
push eax
lea esi, [ebp - 0xb4]
call fcn.1002a2e1
push eax
lea ecx, [ebp - 0x98]
mov byte [ebp - 4], 5
call fcn.1000a830
pop ecx
mov ecx, dword [ebp - 0x54]
push eax
mov byte [ebp - 4], 6
call fcn.10012780
lea esi, [ebp - 0x98]
call fcn.10009500
lea ecx, [ebp - 0xb4]
mov byte [ebp - 4], 4
call fcn.10002e00
jmp 0x10042e61
cmp ebx, 2
je 0x10042e86
lea esi, [ebp - 0x50]
call fcn.10014340
lea esi, [ebp - 0x7c]
lea edi, [ebp - 0x70]
call fcn.10012520
mov esi, eax
lea edi, [ebp - 0x50]
call fcn.10007570
test al, al
jne 0x10042de5
lea esi, [ebp - 0x70]
call fcn.10003180
lea ecx, [ebp - 0x2c]
call fcn.10002e00
lea esi, [ebp - 0x48]
call fcn.10009500
mov eax, dword [ebp - 0x58]
call fcn.1004b13d
ret
Function at 0x10042ea7
Capabilities:
Check if file exists
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x18
mov eax, dword [ebx + 0x18]
mov eax, dword [eax]
mov dword [ebp - 8], eax
mov eax, dword [ebx]
push esi
push edi
mov dword [ebp - 4], 1
mov dword [ebp - 0xc], eax
mov eax, dword [ebx + 0x18]
mov dword [ebp - 0x10], eax
mov eax, dword [ebx]
lea edi, [ebp - 0x14]
lea esi, [ebp - 0xc]
mov dword [ebp - 0x14], eax
call fcn.1003dd49
test al, al
jne 0x10042f4c
call fcn.10036332
add eax, 0x1c
cmp dword [eax + 0x18], 8
jb 0x10042ef0
mov eax, dword [eax + 4]
jmp 0x10042ef3
add eax, 4
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
je 0x10042f3b
lea esi, [ebp - 0xc]
call fcn.10036332
cmp dword [eax + 0x18], 8
jb 0x10042f11
mov edi, dword [eax + 4]
jmp 0x10042f14
lea edi, [eax + 4]
lea esi, [ebp - 0xc]
call fcn.10036332
add eax, 0x1c
cmp dword [eax + 0x18], 8
jb 0x10042f2a
mov eax, dword [eax + 4]
jmp 0x10042f2d
add eax, 4
push 1
push edi
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileExW]
test eax, eax
jne 0x10042f3f
and dword [ebp - 4], 0
lea esi, [ebp - 0xc]
call fcn.10028a2c
jmp 0x10042ec3
mov eax, dword [ebp - 4]
pop edi
pop esi
leave
ret

Function at 0x10042f53
Capabilities:
Check if file exists

Disassembly:
push 0x78
mov eax, 0x10063538
call fcn.1004b0ba
mov ebx, dword [ebp + 8]
mov esi, ecx
push esi
mov edi, edx
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10042f7b
mov eax, 0x44f
jmp 0x10043074
push edi
call dword [sym.imp.SHLWAPI.dll_PathIsDirectoryW]
test eax, eax
jne 0x10042f90
mov eax, 0x450
jmp 0x10043074
push esi
call fcn.100426d3
pop ecx
test eax, eax
je 0x10042fab
push edi
mov edx, ebx
mov ecx, esi
call fcn.10042a3d
pop ecx
jmp 0x10043074
lea eax, [ebp - 0x68]
push eax
call fcn.1002807b
and dword [ebp - 4], 0
push edi
push esi
push 0x1006f420
push str.__s__x___s___r__o__s___y
lea esi, [ebp - 0x2c]
call fcn.100275a7
add esp, 0x10
mov byte [ebp - 4], 4
test ebx, ebx
je 0x1004301a
mov eax, 0x1006f424
lea ecx, [ebp - 0x84]
call fcn.10002e30
push eax
lea esi, [ebp - 0x48]
mov byte [ebp - 4], 5
call fcn.100171c0
pop ecx
push 0
push eax
or eax, 0xffffffff
lea esi, [ebp - 0x2c]
mov byte [ebp - 4], 6
call fcn.10004e80
lea esi, [ebp - 0x48]
call fcn.10009500
lea esi, [ebp - 0x84]
call fcn.10009500
push 0
lea ecx, [ebp - 0x48]
mov dword [ebp - 0x30], 0xf
call fcn.10004da0
mov byte [ebp - 4], 7
cmp dword [ebp - 0x14], 8
mov eax, dword [ebp - 0x28]
jae 0x1004303b
lea eax, [ebp - 0x28]
lea ecx, [ebp - 0x48]
push ecx
push eax
call fcn.10042667
pop ecx
pop ecx
lea ecx, [ebp - 0x48]
mov edi, eax
call fcn.10002e00
test edi, edi
je 0x1004305d
lea ebx, [ebp - 0x68]
call fcn.10042ea7
lea esi, [ebp - 0x2c]
call fcn.10009500
or dword [ebp - 4], 0xffffffff
lea eax, [ebp - 0x68]
push eax
call fcn.100280b1
mov eax, edi
call fcn.1004b13d
ret
Function at 0x10043149
Capabilities:
Delete file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x38
push esi
push edi
lea ecx, [ebp - 0x38]
call fcn.1002550d
mov eax, dword [ebp - 0x20]
mov eax, dword [eax]
mov dword [ebp - 4], eax
mov eax, dword [ebp - 0x38]
mov dword [ebp - 8], eax
mov eax, dword [ebp - 0x20]
mov dword [ebp - 0xc], eax
mov eax, dword [ebp - 0x38]
lea esi, [ebp - 0x10]
lea edi, [ebp - 8]
mov dword [ebp - 0x10], eax
call fcn.10007570
test al, al
je 0x100431ab
mov esi, edi
call fcn.10003220
cmp dword [eax + 0x18], 8
jb 0x10043194
mov eax, dword [eax + 4]
jmp 0x10043197
add eax, 4
push eax
call dword [sym.imp.KERNEL32.dll_DeleteFileW]
lea edi, [ebp - 0x18]
lea esi, [ebp - 8]
call fcn.1003369b
jmp 0x10043167
lea eax, [ebp - 0x38]
push eax
call fcn.10001530
pop edi
pop esi
leave
ret
Function at 0x100434ad
Capabilities:
Check if file exists
Copy file
Get common file path
Move file

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x230
mov eax, dword [0x1007c060]
xor eax, ebp
mov dword [ebp - 4], eax
push esi
push edi
mov edi, ecx
call fcn.100263c2
mov dword [ebp - 0x230], eax
xor eax, eax
push 0x206
push eax
mov word [ebp - 0x210], ax
lea eax, [ebp - 0x20e]
push eax
call fcn.1004e1c0
add esp, 0xc
push 0x104
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_GetSystemDirectoryW]
mov esi, dword [sym.imp.SHLWAPI.dll_PathAppendW]
push str.drivers
lea eax, [ebp - 0x210]
push eax
call esi
lea edx, [ebp - 0x210]
call fcn.10043149
push ebx
lea eax, [ebp - 0x210]
push eax
call esi
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.SHLWAPI.dll_PathFileExistsW]
test eax, eax
jne 0x10043559
push eax
lea eax, [ebp - 0x210]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_CopyFileW]
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xfffffff8
add edi, 8
jmp 0x100435e4
push edi
lea ecx, [ebp - 0x210]
call fcn.10025b75
test eax, eax
jne 0x100435e2
mov esi, dword [sym.imp.KERNEL32.dll_CopyFileW]
push eax
lea eax, [ebp - 0x210]
push eax
push edi
call esi
test eax, eax
jne 0x100435e2
lea eax, [ebp - 0x210]
push eax
lea eax, [ebp - 0x22c]
call fcn.10043123
cmp dword [ebp - 0x214], 8
mov eax, dword [ebp - 0x228]
pop ecx
jae 0x100435a6
lea eax, [ebp - 0x228]
push eax
lea eax, [ebp - 0x210]
push eax
call dword [sym.imp.KERNEL32.dll_MoveFileW]
test eax, eax
je 0x100435d2
push 0
lea eax, [ebp - 0x210]
push eax
push edi
call esi
mov edi, eax
neg edi
sbb edi, edi
and edi, 0xfffffff8
add edi, 8
jmp 0x100435d5
push 9
pop edi
lea esi, [ebp - 0x22c]
call fcn.10009500
jmp 0x100435e4
xor edi, edi
push dword [ebp - 0x230]
call fcn.10026402
mov ecx, dword [ebp - 4]
mov eax, edi
pop edi
xor ecx, ebp
pop esi
call fcn.1004a172
leave
ret
Function at 0x1004375b
Capabilities:
Read file on windows

Disassembly:
push 0x2c
mov eax, 0x1005f8c2
call fcn.1004b0ba
mov eax, dword [ebp + 8]
or dword [ebp - 0x20], 0xffffffff
mov dword [ebp - 0x28], eax
mov dword [ebp - 0x38], 1
mov dword [ebp - 0x34], 5
mov dword [ebp - 0x30], 3
mov dword [ebp - 0x2c], 7
xor ebx, ebx
mov dword [ebp - 4], ebx
xor edi, edi
push ebx
push 0x8000000
push 3
push ebx
push dword [ebp + edi*4 - 0x38]
push 0x80000000
push dword [ebp - 0x28]
call dword [0x10080e10]
push eax
lea esi, [ebp - 0x20]
call fcn.1004371f
mov ecx, dword [ebp - 0x20]
cmp ecx, ebx
je 0x100437c4
cmp ecx, 0xffffffff
jne 0x100437ca
inc edi
cmp edi, 4
jb 0x10043794
cmp ecx, ebx
je 0x100437d5
or eax, 0xffffffff
cmp ecx, eax
jne 0x100437e5
lea eax, [ebp - 0x20]
call fcn.1002509f
xor eax, eax
call fcn.1004b13d
ret
lea edi, [ebp - 0x1c]
stosd dword es:[edi], eax
stosd dword es:[edi], eax
push ebx
stosd dword es:[edi], eax
lea eax, [ebp - 0x24]
push eax
push 0xc
lea eax, [ebp - 0x1c]
push eax
push ecx
mov dword [ebp - 0x24], ebx
call dword [sym.imp.KERNEL32.dll_ReadFile]
cmp dword [ebp - 0x1c], 0x70bfbbef
jne 0x10043812
cmp dword [ebp - 0x18], 0x706c646f
je 0x1004381e
lea eax, [ebp - 0x20]
call fcn.1002509f
mov eax, ebx
jmp 0x100437df
mov eax, dword [ebp - 0x14]
dec eax
dec eax
je 0x1004382d
dec eax
jne 0x10043812
push 3
pop ebx
jmp 0x10043812
push 2
jmp 0x1004382a

Function at 0x10043876
Capabilities:
Encode data using xor

Disassembly:
mov ecx, 0x190
mov eax, dword [esp + 8]
imul eax, eax, 0x343fd
add eax, 0x269ec3
mov dword [esp + 8], eax
mov eax, dword [esp + 4]
mov edx, dword [esp + 8]
add eax, ecx
shr edx, 0x10
xor byte [eax], dl
inc ecx
cmp ecx, 0x1000
jl 0x1004387b
ret
Function at 0x10043922
Capabilities:
Get file size
Read file on windows

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x24
push ebx
push esi
push edi
mov ebx, eax
xor eax, eax
xor esi, esi
mov dword [ebp - 0x10], esi
lea edi, [ebp - 0xc]
stosd dword es:[edi], eax
mov edi, dword [ebp + 8]
lea eax, [ebp - 0xc]
push eax
push edi
call dword [sym.imp.KERNEL32.dll_GetFileSize]
mov dword [ebp - 0x10], eax
cmp dword [ebp - 0xc], esi
ja 0x1004395f
jb 0x10043a78
cmp eax, 0x1000
jb 0x10043a78
push 1
lea eax, [ebp - 0x14]
push eax
push esi
mov dword [ebp - 4], esi
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x14], esi
mov esi, dword [sym.imp.KERNEL32.dll_SetFilePointer]
push edi
mov dword [ebp - 0x20], edi
call esi
mov dword [ebp - 0x18], eax
xor eax, eax
push eax
push eax
push eax
push edi
call esi
push 0
lea eax, [ebp - 4]
push eax
push 0x1000
push ebx
push edi
call dword [sym.imp.KERNEL32.dll_ReadFile]
test eax, eax
jne 0x100439ac
cmp dword [ebp - 0x1c], eax
jne 0x10043a78
push eax
jmp 0x10043a65
xor edi, edi
push edi
call dword [sym.imp.KERNEL32.dll_SetLastError]
mov eax, dword [ebp + 0xc]
cmp eax, edi
je 0x100439c1
mov ecx, dword [ebx + 8]
mov dword [eax], ecx
cmp dword [ebx], 0x70bfbbef
jne 0x10043a5f
cmp dword [ebx + 4], 0x706c646f
jne 0x10043a5f
mov eax, dword [ebx + 8]
cmp eax, 2
je 0x100439e7
cmp eax, 3
jne 0x10043a5f
push dword [ebx + 0x18c]
push ebx
call fcn.10043876
cmp byte [ebx + 0x4a3], 0
pop ecx
pop ecx
jne 0x10043a40
cmp dword [ebx + 0x1a0], 0x40
ja 0x10043a40
mov eax, 0x270f
cmp word [ebx + 0x190], ax
ja 0x10043a40
movzx eax, word [ebx + 0x192]
cmp ax, 1
jb 0x10043a40
cmp ax, 0xc
ja 0x10043a40
movzx eax, word [ebx + 0x196]
cmp ax, 1
jb 0x10043a40
cmp ax, 0x1f
ja 0x10043a40
xor ebx, ebx
inc ebx
jmp 0x10043a42
xor ebx, ebx
cmp dword [ebp - 0x1c], edi
jne 0x10043a5b
push edi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], 1
push dword [ebp - 0x20]
call esi
mov eax, ebx
jmp 0x10043a7a
cmp dword [ebp - 0x1c], edi
jne 0x10043a78
push edi
lea eax, [ebp - 0x14]
push eax
push dword [ebp - 0x18]
mov dword [ebp - 0x1c], 1
push dword [ebp - 0x20]
call esi
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret
Function at 0x10047002
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
push ecx
push ebx
push esi
push edi
push 4
shl eax, 4
pop edx
mov esi, ecx
lea edi, [eax + ecx + 0x3c]
mov dword [ebp - 4], edx
xor eax, eax
mov ecx, edi
mov bl, byte [ecx]
xor byte [esi + eax], bl
inc eax
add ecx, edx
cmp eax, edx
jl 0x1004701c
inc edi
add esi, edx
dec dword [ebp - 4]
jne 0x10047018
pop edi
pop esi
pop ebx
leave
ret

Function at 0x10047137
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x14
mov eax, dword [0x1007c060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
push 4
lea esi, [ebp - 8]
lea ecx, [eax + 4]
pop edi
mov al, byte [esi - 0xc]
mov dl, byte [esi - 8]
call fcn.100472fd
mov bl, al
mov al, dl
call fcn.100472fd
xor bl, al
xor bl, byte [esi - 4]
mov al, dl
xor bl, byte [esi]
xor bl, dl
mov byte [ecx - 4], bl
call fcn.100472fd
mov bl, al
mov al, byte [esi - 4]
call fcn.100472fd
xor bl, al
xor bl, byte [esi - 0xc]
mov al, byte [esi - 4]
xor bl, byte [esi]
xor bl, al
mov byte [ecx], bl
call fcn.100472fd
mov bl, al
mov al, byte [esi]
call fcn.100472fd
xor bl, al
mov al, byte [esi]
xor bl, dl
xor bl, byte [esi - 0xc]
xor bl, al
mov byte [ecx + 4], bl
call fcn.100472fd
mov bl, al
mov al, byte [esi - 0xc]
call fcn.100472fd
xor bl, al
xor bl, dl
xor bl, byte [esi - 4]
xor bl, byte [esi - 0xc]
inc ecx
mov byte [ecx + 7], bl
inc esi
dec edi
jne 0x1004715f
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004a172
leave
ret 4
Function at 0x100471ec
Capabilities:
Encode data using xor

Disassembly:
push ebp
mov ebp, esp
sub esp, 0x1c
mov eax, dword [0x1007c060]
xor eax, ebp
mov dword [ebp - 4], eax
mov eax, dword [ebp + 8]
push ebx
push esi
push edi
mov esi, eax
lea edi, [ebp - 0x14]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
movsd dword es:[edi], dword [esi]
lea edi, [ebp - 0x10]
lea esi, [eax + 4]
mov dword [ebp - 0x1c], 4
mov al, byte [edi - 4]
mov bl, byte [edi + 4]
call fcn.10047379
push ebx
mov dl, al
call fcn.10047352
xor dl, al
movzx eax, byte [edi + 8]
push eax
call fcn.1004730d
xor dl, al
movzx eax, byte [edi]
push eax
call fcn.1004732b
xor dl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi - 4], dl
call fcn.1004730d
push ebx
mov byte [ebp - 0x15], al
call fcn.1004732b
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi + 8]
push eax
mov byte [ebp - 0x15], cl
call fcn.10047352
mov cl, byte [ebp - 0x15]
xor cl, al
mov al, byte [edi]
mov byte [ebp - 0x15], cl
call fcn.10047379
mov cl, byte [ebp - 0x15]
xor cl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi], cl
call fcn.10047352
mov bl, al
mov al, byte [edi + 4]
call fcn.10047379
movzx edx, byte [edi + 8]
push edx
xor bl, al
call fcn.1004732b
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.1004730d
xor bl, al
movzx eax, byte [edi - 4]
push eax
mov byte [esi + 4], bl
call fcn.1004732b
mov bl, al
movzx eax, byte [edi + 4]
push eax
call fcn.1004730d
xor bl, al
mov al, dl
call fcn.10047379
xor bl, al
movzx eax, byte [edi]
push eax
call fcn.10047352
xor bl, al
mov byte [esi + 8], bl
inc esi
inc edi
dec dword [ebp - 0x1c]
jne 0x10047218
mov ecx, dword [ebp - 4]
pop edi
pop esi
xor ecx, ebp
pop ebx
call fcn.1004a172
leave
ret 4
Function at 0x100479f3
Capabilities:
Decode data using base64 via dword translation table

Disassembly:
push 0x2c
mov eax, 0x1005fd24
call fcn.1004b0ba
mov eax, dword [ebp + 8]
mov dword [ebp - 0x38], eax
xor ebx, ebx
mov eax, edi
mov dword [ebp - 0x30], ebx
xor esi, esi
lea ecx, [eax + 1]
mov dl, byte [eax]
inc eax
cmp dl, bl
jne 0x10047a11
sub eax, ecx
push ebx
lea ecx, [ebp - 0x2c]
mov dword [ebp - 0x30], eax
mov dword [ebp - 0x14], 0xf
call fcn.10004da0
mov dword [ebp - 4], ebx
cmp dword [ebp - 0x30], ebx
jbe 0x10047b10
movsx eax, byte [esi + edi]
mov al, byte [eax + 0x1006e880]
inc esi
cmp esi, dword [ebp - 0x30]
jae 0x10047a4d
cmp al, 0xff
je 0x10047a39
cmp al, 0xff
je 0x10047b10
movsx ecx, byte [esi + edi]
mov cl, byte [ecx + 0x1006e880]
inc esi
mov byte [ebp - 0x32], cl
cmp esi, dword [ebp - 0x30]
jae 0x10047a6d
cmp cl, 0xff
je 0x10047a55
cmp cl, 0xff
je 0x10047b10
sar cl, 4
shl al, 2
and cl, 3
or cl, al
movzx eax, cl
push eax
xor eax, eax
inc eax
lea ebx, [ebp - 0x2c]
call fcn.100280f8
mov al, byte [esi + edi]
inc esi
cmp al, 0x3d
je 0x10047b10
movsx eax, al
mov al, byte [eax + 0x1006e880]
mov byte [ebp - 0x31], al
cmp esi, dword [ebp - 0x30]
jae 0x10047aad
cmp al, 0xff
je 0x10047a90
cmp al, 0xff
je 0x10047b10
mov cl, al
mov al, byte [ebp - 0x32]
sar cl, 2
shl al, 4
and cl, 0xf
or cl, al
movzx eax, cl
push eax
xor eax, eax
inc eax
lea ebx, [ebp - 0x2c]
call fcn.100280f8
mov al, byte [esi + edi]
inc esi
cmp al, 0x3d
je 0x10047b10
movsx eax, al
mov cl, byte [eax + 0x1006e880]
cmp esi, dword [ebp - 0x30]
jae 0x10047aeb
cmp cl, 0xff
je 0x10047ad0
cmp cl, 0xff
je 0x10047b10
mov al, byte [ebp - 0x31]
shl al, 6
or al, cl
movzx eax, al
push eax
xor eax, eax
inc eax
lea ebx, [ebp - 0x2c]
call fcn.100280f8
cmp esi, dword [ebp - 0x30]
jb 0x10047a39
mov ecx, dword [ebp - 0x38]
lea eax, [ebp - 0x2c]
push eax
call fcn.10002dd0
lea ecx, [ebp - 0x2c]
call fcn.10002e00
mov eax, dword [ebp - 0x38]
call fcn.1004b13d
ret

Function at 0x10048242
Capabilities:
Hash data with md5

Disassembly:
and dword [eax + 0x14], 0
and dword [eax + 0x10], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
ret

Function at 0x1004944a
Capabilities:
Hash data using sha1

Disassembly:
and dword [eax + 0x18], 0
and dword [eax + 0x14], 0
mov dword [eax], 0x67452301
mov dword [eax + 4], 0xefcdab89
mov dword [eax + 8], 0x98badcfe
mov dword [eax + 0xc], 0x10325476
mov dword [eax + 0x10], 0xc3d2e1f0
ret
Function at 0x10049a97
Capabilities:
Encode data using xor

Disassembly:
push ebp
lea ebp, [esp - 0x74]
sub esp, 0x98
movzx ecx, byte [eax]
movzx edx, byte [eax + 1]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 2]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 3]
shl ecx, 8
or ecx, edx
movzx edx, byte [eax + 4]
push ebx
push esi
movzx esi, byte [eax + 5]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 6]
movzx ebx, byte [eax + 0xd]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 7]
push edi
movzx edi, byte [eax + 9]
shl edx, 8
or edx, esi
movzx esi, byte [eax + 8]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 0xa]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 0xb]
shl esi, 8
or esi, edi
movzx edi, byte [eax + 0xc]
shl edi, 8
or edi, ebx
movzx ebx, byte [eax + 0xe]
movzx eax, byte [eax + 0xf]
shl edi, 8
or edi, ebx
shl edi, 8
or edi, eax
xor ecx, 0xa3b1bac6
xor edx, 0x56aa3350
xor esi, 0x677d9197
xor edi, 0xb27022dc
mov dword [ebp - 0x24], ecx
mov dword [ebp - 0x20], edx
mov dword [ebp - 0x1c], esi
mov dword [ebp - 0x18], edi
xor ecx, ecx
mov eax, dword [ecx + 0x1006e678]
xor eax, dword [ebp + ecx - 0x20]
xor eax, dword [ebp + ecx - 0x18]
xor eax, dword [ebp + ecx - 0x1c]
mov edx, eax
shr edx, 0x18
mov ebx, eax
movzx edx, dl
mov dl, byte [edx + 0x1006e568]
shr ebx, 0x10
mov byte [ebp + 0x70], dl
mov byte [ebp + 0x6d], bl
movzx edx, byte [ebp + 0x6d]
mov dl, byte [edx + 0x1006e568]
mov ebx, eax
movzx eax, al
mov al, byte [eax + 0x1006e568]
mov byte [ebp + 0x73], al
movzx eax, byte [ebp + 0x70]
shr ebx, 8
movzx edx, dl
shl eax, 8
or eax, edx
movzx esi, bl
mov bl, byte [esi + 0x1006e568]
shl eax, 8
movzx edx, bl
or eax, edx
movzx edx, byte [ebp + 0x73]
shl eax, 8
or eax, edx
mov edx, eax
rol edx, 0xd
mov esi, eax
ror esi, 9
xor edx, esi
xor edx, dword [ebp + ecx - 0x24]
xor edx, eax
mov eax, dword [ebp + 0x7c]
mov dword [ebp + ecx - 0x14], edx
mov dword [ecx + eax], edx
add ecx, 4
cmp ecx, 0x80
jb 0x10049b46
pop edi
pop esi
pop ebx
add ebp, 0x74
leave
ret

Function at 0x1004a172
Capabilities:
Terminate process

Disassembly:
cmp ecx, dword [0x1007c060]
jne 0x1004a17c
repz ret
jmp fcn.1004b15b
Function at 0x10055082
Capabilities:
Link many functions at runtime

Disassembly:
mov edi, edi
push ebp
mov ebp, esp
sub esp, 0x14
push ebx
push esi
push edi
call fcn.1004b8e1
and dword [ebp - 4], 0
cmp dword [0x1008009c], 0
mov ebx, eax
jne 0x10055133
push str.USER32.DLL
call dword [sym.imp.KERNEL32.dll_LoadLibraryA]
mov edi, eax
test edi, edi
je 0x100551e4
mov esi, dword [sym.imp.KERNEL32.dll_GetProcAddress]
push str.MessageBoxA
push edi
call esi
test eax, eax
je 0x100551e4
push eax
call fcn.1004b86f
mov dword [esp], str.GetActiveWindow
push edi
mov dword [0x1008009c], eax
call esi
push eax
call fcn.1004b86f
mov dword [esp], str.GetLastActivePopup
push edi
mov dword [0x100800a0], eax
call esi
push eax
call fcn.1004b86f
mov dword [esp], str.GetUserObjectInformationA
push edi
mov dword [0x100800a4], eax
call esi
push eax
call fcn.1004b86f
pop ecx
mov dword [0x100800ac], eax
test eax, eax
je 0x10055133
push str.GetProcessWindowStation
push edi
call esi
push eax
call fcn.1004b86f
pop ecx
mov dword [0x100800a8], eax
mov eax, dword [0x100800a8]
cmp eax, ebx
je 0x1005518b
cmp dword [0x100800ac], ebx
je 0x1005518b
push eax
call fcn.1004b8ea
push dword [0x100800ac]
mov esi, eax
call fcn.1004b8ea
pop ecx
pop ecx
mov edi, eax
test esi, esi
je 0x1005518b
test edi, edi
je 0x1005518b
call esi
test eax, eax
je 0x10055182
lea ecx, [ebp - 8]
push ecx
push 0xc
lea ecx, [ebp - 0x14]
push ecx
push 1
push eax
call edi
test eax, eax
je 0x10055182
test byte [ebp - 0xc], 1
jne 0x1005518b
or dword [ebp + 0x10], 0x200000
jmp 0x100551c4
mov eax, dword [0x100800a0]
cmp eax, ebx
je 0x100551c4
push eax
call fcn.1004b8ea
pop ecx
test eax, eax
je 0x100551c4
call eax
mov dword [ebp - 4], eax
test eax, eax
je 0x100551c4
mov eax, dword [0x100800a4]
cmp eax, ebx
je 0x100551c4
push eax
call fcn.1004b8ea
pop ecx
test eax, eax
je 0x100551c4
push dword [ebp - 4]
call eax
mov dword [ebp - 4], eax
push dword [0x1008009c]
call fcn.1004b8ea
pop ecx
test eax, eax
je 0x100551e4
push dword [ebp + 0x10]
push dword [ebp + 0xc]
push dword [ebp + 8]
push dword [ebp - 4]
call eax
jmp 0x100551e6
xor eax, eax
pop edi
pop esi
pop ebx
leave
ret